New York's Top Prosecutor Says We Need New Laws To Fight iPhone/Android Encryption

from the because-child-murdering-drug-dealers,-of-course dept

The greatest threat to law enforcement since the motocar continues to receive attention from entities aghast at the notion that peoples' communications and data might not be instantly accessible by law enforcement. Apple's decision (followed shortly thereafter by Google) to offer default encryption for phone users has kicked off an avalanche of paranoid hyperbole declaring this effort to be a boon for pedophiles, murders and drug dealers.

New laws have been called for and efforts are being made to modify existing laws to force Apple and Google into providing "law enforcement-only" backdoors, as if such a thing were actually possible. New York County's top prosecutor, Manhattan DA Cyrus Vance -- speaking at an FBI-hosted cybersecurity conference -- is the latest to offer up a version of "there ought to be a law."

Federal and state governments should consider passing laws that forbid smartphones, tablets and other such devices from being “sealed off from law enforcement,” Manhattan District Attorney Cyrus Vance said today in an interview at a cybersecurity conference in New York.

Sure. These entities could "consider" this. And then swiftly discard the idea. There's no good reason why millions of people's data and communications should be made less secure just to make capturing criminals -- a small minority of the population -- easier. There are only law enforcement reasons. And those reasons are specious, at best. Cops have been catching criminals since long before the rise of the cellphone and they'll continue to do so long after default encryption becomes standard operating procedure.

But to hear opponents of Apple's move tell it, encryption-by-default is an unfair impediment to investigative and law enforcement agencies.

“It’s developed into a sort of high-stakes game,” Vance said. “They’ve eliminated accessibility in order to market the product. Now that means we have to figure out how to solve a problem that we didn’t create.”

Vance's portrayal of this decision is dishonest and self-serving, but it's his last sentence that is the most skewed. Law enforcement (along with investigative and national security agencies) did create this problem. They abused their powers to obtain warrantless access to metadata, data, communications, and anything stored locally on the phone. Cops routinely searched phones of those they detained without a warrant, something that was finally curbed by a Supreme Court decison. The NSA, FBI and law enforcement agencies all use the Third Party Doctrine to access call records, cell site location data and anything else that can be easily had without ever approaching a judge. So, they did bring this on themselves. And that's why (as the oft-used quote goes) the "pendulum" has "swung the other way."

It's not marketing. It's a very specific reaction to years of unchecked government power. It's obvious the government can't restrain itself. So, these companies have made it "easier" for the government to refrain from abusing its power by making this decision for them. Sure, there's a limited market for more security, but making it default going forward gains these companies nothing in terms of new customers. It's not an option that's only available to people who buy certain phones or certain service contracts. It's for everyone who buys a phone. Vance echoes the statements of others in his attempt to portray this as a purely mercenary decision but the only thing this does is make him look stupider.

After ticking the mandatory "crimes against children/murderers" emotional-plea checkbox, Vance goes on to cross "public safety" off the list of talking points.

“This is an issue of public safety,” Vance said. “The companies made a conscious decision -- which they marketed -- to make these devices inaccessible. Now it’s our job to figure out how we can do our job in that environment.”

Incredibly, Vance portrays his deployment of every anti-encryption cliche as special and unique, claiming he's "going rogue" by speaking up on the subject. (Because everyone else has been oh so silent...) But there's nothing new being said here. Again, Vance pushes the "greed" angle, but it's his last sentence that's the most ridiculous.

Vance -- and others like him -- aren't "figuring out" how to do their jobs in "this environment." They have no desire to do that. What they want is to change the environment. The new environment doesn't cater to their instant access desires, but rather than deal with the limitations and approach them intelligently, they've chosen to portray encryption-by-default as Google and Apple's new plan to make a ton of money selling smartphones to child molesters and murderers.

They want the laws to change, rather than law enforcement. And all they've offered in support are panic-button-mashing "arguments" and heated hyperbole. The problem is that panic buttons and hyperbole are effective legislative mobilizers. As bad as Vance's ideas are, there's a good chance he'll be able to find a number of politicians that agree with him. In all likelihood, the environment will be forced to adapt to law enforcement, rather than the other way around.

Filed Under: cyrus vance, encryption, mobile encryption, privacy

DOJ Using Antiquated 1789 'All Writs Act' To Try To Force Phone Manufacturers To Help Unlock Encrypted Phones

from the any-and-all-methods dept

With the ongoing fight over mobile encryption in the last few months, it's no secret that law enforcement has been pushing for new laws that require backdoors into encrypted offerings. However, the Wall Street Journal also noted another little trick that the Justice Department appears to be testing out: dumping the problem back on the phone manufacturer, by using a centuries old law to require the [nameless] phone manufacturer to help law enforcement decrypt a phone. And, Ars Technica then found another example of it being used on the very same day in a different case to try to pressure Apple into helping to decrypt a phone.

Specifically, the DOJ used the All Writs Act -- a 1789 law, that is now codified as 28 USC 1651. It's pretty straightforward (and broad):

(a) The Supreme Court and all courts established by Act of Congress may issue all writs necessary or appropriate in aid of their respective jurisdictions and agreeable to the usages and principles of law.

