Intelligence Director Says Gov't Can Demand Encryption Backdoors Without Having To Run It By The FISA Court

from the keeping-secrets-from-the-secret-court dept

A set of questions from Senator Ron Wyden -- directed at the Office of the Director of National Intelligence -- have finally received answers. The answers [PDF] were actually given to the Senate oversight committee in July but have just now been made public.

Zack Whittaker of ZDNet has taken a look at the answers the ODNI provided and found something that indicates the government can not only compel the creation of backdoors, but can do so without explicit approval from the FISA court.

The government made its remarks in July in response to questions posed by Sen. Ron Wyden (D-OR), but they were only made public this weekend.

The implication is that the government can use its legal authority to secretly ask a US-based company for technical assistance, such as building an encryption backdoor into a product, but can petition the Foreign Intelligence Surveillance Court (FISC) to compel the company if it refuses.

In its answers, the government said it has "not to date" needed to ask the FISC to issue an order to compel a company to backdoor or weaken its encryption.

The government would not say, however, if it's ever asked a company to add an encryption backdoor.

The way this process works is the agency requesting the backdoor or other compelled assistance runs the request by the FISA court. This process does not ask the FISA court to approve the method used, nor does it provide the court with details on the assistance sought. All the FISC determines is whether or not compelled assistance is necessary.

The ODNI maintains it has never asked for compelled decryption or the installation of backdoors… at least not under this authority. If it has, there'd be little in the way of a paper trail to prove it. The FBI, as part of the Intelligence Community, appears to be more interested in securing the help of US courts -- something that would prove far more useful in the long run, considering its domestic focus.

This information comes at a critical time. The surveillance wing of the government wants Section 702 (and related authorities) renewed at the end of this year -- unaltered and with at least a half-decade before the next chance of reform. So far, its two Congressional oversight bodies have been compliant with the IC's wishes. Serious reform efforts have been dumped by both House and Senate judiciary committees, leaving only those authored by longtime surveillance state cheerleaders in the running. With limited oversight and an easy way to route around FISA roadblocks, Section 702 reform is badly needed if we have any hope of the next decade being less filled with Fourth Amendment violations than the last one.

Filed Under: backdoors, compelled assistance, encryption, fisa court, fisc, odni, ron wyden

German Government Official Wants Backdoors In Every Device Connected To The Internet

from the bring-back-the-old-Germany-we-know-and-hate! dept

The US Department of Justice is reviving its anti-encryption arguments despite not being given any signals from the administration or Congress that undermining encryption is something either entity desires. The same thing is happening in Germany, with Interior Secretary Thomas de Maizière continuing an anti-encryption crusade very few German government officials seem interested in joining.

The key difference in de Maizière's push is that he isn't limiting potential backdoors to cell phones. He appears to believe anything connected to the internet should be backdoored… possibly even the cars German citizens drive. (h/t Riana Pfefferkorn)

The RedaktionsNetzwerk Deutschland (RND) reported that Thomas de Maizière had written up a draft proposal for the interior minister conference, taking place next week in Leipzig, which he has called “the legal duty for third parties to allow for secret surveillance.”

According to the RND, the proposal would “dramatically extend” the state’s powers to spy on its citizens.

And it's not just backdoors being suggested. De Maizière wants all electronics to be law enforcement-complicit. All things -- especially those connected to the internet -- should be constructed with government access in mind.

For example, the modern locking systems on cars are so intelligent that they even warn a driver if their car is shaken a little bit. De Maizière wants the new law to ensure that these alerts would not be sent out to a car owner if the police determined it to be justified by their investigation.

De Maizière wants the government to be able to intercept and block notifications sent from cars to the people that own them. But it's far more than smarter cars being compromised on behalf of the government. If de Maizière gets his way, it will be every connected device everywhere.

De Maizière also wants the security services to have the ability to spy on any device connected to the internet. Tech companies would have to give the state "back door" access to private tablets and computers, and even to smart TVs and digital kitchen systems.

It's rare for government officials to blatantly state citizens should be under surveillance at all times. Craftier politicians tend to use less direct rhetoric, even if they aspire to the same goals. This blatant call for mass surveillance of millions of innocent people has provoked a reaction from de Maizière's colleagues, although probably not the one he was looking for.

The proposal was met with astonishment by digital activists and politicians on Friday.

De Maizière seems blissfully unaware Germany was once home to a powerful dictator who killed millions of his own citizens while deploying a secret police force. And once that period ended, part of Germany rolled directly into a program of intense domestic surveillance utilizing the Stasi -- one of the most brutally effective secret police forces ever wielded by a government against its own people. De Maizière's proposal is so tone deaf -- given the history of the nation he serves -- it's tempting to believe he's an under-recognized satirist. But de Maizière seems completely serious. Fortunately for Germans, no one else seems to take de Maizière quite as seriously as he does.

Filed Under: backdoors, encryption, germany, iot, privacy, surveillance, thomas de maiziere

Latest DOJ WTFness: Encryption Is Like A Locked House That Won't Let Its Owners Back Inside

from the spare-the-Rod,-spoil-the-horse-carcass dept

Deputy Attorney General Rod Rosenstein continues his push for law enforcement-friendly broken encryption. The ultimate goal is the same but the arguments just keep getting worse. Trying to pitch worthless encryption (i.e., encryption easily compromised in response to government demands) as "responsible" encryption is only the beginning of Rosenstein's logical fallacies.

