stories filed under: "encryption"

Senator Tom Cotton Slams Apple CEO Tim Cook For Protecting User Privacy; Demonstrates Pure Ignorance Of The Law

from the this-is-who-we-elect? dept

Mon, Dec 21st 2015 11:39am — Mike Masnick

As you may have heard, last night Apple CEO Tim Cook was on 60 Minutes. The overall story really wasn't all that insightful for anyone who's been following Apple for any length of time, but what got a lot of attention was Tim Cook reiterating his position on protecting the privacy of Apple users through encryption. Here's basically the entire exchange:

Charlie Rose: In the government, they say it's like saying, you know, you have a search warrant, but you can't unlock the trunk.

Tim Cook: Here's the situation is on your smartphone today, on your iPhone, there's likely health information, there's financial information. There are intimate conversations with your family, or your co-workers. There's probably business secrets and you should have the ability to protect it. And the only way we know how to do that, is to encrypt it. Why is that? It's because if there's a way to get in, then somebody will find the way in. There have been people that suggest that we should have a back door. But the reality is if you put a back door in, that back door's for everybody, for good guys and bad guys.

Charlie Rose: But does the government have a point in which they say, "If we have good reason to believe in that information is evidence of criminal conduct or national security behavior?"

Tim Cook: Well if, if the government lays a proper warrant on us today then we will give the specific information that is requested. Because we have to by law. In the case of encrypted communication, we don't have it to give. And so if like your iMessages are encrypted, we don't have access to those.

Charlie Rose: OK, but help me understand how you get to the government's dilemma.

Tim Cook: I don't believe that the tradeoff here is privacy versus national security.

Charlie Rose: Versus security.

Tim Cook: I think that's an overly simplistic view. We're America. We should have both.

Same basic stuff he's said before. Nothing new. Nothing controversial. But grandstanding Senator Tom Cotton apparently flipped out about it and pushed out a statement that shows a rather stunning ignorance of the law.

"Apple is a distinctive company that has improved the lives of millions of Americans. But Tim Cook omitted critical facts about data encryption on 60 Minutes last night. He claimed that Apple does not comply with lawful subpoenas because it cannot. While it may be true that Apple doesn't have access to encrypted data, that's only because it designed its messaging service that way. As a society, we don't allow phone companies to design their systems to avoid lawful, court-ordered searches. If we apply a different legal standard to companies like Apple, Google, and Facebook, we can expect them to become the preferred messaging services of child pornographers, drug traffickers, and terrorists alike--which neither these companies nor law enforcement want. Our society needs to address this urgent challenge now before more lives are lost or shattered."

Of course, Senator Tom Cotton apparently didn't bother to read the actual law dealing with the issue of "assistance capability requirements" because, among other things, it says:

A telecommunications carrier shall not be responsible for decrypting, or ensuring the government’s ability to decrypt, any communication encrypted by a subscriber or customer, unless the encryption was provided by the carrier and the carrier possesses the information necessary to decrypt the communication.

So, yes, as a society we do allow companies to design their systems with encryption. It's in the law.

And there's a good reason why we do that. Because it makes everyone safer. Again, the idea that this suddenly creates a "going dark" problem where "child pornographers, drug traffickers, and terrorists alike" are able to hide out from the law is a massive exaggeration -- which is why the government has still failed to show any real examples of it being a serious problem. Even with encryption, people engaged in illegal behavior leave plenty of other evidence. Even with encryption, basic detective work can usually track down those responsible. Even without encryption, people have always been able to communicate in ways that defy warrants and surveillance orders (e.g., talking in person or writing in code).

The whole idea that this is a big problem is wrong on multiple levels. First, the "problem" is barely a problem at all. Second, those who are attacking encryption, like Senator Tom Cotton, don't seem to have the first clue about how much encryption protects everyone and makes us safer from the actual threats that people face.

Filed Under: encryption, going dark, law enforcement, tim cook, tom cotton
Companies: apple

47 Comments

Blackberry CEO Gives Public One More Reason To Not Buy Its Phones By Arguing For Greater Law Enforcement Cooperation

(Mis)Uses of Technology

from the the-greater-good-is-apparently-whatever-the-government-says-it-is dept

Mon, Dec 21st 2015 8:29am — Tim Cushing

Blackberry's CEO John Chen feels the company hasn't hit rock-bottom yet. In a post for the company's blog, Chen announces that the phone favored by much of The Establishment will continue to support the hopes and dreams of The Establishment.

There will be no "going dark" at Blackberry.

For years, government officials have pleaded to the technology industry for help yet have been met with disdain. In fact, one of the world’s most powerful tech companies recently refused a lawful access request in an investigation of a known drug dealer because doing so would “substantially tarnish the brand” of the company. We are indeed in a dark place when companies put their reputations above the greater good. At BlackBerry, we understand, arguably more than any other large tech company, the importance of our privacy commitment to product success and brand value: privacy and security form the crux of everything we do. However, our privacy commitment does not extend to criminals.

