Things The Intelligence Community Is Cool With: Backdoor Searches, Skirting Reporting Requirements, Parallel Construction

from the it's-pretty-clear-the-FBI-needs-more-direct-oversight dept

More answers have been provided to Senate Intelligence Committee questions (most of those penned by the always-inquisitive Ron Wyden) by the Office of the Director of National Intelligence. Some, like how often the NSA "incidentally" collects domestic communications, remain unanswered. But the ODNI's answers [PDF] -- given to the Committee in July -- have finally been made public. There are a few things worth noting in this rare display of transparency. (By which I mean a lack of redactions, rather than expansive openness by the ODNI).

To begin with, the ODNI argues the new amicus position created by the USA Freedom Act is harmful to national security. Its theory? Any delays caused by the introduction of some semblance of an adversarial process only slows the NSA down.

The appointment of an amicus curiae is not without effect. Notably, it is likely to increase the time needed for the government to obtain the authorities it is seeking. For instance, in 2015 when the FISC appointed an amicus curiae in connection with its review of the Section 702 certifications, the Court ultimately extended the time for its consideration of the 2015 Section 702 certifications by 90 days, issuing an opinion and order approving those certifications more than two months alter the statute otherwise would have required. As the government noted at that time, such a delay could be harmful to national security under certain scenarios, for instance if the government were to submit an additional certification or make an important time sensitive change in the Section 702 targeting or minimization procedures.

This sounds a lot like law enforcement's continual annoyance at warrant requirements. Respecting things like the Fourth Amendment and the idea of checks and balances just takes too long -- even when it means spending a hour trying to talk someone into granting consent for a search, rather than phoning a judge to get a warrant sworn out. The ODNI's complaint is, basically, it doesn't want anyone arguing for the rights of Americans (who get swept up in collections and deliberately targeted by the FBI) or on behalf of the rest of the world the NSA views as little more than a prolific source of data.

Wyden also wanted to know who's allowed to unmask US persons in NSA collections. The ODNI answered "any authorized recipient" of NSA intelligence, which hardly answers the question. Drilling it down a little further, the ODNI noted it has 20 individuals in the NSA who can authorize unmasking. There are doubtless many more in the FBI, which can use 702-derived collections to search for evidence of nearly any criminal activity or just browse stuff if it can be argued the information is already "publicly available." The decision to unmask US persons in the FBI is left to "agents and analysts" conducting "fully predicated investigations."

As for its all-but-abandoned duties to inform defendants of the use of Section 702-derived evidence, the ODNI explained it will almost never have to do this because of parallel construction.

As we have publicly stated previously, the Department has concluded that in determining whether information is "derived from" FISA-authorized surveillance, including Section 702, the appropriate standards and analyses are similar to those applied in the context of surveillance conducted pursuant to the criminal Wiretap Act, Title of the Omnibus Crime Control and Safe Streets Act of 1968, 18 U.S.C. 2510-2522. As such, the "derived from" standard incorporates a "fruit of the poisonous tree" analysis analogous to that conducted under the Fourth Amendment exclusionary rule context. The general question under a "fruits" analysis is whether the evidence was acquired as an indirect result of the surveillance, taking into account doctrines such as independent source, inevitable discovery, and attenuation.

In other words, if there's any way the government could have conceivably obtained this evidence -- rather than the way it actually did it -- the DOJ can bypass its notification obligations.

As for the number of times Intelligence Community components access purely domestic communications -- either directly or "incidentally" -- the ODNI is nowhere closer to providing the numbers explicitly requested by Sen. Wyden on multiple occasions or fulfilling the reporting requirements of USA Freedom Act.

The ODNI claims one recipient of 702 data (the CIA) "does not currently have the technical capability" to track these numbers. According to the ODNI, this capability won't be up and running until the end of 2018. The ODNI goes on to point out the FBI performs no internal tracking of its 702 searches/queries and makes no statement suggesting the agency is even looking into providing these numbers. The NSA, however, performed 30,355 "queries" on US persons' data, using 2,280 "approved" search terms.