(b) An alternative writ or rule nisi may be issued by a justice or judge of a court which has jurisdiction.

The case the WSJ found is not at all clear in the details. An order was issued to a phone manufacturer -- whose name is redacted to [XXX] Inc. -- saying that it needed to help the DOJ unlock the phone. Federal Court Magistrate Judge Gabriel Gorenstein (in the Southern District of NY) agreed, but issued the public ruling on it, perhaps recognizing that this is diving into slightly questionable territory. While noting that the All Writs Act was also the basis for so called "pen register" orders (recording phone numbers dialed by certain phones based on court orders), Gorenstein points out that this is a similar situation:

the Supreme Court held that a district court had authority under the All Writs Act to issue an order requiring a telephone company to provide technical assistance to the Government in its effort to install a "pen register" — a device for recording the numbers dialed on a telephone.... Thus, we conclude that it is appropriate to order the manufacturer here to attempt to unlock the cellphone so that the warrant may be executed as originally contemplated.

However, Gorenstein points out that the All Writs Act isn't without its limits, and thus he provides the phone manufacturer a chance to protest, arguing that the request is too burdensome:

The Government has provided a proposed Order that directs the manufacturer to provide "reasonable technical assistance" in unlocking the device. The proposed Order omits, however, any mention of a process by which the manufacturer may seek to the challenge the Order. Courts have held that due process requires that a third party subject to an order under the All Writs Act be afforded a hearing on the issue of burdensomeness prior to compelling it to provide assistance to the Government.... To the extent the manufacturer believes the order to be unduly burdensome or that it should be reimbursed for expenses, the manufacturer should be given clear notice that it has the opportunity to object to the Order.

It's unclear if the manufacturer did object to the order or not. In the other case, in the Northern District of California, Magistrate Judge Kandis Westmore doesn't hide Apple's name, noting that the FBI has the phone and wants Apple's help to decrypt it under the All Writs Act. The request, filed on the same day as the ruling in NY, notes that "in other cases, courts have ordered the unlocking of an iPhone under this authority." In other words, it looks like the DOJ wasted no time using the ruling in NY to suggest this was a common way of forcing the phone manufacturer to help decrypt phones. Though, as others have pointed out, other courts have actually pushed back on attempts by the feds to use the All Writs Act to spy on people like this.

Either way, Westmore doesn't go as far as Gorenstein, and rather notes that Apple only need provide "reasonable technical assistance" but "is not required to attempt to decrypt, or otherwise enable law enforcement's attempts to access any encrypted data." Instead:

Apple's reasonable technical assistance may include, but is not limited to, bypassing the iOS Device's user's passcode so that the agents may search the device, extracting data from the Device and copying the data onto an external hard drive or other storage medium that law enforcement agents may search, or otherwise circumventing the Device's security systems to allow law enforcement access to Data and to provide law enforcement with a copy of encrypted data stored on the iOS Device.

Westmore's response seems somewhat limited. It basically says that Apple can help getting the (encrypted) data off the device if the FBI can't figure out how, but it shouldn't have to help to decrypt it. The NY case ruling seems much more open ended. It's unclear if the nameless manufacturer in the NY case did push back on the ruling by protesting it. If it did, the efforts are probably sealed up. However, it does suggest that the DOJ is already figuring out a variety of ways to try to pressure even those who lock down information on devices to help the DOJ break those locks.

Filed Under: all writs act, doj, fbi, gabriel gorenstein, kandis westmore, mobile encryption, phone manufacturers

Ridiculously Misinformed Opinion Piece In WSJ Asks Apple And Google To Make Everyone Less Safe

from the who-takes-these-people-seriously? dept

Former Wall Street Journal publisher L. Gordon Crovitz still gets to publish opinion pieces in the WSJ. And while I often find them interesting, any time he touches on technology in almost any manner, he seems to fall flat on his face, often in embarrassing ways -- such as the time he insisted the internet was invented by companies without government support (yes, he really argued that). Crovitz has also been strongly pro-surveillance state for years. He's attacked Wikileaks and Chelsea Manning by blatantly taking quotes out of context, and then last year, writing a column about the Snowden leaks that showed he doesn't understand even the basic facts. Crovitz tends to see the world the way he wants to see it, rather than the way it really is.

His latest is no exception, repeating a bunch of bogus or debunked claims to argue that the tech industry should happily insert back doors into technology to aid in surveillance. He kicks it off by both repeating the false claim concerning how "subway bomber" Najibullah Zazi was caught, but also totally misunderstanding the difference between encrypting data on a device and encrypting data in transit:

It’s a good thing Najibullah Zazi didn’t have access to a modern iPhone or Android device a few years ago when he plotted to blow up New York City subway stations. He was caught because his email was tapped by intelligence agencies—a practice that Silicon Valley firms recently decided the U.S. government is no longer permitted.

Apple , Google, Facebook and others are playing with fire, or in the case of Zazi with a plot to blow up subway stations under Grand Central and Times Square on Sept. 11, 2009. An Afghanistan native living in the U.S., Zazi became a suspect when he used his unencrypted Yahoo email account to double-check with his al Qaeda handler in Pakistan about the precise chemical mix to complete his bombs. Zazi and his collaborators, identified through phone records, were arrested shortly after he sent an email announcing the imminent attacks: “The marriage is ready.”

