The FBI's Not-So-Compelling Pitch For Sacrificing Security For Safety

from the the-public-should-decide-this,-says-agency-seeking-compelled-action-from-a-priva dept

The FBI's attempt to use an All Writs order to force Apple to help it break into a locked iPhone is seemingly built on a compelling case: a large-scale shooting involving people with ties to terrorist groups. This is exactly the sort of case Comey hoped would help push his anti-encryption agenda forward. Or so it seems.

But is the case really that "compelling," especially in the legal sense of the word, which requires the court to weigh the imposition on Apple against the public's interest in seeing wrongdoers punished/future terrorist attacks prevented?

Conor Friedersdorf, writing for The Atlantic, finds the agency's "compelling" case to be far less interesting than the FBI imagines it is.

Even so, there are many factors that make me underwhelmed by the San Bernardino case, too. The killers deliberately destroyed other devices but didn’t bother destroying this one. It was a work phone issued by San Bernardino County. Until some time prior to the killings it was backing up to iCloud, and the FBI was able to get those backups.

]So once again, law enforcement personnel got information about some of what was on the phone. They’re missing a mere fraction of its contents. And one would guess that in the time between the last iCloud backup and the terrorist attack, Syed Farook did not suddenly start updating his work iPhone’s contacts with the addresses of his terrorist buddies, but refrained from calling or texting them (which the phone company could tell the FBI).

The FBI likely knows there's little chance much of investigative worth will be found on this phone. It wants the precedent, not the iPhone's contents. That's why Comey is telling anyone who will listen about other cases where encrypted phones have led to "dead ends." Comey's pitch for an Apple-assisted break-in presumes locked phones are literally helping people get away with murder. Friedersdorf notes that Lawfare's Ben Wittes -- arguing on behalf of the FBI -- cites testimony Comey gave to Congress in which he discusses a pregnant woman who was murdered last summer. Her phone was found near her body but the FBI has been unable to access the contents.

Again, Comey is making serious presumptions about the worth of the phone's contents to investigators. Taking a more logical approach to the facts of the case, Freidersdorf points out this phone is likely to be as useless as the phone central to the FBI's current actions.

For the first 230 years of U.S. history, police officers managed to investigate murders without the benefit of any evidence from smartphones belonging to the victim. Keep that baseline in mind, because any information that the cops get from the Louisiana victim’s device leaves them better off than all prior generations of law enforcement. And they presumably did get some useful information, because a locked device doesn’t prevent them from going to the phone company and getting access to call, text, and location data generated by the device.

It doesn’t stop the authorities from going to Uber to see when the victim last took a ride, to her cloud backup to see what was last uploaded, to her email client to see if she sent or received any messages through that medium, and on and on and on.

Admittedly, there could be something only on the device relevant to the murder. The victim could’ve recorded a quick voice memo. She could’ve jotted a note to herself. She could’ve snapped a photograph of the killer in the moment before he acted. But you’ve gotta think that the odds are against there being conclusive evidence on the phone that isn’t available elsewhere, not only because so much data is available in multiple places, but because the killer left the phone with the victim.

Encryption has turned smartphones into Chekov's Device: if a locked phone is owned by a criminal or found with a crime victim, the automatic assumption is that it houses relevant information of high investigatory value.

Comey is carefully picking his examples when arguing for greater law enforcement access… for the most part. A mass shooting that left 14 dead. A murdered pregnant woman. A fender bender at a busy intersection?

Marcy Wheeler also quotes testimony from Comey.

I’d say this problem we call going dark, which as Director Clapper mentioned, is the growing use of encryption, both to lock devices when they sit there and to cover communications as they move over fiber optic cables is actually overwhelmingly affecting law enforcement. Because it affects cops and prosecutors and sheriffs and detectives trying to make murder cases, car accident cases, kidnapping cases, drug cases. It has an impact on our national security work, but overwhelmingly this is a problem that local law enforcement sees.

Yes, the FBI would like Apple to help it break into an iPhone because law enforcement needs a leg up in traffic enforcement. If the FBI is given what it wants, the precedent will allow local law enforcement agencies to seek the same assistance any time the most mundane of investigations runs into a locked phone.