The ODNI also explains the difference between a "query" and a "search" in reference to accessing unminimized domestic data and communications. A "query" flags relevant data in existing collections. A "search" actually looks at the contents of communications. In both cases, the ODNI says no warrant is needed. If the domestic communications are swept up lawfully (as part of a FISA-ordained collection), there's no Fourth Amendment violation when content is accessed by a "search." The legal rationale is that the Fourth Amendment is adhered to during the collection process, so it cannot possibly be violated when the collections are accessed by the FBI, NSA, CIA or other IC component.

Wyden's long-running question about incident collection of US persons communications remains unanswered. Questions about the FBI's prolific use of NSA data have been answered with a shrug. The DOJ has been given a pass on its evidence source obligations and IC components have multiple ways of search foreign-facing collections for US persons communications and data, all while supposedly upholding Fourth Amendment ideals. These are the powers the ODNI wants to see renewed for several years with zero changes to the status quo and, given the looks of surviving legislation, its wishes might come true.

Filed Under: backdoors, nsa, odni, parallel construction, reporting, ron wyden, surveillance

Intelligence Director Says Gov't Can Demand Encryption Backdoors Without Having To Run It By The FISA Court

from the keeping-secrets-from-the-secret-court dept

A set of questions from Senator Ron Wyden -- directed at the Office of the Director of National Intelligence -- have finally received answers. The answers [PDF] were actually given to the Senate oversight committee in July but have just now been made public.

Zack Whittaker of ZDNet has taken a look at the answers the ODNI provided and found something that indicates the government can not only compel the creation of backdoors, but can do so without explicit approval from the FISA court.

The government made its remarks in July in response to questions posed by Sen. Ron Wyden (D-OR), but they were only made public this weekend.

The implication is that the government can use its legal authority to secretly ask a US-based company for technical assistance, such as building an encryption backdoor into a product, but can petition the Foreign Intelligence Surveillance Court (FISC) to compel the company if it refuses.

In its answers, the government said it has "not to date" needed to ask the FISC to issue an order to compel a company to backdoor or weaken its encryption.

The government would not say, however, if it's ever asked a company to add an encryption backdoor.

The way this process works is the agency requesting the backdoor or other compelled assistance runs the request by the FISA court. This process does not ask the FISA court to approve the method used, nor does it provide the court with details on the assistance sought. All the FISC determines is whether or not compelled assistance is necessary.

The ODNI maintains it has never asked for compelled decryption or the installation of backdoors… at least not under this authority. If it has, there'd be little in the way of a paper trail to prove it. The FBI, as part of the Intelligence Community, appears to be more interested in securing the help of US courts -- something that would prove far more useful in the long run, considering its domestic focus.

This information comes at a critical time. The surveillance wing of the government wants Section 702 (and related authorities) renewed at the end of this year -- unaltered and with at least a half-decade before the next chance of reform. So far, its two Congressional oversight bodies have been compliant with the IC's wishes. Serious reform efforts have been dumped by both House and Senate judiciary committees, leaving only those authored by longtime surveillance state cheerleaders in the running. With limited oversight and an easy way to route around FISA roadblocks, Section 702 reform is badly needed if we have any hope of the next decade being less filled with Fourth Amendment violations than the last one.

Filed Under: backdoors, compelled assistance, encryption, fisa court, fisc, odni, ron wyden

German Government Official Wants Backdoors In Every Device Connected To The Internet

from the bring-back-the-old-Germany-we-know-and-hate! dept

The US Department of Justice is reviving its anti-encryption arguments despite not being given any signals from the administration or Congress that undermining encryption is something either entity desires. The same thing is happening in Germany, with Interior Secretary Thomas de Maizière continuing an anti-encryption crusade very few German government officials seem interested in joining.