Except, no. It wouldn't have mattered if he had a modern iPhone or Android device because whether or not email is encrypted is entirely unrelated to whether or not data on the device is encrypted. What Apple and Google are promising now is to encrypt data on the device. Even if that was turned on, if you send an unencrypted email, it's still available to be viewed. Crovitz is comparing two completely different things and doesn't seem to realize it. What kind of standards does the WSJ have when it allows such false arguments to be published uncritically?

Furthermore, the fact that Zazi sent an unencrypted email via Yahoo was a different issue. And Yahoo encrypted all its email connections a while ago, and no one freaked out at the time. Even so, that's unimportant, because law enforcement and the intelligence community can and do still read emails with a warrant. And, as was made clear by many in the analysis of the Zazi case, he had been watched by law enforcement for a while. The phone encryption that Google and Apple are discussing would have had no impact whatsoever on the Zazi case. So why even bring it up, other than pure surveillance state FUD?

But, to someone as ignorant of the basics as Crovitz, it's an opportunity to double down.

The Zazi example (he pleaded guilty to conspiracy charges and awaits sentencing) highlights the risks that Silicon Valley firms are taking with their reputations by making it impossible for intelligence agencies or law enforcement to gain access to these communications.

Except, again, that's not true. Intelligence agencies and law enforcement would still have access to communications in transit -- just not data held on his phone directly (which they wouldn't have unless they got the phone itself). Second, it still wouldn't be "impossible" to get the information. They could either crack the encryption or issue a subpoena ordering the phone's owner to unlock the data (or potentially face a potential contempt of court ruling). While there are some 5th Amendment concerns with that latter route, it's still not "impossible." And it's not about communications. Crovitz is just totally ignorant of what he's writing about.

Since then, U.S. and British officials have made numerous trips to Silicon Valley to explain the dangers. FBI Director James Comey gave a speech citing the case of a sex offender who lured a 12-year-old boy in Louisiana in 2010 using text messages, which were later obtained to get a murder conviction. “There should be no one in the U.S. above the law,” Mr. Comey said, “and also no places within the U.S. that are beyond the law.”

Again, different issue. The Louisiana case? That was debunked a day later, and it wasn't because of access to the kind of information that would now be encrypted. As noted by the Intercept:

In another case, of a Lousiana sex offender who enticed and then killed a 12-year-old boy, the big break had nothing to do with a phone: The murderer left behind his keys and a trail of muddy footprints, and was stopped nearby after his car ran out of gas.

Next thing you know, Crovitz will argue that all shoes should come pre-muddied so that law enforcement can track them. After all, how could law enforcement track down criminals who don't leave a trail of muddy footprints?

Then Crovitz shifts to his own personal worldview -- insisting that the public actually doesn't want privacy or protection from the snooping eyes of government. He insists, the truth is the public really wants to be spied on.

It looks like Silicon Valley has misread public opinion. The initial media frenzy caused by the Edward Snowden leaks has been replaced by recognition that the National Security Agency is among the most lawyered agencies in the government. Contrary to initial media reports, the NSA does not listen willy-nilly to phone and email communications.

Last week, the Senate killed a bill once considered a sure thing. The bill would have created new barriers to the NSA obtaining phone metadata to connect the dots to identify terrorists and prevent their attacks. Phone companies, not the NSA, would have retained these records. There would have been greater risks of leaks of individual records. An unconstitutional privacy advocate would have been inserted into Foreign Intelligence Surveillance Court proceedings.

First off, no, the USA Freedom Act was never "a sure thing." From the very beginning, it was considered a massive long shot. And, no it would not have "created new barriers" -- it would have merely made it clear that the NSA can't simply collect everyone's data in the hopes of magically sifting through the haystack and finding connections. Also, Crovitz is flat out wrong (again!) that this would have led to a "greater risk" because the phone companies held the data. While this was the key talking point among those who voted against it, it's simply incorrect. The telcos already retain that information. The bill made no changes to what information telcos could and would retain. It only said that they shouldn't also have to ship all that data to the NSA as well. There was no increased risk. Saying so is -- once again -- trumpeting Crovitz's ignorance.

Furthermore, the idea that the public is miraculously comfortable with the government spying on them... based on the government voting against curtailing government surveillance is simply ludicrous. It doesn't even pass a basic laugh test. The Pew Research poll that tracks this issue most closely continues to show that the vast majority of people are against NSA surveillance on American data, and the numbers who feel that way have been growing consistently since the first of the Snowden revelations.

But let me repeat the assertion Crovitz made here, just to remind everyone of how idiotic it is: he's saying that the public is now comfortable with surveillance because Congress voted down surveillance reform. And he thinks this is obvious.

The lesson of the Snowden accusations is that citizens in a democracy make reasonable trade-offs between privacy and security once they have all the facts. As people realized that the rules-bound NSA poses little to no risk to their privacy, there was no reason to hamstring its operations. Likewise, law-abiding people know that there is little to no risk to their privacy when communications companies comply with U.S. court orders.