After a month-plus of bad analogies and false equivalents, Rosenstein has managed to top himself. The path to Rosenstein's slaughtering of a metaphor runs through such highlights as the DAG claiming device encryption is solely motivated by profits and that this is the first time in history law enforcement hasn't had access to all forms of evidence. It's an intellectually dishonest campaign against encryption, propelled by the incredibly incorrect belief that the Fourth Amendment was written to provide the government with access, rather than to protect citizens from their government.

In a long article by Cyrus Farivar discussing a recent interview given by Rosenstein, the Deputy Attorney General drops this abomination of an analogy:

"I favor strong encryption, because the stronger the encryption, the more secure data is against criminals who are trying to commit fraud," he explained. "And I'm in favor of that, because that means less business for us prosecuting cases of people who have stolen data and hacked into computer networks and done all sorts of damage. So I'm in favor of strong encryption."

"This is, obviously, a related issue, but it's distinct, which is, what about cases where people are using electronic media to commit crimes? Having access to those devices is going to be critical to have evidence that we can present in court to prove the crime. I understand why some people merge the issues. I understand that they're related. But I think logically, we have to look at these differently. People want to secure their houses, but they still need to get in and out. Same issue here."

It is nowhere near the "same issue." I sincerely hope DAG Rosenstein regrets every word of this statement.

Let's streamline the analogy: People want to protect the data on their phones. People still want to be able to access this data on their phones. In no case ever has encryption prevented people from accessing the data on their phones. Forgotten passcodes might, but that's like losing house keys. You might need outside assistance to get back in.

Rosenstein's analogy skips a step. It has to. There's no way this analogy can ever work couched in Rosenstein's anti-encryption statements. People lock their houses when they leave and unlock them with their keys when they get back. Rosenstein's analogy is completely baffling, given the context of his remarks. How does strong security prevent people from "entering" their devices? It doesn't and Rosenstein knows this. It only prevents people other than the device owner from doing so.

What he's actually talking about is government access, but he can't find a credible argument for weakening the strong encryption he just claimed he believed in. And he doesn't have the intellectual honesty to say what he really means. The "they" in "but they still need to get in and out" is meant to encompass law enforcement agencies. In the context of Rosenstein's anti-encryption argument, that's the only interpretation that makes any sort of sense. Otherwise, it's a non sequitur -- one that claims strong security is somehow capable of preventing home owners from coming and going as they please.

A boneheaded analogy like this is the only rhetorical option left. That's because what Rosenstein wants -- easily-compromised "strong" encryption (i.e., "responsible encryption") -- simply cannot exist. Impossible demands can only be justified by implausible arguments. Given the swift and steady deterioration of Rosenstein's rhetoric, it's probably time to put his "Dead Horses and the Men Who Beat Them" show on ice.

Filed Under: bad analogies, doj, encryption, going dark, responsible encryption, rod rosenstein

Sen. Feinstein Looking To Revive Anti-Encryption Bill In The Wake Of Texas Church Shooting

from the exploitable-tragedies dept

Shortly after the horrific shooting of 26 people in a Texas church, the FBI began dropping hints about its inability to access the contents of the shooter's phone. Things didn't go the FBI's way the last time it tried to access a phone's contents following a mass shooting. It was unable to force Apple to break its own encryption and failed to obtain a judicial precedent it could wield against other manufacturers. In the end, the FBI ended up out a large sum of cash in exchange for access to phone contents that ultimately proved worthless.

These rumblings follow the DOJ's push for "responsible encryption" -- a mythical beast composed of "strong" encryption that can be broken at the drop of warrant. This is the FBI hinting it's interested in taking a second swing at obtaining a pro-encryption breaking courtroom decision. What the FBI won't do is offer any details on the shooter's phone itself.

"We are unable to get into that phone," FBI Special Agent Christopher Combs said in a press conference yesterday (see video).

Combs declined to say what kind of phone was used by gunman Devin Kelley, who killed himself after the mass shooting. "I'm not going to describe what phone it is because I don't want to tell every bad guy out there what phone to buy, to harass our efforts on trying to find justice here," Combs said.

Most agents aren't adept at handing out off-the-cuff statements, as Agent Combs's "harass our efforts on trying to find justice" word salad can attest. Withholding this information made little difference, however. The phone the FBI is trying to break into is an iPhone -- something Apple may have inadvertently outed while preemptively defending itself against FBI/DOJ criticism.

Apple today tried to get ahead of another encryption showdown with the Federal Bureau of Investigation related to the Texas gunman’s attack this past Sunday, saying it reached out to the bureau to offer assistance in getting into the gunman’s iPhone and expedite its response to any legal process. The attack, which left 26 dead and many more injured, was committed by now-deceased Devin P. Kelley, who is confirmed to have been carrying an iPhone that may have crucial information about his activities in the lead up to the shooting.

Maybe the FBI should have taken Apple up on its offer. As Reuters reports, the FBI did not ask Apple for help during the 48 hours following its receipt of the phone -- a time period during which Apple's assistance may have been invaluable. (This echoes the FBI's apparent mishandling of the San Bernardino shooter's phone, which resulted in a locked phone and a courtroom showdown.) Apple likely would have known whether or not the phone was secured by the shooter's fingerprint, which certainly could have been applied postmortem.

