The U.S. Intel Community's Demonization of Huawei Remains Highly Hypocritical

from the do-as-we-say,-not-as-we-do dept

We've noted for some time how Chinese hardware vendor Huawei has been consistently accused of spying on American citizens without any substantive, public evidence. You might recall that these accusations flared up several years ago, resulting in numerous investigations that culminated in no hard evidence whatsoever to support the allegations. We're not talking about superficial inquiries, we're talking about eighteen months, in-depth reviews by people with every interest in exposing them. One anonymous insider put it this way in the wake of the last bout of hysteria surrounding the company:

"We knew certain parts of government really wanted” evidence of active spying, said one of the people, who requested anonymity. “We would have found it if it were there."

Never mind that almost all U.S. network gear is made in (or comprised of parts made in) China. Never mind that years of reports have shown the United States spies on almost everyone, constantly. Never mind that reports have emerged that a lot of the spy allegations often originate with Huawei competitor Cisco, which was simply concerned with the added competition. Huawei is a spy. We're sure of it. And covert network snooping is bad. When China does it.

Worries over Huawei bubbled up again recently when the U.S. government pressured both AT&T and Verizon to kill off plans to sell Huawei phones here in the States. It should be noted that Huawei phones are already available here, and the company has worked with several U.S. companies to gain a foothold in the U.S. market (like when it partnered with Google on the Nexus 6P). It should also probably be noted that in the modern era, you can't really differentiate between where a company like AT&T ends and the NSA begins, given the telco's extreme enthusiasm for spying on American citizens itself.

This week, hysteria concerning Huawei again reached a fevered pitch, as U.S. intelligence chiefs, testifying before Congress over Russian hacking and disinformation concerns, again proclaimed that Huawei was spying on American citizens and their products most assuredly should not be used:

"At the hearing, FBI Director Chris Wray testified, “We’re deeply concerned about the risks of allowing any company or entity that is beholden to foreign governments that don’t share our values to gain positions of power inside our telecommunications networks." Purchasing Huawei or ZTE products, Wray added, “provides the capacity to maliciously modify or steal information. And it provides the capacity to conduct undetected espionage."

Which values would those be, exactly? Would it be the values, as leaked Edward Snowden docs revealed, that resulted in the NSA hacking into Huawei, stealing source code, then attempting to plant its own backdoors into Huawei products? Or perhaps it's the values inherent in working closely with companies like AT&T to hoover up every shred of data that touches the AT&T network and share it with the intelligence community? Perhaps it's the values inherent in trying to demonize encryption, by proxy weakening security for everyone?

News outlets, semi-oblivious to their own nationalism, quickly ignored the NSA's hypocrisy when it comes to worrying about values and regurgitated the intel chiefs' concerns. Few could also be bothered to note that numerous investigations have culminated in bupkis, the NSA has routinely and consistently been caught doing precisely what they accuse Huawei of, or that American companies tend to drum up hysteria on this front simply because they're afraid of competition (protectionism we routinely and justly accuse China of).

Focusing on Huawei also seems semi-myopic, given the fact that Chinese hardware can already be found in an absolute ocean of products available here in the States, many of which are made by U.S. hardware vendors. It also ignores the fact that if somebody really wants to hack us, all they need to do is spend five seconds hunting down one of a million poorly secured internet of broken things devices, which create millions of new easily-exploited attack vendors annually in businesses and residences nationwide.

None of this is to say it's impossible that Huawei has helped the Chinese government spy, much like our own companies here in the States. But if you're going to discuss this subject, you can't have an honest conversation without highlighting our own hypocrisy on this front, given it's abundantly clear that we're perfectly OK with unethical behavior, backdoors, and spying with negligible oversight and accountability -- provided the United States is the one doing it.