Facts, huh? It's kind of funny that he'd argue for the facts when he seems to be lacking in many of them. And he's wrong. There is tremendous risk to privacy, as illustrated by the fact that the NSA regularly abused its powers to spy on Americans. Furthermore, he ignores (or is ignorant of the fact) that much of the data the NSA collects is also freely available to the CIA and FBI -- and that the FBI taps into it so often that it doesn't even track how many times it dips into the database.

And of course, none of this even bothers to point out that the reason why Google and Apple are increasing encryption is because it makes us all much safer from actual everyday threats -- including the very threats that the NSA and others in law enforcement keep warning us about. Making us all safer is a good thing, though, not to L. Gordon Crovitz, apparently.

Crovitz is either woefully clueless and misinformed or he's purposely misleading the American public. Neither reflects well on him or the Wall Street Journal.

Filed Under: encryption, fud, gordon crovitz, l. gordon crovitz, mobile encryption, najibullah zazi, surveillance
Companies: apple, google, wall street journal

So, If Someone Could Just Kill A Child And Let The FBI And DOJ Get Their Anti-Phone Encryption Legislation Going, That Would Be Great

from the 'terrorism'-no-longer-'motivational'-enough dept

The discussion over cellphone encryption continues, with much of the "discussion" being FBI director James Comey's insistence that Apple and Google simply can't do the very thing they're doing... and offering zero legal reasons why they can't. There have been a lot of horribles paraded around during the past few weeks, mainly of the terrorist or pedophile variety. None of it has been very persuasive to anyone not wearing a badge. The converts continue to love the preaching while those on the outside look on in bemusement.

It's not just Apple and Google at this point. Whatsapp, the messaging app Facebook recently purchased, will be providing end-to-end encryption. Twitter is fighting National Security Letter gag orders in court.

The Wall Street Journal's recent article provides a closer look at the reactions of the upper echelon of law enforcement (DOJ and FBI) but only finds more of the same.

The No. 2 official at the Justice Department delivered a blunt message last month to Apple Inc. executives: New encryption technology that renders locked iPhones impervious to law enforcement would lead to tragedy. A child would die, he said, because police wouldn’t be able to scour a suspect’s phone, according to people who attended the meeting.

"A child would die." That's the argument. That's almost the only argument.

I'd hate to have people look at me and say, 'Well how come you can't save this kid,' 'how come you can't do this thing.'" (Sept. 25)

Smartphone communication is “going to be the preferred method of the pedophile and the criminal.' [Washington DC Police Chief Cathy Lanier] (Sept. 30)

Eric Holder: 'When a child is in danger, law enforcement needs to be able to take every legally available step to quickly find and protect the child...' (Oct 1st)

As a result, child predators, terrorists, and other criminals could go free, he [James Comey] warned. (Oct. 30)

Unsurprisingly, when the subject was first broached in this fashion, Apple reacted as any company would when faced with the insinuation that its latest feature would kill children.

The meeting last month ended in a standoff. Apple executives thought the dead-child scenario was inflammatory. They told the government officials law enforcement could obtain the same kind of information elsewhere, including from operators of telecommunications networks and from backup computers and other phones, according to the people who attended.

There are other options, but the FBI and DOJ only want the easiest route. To get it, the same argument is presented again and again. The FBI, along with other law enforcement officials, have accused Apple and Google of marketing to criminals. The companies have reasonably responded by presenting the alternatives the FBI and others are willfully ignoring. Files stored on phones are often stored elsewhere. Talk to service providers. Demand the information from the suspects themselves.

James Comey says he wants to have a "discussion," but plugs his ears and shouts about pedophiles and dead children when options other than a law enforcement-only "back door/front door" are brought up. Apple and Google have told the FBI to change the law if it doesn't like the new reality. James Comey and the DOJ's second-in-command, James Cole, know this is the route they have to take if they want to force Apple and Google to drop encryption. They also know the current backlash against government surveillance makes this pursuit anything but a foregone conclusion.

And, so, Comey and Cole exhume the corpses of child victims and give them lead roles in their pathetic, ghoulish puppet show -- something they perform for any halfway-sympathetic audience. Comey and others in law enforcement know what it will take to pass legislation or amendments in their favor.

[Deputy Attorney General James] Cole predicted that [law change] would happen, after the death of a child or similar event.

So, it would appear that both sides of the argument are waiting for a watershed event to prove their respective points. Apple's Tim Cook believes "something major" will happen that will prove to customers that his company's decision to provide encryption by default was the right one. The DOJ and FBI, on the other hand, are apparently waiting for something much more tragic: the severe abuse and/or death of a child at the hand of criminal in possession of an encrypted phone.

One side is waiting for a horrible event their customers are shielded from. The other side is waiting for a horrible event to convert into legislative currency. If the side looking to exploit a tragedy strikes first, the second watershed event -- the one Tim Cook posits -- will have no positive outcome. The FBI isn't just willing to use dead children to achieve its aims. It's also willing to sacrifice the public's privacy and security at the same time.