James Comey said (but didn't mean) the public needs to determine for itself whether they'd rather have security or safety (and presumably apply that conclusion to every member of the public who diagrees with them). But as Friedersdorf points out, every individual member of the public is free to make that decision for themselves, without having to drag in either party or 1789's All Writs Act.

The fact that there’s an unsolved murder case where some evidence might or might not be on a locked phone doesn’t seem like a compelling anecdote demonstrating the need to weaken security on everyone’s consumer devices. And if you’re worried that you’ll be killed and the lock on your smartphone will prevent the cops from finding your killer, by all means, disable the lock screen or leave a copy of your code in a safety deposit box. Everyone is free to decide when the costs of having strong security outweigh the benefits.

This is a decision any individual can make on their own. It doesn't have to involve the government compelling companies to purposefully weaken protective measures. Any member of the "nothing to hide" crowd can shut off anything meant to keep others (criminals or law enforcement) from accessing their phones' contents. Anyone who thinks the government has a "right" to access the contents of their phone should do whatever they can to ensure the government actually has that access -- provided it's limited to their own devices.

Comey says the public should consider the balance between safety and security in light of his agency's efforts. What's left unsaid is that the public has always had the ability to consider the tradeoffs and act on those conclusions. It didn't need the FBI's permission. Or Apple's. But this isn't about the public's ability to determine its own security/safety balance and applying it on a case-by-case basis. This is about the FBI seeking to have that balance determined by a magistrate judge and applied to everyone, regardless of the public's determination of where that balance should actually lie.

Filed Under: encryption, fbi, iphones, safety, security
Companies: apple

Alternate Titles: Apple Now Looking To Close The Backdoor The FBI Discovered

from the real-talk dept

Yesterday the NY Times put out a story claiming that Apple Is Said to Be Working on an iPhone Even It Can't Hack, with the underlying thrust being that this is a response to the big DOJ case against it, in which the court has ordered Apple to undermine key security features, which would then enable the FBI to brute force the (almost certainly weak) passcode used by Syed Farook on his work iPhone. But, here's the thing: prior to that order and its details coming to light, many people were under the impression that the existing iPhones were ones that it "couldn't hack." After all, it was offering full disk encryption tied to the device where it didn't hold the key.

And thus, a key reality of this debate is that Apple already had a bit of a backdoor in its devices: it could update the code on the device, without it wiping the key, and that updated operating system could, theoretically, remove key security protections that made the iPhone's security workable. It's just that the FBI found the backdoor.

So, really, it appears that what Apple is doing is what a few of us asked about as the details became clear: why can't Apple build a phone that works the way many people assumed it worked prior to this court order: and not allow for such a software update to work without first being approved by the end user.

So, really, this is just Apple closing the backdoor that the FBI revealed. Nice work, FBI, for disclosing this vulnerability.

Of course, as this so-called "arms race" continues, the surveillance state apologists are coming out of the woodwork to insist that the law must stop what the technology allows:

“We are in for an arms race unless and until Congress decides to clarify who has what obligations in situations like this,” said Benjamin Wittes, a senior fellow at the Brookings Institution.

Or, Congress can leave things as they are, and Apple and others can continue to better protect the security of all of us. That seems like a good idea.

Filed Under: backdoor, doj, encryption, fbi, iphones, security
Companies: apple

Pew Asks Stupid Misleading Question About FBI Apple Fight, Gets Stupid Misleading Answers

from the shocking,-I-know dept

The folks over at Pew Research usually do pretty good work, but they decided to weigh in on the Apple / FBI backdoor debate by asking a really dumb poll question -- the results of which are now being used to argue that the public supports the FBI over Apple by a pretty wide margin. But, of course, as with everything in polling, the questions you ask and how you phrase them are pretty much everything. And here's the thing. The question asked was:

As you may know, RANDOMIZE: [the FBI has said that accessing the iPhone is an important part of their ongoing investigation into the San Bernardino attacks] while [Apple has said that unlocking the iPhone could compromise the security of other users’ information] do you think Apple [READ; RANDOMIZE]?

(1) Should unlock the iPhone (2) Should not unlock the iPhone (3) Don't Know.