Instead, the FBI chose to complain about its lack of access. This may be part of the DOJ's long game. Immediate assistance only helps in individual cases and only if done as soon as possible after taking possession of a device. But a favorable court decision? That lasts forever and can be applied at the FBI's leisure.

Unfortunately, it's not just the FBI and DOJ looking for permanently broken encryption. Sen. Dianne Feinstein is looking to revive her anti-encryption bill, last seen collecting dust following Congressional and presidential disinterest during the final year of the Obama administration.

As the FBI struggles to unlock the iPhone used by the gunman in the recent Texas massacre, Sen. Dianne Feinstein believes it’s time to bring back long-dormant encryption-piercing legislation. It’s been about 18 months since she and Senate Intelligence Committee Chairman Richard Burr floated legislation that would have required tech firms to hand over customers’ secure messages when served with a warrant. The measure, released after a bitter feud between the FBI and Apple over a locked iPhone, was never formally introduced but the latest case is exactly why it should be revived, she told Martin. “I think we ought to move that bill,” she said.

If everything alleged by the Reuters report is true, the FBI's "struggles" are of its own making. It could have sought immediate assistance from Apple but chose not to. It also, apparently, turned down Apple's offer to help. If so, the FBI doesn't actually want cooperation from tech companies. It wants to be able to tell companies what features they can and can't have. It wants to dictate all the terms of these engagements, which is very much in line with the DOJ's views on tech company "partnerships."

Filed Under: dianne feinstein, encryption, going dark

BlackBerry CEO Promises To Try To Break Customers' Encryption If The US Gov't Asks Him To

from the I-got-you dept

The DOJ's reps -- along with the new FBI boss -- keep making noises about device encryption. They don't like it. What they want is some hybrid unicorn called "responsible encryption," which would keep bad guys out but let law enforcement in. The government has no idea how this is supposed to be accomplished, but it has decided to leave that up to the smart guys at tech companies. After all, tech companies are only in it for the money. The government, however, answers to a higher calling: public safety -- a form of safety that apparently has room for an increase in criminal activity and nefarious hacking.

There's one cellphone company that's been conspicuously absent from these discussions. A lot of that conspicuous absence has to do with its conspicuous absence from the cellphone marketplace. Pretty much relegated to governments and enterprise users, Blackberry has been offering encrypted messaging for years. But it's been offering a different sort of encryption -- one it can remove if needed.

Enterprise users hold their own encryption keys but individual nobodies have their encryption keys held by Blackberry. Blackberry would likely be held up as the "responsible encryption" poster boy by the DOJ if only it held enough marketshare to make an appreciable difference. Instead, it's of limited use to the DOJ and FBI.

But that doesn't mean Blackberry isn't willing to submit multiple height bids whenever government says jump. Over the past couple of years, it has come to light Blackberry routinely decrypts messages for inquiring governments. Apparently, there's some sort of golden key law enforcement can use to access communications -- one multiple governments seem to have access to.

There are still some unanswered questions about enterprise accounts -- the ones Blackberry doesn't hold the keys to. This poses the same problem for law enforcement that other, more popular phones do. But rather than point out the problems with the government's demands for "responsible encryption," Blackberry has irresponsibly chosen to proclaim its willingness to hack into its own customers' devices if the government asks.

[CEO John] Chen, speaking at a press Q&A during the BlackBerry Security Summit in London on Tuesday, claimed that it wasn't so simple for BlackBerry to crack its own protections. "Only when the government gives us a court order we will start tracking it. Then the question is: how good is the encryption?

"Today's encryption has got to the point where it's rather difficult, even for ourselves, to break it, to break our own encryption... it's not an easily breakable thing. We will only attempt to do that if we have the right court order. The fact that we will honor the court order doesn't imply we could actually get it done."

Oddly, this came coupled with Chen's assertions its user protections were better than Apple's and its version of the Android operating system more secure than the one offered by competitors.

This proactive hacking offer may be pointed to in the future by DOJ and FBI officials as evidence Apple, et al aren't doing nearly enough to cooperate with US law enforcement. Of course, Chen's willingness to try doesn't guarantee the company will be able to decrypt communications of certain users. But I'm sure Chen's positive attitude will be used as leverage in talks with tech companies the DOJ clearly believes have added encryption to their devices solely as a middle finger to US law enforcement. This belief clearly isn't true, but the DOJ in particular has already show it's willing to be completely disingenuous when arguing for weakened encryption.

Finally, Blackberry may be opening up to law enforcement but it won't be sharing anything more with its remaining users.

Chen also said there were no plans for a transparency report that would reveal more about the company's work with government. "No one has really asked us for it. We don't really have a policy on whether we will do it or not. Just like every major technology company that deals with telecoms, we obviously have quite a number of requests around the world."

This seems a bit unfair. Blackberry will be offering more to the government and telling the public less. Then again, the general public is likely no more interested in a Blackberry transparency report than it is in Blackberry smartphones.

Filed Under: doj, encryption, john chen, privacy
Companies: blackberry

Back Down The Rabbit Hole About Encryption On Smartphones

from the the-rule-of-law dept

Deputy Attorney General Rod Rosenstein wrote the disapproving memo that President Trump used as a pretext to fire FBI Director James Comey in May. But on at least one area of law-enforcement policy, Rosenstein and Comey remain on the same page—the Deputy AG set out earlier this month to revive the outgoing FBI director's efforts to limit encryption and other digital security technologies. In doing so, Rosenstein has drawn upon nearly a quarter century of the FBI's anti-encryption tradition. But it's a bad tradition.