Filed Under: children, doj, encryption, fbi, fud, james comey, legislation, mobile encryption
Companies: apple, google

Demonizing Strong Encryption: Welcome To The Crypto Wars 2.0

from the paedophiles,-murderers-and-terrorists dept

Recently Techdirt wrote about the extraordinary tirade by the new GCHQ boss, Robert Hannigan, which boiled down to: "however much we spy and censor online today, it's still not enough." It was so full of wrong-headed and dangerous ideas that it was hard to capture it all in one post. Here's one thing we didn't have room for last time:

Isis also differs from its predecessors in the security of its communications. This presents an even greater challenge to agencies such as GCHQ. Terrorists have always found ways of hiding their operations. But today mobile technology and smartphones have increased the options available exponentially. Techniques for encrypting messages or making them anonymous which were once the preserve of the most sophisticated criminals or nation states now come as standard. These are supplemented by freely available programs and apps adding extra layers of security, many of them proudly advertising that they are "Snowden approved". There is no doubt that young foreign fighters have learnt and benefited from the leaks of the past two years.

Leaving aside the rather pathetic dig at Snowden at the end there, and the unsubstantiated statement that terrorists have benefited from his leaks, the key message here is that strong encryption is now used routinely by the wrong people, and that it presents an "even greater challenge" to the world's security services. If that lament sounds familiar, it's because suddenly, over the last few weeks, it has become the persistent refrain of law enforcement agencies in both the US and UK.

First we had the FBI Director James Comey talking about his agency's fears about things "going dark" because of encryption; then we heard from NYPD Commissioner Bill Bratton about how encryption "does a terrible disservice to the public"; a couple of weeks later, former NSA General Counsel Stewart Baker suggested the reason Blackberry had failed was because it used "too much encryption".

Now it seems that the baton has been passed to the UK. The day after Hannigan led the way with his piece in the Financial Times, the head of London's Metropolitan Police added his voice to the chorus of disapproval, as the London Evening Standard reports:

London's police chief today warns society against letting parts of the internet become a "dark and ungoverned" space populated by paedophiles, murderers and terrorists.

In a call for action, Met Commissioner Sir Bernard Hogan-Howe says encryption on computers and mobile phones is frustrating police investigations, meaning parts of the web are becoming "anarchic places".

What's particularly interesting is that as part of his visit to New York to make this speech, Hogan-Howe was also planning to meet all the senior US officials who had just voiced their concerns about encryption in precisely the same terms:

Sir Bernard has spent several days in talks with New York and Washington police chiefs about the threat of terrorism and what he calls "the challenges and opportunities" of technology. Today he was meeting FBI director James Comey.

He was also telling law enforcement experts behind closed doors at the New York police department that the internet is now a safe haven for criminality, adding: "Privacy is important but in my view the security of communications methods and devices is growing beyond what any genuine domestic user could reasonably require."

It's hard not to see this as part of a concerted and organized counter-attack against growing calls to rein in US and UK surveillance in the wake of Snowden's revelations. The common line on both sides of the Atlantic is that encryption has gone too far -- that "the security of communications methods and devices is growing beyond what any genuine domestic user could reasonably require". The clear implication is that only "paedophiles, murderers and terrorists" would want strong crypto, and that for law-abiding citizens with nothing to hide, crypto with backdoors is good enough.

But it isn't, of course. Law-abiding citizens with nothing to hide have a perfect right to real privacy online, just as they have a right to use doors, walls and curtains to screen off their private lives from the world's gaze. As Techdirt has noted before, placing backdoors in nominally secure systems simply makes them completely insecure, since there is no way to stop the bad people from using them too. Moreover, weakening crypto would not only make the Internet vastly less secure for billions of users, it would also undermine millions of online businesses and thus the economies with which they are now so deeply intertwined.

We can expect more of these blatant attempts to demonize strong cryptography, and to paint its mere use as a sure sign of terrorism and depravity. But we have been here before. During the 1990s the US government tried to introduce backdoors into secure communications using the Clipper chip. Civil society won those first Crypto Wars; now it needs to gird its loins to fight and win Crypto Wars 2.0.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: bernard hogan-howe, crypto wars, demonized, encryption, james comey, mobile encryption, robert hannigan, stewart baker
Companies: apple, google

James Comey Again Demands Tech Companies Do As He Says And Grant The FBI Complete Access To Whatever It Wants

from the please-please-please-let-me-get-what-I-want dept

FBI director James Comey -- (again) citing no legal authority or precedent -- is demanding Google and Apple hand over the keys to their default phone encryption.

The director of the FBI on Monday doubled down on demands that Silicon Valley giants cooperate in the course of criminal investigations, saying that tech companies such as Apple and Google have to unlock cellphones, if authorities request it.

And what has all this "demanding" and "doubling down" netted Comey? Nothing really. He still needs a compliant legislative body to oblige his fantasies of subservient tech companies opening wide for fat-fingered g-men.

Comey's latest attempt to sell the government's plan to exchange fear for all-access mobile phone passes came at a counterterrorism conference hosted by Fordham University. And, once again, Comey followed up his baseless demands with a whole lot of nothing.