Filed Under: china, chris wray, fud, intelligence community, nsa
Companies: huawei

FBI Director Still Won't Say Which Encryption Experts Are Advising Him On His Bizarre Approach To Encryption

from the perhaps-there's-a-reason-he-won't-say... dept

For the past few months, we've talked about how FBI Director Chris Wray has more or less picked up where his predecessor, James Comey, left off when it came to the question of encryption and backdoors. Using a contextless, meaningless count of encrypted seized phones, Wray insists that not being able to get into any phone the FBI wants to get into is an "urgent public safety issue."

Of course, as basically every security expert has noted, the reverse is true. Weakening encryption in the manner that Wray is suggesting would create a much, much, much bigger safety issue in making us all less safe. Hell, even the FBI used to recommend strong encryption as a method to protect public safety.

Last month, we wrote about a letter sent by Senator Ron Wyden to Wray, simply asking him to list out the names of encryption experts that he had spoken to in coming to his conclusion that it was possible to create backdoors to encryption without putting everyone at risk.

I would like to learn more about how you arrived at and justify this ill-informed policy proposal. Please provide me with a list of the cryptographers with whom you've personally discussed this topic since our July 2017 meeting and specifically identify those experts who advised you that companies can feasibly design government access features into their products without weakening cybersecurity. Please provide this information by February 23, 2018.

Technically, Wray still has a week or so to answer, but earlier this week during an open Senate hearing involving the heads of various law enforcement and intelligence agencies, Wyden asked Wray when he might get that list and Wray sidestepped the question entirely, other than saying he'd discuss it later (in a closed session):

If you can't see that, here's my quick transcript (though I do recommend watching the video just to see the smartass smirk on Wray's face through much of it).

Wyden: On encryption. Director Wray, as you know, this isn't a surprise because I indicated, I would ask you about this. You have essentially indicated that companies should be making their products with backdoors in order to allow you all to do your job. And we all want you to protect Americans and at the same time, sometimes there are these policies that make us less safe and give up our liberties. And that's what I think we get with what you all are advocating which is weak encryption. Now this is a pretty technical area, as you and I have talked about it. And there's a field known as cryptography. I don't pretend to be an expert on it. But I think there is a clear consensus among experts in the field against your position to weaken strong encryption. So I have asked you for a list of the experts that you have consulted. I haven't been able to get it. Can you give me a date this afternoon when you will give me... this morning, a sense of when we will be told who are these people who are advising you to pursue this route. Because I don't know of anybody who is respected in this field who is advising that it is a good idea to adopt your position to weaken strong encryption. So can I get that list?

Wray: I would be happy to talk more about this topic this afternoon. My position is not that we should weaken encryption. My position is that we should be working together -- the government and the private sector -- to try to find a solution that balances both concerns.

Wyden: I'm on the program for working together. I just think we need to be driven by objective facts, and the position you all are taking is out of sync with what all the experts in the field are saying and I'd just like to know who you all have been consulting, and we'll talk more about it this afternoon.

So, a few points on this. First, Wray doesn't answer the actual question of when he'll be giving Wyden a list, but rather suggests he'll discuss this topic in the closed session. But the question of when he'll be delivering his list of experts he's consulted shouldn't be a classified piece of information. It's just a date. Second, Wray immediately misrepresents the issue, by saying he's not asking to weaken encryption. Because he has to realize by now that that's exactly what he's asking to do. If he doesn't recognize that then it's clear he doesn't understand the first thing about how encryption actually works. Third, he's incorrectly talking about "balancing both concerns." But there's no balancing question here. It is not a "balance" between "security" and "civil liberties" as some keep trying to make it out to be. This is a concern between good security and bad security that makes everyone less safe (oh, and also has the potential to violate civil liberties).

It does not inspire confidence to have Wray have trouble answering such a basic question and then totally misrepresent how this all works, even in his two sentence answer.

Filed Under: backdoors, chris wray, cryptographers, encryption, experts, fbi, ron wyden

FBI Director Chris Wray Says Secure Encryption Backdoors Are Possible; Sen. Ron Wyden Asks Him To Produce Receipts

from the not-so-great-when-you're-on-the-receiving-end-of-a-bludgeoning-interrogation dept

I cannot wait to see FBI Director Christopher Wray try to escape the petard-hoisting Sen. Ron Wyden has planned for him. Wray has spent most of his time as director complaining about device encryption. He continually points at the climbing number of locked phones the FBI can't crack. This number signifies nothing, not without more data, but it's illustrative of Wray's blunt force approach to encryption.