Like many career prosecutors, Deputy Attorney General Rod Rosenstein is pretty sure he's more committed to upholding the U.S. Constitution and the rule of law than most of the rest of us are. This was the thrust of Rosenstein's recent October 10 remarks on encryption, delivered to an audience of midshipmen at the U.S. Naval Academy.

The most troubling aspect of Rosenstein's speech was his insistence that, while the government's purposes in defeating encryption are inherently noble, the motives of companies that provide routine encryption and other digital-security tools (the way Apple, Google and other successful companies now do) are inherently selfish and greedy.

At the same time, Rosenstein said those who disagree with him on encryption policy as a matter of principle—based on decades of grappling with the public-policy implications of using strong encryption versus weak encryption or no encryption—are "advocates of absolute privacy." (We all know that absolutism isn't good, right?)

In his address, Rosenstein implied that federal prosecutors are devoted to the U.S. Constitution in the same way that Naval Academy students are:

"Each Midshipman swears to 'support and defend the Constitution of the United States against all enemies, foreign and domestic.' Our federal prosecutors take the same oath."

Of course, he elides the fact that many who differ with his views on encryption—including yours truly, as a lawyer licensed in three jurisdictions—have also sworn, multiple times, to uphold the U.S. Constitution. What's more, many of the constitutional rights we now regard as sacrosanct, like the Fifth Amendment privilege against self-incrimination, were only vindicated over time under our rule of law—frequently in the face of overreaching by law-enforcement personnel and federal prosecutors, all of whom also swore to uphold the Constitution.

The differing sides of the encryption policy debate can’t be reduced to supporting or opposing the rule of law and the Constitution. But Rosenstein chooses to characterize the debate this way because, as someone whose generally admirable career has been entirely within government, and almost entirely within the U.S. Justice Department, he simply never attempted to put himself in the position of those with whom he disagrees.

As I've noted, Rosenstein's remarks draw on a long tradition. U.S. intelligence agencies, together with the DOJ and the FBI, reflexively resorted to characterizing their opponents in the encryption debate as fundamentally mercenary (if they're companies) or fundamentally unrealistic (if they're privacy advocates). In Steven Levy's 2001 book Crypto, which documented the encryption policy debates of the 1980s and 1990s, he details how the FBI framed the question for the Clinton administration:

"What if your child is kidnapped and the evidence necessary to find and rescue your child is unrecoverable because of 'warrant-proof' encryption?"

The Clinton administration's answer—deriving directly from George H.W. Bush-era intelligence initiatives—was to try to create a government standard built around a special combination of encryption hardware and software, labeled "the Clipper Chip" in policy shorthand. If the U.S. government endorsed a high-quality digital-security technology that also was guaranteed not to be "warrant-proof"—that allowed special access to government agents with a warrant—the administration asserted this would provide the appropriate "balance" between privacy guarantees and the rule of law.

But, as Levy documents, the government's approach in the 1990s raised just as many questions then as Rosenstein's speech raises now. Levy writes:

"If a crypto solution was not global, it would be useless. If buyers abroad did not trust U.S. products with the [Clipper Chip] scheme, they would eschew those products and buy instead from manufacturers in Switzerland, Germany, or even Russia."

The United States' commitment to rule of law also raised questions about how much our legal system should commit itself to enabling foreign governments to demand access to private communications and other data. As Levy asked at the time:

"Should the United States allow access to stored keys to free-speech—challenged nations like Singapore, or China? And would France, Egypt, Japan, and other countries be happy to let their citizens use products that allowed spooks in the United States to decipher conversations but not their own law enforcement and intelligence agencies?"

Rosenstein attempts to paint over this problem by pointing out that American-based technology companies have cooperated in some respects with other countries' government demands—typically over issues like copyright infringement or child pornography rather than digital-security technologies like encryption. "Surely those same companies and their engineers could help American law enforcement officers enforce court orders issued by American judges, pursuant to American rule of law principles," he says.

Sure, American companies, like companies everywhere, have complied as required with government demands designed to block content deemed in illegal in the countries where they operate. But demanding these companies meet content restrictions—which itself at times also raises international rule-of-law issues—is a wholly separate question from requiring companies to enable law-enforcement everywhere to obtain whatever information they want regarding whatever you do on your phone or on the internet. This is particularly concerning when it comes to foreign governments' demands for private content and personal information, which might include providing private information about dissidents in unfree or "partly free" countries whose citizens must grapple with oppressive regimes.

Technology companies aren't just concerned about money—it's cheaper to exclude digital security measures than to invent and install new ones (such as Apple's 3D-face-recognition technology set to be deployed in its new iPhone X). Companies do this not just to achieve a better bottom line but also to earn the trust of citizens. That's why Apple resists pressure, both from foreign governments and from the U.S. government, to develop tools that governments—and criminals—could use to turn my iPhone against me. This matters even more in 2017 and beyond—because no matter how narrowly a warrant or wiretap order is written, access to my phone and other digital devices is access to more or less everything in my life. The same is true for most other Americans these days.

Rosenstein is certainly correct to have said "there is no constitutional right to sell warrant-proof encryption"—but there absolutely is a constitutional right to write computer software that encrypts my private information so strongly that government can't decrypt it easily. (Or at all.) Writing software is generally understood to be presumptively protected expression under the First Amendment. And, of course, one needn't sell it—many developers of encryption tools have given them away for free.