Comey didn't specify what he wants Apple and Google to do but said that to find a solution requires an "honest debate."

"I don't want to tell people what to do," he said. "But I want to try to foster a national conversation about this."

"There has to be some solution that will allow us with lawful authority to be able to have the company unlock the device," he added.

There's nothing honest about Comey's approach and walking around claiming that phone encryption will lead to new highs in terrorist attacks and pedophilia is only part of the dishonesty. Comey claims he doesn't want to "tell people what to do," apparently completely unaware that throwing around the weight of his agency and position and demanding phone makers play by his rules is the very definition of "telling people what to do."

Unfortunately for Comey, throwing around this weight just isn't enough anymore. No one in the tech world is going to be cowed into obeisance. Not anymore. Now, everyone wants to stick it to The Man, even many of those that worked in close proximity with government agencies over the past several years. Why? Because the nation's intelligence and investigative agencies are always hungry. They always want more.

The "solution" Comey's looking for runs through Congress. Historically, legislators have almost always come down on the side of law enforcement. The twin specters of terrorism and child molestation have resulted in plenty of government expansion and law enforcement leeway over the years. But maybe even the legislators are beginning to realize that this is something that can never be satiated. You can give and give and give and the same people will return over and over again, asking for just a little more. The government is -- and has been for years -- a mixture of junkies and their enablers.

Maybe we're at the point that a certain number of enablers have become sick of the constant need. Maybe they'll cut Comey and his ilk off and put up with the keening, inarticulate sounds of their withdrawal. Or maybe they'll meet them out back and slip them a fix when they think no one's looking. As I've said before, the voices out front are claiming the FBI will find no assistance here. It's the large number of those who've offered no opinion we need to keep an eye on. Law enforcement's emotional blackmail has worked for years. It may have recently lost its edge, but it's still too powerful to count out completely.

"In one way or another, our entire lives — our social lives, our work lives — reside online and on these devices," Comey said. "And that's a great thing. But that's also where the bad guys are."

Yeah. As in "real life" itself. I guess we should expect him to ask for "golden key" access to every front door in America. As long as he's transparent about it, what's there to be concerned about? Comey just wants to keep America safe. Who are we to deny complete access to our "entire lives?"

Filed Under: back doors, encryption, fbi, front door, james comey, mobile encryption
Companies: apple, google

FBI Holds Secret Meeting To Scare Congress Into Backdooring Phone Encryption

from the just-in-time-for--halloween dept

In September, both Apple and Google announced plans to encrypt information on iOS and Android devices by default. Almost immediately, there was a collective freakout by law enforcement types. But, try as they might, these law enforcement folks couldn't paint any realistic scenario of where this would be a serious problem. Sure, they conjured up scenarios, but upon inspection they pretty much all fell apart. Instead, what was clear was that encryption could protect users from people copying information off of phones without permission, and, in fact, the FBI itself recommends you encrypt the data on your phone.

But it didn't stop FBI director James Comey from ignoring the advice of his own agency and pushing for a new law that would create back doors (he called them front doors, but when asked to explain the difference, he admitted that he wasn't "smart enough" to understand the distinction) in such encryption.

So, now, of course, the FBI/DOJ gets to go up to Congress and tell them scary stories about just how necessary breaking encryption would be. And it's being done in total secrecy, because if it was done in public, experts might debunk the claims, like they've done with basically all of the scenarios provided in public to date.

FBI and Justice Department officials met with House staffers this week for a classified briefing on how encryption is hurting police investigations, according to staffers familiar with the meeting. The briefing included Democratic and Republican aides for the House Judiciary and Intelligence Committees, the staffers said. The meeting was held in a classified room, and aides are forbidden from revealing what was discussed.

It's almost guaranteed that someone will introduce some legislation, written primarily by the FBI, pushing for this (such a bill is almost certainly already sitting in some DOJ bureaucrat's desk drawer, so they just need to dot some i's, cross some t's and come up with a silly acronym name for the bill). So far, many in Congress have been outspoken against such a law, but never underestimate the ability of the FBI to mislead Congress with some FUD, leading to all sorts of scare stories about how we need this or we're all going to die.

Filed Under: back doors, calea, congress, doj, fbi, front doors, james comey, mobile encryption

California Cops Passed Around Explicit Photos Harvested From Arrestees' Phones

from the precinct-office-as-frat-house dept

Another argument for default phone encryption: to keep criminals from accessing your personal photos and sharing them with others.

CHP Officer Sean Harrington, 35, of Martinez… confessed to stealing explicit photos from the cellphone of a second Contra Costa County DUI suspect in August and forwarding those images to at least two CHP colleagues. The five-year CHP veteran called it a "game" among officers, according to an Oct. 14 search warrant affidavit.

That this criminal (and his criminal cohorts) happened to wear a uniform makes him no less of a criminal. The difference here is that the phone containing the photos wasn't stolen by a criminal but rather seized during a DUI arrest and accessed during booking.

[T]he investigation began with a single incident: Harrington's conduct during the Aug. 29 arrest of the San Ramon woman. The woman discovered that photos had been stolen from her phone five days after her release, when she noticed on her iPad that the photos had been sent to an unknown number. A record of the messages had been deleted from her iPhone, but the phone had been synced to the iPad.