I'm sure Wray views himself as a man carefully picking his way through the encryption minefield. But there's nothing subtle about his approach. He has called encryption a threat to public safety. His lead phone forensics person has called Apple "evil" for offering it to its users. He has claimed the move to default encryption is motivated by profit. And if that's not the motivation, then it's probably just anti-FBI malice. Meanwhile, he claims the FBI has nothing but the purest intentions when it calls for encryption backdoors, even while Wray does everything he can to avoid using that term.

He claims the solution is out there -- a perfect, seamless blend of secure encryption and easy law enforcement access. The solution, he claims, is most likely deliberately being withheld by the "smart people." These tech companies that have made billionaires of their founders are filled with the best nerds, but they're just not applying themselves. Wray asserts -- without evidence -- that secure encryption backdoors are not only possible, but probable.

Senator Ron Wyden has had enough. He's calling out Director Wray on his bullshit. Publicly. His letter [PDF] demands Wray hand over information on his encryption backdoor plans. Specifically, Wyden wants Wray to name names. [via Kate Conger at Gizmodo]

Your stated position parrots the same debunked arguments espoused by your predecessors, all of whom ignored the widespread and vocal consensus of cryptographers. For years, these experts have repeatedly stated that what you are asking for is not, in fact, possible. Building secure software is extremely difficult, and vulnerabilities are often introduced inadvertently in the design process. Eliminating these vulnerabilities is a mammoth task, and experts are unified in their opinion that introducing deliberate vulnerabilities would likely create catastrophic unintended consequences that could debilitate software functionality and security entirely.

I would like to learn more about how you arrived at and justify this ill-informed policy proposal. Please provide me with a list of the cryptographers with whom you've personally discussed this topic since our July 2017 meeting and specifically identify those experts who advised you that companies can feasibly design government access features into their products without weakening cybersecurity. Please provide this information by February 23, 2018.

Remember how FBI directors (Wray, Jim Comey) claimed they just wanted to have "an adult conversation" with tech experts and cryptographers? My guess is they've never even tried. Wray hasn't held the post for long, but he's been beating Comey's weathered anti-encryption drum as long as he's held the title. And in all this time, I doubt he has talked to anyone in the tech industry directly about his encryption backdoor theory. Even if he has, he certainly hasn't found anyone who agrees such a thing can be done without weakening device security. Wray will have no answers for Wyden. We can only hope being publicly embarrassed by Senator Wyden will force him to rethink his position.

Filed Under: backdoors, chris wray, encryption, fbi, going dark, responsible encryption, ron wyden

FBI Says Device Encryption Is 'Evil' And A Threat To Public Safety

from the thanks,-g-men.-we'll-take-it-under-advisement. dept

The FBI continues its anti-encryption push. It's now expanded past Director Christopher Wray to include statements by other FBI personnel. Not that Chris Wray isn't taking every opportunity he can to portray personal security as a threat to the security of the American public. He still is. But he's no longer the only FBI employee willing to speak up on the issue.

Wray expanded his anti-encryption rhetoric last week at a cybersecurity conference in New York. In short, encryption is inherently dangerous. And the FBI boss will apparently continue to complain about encryption without offering any solutions.

The Federal Bureau of Investigation was unable to access data from nearly 7,800 devices in the fiscal year that ended Sept. 30 with technical tools despite possessing proper legal authority to pry them open, a growing figure that impacts every area of the agency's work, Wray said during a speech at a cyber security conference in New York.

The FBI has been unable to access data in more than half of the devices that it tried to unlock due to encryption, Wray added.

"This is an urgent public safety issue," Wray added, while saying that a solution is "not so clear cut."