Chen notably does not use Apple's name, lest it encourage potential customers to seek out a company that gives a damn about its customers' privacy. Chen claims he won't allow criminals to remain hidden from law enforcement if they're using his company's phones and services. All well and good, but that assumes the only time law enforcement will seek access to encrypted communications and data is when they've obtained a conviction, which is rarely the case.

Sometimes, these agencies are relying on a minimal showing of reasonable suspicion to obtain data/communications with subpoenas and national security letters. Other times, they're working with probable cause and actually obtaining warrants (warrants which also give them permission to seize electronics, thus ending their alleged use in criminal activity). Either way, the question of guilt is still up in the air. What Chen likely means is he won't extend his privacy commitment to people who are suspected of criminal activity, but that doesn't sound nearly as audacious and idealistic as declaring "criminals" will have no place while Chen's in charge.

When your company has been engaged in a multi-year marketshare freefall, it's pretty easy to take shots at companies who worry about possibly "tarnished reputations." Outside of the government itself, Blackberry is nobody's idea of an innovator or a viable threat. When Chen says he's on the side of the government, it's no surprise, as the government has been on his company's side for several years now.

From this self-interested take on the encryption debate, Chen moves on to making questionable assertions about the public's obligation to assist law enforcement.

We reject the notion that tech companies should refuse reasonable, lawful access requests. Just as individual citizens bear responsibility to help thwart crime when they can safely do so, so do corporations have a responsibility to do what they can, within legal and ethical boundaries, to help law enforcement in its mission to protect us.

Just to be clear, citizens are not obligated to "thwart crime." Neither is law enforcement, for that matter. Both can make reasonable efforts to deter criminal activity, but nobody's charged with "thwarting crime." This is why law enforcement agencies must use warrants and other legal paperwork to demand this information. The receiving party's obligation doesn't begin until the paperwork is in hand. Chen almost suggests private companies should be going above and beyond what is required by these court orders.

The key issue in the case Chen doesn't refer to by name is a 1789 law that the feds are using to avoid dealing with the Fifth Amendment. They want Apple to unlock a phone so they can access the contents, rather than spending any more time asking the detained suspect to do this. Apple has refused. It has also noted that, even if it does comply with this order, it will be unable to do so with its newer iPhones.

Chen thinks Apple should just comply with the order "for the greater good," apparently never considering the fact that forcing the government to actually operate within the confines of existing statutes would perhaps result in a form of "greater good" itself.

He then goes on to state his support for encryption and opposition to encryption bans or backdoors. This seems highly unlikely considering his earlier statements about granting the government access to phone contents. He notes he has pulled his products from countries that have demanded backdoors (but not all of them), but doesn't appear to be able to reconcile Blackberry's actions with his criticism of Apple's. Instead, he makes this unsupported statement:

Make no mistake: service providers bear a dual responsibility to protect customer privacy zealously and to cooperate with lawful requests for investigative assistance.

Very idealistic, but whether or not Apple wins this particular battle (and loses more of Chen's respect, whatever that's worth), it will make no difference in the future. Blackberry offers encryption, but Chen's post contains no details about his company's ability to decrypt to comply with law enforcement orders. Blackberry's early implementation of encrypted communications actually led to a former NSA official claiming this was the reason for its downfall. So, unless Blackberry is creating escrow keys, it will be no more cooperative than Apple when the government comes asking for access to communications.

And this is nothing new for Chen. He's been claiming there's some mythical middle ground that will serve both phone manufacturers and the government since a few weeks after the Charlie Hebdo attack. Several months later, his message remains unchanged. There's a balance here, and it must be tipped in favor of law enforcement… for the "greater good."

Filed Under: backdoors, encryption, going dark, john chen, privacy
Companies: at&t, blackberry

18 Comments

Hillary Clinton Wants A 'Manhattan Project' For Encryption... But Not A Back Door. That Makes No Sense

Failures

from the politics-is-dumb dept

Mon, Dec 21st 2015 6:54am — Mike Masnick

In the Democratic Presidential debate on Saturday night, Hillary Clinton followed up on her recent nonsensical arguments about why Silicon Valley has to "solve" the problem of encryption. As we've noted, it was pretty clear that she didn't fully understand the issue, and that was even more evident with her comments on Saturday night.

Here's what's clear: she's trying to do the old politician's trick of attempting to appease everyone with vague ideas that allow her to tap dance around the facts.

First, she proposed a "Manhattan-like project" to create more cooperation between tech companies and the government in fighting terrorism. The Manhattan Project was the project during World War II where a bunch of scientists were sent out to the desert to build an atomic bomb. But they had a specific goal of "build this." Here, the goal is much more vague and totally meaningless: have tech and government work together to stop bad people. How do you even do that? The only suggestion that has been made so far -- and the language around which Clinton has been echoing -- has been to undermine encryption with backdoors.

However, since that resulted in a (quite reasonable) backlash from basically anyone who knows anything about computer security, we get the second statement from Clinton that she doesn't want backdoors.