In his investigation, Holcombe compared video surveillance and time-stamped text messages from the woman's phone and determined Harrington was in possession of the woman's phone at the moment the photos were forwarded. The woman -- who registered a blood-alcohol level of 0.29 percent, more than three times the legal limit -- was being processed in the Martinez County Jail when the photos were stolen, according to court records.

Not an isolated incident. Officer Shawn Harrington called it a "game." Harrington says other officers at the Dublin precinct routinely distributed pictures from phones of female arrestees. Images were forwarded to other officers and "non-CHP individuals." Court documents also describe a second incident in which Harrington forwarded images from a DUI arrestee's phone while she was being x-rayed.

Encryption by default keeps criminals out of people's phones, even the criminals that hide behind uniforms and the color of law. The same goes for the warrant requirement recently ordered by the US Supreme Court. In a typical DUI arrest, there's really no reason for a cop to be going through the suspect's phone. Evidence of drunk driving is usually contained within the arrestees themselves, not their phones. At best, any time a cop does this, it's a fishing expedition for bigger charges. At worst, it's Harrington and his complicit bro cops, passing around nudie pics just because they can. Access and ability are the worst enablers.

When cops complain about falling behind in the tech race while arguing against warrant requirements and encryption, one wonders whether this isn't part of the "problem." It's not so much that the criminals have gotten smarter than the cops. It's that the phones have. The incidents leading to Officer Harrington's arrest both created digital paper trails leading back to the California Highway Patrol. The minimal effort made to cover his tracks wasn't enough. Maybe this is why some cops fear the relentless forward march of technology: covering up misconduct has never been harder.

Going beyond the relation of these incidents to both search warrants and encryption-by-default, this episode of casual power abuse also implicates another hot button topic located at the intersection of policework and technology: revenge porn.

Scott Greenfield points out a couple of flaws in the plan to criminalize revenge porn, both highlighted by Officer Harrington and his coworkers' abuse of arrested citizens.

An aspect of the push for new laws criminalizing intimate conduct that hasn’t been given much attention is the underlying assumption that if such laws are enacted, they will not only be enforced, but they will be enforced by law enforcement with a level of trust and respect for the delicate subject matter and the sensibilities of the victims.

Well, these CHP officers sort of ruined that.

Not to paint cops with too broad a brush, but, ahem, some of them aren’t a whole lot better than those “frat boys” or MRAs you think so poorly of. In fact, some are pretty awful when it comes to respecting the physical integrity of female suspects, trading off sex acts for arrest because they can.

And so your grand scheme to save the internet from angry males bent on revealing the private, intimate images of women, is to turn to the guys who steal private, intimate images of women and share them amongst themselves?

So, there's that. And that's on top of the nearly-universal complaint that police officers don't take sexual assualt complaints seriously enough. Incidents like these aren't going to encourage more victims to step forward or give them the confidence needed to pursue wrongdoers. At his point, the local PD look like just another place to be victimized.

Going beyond the misconduct and abuse, there's the blind spot advocates of criminalizing revenge porn continue to induldge: the assumption that turning something into a crime will be a massive deterrent.

The idea that creating a crime will serve as a disincentive for people to post intimate images on the internet may make a lot more sense in theory than it does in practice. Of course, maybe you trust that the “new professionalism” will protect you from the ravages of improper distribution of images. But then again, it didn’t stop the California Highway Patrol cops from doing so, even though it was clearly illegal for them to steal the images off suspects’ cellphones to pass around as part of their game.

If those on the inside are not appreciably "better" than those on the outside, then incentives and deterrents mean nothing. This abuse may be limited to a few California peace officers, or it may be far more common that any law enforcement agency would like to admit. (The CHP has already issued a statement basically declaring this to be completely isolated to its Dublic precinct, rather than the more widespread "game" Officer Harrington alleges it to be.) The underlying number of abusive incidents doesn't matter (much). This incident -- isolated or not -- just provides more ammo for those pushing encryption and warrant requirements. Law enforcement should need to make an effort before obtaining access, preferably an effort that creates a paper trail.

For those pushing revenge porn laws, this incident should temper expectations. Chances are it won't, not because it may not be indicative of the general law enforcement mentality, but because many of those advocating this sort of legislation tend to value emotional arguments over pragmatic reasoning. A deterrent is only as solid as those enforcing it. And if the enforcers are willing to casually violate existing laws as part of a "game," there can be little hope that they're the best equipped to pursue revenge porn law violators.

Filed Under: california, chips, mobile encryption, naked photos, police

Washington Post's Clueless Editorial On Phone Encryption: No Backdoors, But How About A Magical 'Golden Key'?

from the golden-key-cryptography dept

The Washington Post editorial board has weighed in on the recent "controversy" over Apple and Google's smart decision to start encrypting mobile devices by default. The "controversy" itself seems pretty hyped up by law enforcement types who are either lying or clueless about the technology. Throwing a bunch of technically ignorant newspaper editors into the mix probably wasn't the wisest of decisions.