The solution is clear cut, even if it's not workable. What Wray wants is breakable encryption. And he wants companies to do the work and shoulder the blame. Wray wants to be able to show up at Apple's door with a warrant and walk away with the contents of someone's phone. How that's accomplished isn't really his problem. And he's not intellectually honest enough to own the collateral damage backdoored encryption would cause. But that's how Wray operates. He disparages companies, claiming encryption is all about profit and the government is all about caring deeply for public safety. Both statements are dishonest.

But Wray isn't the only FBI employee taking the move to default encryption personally. And the others commenting are taking the rhetoric even further, moving towards personal attacks.

On Wednesday, at the the International Conference on Cyber Security in Manhattan, FBI forensic expert Stephen Flatley lashed out at Apple, calling the company “jerks,” and “evil geniuses” for making his and his colleagues' investigative work harder. For example, Flatley complained that Apple recently made password guesses slower, changing the hash iterations from 10,000 to 10,000,000.

That means, he explained, that “password attempts speed went from 45 passwords a second to one every 18 seconds,” referring to the difficulty of cracking a password using a “brute force” method in which every possible permutation is tried.

[...]

“At what point is it just trying to one up things and at what point is it to thwart law enforcement?" he added. "Apple is pretty good at evil genius stuff."

This is great. Apple is now an "evil genius" because it made stolen iPhones pretty much useless to thieves. Sure, the device can be sold but no one's going to be able to drain a bank account or harvest a wealth of personal information. This was arguably in response to law enforcement (like the FBI!) complaining cellphone makers like Apple were assholes because they did so little to protect users from device theft. And why should they, these greedy bastards? Someone's phone gets stolen and the phone manufacturer now has a repeat customer.

Encryption gets better and better, limiting the usefulness of stolen devices and now Apple is an "evil genius" engaged in little more than playing keepaway with device contents. Go figure.

The FBI's phone hacker did have some praise for at least one tech company: Cellebrite. The Israeli hackers were rumored to have helped the FBI get into San Bernardino shooter Syed Farook's phone after a failed courtroom showdown with Apple. The FBI ended up with nothing -- no evidence on the phone and no court precedent forcing companies to hack away at their own devices anytime the government cites the 1789 All Writs Act.

Now we're supposed to believe device makers are the villains and the nation's top law enforcement agency is filled with unsung heroes just trying to protect the public from greedy phone profiteers. I don't think anyone believes that narrative, possibly not even those trying to push it.

Filed Under: chris wray, encryption, fbi, going dark, stephen flatley
Companies: apple

FBI Says It Can't Get Into 6,900 Encrypted Phones. So What?

from the doing-less-with-more dept

The new director of the FBI, Christopher Wray, has apparently decided to take up James Comey's anti-encryption fight. He's been mostly quiet on the issue since assuming the position, but the DOJ's recent calls for "responsible encryption" has emboldened the new FBI boss to speak up on the subject.

And speak up he has. Although the FBI still hasn't released the text of his remarks to the International Association of Chiefs of Police, more than a few sites are reporting it was the usual "go team law enforcement" boosterism, but with the added zest of phone encryption complaints.

He also spoke about roadblocks in dealing with cellphone encryption technology, saying that in first 11 months of the fiscal year, the FBI has been unable to access content from 6,900 mobile devices despite having the proper legal authority to do so.

"It's going to be a lot worse than that in just a couple of years if we don't come up with some responsible solution," he lamented. "I'm open to all ideas."

All ideas, maybe. But certainly not all viewpoints. The Deputy Attorney General has made it clear in multiple speeches he views phone encryption as the end result of tech companies' low-minded pursuit of revenue. DAG Rosenstein repeatedly emphasized US law enforcement measures success by a different standard -- a standard mercenary phone manufacturers couldn't even begin to approach.

Of course, the FBI head also nodded towards the importance of device security.

"I get it, there's a balance that needs to be struck between encryption and the importance of giving us the tools we need to keep the public safe."