What's more, our government's prerogative to seek information pursuant to a court-issued order or warrant has never been understood to amount to a "constitutional right that every court order or search warrant be successful." It's common in our law-enforcement culture—of which Rosenstein is unquestionably a part and partisan—to invert the meaning of the Constitution's limits on what our government can do, so that that law-enforcement procedures under the Fourth and Fifth Amendments are interpreted as a right to investigatory success.

We've known this aspect of the encryption debate for a long time, and you don't have to be a technologist to understand the principle involved. Levy quotes Jerry Berman, then of the Electronic Frontier Foundation and later the founder of the Center for Democracy and Technology, on the issue: "The idea that government holds the keys to all our locks, even before anyone has been accused of committing a crime, doesn't parse with the public."

As Berman bluntly sums it up, "It's not America."

Mike Godwin (@sfmnemonic) is a distinguished senior fellow at the R Street Institute.

Filed Under: crypto wars, doj, encryption, going dark, privacy, rod rosenstein, rule of law

FBI Says It Can't Get Into 6,900 Encrypted Phones. So What?

from the doing-less-with-more dept

The new director of the FBI, Christopher Wray, has apparently decided to take up James Comey's anti-encryption fight. He's been mostly quiet on the issue since assuming the position, but the DOJ's recent calls for "responsible encryption" has emboldened the new FBI boss to speak up on the subject.

And speak up he has. Although the FBI still hasn't released the text of his remarks to the International Association of Chiefs of Police, more than a few sites are reporting it was the usual "go team law enforcement" boosterism, but with the added zest of phone encryption complaints.

He also spoke about roadblocks in dealing with cellphone encryption technology, saying that in first 11 months of the fiscal year, the FBI has been unable to access content from 6,900 mobile devices despite having the proper legal authority to do so.

"It's going to be a lot worse than that in just a couple of years if we don't come up with some responsible solution," he lamented. "I'm open to all ideas."

All ideas, maybe. But certainly not all viewpoints. The Deputy Attorney General has made it clear in multiple speeches he views phone encryption as the end result of tech companies' low-minded pursuit of revenue. DAG Rosenstein repeatedly emphasized US law enforcement measures success by a different standard -- a standard mercenary phone manufacturers couldn't even begin to approach.

Of course, the FBI head also nodded towards the importance of device security.

"I get it, there's a balance that needs to be struck between encryption and the importance of giving us the tools we need to keep the public safe."

But does he actually "get it?" What if the status quo is the ending "balance?" Would that satisfy Wray? Doubtful. He wants law enforcement-friendly security holes and he wants tech companies to provide them voluntarily.

The number of locked devices means nothing. The "6,900 mobile devices" will be 8,000 or 10,000 by early next year -- sound-and-fury totals signifying nothing. It was 6,000 phones when Comey trotted out numbers earlier this year. It will always increase and it will always grab eyeballs but it won't ever mean anything unless the FBI is willing to provide a lot more context.

Is the FBI just spectacularly bad at cracking cell phones? We're not hearing these complaints from local law enforcement agencies with less expertise and lower budgets. Is the FBI just not even trying? Is it not using everything it has available -- including a number of judicial forgiveness plans for rights violations -- to get into these phones? It's inconceivable the nation's top law enforcement agency is experiencing nearly a 50% failure rate when it comes to locked phones.

All Wray says is there are 6,900 phones the FBI hasn't gotten into. Yet. What's never discussed is how many investigations resumed unimpeded by cellphone encryption. Phones are not the sole repository of criminal evidence in any investigation. The FBI has options even if the seized phone seems impermeable. The FBI insinuates it's being stopped, but never specifies how many of these phones have resulted in terminated investigations.

It's just a number, divorced from context, but one the FBI can ensure will always be larger than last time it was mentioned.

Filed Under: chris wray, context, crime, encryption, fbi, going dark, phones

DOJ Subpoenas Twitter About Popehat, Dissent Doe And Others Over A Smiley Emoji Tweet

from the our-tax-dollars-at-work dept

So, here's a fun one. Back in May, the Justice Department -- apparently lacking anything better to do with its time -- sent a subpoena to Twitter, demanding a whole bunch of information on a five Twitter users, including a few names that regular Techdirt readers may be familiar with:

If you can't see that, it's a subpoena asking for information on the following five Twitter users: @dawg8u ("Mike Honcho"), @abtnatural ("Virgil"), @Popehat (Ken White), @associatesmind (Keith Lee) and @PogoWasRight (Dissent Doe). I'm pretty sure we've talked about three of those five in previous Techdirt posts. Either way, they're folks who are quite active in legal/privacy issues on Twitter.

And what info does the DOJ want on them? Well, basically everything:

1. Names (including subscriber names, user names, and screen names);
2. Addresses (including mailing addresses, residential addresses, business addresses, and e-mail addresses);
3. Records of session times and durations, and the temporarily assigned network addresses (such as Internet Protocol ("IP") addresses) associated with those sessions;
4. Length of service (including start date) and types of service utilized;
5. Telephone or instrument numbers (including MAC addresses, Electronic Serial Numbers ("ESN"), Mobile Electronic Identity Numbers ("MEIN"), Mobile Equipment Identifier ("MEID"), Mobile Identification Numbers ("MIN"), Subscriber Identity Modules ("SIM"), Mobile Subscriber Integrated Services Digital Network Numbers ("MSISDND"), International Mobile Subscriber Identifier ("IMSI"), or International Mobile Equipment Identities ("IMEI"));
6. Other subscriber numbers or identities, or associated accounts (including the registration Internet Protocol ("IP") address);
7. Means and source of payment for such service (including any credit card or bank account number) and billing records.