"Maybe the back door isn't the right door, and I understand what Apple and others are saying about that. I just think there's got to be a way, and I would hope that our tech companies would work with government to figure that out."

No, she clearly does not understand what Apple and others are saying about that. Just a week or so ago, she insisted that Apple's complaint about it was that it might lead to the government invading users' privacy, but that's only a part of the concern. The real concern is that backdooring encryption means that everyone is more exposed to everyone, including malicious hackers. You create a backdoor and you open up the ability for malicious hackers from everywhere else to get in.

So, she's trying to walk this ridiculously stupid line in trying to appease everyone. She wants the security/intelligence officials to hear "Oh, I'll get Silicon Valley to deal with the 'going dark' thing you're so scared of," and she wants the tech world to hear "Backdoors aren't the answer." But, that leaves a giant "HUH?!?" in the middle.

It seems to come down to this: None of the candidates for president appear to have the slightest clue how encryption or computer security work and that allows them to make statements like this that are totally nonsensical, while believing that they make sense.

The issue, again, is that what they're really asking for is "Can you make a technology where only 'good' people can use it safely, and everyone else cannot?" And the answer to that question is to point out how absolutely astoundingly stupid the question is. Because there's no way to objectively determine who is "good" and who is "bad," and thus the only possible response is to create code that really thinks everyone is "bad." And to do that, you have to completely undermine basic security practices..

So this whole idea of "if we just throw smart people in a room, they'll figure it out" is wrong. It's starting from the wrong premise that there's some sort of magic formula for "good people" and "bad people." And without understanding that basic fact, the policy proposals being tossed out are nothing short of ridiculous.

Filed Under: encryption, going dark, hillary clinton, manhattan project, silicon valley

198 Comments

Juniper Reveals 'Unauthorized Code' That Decrypts VPN Connections

(Mis)Uses of Technology

from the let-the-speculation-begin dept

Fri, Dec 18th 2015 8:21am — Mike Masnick

Well, well, well. Yesterday morning, Juniper Networks announced that it had discovered some "unauthorized code" in its ScreenOS that would allow "knowledgeable" attackers to decrypt VPN traffic on Juniper's NetScreen devices:

During a recent internal code review, Juniper discovered unauthorized code in ScreenOS that could allow a knowledgeable attacker to gain administrative access to NetScreen devices and to decrypt VPN connections. Once we identified these vulnerabilities, we launched an investigation into the matter, and worked to develop and issue patched releases for the latest versions of ScreenOS.

At this time, we have not received any reports of these vulnerabilities being exploited; however, we strongly recommend that customers update their systems and apply the patched releases with the highest priority.

Not surprisingly, speculation is running rampant concerning how this happened. Since this isn't just using some sort of zero day exploit, but rather "unauthorized code" -- it's pretty clear this isn't just some random security folks having fun. The most obvious possibilities here are nation-state level actors -- with a lot of finger pointing in the NSA's general direction. I would imagine, whether or not it's the NSA, there was a lot of freaking out at Ft. Meade yesterday as this came out. Either their own handiwork was exposed... or their own failure.

You may recall that, almost exactly two years ago the German newspaper Der Spiegel had a fairly revealing article about the NSA's Tailored Access Operations (TAO) unit, that focused on figuring out how to get into basically any computer or network. The article also discussed another group, Advanced or Access Network Technology (ANT) which focused on creating exploits in equipment. In the accompanying article about the "catalog" that ANT produces for the NSA to "purchase" exploits, it discusses targeting Juniper equipment:

In the case of Juniper, the name of this particular digital lock pick is "FEEDTROUGH." This malware burrows into Juniper firewalls and makes it possible to smuggle other NSA programs into mainframe computers. Thanks to FEEDTROUGH, these implants can, by design, even survive "across reboots and software upgrades." In this way, US government spies can secure themselves a permanent presence in computer networks. The catalog states that FEEDTROUGH "has been deployed on many target platforms."

Of course, if the code is already directly in the OS, that explains why the code can "survive 'across reboots and software upgrades'." In other words, while the original article suspected malware, perhaps the malware was already in the OS itself.

And, remember, this is the same government/NSA that now wants tech companies to share even more information with it via CISA...

Filed Under: decryption, encryption, feedthrough, network, nsa, screenos, surveillance, unauthorized code, vpn
Companies: juniper, juniper networks

17 Comments

Congressman Who Supports Undermining Encryption Says We Need CISA (Which Undermines Privacy) To 'Protect Privacy'

Privacy

from the up-is-down,-black-is-white,-day-is-night dept

Thu, Dec 17th 2015 11:38am — Mike Masnick

Representative Adam Schiff, the ranking member of the House Intelligence Committee (the Committee that has most strongly been pushing versions of cybersecurity bills that undermine privacy and provide more surveillance powers) apparently believes that as long as he says day is night and up is down, the world will believe him. In response to Speaker Paul Ryan's decision to shove CISA into the omnibus funding bill, Schiff insisted that this was necessary to protect our privacy:

“This is the most protective of privacy of any cyber bill that we have advanced and we need to keep in mind the overriding interest all Americans have in protecting their privacy from these innumerable hacks,” Intelligence Committee ranking member Adam Schiff (D-Calif.), a cosponsor of his panel’s cyber bill, told The Hill. “Our privacy is being violated every day. And the longer we delay on measures like this, the more we subject ourselves to those kind of intrusions into our privacy.”