But does he actually "get it?" What if the status quo is the ending "balance?" Would that satisfy Wray? Doubtful. He wants law enforcement-friendly security holes and he wants tech companies to provide them voluntarily.

The number of locked devices means nothing. The "6,900 mobile devices" will be 8,000 or 10,000 by early next year -- sound-and-fury totals signifying nothing. It was 6,000 phones when Comey trotted out numbers earlier this year. It will always increase and it will always grab eyeballs but it won't ever mean anything unless the FBI is willing to provide a lot more context.

Is the FBI just spectacularly bad at cracking cell phones? We're not hearing these complaints from local law enforcement agencies with less expertise and lower budgets. Is the FBI just not even trying? Is it not using everything it has available -- including a number of judicial forgiveness plans for rights violations -- to get into these phones? It's inconceivable the nation's top law enforcement agency is experiencing nearly a 50% failure rate when it comes to locked phones.

All Wray says is there are 6,900 phones the FBI hasn't gotten into. Yet. What's never discussed is how many investigations resumed unimpeded by cellphone encryption. Phones are not the sole repository of criminal evidence in any investigation. The FBI has options even if the seized phone seems impermeable. The FBI insinuates it's being stopped, but never specifies how many of these phones have resulted in terminated investigations.

It's just a number, divorced from context, but one the FBI can ensure will always be larger than last time it was mentioned.

Filed Under: chris wray, context, crime, encryption, fbi, going dark, phones

Trump's Pick For FBI Head Sounds A Lot Like The Guy He Fired When It Comes To Encryption

from the BACK-TO-WORK,-NERDS dept

Trump's pick to head the FBI -- former DOJ prosecutor Christopher Wray -- appeared before the Senate to answer several questions (and listen to several long-winded, self-serving statements). Wray's confirmation hearing went about as well as expected. Several senators wanted to make sure Wray's loyalty lay with the nation rather than the president and several others hoped to paint him into a Comey-bashing corner in order to belatedly justify Trump's firing of his (potential) predecessor.

Wray also spent a lot of time not talking about things he claimed he was unfamiliar with -- covering everything from presidential directives, to Donald Trump Jr.'s Russian emails, to questions about CIA human rights violations that went unnoticed/unprosecuted during his tenure in the DOJ.

Sen. Orrin Hatch -- as he did during a recent Comey hearing -- brought up the subject of encryption. Hatch claims he "agrees with Tim Cook," which places him in opposition to Sens. Feinstein and Burr. It also puts him in opposition of the possible new FBI boss, who had this to say about encryption. (h/t Politico's Eric Geller)

I think this is one of the most difficult issues facing the country. There's a balance that has to be struck between the importance of encryption, which I think we can all respect when there are so many threats to our systems, and the importance of giving law enforcement the tools that they need to keep us safe.

You can already tell where this is going. Encryption is great and all, but what's would be really great is some sort of backdoor-type thingy.

Wray continued by swiftly jumping to the other side of the argument -- at least in terms of team uniform. Certainly not in terms of how the "other side" feels about encryption and backdoors.

I don't know sitting here today as an outsider and a nominee before this committee what the solution is, but I do know that we have to find a solution. And my experience in trying to find solutions is that it's more productive for people to work together than to be pointing fingers blaming each other. And that's the approach I've tried to take to almost every problem I've tackled. And that's the approach I would want to take here in working with this committee and the private sector.

One advantage to having been in the private sector for a while is that I think I know how to talk to the private sector, and I would look for ways to try to see if I could get the private sector more on-board to understand why this issue is so important to keep us all safe.

So far, so Comey. New suit in the office, but it fits the same as the last one. Wray thinks both sides should work together but strongly hints the actual work will have to be done by the private sector. The problem, according to a guy who's worked "both sides," is the private sector needs to be more "on-board." And that indicates Wray feels the problem isn't the lack of both sides working together, but the other side not capitulating. That's a problem, and it sounds a whole lot like X more years of Comey.

Filed Under: chris wray, encryption, fbi, going dark, james comey