That's a fair bit of information. Why the hell would the DOJ want all that? Would you believe it appears to be over a single tweet from someone to each of those five individuals that consists entirely of a smiley face? I wish I was kidding. Here's the tweet and then I'll get into the somewhat convoluted back story. The tweet is up as I write this, but here's a screenshot in case it disappears:

And, just to make it clear, here are all the users "in the conversation" on that tweet (since Twitter now buries at least some of that information):

You'll note that all of the names are the same names as listed in the subpoena above (as a point of clarification, the four users listed below were already in the conversation, so their metadata gets swept along, and then the tweeter, Justin Shafer, is also adding in @PogoWasRight to the conversation).

So, who is Justin Shafer, and what the hell is all of this about? Buckle up, because it'll take a bit of background to get around to this tweet (and, yes, it will still feel very, very, stupid that this subpoena was ever issued). First up: Justin Shafer is a security researcher, who has some history spotting bad encryption. Go back to 2013 and he had spotted a weak not really "encryption" standard put out by Faircom. Once it was called out as weak, vulnerable and not really encryption, Faircom rebranded it from the "Faircom Standard Encryption" to "Data Camouflage" since the reporting by Shafer showed that it wasn't really encryption at all -- but just a weak attempt at obfuscation.

Fast forward to late 2013, when a dentist named Rob Meaglia alerted some of his patients that a computer was stolen from his offices with "medical records and dental insurance information." But, Dr. Meaglia told his patients that the records system they were using, Dentrix, made by a company called Henry Schein, Inc., had all of that data encrypted. Except it appeared that Dentrix was actually using Faircom's "Data Camouflage" and not actual encryption. And, as that link notes, Henry Schein, Inc. had been informed of this problem months earlier, around the time Faircom admitted it wasn't actual encryption.

In May of 2016, the FTC announced a settlement with Henry Schein, Inc. over the claim that it "falsely advertised the level of encryption it provided to protect patient data." Kudos to Justin Shafer.

But, literally days later, the FBI was raiding Justin Shafer's home and taking all of his computers. This was not specifically about the Harry Schein case, but since Shafer had continued to investigate poor data security practices involving dentists, he'd come across an FTP server operated by another dental software company, Patterson Dental, which makes "Eaglesoft," a dental practice management software product. Shafer had discovered an openly available anonymous FTP server with patient data. Shafer did the right thing as a security researcher, and alerted Patterson. However, rather than thanking Shafer for discovering the server they had left with patient data exposed, Patterson Dental argued that Shafer had violated the CFAA in accessing the open anonymous FTP server. Hence the FBI raid.

Not surprisingly, Shafer was none too pleased with the FBI's decision to raid his home and take all of his electronics. In particular, it appears he was especially annoyed with FBI Special Agent Nathan Hopp (who he initially believed was actually Nathan "Hawk.")

Fast forward to March of this year, to an entirely different story: the FBI arresting John Rivello for "assaulting" journalist Kurt Eichenwald with a tweet. If you follow Techdirt related stuff, you probably remember that whole story. Lots of people, including us, posted the criminal complaint that was put together by one Nathan Hopp, a special agent at the FBI.

It appears that the Rivello arrest and subsequent news coverage suddenly alerted Shafer to the fact that "Nathan Hawk" was actually "Nathan Hopp" and Shafer began a bit of an open source "investigation" on Twitter. I wouldn't necessarily call the following tweets "smart," but Shafer, finally aware of the FBI agent who lead the raid on his house, started trying to find any public info on Hopp -- and his family. Now, searching out his family isn't great. But it does appear that he was just looking up publicly available information:

At this point, the FBI decided to start protecting its own. Seeing as the guy whose home the FBI had ridiculously raided a year earlier was now tweeting some info about one of its special agents, the FBI started putting together a new criminal complaint arguing that all of the tweets above amounted to "Cyber Stalking" under 18 USC 2216A. This seems like a huge stretch, because that law requires "intent to kill, injure, harass, intimidate, or place under surveillance...."

Either way, about the time all of this was happening, Ken "Popehat" White had started another Twitter thread about the Rivello arrest, leading Virgil and Keith Lee to respond about the criminal complaint, eventually leading Mike Honcho to note "Nathan Hopp is the least busy FBI agent of all time." It is to that tweet that Shafer replies with his smiley emoji and adds or cc's, Dissent Doe to the conversation:

And that takes us to 10 days later, when a new criminal complaint against Shafer is issued*, arguing that those tweets were criminal Cyber Stalking. And because part of that included his smiley emoji in response to the Popehat thread/Honcho tweet, the DOJ felt it necessary to issue a subpoena demanding basically all info on those 5 Twitter users (including Popehat, a former Assistant US Attorney whose info is pretty easy to find on Google). Perhaps the FBI somehow thinks that Shafer was really behind those other accounts or something -- but anyone with even the slightest level of competence should realize that's unlikely -- and that's got nothing to do with anything here anyway.