Nearly everything Schiff says here is complete hogwash. This bill is far from "the most protective of privacy of any cyber bill" that has advanced. Other versions clearly had more privacy protections (mainly the one advanced by the House Judiciary Committee). And, this latest one clearly strips out privacy provisions and makes it that much more difficult to protect our privacy.

And the fearmongering about "these innumerable hacks" and how "our privacy is being violated every day" is totally meaningless, because CISA does nothing to stop these hacks. We've asked many times before how would CISA have stopped a single hack and no one ever answers. We've looked hard and cannot find a single online security expert who thinks that CISA would be useful in preventing online hacks and attacks. Because it wouldn't. There is nothing in there geared towards stopping attacks.

You know what would help in protecting our privacy and limiting the damage from hacks? Stronger encryption. I wonder what Rep. Adam Schiff thinks about that?

Take a wild... wild guess. Oh, you're right: He doesn't like encryption.

"While it remains too early to tell the role encrypted communications may have played in the devastating terrorist attacks in Paris, we do know that ISIS regularly instructs its operatives to use encrypted platforms precisely to help evade detection. These platforms are made overseas as well as in the U.S., and there are significant security, technological, economic and privacy issues involved in addressing the challenge posed to the intelligence community and law enforcement by encryption.

"That is why Chairman Nunes and I – months before these horrific attacks – requested that the National Academy of Sciences, an organization that two decades ago studied this very issue, produce an updated report that can help us to identify and design effective, technologically feasible and economically viable solutions to the increasingly dangerous problem known as 'going dark.' I am pleased that the Academy is proceeding with such a study, which will help inform policymakers and the public alike.

Yup.

If Rep. Schiff was truly worried about hacks and keeping Americans' data secure, he'd be supporting strong encryption. Instead, he's looking to undermine it, while at the same time supporting a separate bill which, under the false pretense of protecting us from cybersecurity attacks, actually undermines our privacy even further.

So here's a challenge to Rep. Adam Schiff: Can you find a single recognized cybersecurity expert who thinks that the way to protect against hacks is (1) found in this Cybersecurity Act and (2) involves figuring out ways to stop encryption from letting people "go dark"? If not, perhaps you should stop saying these things and stop legislating about it.

Filed Under: adam schiff, cisa, cybersecurity, encryption, privacy

24 Comments

No, Strong Crypto Is Not Making The World 'Go Dark' For Intelligence Agencies: Here's Why

Privacy

from the don't-be-afraid-of-the-dark dept

Wed, Dec 16th 2015 6:27am — Glyn Moody

Last year, Techdirt noted that there was something of a concerted campaign to paint strong encryption as a real threat to intelligence agencies. That's continuing, except that for a number of recent attacks "encryption" has become a generic excuse for intelligence failures. To the extent that there was any real logic behind the attacks on crypto, the main one was that it was making things "go dark" by preventing the authorities from accessing vital information that could have stopped the attack/saved lives/led to arrests etc. if only it had been available. You can see why this phrase is such a favorite: it cleverly reminds us that once things have gone dark, all kinds of scary stuff could start happening, just like in our childhood nightmares. The only problem with this metaphor is that it is exactly wrong, as Phillip Rogaway points out in a recent interview in The Atlantic:

law enforcement has an extraordinary set of tools available to them now. An unprecedented set of capabilities, both for law enforcement and intelligence services. These aren't somehow the dark times for either law enforcement or intelligence. These are the times of extraordinary information. Nowhere in history has it been so easy to learn so much about everybody.