But that's not the issue in this case!

As noted in the past, when it's possible for Apple to get access to data, it has always done so in response to lawful court orders. That's similar to almost every other company as well. This case is different because it's not asking Apple to "unlock the iPhone." The issue is that Apple cannot unlock the iPhone and thus, the FBI has instead gotten a court order to demand that Apple create an entirely new operating system that undermines the safety and security of iPhones, so that the FBI can hack into the iPhone. That's a really different thing.

And it does a massive disservice by Pew to (1) ask the wrong question and then (2) make people think that the public supports the FBI's view when Pew itself misrepresented the issues in the case in the first place. And of course, the mainstream media, like the Washington Post (who normally is better than this) puts out a bullshit story claiming that "Apple is fighting a war most Americans don't believe in." But that's not what the poll actually says. You'd think that reporters might actually take the time to understand the story and the poll first, but apparently that's too difficult, as compared to the easy, if misleading headline.

As Ed Snowden himself pointed out, this is nothing more than misinformation:

Pew poll finds when the government misinforms the public, the public is misinformed. Scientists baffled. https://t.co/8LcRg7ismw

— Edward Snowden (@Snowden) February 22, 2016

But even that's not entirely accurate. In this case, it really seems like the fault is with Pew for asking a misleading question over an issue that is not up for debate here. And the press is similarly at fault for running with it and appearing to not understand either. Yes, the government is partially responsible for being misleading, but in this case, I'd put them third in line behind Pew and reporters. If people were accurately informed and actually understood the real issues, the poll would likely be quite different. But Pew didn't bother to understand the issue, and asked a questions that totally misrepresents the issue to the point that the results are actually completely meaningless to the ongoing debate.

Filed Under: all writs act, backdoors, doj, encryption, fbi, iphones, polls, san bernardino, unlocking
Companies: apple, pew

The List Of 12 Other Cases Where The DOJ Has Demanded Apple Help It Hack Into iPhones

from the no-precedent? dept

In our last post we noted that while FBI Director James Comey insists that it wasn't trying to set a precedent, and this move was just about getting access to a single phone, law enforcement around the country was eagerly lining up behind the FBI to make similar requests. And... then last night it came out that even the DOJ is making similar requests in 12 other cases. And now, the full list of such cases has come out: Now, it's actually not entirely clear from this that all the cases really are the same. All of them do involve the DOJ using the All Writs Act to demand extra assistance from Apple -- and we already knew about some of those earlier cases. And in most of them, the specifics of the "ask" is not actually public yet.

That is, it's not known if they're all asking for the same level of forcing Apple to build a new operating system that reduces security and enables the FBI to hack through a weak passcode. It's safe to assume that's probably the case in at least some of them.

Still, given all of this, the details of all of these cases were kept sealed until now. And, it's been reported that Apple had asked for the San Bernardino case to be sealed as well, but the DOJ was the one who moved to make it public. And that lends tremendous weight to the idea that not only is the FBI desperately seeking to set a precedent, but it was waiting for a case with "good PR optics" to go public with, so that it could pull on some heart strings to get the public on its side. The high profile "terror" case in which a bunch of people were murdered in cold blood apparently was the perfect case.

But, yeah, once again, Director Comey was flat out lying when he claimed the FBI has no interest in setting a precedent.

Filed Under: all writs act, doj, encryption, fbi, going dark, iphones, james comey, precedent, privacy, security
Companies: apple

GCHQ Used Compromised Hardware To Suck Data And Communications Out Of Exploit-Resistant iPhones

from the it-was-the-WiFi-in-the-library-with-the-backdoor dept

Included in the new Snowden document dump by Der Spiegel is one detailing the GCHQ's exploitation of iPhones [pdf link]. It isn't discussed much in the Der Spiegel piece (unsurprising, considering the number of documents revealed) but has picked up press elsewhere.

The GCHQ managed to pull off a bit of coup, considering the iPhone's general resistance to malware. Instead of deploying an exploit to the target's phone, the GCHQ used an "endpoint machine" (a compromised computer or other device) to harvest data from the phone whenever it connected and synced. Similar to the NSA's exploitation of ad-tracking cookies, the GCHQ's program extracted the iPhone's UDID (Unique Device Identifier) during certain interactions -- like debit card purchases or interactions with AdMob.