* As an aside, look closely at that criminal complaint against Shafer. I have no idea why but it appears that the FBI/DOJ is so clueless that rather than submitting the final complaint, they actually submitted the copy showing the "comments" on the Word doc they were using to prepare the complaint -- which shows two comments that both suggest the FBI is well aware that this complaint is weak sauce and probably doesn't meet the standard under the law... but this story is crazy enough without spending too much time on that.

Twitter is apparently fighting back against this subpoena. And even though it was issued back in May, a few days ago, the company alerted the individuals that the DOJ was demanding info on. Dissent Doe has already stated publicly a plan to move to quash the subpoena as well, and I wouldn't be surprised to see the others named take similar steps.

But, really, take a step back and everything about this situation is crazy. Going after Shafer the first time was crazy. Going after him again for supposed "Cyber Stalking" over a few harmless tweets was clearly just the FBI trying to protect its own from being embarrassed online. Then, to subpoena a ton of info on 5 totally unrelated Twitter users... just because Shafer tweeted a smiley face emoticon at them? What the fuck is the DOJ up to? Doesn't Assistant US Attorney Douglas Gardner, who signed the subpoena, have better things to do with his time, like going after actual criminals, rather than harassing people for tweeting?

Filed Under: cfaa, cyberstalking, dissent doe, doj, douglas gardner, emoji, encryption, fbi, fbi raid, justin shafer, keith lee, ken white, nathan hopp, pogowasright, popehat, subpoena, tweets
Companies: henry schein, patterson dental, twitter

Law Prof Argues Cell Location Records Shouldn't Need Warrants Because Cell Phones Have Encryption

from the towards-a-more-government-friendly-reading-of-the-4th-Amendment dept

As the Supreme Court readies itself for an important Fourth Amendment decision, the supporting briefs are beginning to trickle in. At stake is a potential redefining of the expectation of privacy under the Fourth Amendment, something that was diminished by the 1979 Supreme Court decision that created the so-called Third Party Doctrine.

In Carpenter's case, the third party records in question are something gathered by all cell phone companies: location data. The government used months of cell site location data to retrace Carpenter's movements, all without a warrant. This warrantless access turns cell phones into proxy tracking devices for the government. The government is perfectly fine with this turn of events and is asking the Supreme Court to uphold the lower court's decision.

A brief [PDF] siding with the government has been submitted by George Washington University law prof (and Volokh Conspirator) Orin Kerr. In it, Kerr makes some strange arguments.

The least weird argument is Kerr's assertion cell site location records shouldn't be covered by the Fourth Amendment because they are the equivalent of "observation in a public space." This is undoubtedly true, but it does allow the government to perform these "observations" without actually having to use its own eyeballs. Instead of tracking someone's movement through direct, in-person surveillance, the government can serve a subpoena to phone companies and use constantly-collected data to perform retrospective tracking.

Kerr goes on to serve up an analogy to buttress his assertion the Fourth Amendment should provide no protection for ostensibly "public" activities. And that's where the arguments start going off the rails.

[I]magine a world without communications networks. If Alice wants to communicate with Bob, Alice has to leave her home and travel to Bob’s house. If the police suspect that Alice and Bob are conspirators planning a crime, and they assign an officer to watch Alice’s whereabouts, the police can collect only some information without triggering the Fourth Amendment. The police cannot learn the contents of what Alice and Bob said inside Bob’s home without a warrant. On the other hand, the police can observe Alice and see what she did in public – when she left home, where she traveled, when she arrived at Bob’s house, and where they both live – without triggering the Fourth Amendment.

Next imagine that Alice calls Bob on her cell phone instead of meeting him in person. Alice no longer has to travel to meet Bob. The cell phone network delivers the call from Alice to Bob, making a remote transfer that eliminates the need for a public trip. But, critically, the same information exists. What was previously the contents of the conversation in Bob’s house is now the contents of the phone call between Alice and Bob. And what was previously Alice’s publicly observable trip from her house to Bob’s house is now a record that the phone provider generated and may keep about when the call was made, to and from what numbers, and what cell towers were used to deliver it.

What's glossed over in this analogy is the existence of landlines. This middle step is instructive and its absence from Kerr's brief seems almost disingenuous. For years, criminal collaborators used landlines and payphones to converse. This is what the Third Party Doctrine is predicated on: phone records. The Supreme Court's 1979 decision forced companies to comply with (and provide technical assistance for) pen register/trap-and-trace orders. These captured numbers dialed and length of conversations. The only location of interest was already known: the residence/phone booth containing the targeted phone. If law enforcement wanted information on suspects' movements, they still needed to deploy some form of additional surveillance.

Kerr is arguing law enforcement should have access to people's public movements without having to do the actual legwork. And he starts this argument by ignoring the fact law enforcement has -- for years! -- been unable to do anything more than collect phone records sans location data. But now phone records also contain information about people's movements, and Kerr believes they should be inseparable and easily-accessible. This assertion is made despite Kerr attempting to draw a straight line from the good old days of walking from house to house directly through CSLI and email header info.

To maintain the balance of the Fourth Amendment, courts should treat the same information in the same way in both the physical and network contexts. The contents of phone calls should be protected, as they are the telephone equivalent of protected inside space. This means, in the Internet context, that the contents of e-mails, text messages, and files that users place in cloud storage should receive full Fourth Amendment protection. On the other hand, non-content records generated by network providers – the business records they generate about how they delivered the communications – should not be protected because they are the network equivalent of the publicly observable trip that is outside such protection in the physical world.