Critics might counter that it's easy to say that, but how are the authorities supposed to gather vital information when strong encryption has been used? An excellent column in The Washington Post by Nicholas Weaver, a computer security researcher at the International Computer Science Institute, provides step-by-step instructions that the intelligence services can follow if they are afraid of the gathering dark: Let's examine a hypothetical investigation into Johnny Badguy. To plan and execute his crimes, Johnny uses an iPhone with encrypted features -- such as disk encryption that prevents anyone without the pass code from accessing the data and iMessage which encrypts messages in transit -- that have drawn the ire of FBI Director James Comey.
As Weaver points out, the communications metadata is actually much more useful than any encrypted content that has "gone dark": If the investigator knows everything Johnny does, everyone he talks to and everywhere he goes, how much does it matter that the investigator doesn't know what Johnny says?
And it's not just about metadata: unless switched off, Johnny's iCloud backup will include a copy of all undeleted messages, all his contacts, his email accounts and his photographs. Moreover, Weaver notes, Google provides even more useful info: Every IP address used to log into the Google account can recreate Johnny's movements -- the same information used by the FBI to unmask former CIA head David Petraeus's affair. If Johnny stays logged into Google through his browser, investigators have access to Johnny's search history and, thanks to how the Google+ button operates, a large number of the pages Johnny has viewed.
On top of that, a warrant to the phone company will provide: the movements of the phone itself, as every call, text or push notification records at least the cell tower and sector, which says Johnny was in a particular wedge-shaped location occupying a few square miles.
As Weaver concludes: Taken together, and further combined with other sources (such as the near-ubiquitous license plate readers and toll-tags), investigators have a nearly complete picture of Johnny's behavior, movements and associates without having to ever worry about the effects of cryptography.
As well as confirming that metadata is in general far more revealing than content -- despite what the UK government likes to insist -- Weaver's tale of Johnny Badguy brings out something that is insufficiently appreciated: the fact that today's mobile devices provide an amazing treasure-trove of information about their owner that is without precedent historically. In fact, Weaver's helpful analysis shows that the real threat to the intelligence agencies is not that the bad people might start using strong encryption, but that they might stop using smartphones.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: detective work, encryption, going dark, information, investigations, law enforcement

19 Comments

Clueless Press Being Played To Suggest Encryption Played A Role In San Bernardino Attacks

Failures

from the gotta-try dept

Mon, Dec 14th 2015 8:29am — Mike Masnick

As law enforcement and their friendly politicians have used the attacks in San Bernardino to renew a call to undermine and break encryption, the mainstream press has been an easy target for politicians looking to get out whatever message they want. Take, for example, the following set of stories that popped up for me in a simple Google News search:

Note that the first story -- the one claiming the San Bernardino attackers had encryption actually came out before the second story saying they did not. Incredibly, if you read the full text of both stories, neither fully agrees with its own headline. The ABC story is ridiculously vague:

The couple who launched the terrorist attack in San Bernardino, California, last week had devices with some form of encryption, making it difficult for authorities to access all potential information on phones and perhaps other devices, two senior U.S. officials told ABC News.

"Some of their digital media we have been able to exploit. Some of it we have not,” one official said.

The story at The Hill that claims there's "no evidence" instead has lots of quotes from people suggesting that they just haven't found it yet, and Senator Richard Burr saying it doesn't matter because "we've still got a big problem out there that we're going to have to deal with and it's called encryption." This is the same Richard Burr who, just a couple of months ago, was warning about the dangers of "cyber" attacks in pushing CISA. Does he not realize that encryption helps protect against those attacks significantly more than the ridiculous CISA bill he supported?

Anyway, it appears the same anonymous "senior US officials" who were whispering in ABC's ear were doing the same to CBS, which posted a ridiculously vague tweet, without any followup story (that I can find):

Others have since run with it. The International Business Times wrote an entire story about the encryption the attackers used, with CBS's tweet as its sole source. And a local Fox affiliate ran a similar story that also is ridiculously vague, with a title breathlessly declaring "ISIS Encryption Used By San Bernardino Shooters." Even that headline goes beyond anything else I've seen, since no one had specifically claimed "ISIS encryption." But then you read the full article and it doesn't either. Here's the entire discussion of the San Bernardino attackers in the first paragraph:

Lawmakers say the San Bernardino shooters may have used encrypted communications in an attempt to hide their activities. This type of encryption has been seen before, however.

The rest of the article deals with the FBI's new claims that one of the Garland, Texas, shooters used encryption, not the San Bernardino attackers. And then it just mentions that ISIS has its own form of encryption at the end of the article, never tying it back to the San Bernardino attackers. A headline like that seems like journalistic malpractice.

Thankfully, Joshua Koopstein at Vice's Motherboard throws some cold water on this kind of idiocy, noting that every phone these days has some "built-in encryption" and that the press running with this story are being ridiculous.

As many in the security world quickly pointed out, the claim is both vague and nonsensical: Every phone and computing device currently sold in the US has “levels of built-in encryption.” If they didn't, criminals would still be able to easily intercept your calls when your phone connects to a cell tower, and a common thief who steals your device would get access to your bank account info, login details, pictures, and any other sensitive data you stored on it.

In other words, saying you found “built-in encryption” in a modern cellphone is about as meaningful as saying you found a battery and a touchscreen.

And, even more on point, Marcy Wheeler points out that "encryption" has just become law enforcement and the intelligence community's buzzword of choice for "failing to achieve omniscience."

But this is the second attack in a row, with Paris, where Burr and others have suggested that their lack of foreknowledge of the attack makes it probable the planners used encryption. Burr doesn’t even seem to be considering a number of other things, such as good operational security, languages, and metadata failures might lead the IC to miss warning signs, even assuming they’re collecting everything (there should have been no legal limits to their ability to collect on Malik).

We’re not having a debate about encryption anymore. We’re debating making the Internet less secure to excuse the IC’s less-than-perfect-omniscience.