The Mobile Theme has invested a large amount of research into iPhone apps and metadata analysis over the last year accumulating with a detailed report done by [redacted] in October 2009 and 29 SEM rules created by ICTR-MCT These rules have used to extract iPhone metadata for a number of apps and in particular the Unique Device Identifier (UDID) from any carrier being processed using DEBIT CARDs. Further TDI rules are being developed by GTE that will in the future extract UDID events from carriers processed through the MVR system. The resulting events have then been used to populate both research and corporate QFDs (Query Focused Datasets) such as MUTANT BROTH and AUTOASSOC and will eventually form the basis of mobile correlations in HARD ASSOC.

The end result of this proxy exploit? A ton of data and communications.

The WARRIORPRIDE exploit has resulted in extraction of the target's address book, sms, call logs, notes, WLAN logs, bookmarks, map query history, Safari browsing history and some images.

The document notes that this limited deployment resulted in the acquisition of three targets for the NSA, in addition to a number of UDIDs passed on to GCHQ's Tailored Access Operations, presumably in order to push further exploits to the phones at syncing.

Unfortunately, further information isn't forthcoming as the accompanying guidance document -- the inadvertently hilariously-titled "Good Penetration Guide" -- has not been made public.

One particular case was a [redacted] target, [redacted] with yahoo selector that was seen active on a iPhone OS 3_1_2, as shown in Figure 8. The resulting Yahoo-B cookie is [redacted] and as can be seen the target has been active off [redacted]. Running the resulting Yahoo-cookie through MUTANT BROTH resulted in 171 events primarily on case notations GWUKGOOS, and IRUKCO36. The resulting information was then forwarded to the in the [redacted] team for tasking by the standard CNE process as outlined in the Good Penetration Guide.

The document is dated November 2010. Apple began phasing out the UDID system the next year and finally banned app developers from integrating this deprecated identifier into their apps in May of 2013. Considering the dates involved, the GCHQ had at least a two-year window where the end machine exploit provided access to data and content. (Apple began its deprecation of the identifier in 2012.)

Considering this collection was killed off by the unaware company along with its UDID system, the GCHQ is obviously on board with UK Prime Minister David Cameron's call to forbid the sort of encryption Apple is making available by default. No one likes to see a source dry up, especially one utilizing devices historically resistant to outside exploitation.

Filed Under: gchq, iphones, malware, surveillance, udid
Companies: apple

iPhone Data Debunks Recording Industry's Report On How French Three Strikes Law Increased Sales

from the correlation-is-not-causation dept

The annual Digital Music Report (pdf) of the International Federation for the Phonographic Industry (IFPI) is a curiously conflicted production. On the one hand, it must celebrate "a healthy 8 per cent increase in our digital revenues in 2011 -- the first time the annual growth rate has risen since records began in 2004 "; on the other, it must continue to push the party line about how the industry is being destroyed by piracy.

The IFPI has a stab a reconciling that contradiction, writing: "The truth is that record companies are building a successful digital music business in spite of the environment in which they operate, not because of it." However, it desperately needs some proof of that statement, because otherwise the simplest explanation is that piracy is not a serious problem, and that the recording industry is thriving, just like the rest of the creative industries.

The IFPI probably thinks it has found some proof in the French HADOPI experience, which, according its report, demonstrates that introducing three-strikes measures against unauthorized sharing boosts digital sales.

A new academic study -- The Effect of Graduated Response Anti-Piracy Laws on Music Sales: Evidence from an Event Study in France, by Danaher et al -- has also found evidence that Hadopi has had a positive impact on iTunes sales in France. The authors studied sales of digital singles and album downloads on iTunes from July 2008, before the law was adopted, until six months after the start of notices. They developed an estimate of what French iTunes sales would have looked like in the absence of Hadopi by studying a control group of similar markets.

The analysis found that French iTunes sales saw a significant uplift at exactly the period when awareness of Hadopi was at its highest, in Spring 2009, when the law was being debated in the National Assembly. This effect was maintained throughout the period studied. French iTunes sales were 22.5 per cent higher for singles and 25 per cent higher for digital albums than they would have been, on average, in the absence of Hadopi.