Much of the editorial engages in hand-wringing about what law enforcement is going to do when they need the info on your phone (answer: same thing they did for years before smartphones, and most of the time with smartphones as well, which is regular detective work). It even repeats the bogus use of the phrase "above the law" that FBI director James Comey bizarrely keeps repeating (hint: putting a lock on your stuff isn't making you above the law). But the real kicker is the final paragraph:

How to resolve this? A police “back door” for all smartphones is undesirable — a back door can and will be exploited by bad guys, too. However, with all their wizardry, perhaps Apple and Google could invent a kind of secure golden key they would retain and use only when a court has approved a search warrant. Ultimately, Congress could act and force the issue, but we’d rather see it resolved in law enforcement collaboration with the manufacturers and in a way that protects all three of the forces at work: technology, privacy and rule of law.

Did you get that? No "back door," but rather a "golden key." Now, I'm not sure which members of the Washington Post editorial board is engaged in mythical "golden key" cryptography studies, but to most folks who have even the slightest understanding of technology, they ought to have recognized that what they basically said is: "a back door is a bad idea, so how about creating a magic back door?" A "golden key" is a backdoor and a "backdoor" is a "golden key." The two are indistinguishable and the Post's first point is the only accurate one: it "can and will be exploited by bad guys, too." That's why Apple and Google are doing this. To protect users from bad guys.

In the meantime, just watch, and we'll start to see ignorant politicians and law enforcement start to echo this proposal as well, talking down "backdoors" and talking up "golden keys." The fact that we already had this debate in the 1990s, when the "golden key" was called "key escrow" and when having the government lose that was was fairly important in allowing the internet to become so useful, will apparently be lost on the talking heads.

Still, a small request for the Washington Post Editorial Board: before weighing in on a subject like this, where it's fairly clear that none of you have the slightest clue, perhaps try asking a security expert first?

Filed Under: backdoors, editorial board, encryption, golden key, mobile encryption, privacy, security
Companies: washington post

FBI Director Angry At Homebuilders For Putting Up Walls That Hide Any Crimes Therein

from the wtf dept

We already wrote about how law enforcement was freaking out over the (good) news that Apple and Google were making encryption a default on both iOS and Android. Then we had a followup where a recently retired FBI guy insisted that such encryption would have meant a kidnap victim died... until everyone pointed out that the entire premise of that story was wrong and the Washington Post had to change the entire thing. We had hoped that, maybe, just maybe the misguided whining and complaining wouldn't come from those in charge, but apparently that's not happening.

On Thursday, FBI boss James Comey displayed not only a weak understanding of privacy and encryption, but also what the phrase "above the law" means, in slamming Apple and Google for making encryption a default:

"I am a huge believer in the rule of law, but I am also a believer that no one in this country is above the law," Comey told reporters at FBI headquarters in Washington. "What concerns me about this is companies marketing something expressly to allow people to place themselves above the law."

[....]

"There will come a day -- well it comes every day in this business -- when it will matter a great, great deal to the lives of people of all kinds that we be able to with judicial authorization gain access to a kidnapper's or a terrorist or a criminal's device. I just want to make sure we have a good conversation in this country before that day comes. I'd hate to have people look at me and say, 'Well how come you can't save this kid,' 'how come you can't do this thing.'"

First of all, nothing in what either Apple or Google is doing puts anyone "above the law." It just says that those companies are better protecting the privacy of their users. There are lots of things that make law enforcement's job harder that also better protect everyone's privacy. That includes walls. If only there were no walls, it would be much easier to spot crimes being committed. And I'm sure some crimes happen behind walls that make it difficult for the FBI to track down what happened. But we don't see James Comey claiming that homebuilders are allowing people to be "above the law" by building houses with walls.

"I get that the post-Snowden world has started an understandable pendulum swing," he said. "What I'm worried about is, this is an indication to us as a country and as a people that, boy, maybe that pendulum swung too far."

Wait, what? The "pendulum" hasn't swung at all. To date, there has been no legal change in the surveillance laws post-Snowden. The pendulum is just as far over towards the extreme surveillance state as it has been since Snowden first came on the scene. This isn't the pendulum "swinging too far." It's not even the pendulum swinging. This is just Apple and Google making a tiny shift to better protect privacy.

As Christopher Soghoian points out, why isn't Comey screaming about the manufacturers of paper shredders, which similarly allow their customers to hide papers from "lawful surveillance?"

But, of course, the freaking out continues. Over in the Washington Post, there's this bit of insanity:

“Apple will become the phone of choice for the pedophile,” said John J. Escalante, chief of detectives for Chicago’s police department. “The average pedophile at this point is probably thinking, I’ve got to get an Apple phone.”

Um. No. That's just ridiculous. Frankly, if pedophiles are even thinking about encryption, it's likely that they already are using one of the many encryption products already on the market. And, again, this demonizing of encryption as if it's only a tool of pedophiles and criminals is just ridiculous. Regular everyday people use encryption every single day. You're using it if you visit this very website. And it's increasingly becoming the standard, because that's just good security.

Filed Under: crime, encryption, fbi, james comey, john escalante, mobile encryption, overreaction