Indeed, that's why we pointed out that the Paris attacks were an intelligence failure, not an encryption problem. And it explains why the law enforcement and intelligence communities are so quick to blame encryption. They don't want people looking back at their own failures, so they might as well blame the technology.

But, really, none of that really matters in the long run. There certainly will be attacks where encryption is used for planning -- why wouldn't there be? But the debate shouldn't be about that so much as looking at the overall setup of the world and computer security. And the simple fact is that more people are made safer by the widespread adoption of encryption than are made safer by undermining that encryption to let the FBI peek in on your communications.

Filed Under: encryption, journalism, san bernardino attacks

33 Comments

French Prime Minister Says Government Not Considering Banning Open WiFi, Tor Connections

Say That Again

from the that-proposed-encryption-ban,-tho dept

Fri, Dec 11th 2015 10:39am — Tim Cushing

The French government has issued a statement indicating it will not be participating in the nation's law enforcement agencies' perversely masturbatorial power fantasies. A few days ago, Le Monde published a few "highlights" from a law enforcement "wishlist," crafted in response to the terrorist attacks in Paris.

Among the many, many things law enforcement jotted down in response to a call for input on future terrorist-related legislation was a ban on public WiFi, Tor connections and encrypted communications. This was in addition to requests for warrantless/consent-less searches of people and vehicles, and the power to arbitrarily set up roadblocks for the purposes of executing even more warrantless/consent-less searches of people and vehicles.

The French Prime Minister has now confirmed that at least one of the items on the disturbing list will not be implemented. (via the Daily Dot)

A ban on Wifi internet access will not be introduced as part of new security measures in response to the Paris attacks in November, the Prime Minister has said.

There also appears to be no government interest in banning Tor connections, although this was stated a little less firmly. And the whole "demand encryption keys from third parties" request goes entirely unaddressed, suggesting the French government still has an eye on inserting itself into encrypted relationships as a "trusted partner."

Interestingly, Prime Minister Manual Valls appears to have not seen the same document Le Monde did.

The prime minister denied any knowledge of such police requests, adding: "Internet is a freedom, is an extraordinary means of communication between people, it is a benefit to the economy."

Mr Valls said he understood the security services' need for tough measures to fight terrorism but stressed that those measures had to be "effective".

This could be taken to mean that the law enforcement wishlist compiled by the police liaison office isn't viewed as an "official" request in any way, shape or form -- that it may as well have been drunken scrawls on the back of a cocktail napkin as far as the Prime Minister is concerned. It could also mean the Prime Minister isn't yet willing to go on record as to the numerous other, unaddressed requests made by law enforcement, most of which deal with the terrestial realm, rather than the more ethereal 'net.

France is still under a state of emergency, which has already given law enforcement increased discretionary powers. The government will likely move forward with harmful legislation because that's what governments tend to do in response to violent attacks. But, for now, it appears law enforcement will have to make do with the arbitrary house arrests and warrantless searches it's already engaging in.

Filed Under: encryption, france, freedom, law enforcement, manual valls, public wifi, surveillance, tor, wifi

5 Comments

FBI Director Says 'Smart People' At Office Supply Companies Can Help Limit Terrorists' Access To Pen And Paper

Say That Again

from the also-has-concerns-about-auto-manufacturers-offering-locking-trucks-by-default dept

Fri, Dec 11th 2015 9:31am — Tim Cushing

Another terrorist attack (this one thwarted) has renewed calls for private companies to work more closely with law enforcement and intelligence agencies.

The pair were arrested in counter-terror raids in Sydney’s west yesterday with police saying they and three other conspirators were involved in “formulating documents connected with preparations to facilitate, assist or engage a person to undertake a terrorist act”.

The group of alleged extremists used handwritten notes to plot a Sydney attack in a bit to circumvent police and ASIO surveillance, The Australian reports.

The scrawled messages circulating between the group allegedly detailed the an attack on a government building, believed to be the AFP’s Sydney headquarters.

FBI Director James Comey has spent the last several months expressing his concern that criminals and terrorists are eluding justice by using off-the-shelf products offered by manufacturers nationwide -- paper, pens, shredders, trash cans, etc.*

"We aren't seeking anything more than what we've always been able to obtain with court orders, subpoenas and warrants. But now, this information is unavailable to us, thanks to decisions being made by some very smart people who have, for whatever reason, decided to start supplying their customers with these items."

Comey acknowledged that a legislated ban on these items is highly unlikely, but pointed out that the lack of access to handwritten notes was on its way to becoming a day-to-day occurrence for law enforcement.

"The reality is that terrorist plots are going to be carried out, kids are going to be kidnapped and to-do lists are going be executed -- and law enforcement will be locked out. We go to Georgia-Pacific, Bic or Royal with a warrant and we still can't obtain the communications we're seeking because these companies have decided to allow their customers to use a destructible form of communication."

Addressing his critics, Comey coldly noted that approaching third parties for access to these communications has also been a dead end.