Going on from there, Kerr says the court -- along with legislators -- must maintain an "equilibrium" between expectations of privacy and lawful access. But in this case, the equilibrium must shift towards the government. Why? Because criminals use cell phones.

The ways that cell phones can facilitate crime and avoid detection counsels against creating new Fourth Amendment protections for cell phone records. Obviously, most people don’t use their phones to commit crimes. But most people don’t have their records collected by court order under the Stored Communications Act, either. The key point is that the effect of cell phone technology on the “often competitive enterprise of ferreting out crime,” Johnson v. United States, 333 U.S. 10, 14 (1948), operates as a two-way street. The ability of cell phone companies to deliver communications quickly and silently over any distance cuts both ways. It can lead to records about the delivery that helps the police, and it can aid in the commission of crime that helps wrongdoers. Both should be considered.

He's right that both should be considered. But his argument doesn't suggest both should be considered. Kerr believes the government's view should be given priority -- a view that allows for no narrowing of the Third Party Doctrine. No one should be granted a higher expectation of privacy because criminals use cell phones. That's basically the argument. And it leads directly to this argument, which isn't any better. The Third Party Doctrine should remain intact because people -- including criminals -- use encryption.

It is too early to tell how far encryption will interfere with government investigative powers. But because users generally can’t encrypt non-content records such as historical cell-site records, the collection of such records may take on a more important role in future surveillance practices. The Court should be reluctant to introduce new constitutional protections for non-content records when the existing constitutional framework for access to contents may be impeded by new encryption technology.

I'm honestly unsure what to make of that argument, which seems to imply the Court should only view the Fourth Amendment as an avenue for law enforcement access, rather than its true purpose: protecting citizens from their government. Kerr talks about maintaining a balance, but posits that relevant technological advancements should work for the government, rather than against it. If people can have encryption and little metal-and-glass rectangles that allow them to hold private, long distance conversations, then the government should have uninterrupted, warrantless access to anything the government deems to be a "third party records."

This isn't the way to maintain balance. The Fourth Amendment isn't the government's enabler. And it never has been. It was written to curb government overreach and abuse. The government has been dealing with unobservable conversations for decades now. That it can now track people without ever leaving the office may be handy, but it doesn't necessarily follow it should always be able to do this without a warrant. The Supreme Court should take a close look at the implications of allowing the status quo to remain in place. Thousands of electronic devices generate millions of third party records every day, all less than a warrant away. Ignoring these implications in favor a simplistic rehashing of a forty-year-old decision is only going to cause further difficulties down the road.

Filed Under: 4th amendment, cell site location info, csli, encryption, location info, orin kerr, scotus, third party doctrine

The Cyber World Is Falling Apart And The DOJ Is Calling For Weakened Encryption

from the better-for-cops,-worse-for-everyone-else dept

It seemed like the (mostly) one-man War on Encryption had reached a ceasefire agreement when "Going Dark" theorist James Comey was unceremoniously ejected from office for failing to pledge allegiance to the new king president. But it had barely had time to be relegated to the "Tired" heap before Deputy Attorney General Rod Rosenstein resurrected it.

Rosenstein has been going from cybersecurity conference to cybersecurity conference raising arguments for encryption before dismissing them entirely. His remarks have opened with the generally awful state of cybersecurity at both the public and private levels. He says encryption is important, especially when there are so many active security threats. Then he undermines his own arguments by calling for "responsible encryption" -- a euphemism for weakened encryption that provides law enforcement access to locked devices and communications on secured platforms.

Considering recent events, this isn't the direction the DOJ should be pushing. Russian hackers used a popular antivirus software to liberate NSA exploits from a contractor's computer. Equifax exposed the data of millions of US citizens who never asked to be tracked by the service in the first place. Yahoo just admitted everyone who ever signed up for its email service was affected by a years-old security breach. Ransomware based on NSA malware wreaked havoc all over the world. These are all issues Rosenstein has touched on during his remarks. But they're swiftly forgotten by the Deputy Attorney General when his focus shifts to what he personally -- representing US law enforcement -- can't access because of encryption.

DAG Rosenstein needs to pay more attention to the first half of his anti-encryption stump speeches, as Matthew Green points out at Slate:

[A]ny technology that allows U.S. agencies to lawfully access data will present an irresistible target for hackers and foreign intelligence services. The idea that such data will remain safe is laughable in a world where foreign intelligence services have openly leveraged cyberweapons against corporate and political targets. In his speech, Rosenstein claims that the “master keys” needed to enable his proposal can be kept safe, but his arguments are contradicted by recent history. For example, in 2011 hackers managed to steal the master keys for RSA’s SecurID authentication product—and then used those keys to break into a slew of defense contractors. If we can’t secure the keys that protect top-secret documents, it’s hard to believe we’ll do better for your text messages.

Rosenstein is steering everyone towards his new term "responsible encryption" but there's nothing responsible about creating a set of encryption keys for lawful access. It may not necessarily be a backdoor -- a term Rosenstein is trying hard to distance himself from -- but it is a hole that wouldn't otherwise exist. And if keys are created and stored by manufacturers and platform providers, the chance malicious hackers can find them will always remain above 0%.

Filed Under: cybersecurity, encryption, going dark, hacks, matthew green, rod rosenstein, security