Taking a look at the study (pdf) provides some details of how the research was carried out:

For this study, we obtained a panel of total weekly iTunes sales units for a number of European countries including France. Our data extend from July 2008 to May 2011, and we observe separately both track unit sales and album unit sales. The data were obtained directly from the four major music labels -- EMI, Sony, Universal, and Warner -- and aggregated to reflect total iTunes sales for the majors.

In an attempt to observe the effect of HADOPI, these sales were compared with a control group of five other European countries that didn't introduce similar legislation: the UK, Italy, Spain, Germany, and Belgium. By looking for differences between these two data sets, the researchers hoped to observe the effects of the three-strikes legislation on sales of digital music, using a Google Trends graph of searches for the word "HADOPI" as a proxy for awareness of that legislation, both before and after it was passed.

The graph of iTunes sales for France clearly diverges from that of the control group, lying consistently above it. The divergence begins around about the time that HADOPI was first presented to the French National Assembly, increases slightly, and then decreases a little after the first warning letters were sent out. From this, the researchers deduce that the discussion around HADOPI caused significantly increased sales of iTunes compared to the control countries:

these estimates indicate that French track sales units rose about 25.5% in the control group after March 1, 2009 but by 48% in France, indicating that French iTunes track sales were 22.5% higher on average than they would have been in the absence of HADOPI. Similarly, album sales units rose by 42% in the control group but 67% in France, indicating that HADOPI increased iTunes album sales an average 25% per week in France.

That's a plausible explanation if you believe that piracy is stopping people from buying digital music, but it's not the only one. The French newspaper Le Monde decided to use the same technique of comparing the rise in iTunes sales with Google Trends, but with a different search term. Since iTunes is intimately bound up with Apple's products, Le Monde thought to take a look at the trend for "iPhone" searches on Google.

What it found were five very pronounced peaks in the French searches that corresponded exactly with five (smaller) peaks in iTunes sales, and also to five well-defined external events: the launch of the Iphone 3GS and iPhone 4, and three Christmas seasons. The effect was so marked in France because it was starting from a lower base: according to the researchers, the average sales of iTunes in France were 450,000 per week, while in the UK they were 2,900,000 per week. So an alternative explanation for those impressive increases in sales is simply the uplift in iPhone ownership generated by new launches and the holidays in an immature market with plenty of room for growth.

The researchers do offer one other piece of evidence for the uplift in sales being due to the crackdown on piracy:

EMI surveys of French citizens show that that Rap and Hip Hop are the most heavily pirated genres, even relative to popularity in legal sales channels. While Rock and Pop experience average levels of piracy, the data also indicate that genres such as Classical, Christian, Folk, and Jazz experience significantly lower levels of piracy.

Therefore, they argued, if the increase in sales were due to reductions in piracy, they would expect "the increase in Rap sales to be larger than that for Rock and Pop and the increase for Classical, Christian, etc. to be quite low." And that is precisely what is observed. Conclusive proof? Maybe not.

As the Le Monde analysis points out, another explanation is that many recent iPhone purchasers are younger people, who are generally the most interested in acquiring the latest technology as soon as it comes out. And younger people, by and large, listen to more Rap than Classical or Christian music, which would explain the difference in the increase across genres.

Spending so much effort here on exploring one research report might seem excessive, but it matters. The IFPI is already branding this supposed increase in digital music sales -- quantified by the researchers at $18.6 million annually for France -- the "HADOPI Effect". In the months to come, you can bet that the recording industry's representatives and lobbyists will be visiting governments and showing them this "proof" that three-strikes really "works" -- and demanding they follow suit to "protect" the artists.

What's ironic is that the IFPI report spends many of its pages discussing a much more sensible way of reducing unauthorized sharing: offering high-quality music streaming services instead, as recent market research from Scandinavia indicates. Unfortunately, the recording industry is so obsessed with punishing pirates that it can't see that its future lies in promoting innovation, not legislation.

Follow me @glynmoody on Twitter or identi.ca, and on Google+

Filed Under: data, france, hadopi, iphones, research, sales