"We've sought the assistance of Staples, Office Depot and other office supply retailers, but have been stymied completely by the incredulous laughter of their legal representatives, along with their demands to know whether 'we're serious' and 'Where's the camera? Is this one of those punk'd shows?'"

Comey again expressed his belief that a solution is out there, but it takes law enforcement and nation's top office supply companies working together.

"There are some very smart people running these companies and I think if they were willing to apply themselves to the problem, they could come up with a solution."

The administration has less-than-firmly stated that it won't look into mandating the elimination of this communication method. Congress has similarly shown little support for Comey's quest to achieve the impossible.

But some long-time supporters of the NSA -- along with presidential candidates who believe everything the AP prints -- are calling for more extreme measures to be taken in response to recent terrorist attacks.

Sen. Tom Cotton, Marco Rubio and a handful of others are touting a plan for mandatory internet usage.

"Extremists and terrorists are hiding behind pen-and-paper while carrying out their violent plans. This is unacceptable. If the nation is going to be secure, citizens and non-citizens residing in the US should be required to use internet-based communication methods, preferably of the unencrypted variety."

Comey agreed that something must be done to prevent today's criminals from "going looseleaf." The key, he says, is no longer in the government's hands. It's in the hands of private companies, who he feels are more interested in their bottom line than a secure nation.

"It's not a security issue. It's a business model issue," Comey said, adding that customers should pressure companies into abandoning the production of these archaic items. "In a world where iPad-like devices are as prevalent as National Security Letters, it makes no sense for the Hammermills of the nation to continue to offer archaic communication methods."

*Just in case it wasn't obvious, nothing in the above post actually happened other than the thwarted terrorist attack in which the suspects used handwritten notes to avoid surveillance. They also used text messages, which was (part of) their downfall. But arguments against encryption because some bad people use it are no different than arguments against pen/paper, which also helps bad people avoid the scrutiny of law enforcement.

Filed Under: encryption, going dark, james comey, paper, pencil, terrorism

76 Comments

WaPo's Excellent Explainer On Encryption Debunks WaPo's Stupid Editorial In Favor Of Encryption Backdoors

Journalism

from the hey,-you-guys-should-talk! dept

Wed, Dec 9th 2015 2:43pm — Mike Masnick

Washington Post reporter Andrea Peterson has put together a really excellent explainer piece on what you should know about encryption. Considering the source, it's a good "general knowledge" explainer piece for people who really aren't that aware of encryption or technically savvy. That's important and useful, given how important this debate is and how many participants in it don't seem to understand the first thing about encryption. But what struck me is this little tidbit:

Can the government stop terrorists from using encryption?

Well, no. The most the government can probably do is bar companies from offering the most secure forms of encryption to their users. But encryption isn't just one product. Just like the math it's based on, it's really more of a concept or an idea rather than a specific technical tool.

And it's pretty impossible to outlaw ideas.

It goes on, in some depth, to explain just what a stupid idea it would be to outlaw end-to-end encryption, noting that there are lots of non-US companies and plenty of open source offerings for encryption that would still be widely available and used.

Now, compare that to the ridiculous editorial that the Washington Post put out a year ago, advocating for just such a solution:

How to resolve this? A police “back door” for all smartphones is undesirable — a back door can and will be exploited by bad guys, too. However, with all their wizardry, perhaps Apple and Google could invent a kind of secure golden key they would retain and use only when a court has approved a search warrant. Ultimately, Congress could act and force the issue, but we’d rather see it resolved in law enforcement collaboration with the manufacturers and in a way that protects all three of the forces at work: technology, privacy and rule of law.

Hey, Washington Post editorial board, I hope you read your own newspaper.

Filed Under: andrea peterson, backdoors, encryption, going dark, golden key
Companies: washington post

27 Comments

<< Newer Stories

Older Stories >>

Follow Techdirt

Essential Reading

The Techdirt Greenhouse

Read the latest posts:

read all »

Techdirt Deals

Report this ad | Hide Techdirt ads

Techdirt Insider Discord

The latest chatter on the Techdirt Insider Discord channel...

Older Stuff

Monday
09:31	Washington Post Forgets It Fought (And Won) Legal Battle Against Mandatory Transparency; Now Demands Internet Co's Face The Same (18)
06:35	Cable Giant Spectrum Endangered Its Employees And Screwed Its Technicians During COVID (15)
Sunday
12:00	Funniest/Most Insightful Comments Of The Week At Techdirt (5)
Saturday
12:00	This Week In Techdirt History: November 21st - 27th (7)
Friday
09:00	Non-Fungible T-Shirts, And Other New Gear From Techdirt (10)
08:55	Daily Deal: Black Friday Roundup (0)
Thursday
09:00	Get A Beautiful Open Syllabus Poster To Support Techdirt And The Open Syllabus Project (5)
08:55	Daily Deal: The Stellar Utility Software Bundle (0)
Wednesday
19:39	The Next 'Elder Scrolls' Game Will Be A PC, Xbox Exclusive (45)
15:31	Content Moderation Case Studies: Facebook Suspends Account For Showing Topless Aboriginal Women (2016) (20)
13:39	No Immunity For Cops Who Used A Field Drug Test To Turn Stress Ball Sand Into Cocaine (23)
12:05	Texas Gas Companies Hit Texas Consumers With 'Whoops You Froze To Death' Surcharge (68)
10:44	Company Promises 'Seamless Parking Experience' In Exchange For The Permission To Track App Users All Over The Internet (29)
10:39	Daily Deal: VidToon 2.0 Animated Video Maker (1)
09:31	Why Are Drug Prices So High? Because Asshole McKinsey Consultants Figure Out Ways To Re-Patent The Same Drugs Over And Over (39)
06:36	Biden FCC Green Lights Yet More Telecom Consolidation With Verizon Tracfone Merger (5)
03:30	Helicopter Footage Obtained By The ACLU Shows Pervasive Surveillance Of Peaceful Anti-Police Violence Protests (43)
Tuesday
19:47	BookTok Shows How Fans Can Power Sales; Imagine What Could Be Done Without Copyright Anxiety (10)
15:48	NSO Made Millions Selling Phone Hacking Tools To The Princes And Kings Of The United Arab Emirates (5)
13:30	Techdirt Podcast Episode 306: Lessons From The First Internet Ages (2)
12:05	Lots Of Big Media Companies Had Access To The Facebook Files; Only Gizmodo Decided To Put In The Work To Make Them Public (8)
10:56	South Korean Gov't Gave Millions Of Facial Photos Collected At Airports To Private Companies (2)
10:51	Daily Deal: Speakly (0)
09:26	Ridley Scott Blames His Latest Movie Bombing At The Box Office On Facebook And Millennials, Rather Than Pandemic And Poor Marketing (86)
06:25	FAA Blocks 5G Deployments Over Safety Concerns Despite No Actual Evidence Of Harm (31)
03:25	Baltimore Police Department Sued For Seizing Phones, Cash, And Jewelry From Crime Victims Recovering From Shootings (19)
Monday
20:02	NYPD Continues To Screw Over Its Oversight By Denying Access To Bodycam Footage (14)
15:41	Rock Band Doomscroll Has Trademark App Opposed By id Software (17)
13:34	More Than 100 Hertz Customers Are Suing The Company For Falsely Reporting Rented Vehicles As Stolen (31)
12:09	Hikvision's Director Of Cybersecurity And Privacy Says IoT Devices With Backdoors 'Can't Be Used To Spy On Companies, Individuals Or Nations' (14)

Senator Tom Cotton Slams Apple CEO Tim Cook For Protecting User Privacy; Demonstrates Pure Ignorance Of The Law

from the this-is-who-we-elect? dept

Blackberry CEO Gives Public One More Reason To Not Buy Its Phones By Arguing For Greater Law Enforcement Cooperation

from the the-greater-good-is-apparently-whatever-the-government-says-it-is dept

Hillary Clinton Wants A 'Manhattan Project' For Encryption... But Not A Back Door. That Makes No Sense

from the politics-is-dumb dept

Juniper Reveals 'Unauthorized Code' That Decrypts VPN Connections

from the let-the-speculation-begin dept

Congressman Who Supports Undermining Encryption Says We Need CISA (Which Undermines Privacy) To 'Protect Privacy'

from the up-is-down,-black-is-white,-day-is-night dept

No, Strong Crypto Is Not Making The World 'Go Dark' For Intelligence Agencies: Here's Why

from the don't-be-afraid-of-the-dark dept

Clueless Press Being Played To Suggest Encryption Played A Role In San Bernardino Attacks

from the gotta-try dept

French Prime Minister Says Government Not Considering Banning Open WiFi, Tor Connections

from the that-proposed-encryption-ban,-tho dept

FBI Director Says 'Smart People' At Office Supply Companies Can Help Limit Terrorists' Access To Pen And Paper

from the also-has-concerns-about-auto-manufacturers-offering-locking-trucks-by-default dept

WaPo's Excellent Explainer On Encryption Debunks WaPo's Stupid Editorial In Favor Of Encryption Backdoors

from the hey,-you-guys-should-talk! dept

The Techdirt Greenhouse

Monday

Sunday

Saturday

Friday

Thursday

Wednesday

Tuesday

Monday

More

Tools & Services

Company

Contact

More

from the this-is-who-we-elect? dept

from the the-greater-good-is-apparently-whatever-the-government-says-it-is dept

from the politics-is-dumb dept

from the let-the-speculation-begin dept

from the up-is-down,-black-is-white,-day-is-night dept

from the don't-be-afraid-of-the-dark dept

from the gotta-try dept

from the that-proposed-encryption-ban,-tho dept

from the also-has-concerns-about-auto-manufacturers-offering-locking-trucks-by-default dept

from the hey,-you-guys-should-talk! dept

Techdirt Daily Newsletter

The Techdirt Greenhouse

Tools & Services

Company

Contact

More