The key difference in de Maizière's push is that he isn't limiting potential backdoors to cell phones. He appears to believe anything connected to the internet should be backdoored… possibly even the cars German citizens drive. (h/t Riana Pfefferkorn)

The RedaktionsNetzwerk Deutschland (RND) reported that Thomas de Maizière had written up a draft proposal for the interior minister conference, taking place next week in Leipzig, which he has called “the legal duty for third parties to allow for secret surveillance.”

According to the RND, the proposal would “dramatically extend” the state’s powers to spy on its citizens.

And it's not just backdoors being suggested. De Maizière wants all electronics to be law enforcement-complicit. All things -- especially those connected to the internet -- should be constructed with government access in mind.

For example, the modern locking systems on cars are so intelligent that they even warn a driver if their car is shaken a little bit. De Maizière wants the new law to ensure that these alerts would not be sent out to a car owner if the police determined it to be justified by their investigation.

De Maizière wants the government to be able to intercept and block notifications sent from cars to the people that own them. But it's far more than smarter cars being compromised on behalf of the government. If de Maizière gets his way, it will be every connected device everywhere.

De Maizière also wants the security services to have the ability to spy on any device connected to the internet. Tech companies would have to give the state "back door" access to private tablets and computers, and even to smart TVs and digital kitchen systems.

It's rare for government officials to blatantly state citizens should be under surveillance at all times. Craftier politicians tend to use less direct rhetoric, even if they aspire to the same goals. This blatant call for mass surveillance of millions of innocent people has provoked a reaction from de Maizière's colleagues, although probably not the one he was looking for.

The proposal was met with astonishment by digital activists and politicians on Friday.

De Maizière seems blissfully unaware Germany was once home to a powerful dictator who killed millions of his own citizens while deploying a secret police force. And once that period ended, part of Germany rolled directly into a program of intense domestic surveillance utilizing the Stasi -- one of the most brutally effective secret police forces ever wielded by a government against its own people. De Maizière's proposal is so tone deaf -- given the history of the nation he serves -- it's tempting to believe he's an under-recognized satirist. But de Maizière seems completely serious. Fortunately for Germans, no one else seems to take de Maizière quite as seriously as he does.

Filed Under: backdoors, encryption, germany, iot, privacy, surveillance, thomas de maiziere

DOJ Continues Its Push For Encryption Backdoors With Even Worse Arguments

from the let-us-save-you-from-your-security dept

Early last week, the Deputy Attorney General (Rod Rosenstein) picked up the recently-departed James Comey's Torch of Encroaching Darkness +1 and delivered one of the worst speeches against encryption ever delivered outside of the UK.

Rosenstein apparently has decided UK government officials shouldn't have a monopoly on horrendous anti-encryption arguments. Saddling up his one-trick pony, the DAG dumped out a whole lot of nonsensical words in front of a slightly more receptive audience. Speaking at the Global Cyber Security Summit in London, Rosenstein continued his crusade against encryption using counterintuitive arguments.

After name-dropping his newly-minted term -- responsible encryption™ -- Rosenstein stepped back to assess the overall cybersecurity situation. In short, it is awful. Worse, perhaps, than Rosenstein's own arguments. Between the inadvertently NSA-backed WannaCry ransomware, the Kehlios botnet, dozens of ill-mannered state actors, and everything else happening seemingly all at once, the world's computer users could obviously use all the security they can get.

Encryption is key to security. Rosenstein agrees… up to a point. He wants better security for everyone, unless those everyones are targeted by search warrants. Then they have too much encryption.

Encryption is essential. It is a foundational element of data security and authentication. It is central to the growth and flourishing of the digital economy. We in law enforcement have no desire to undermine encryption.

But “warrant-proof” encryption poses a serious problem.

Well, you can't really have both secure encryption and law enforcement-friendly encryption. Rosenstein knows this just as surely as Comey knew it. That didn't stop Comey from pretending it was all about tech company recalcitrance. The same goes for Rosenstein who, early on in his speech, plays a shitty version of Sympathy for the Tech Devil by using the phrase "competitive forces" as a stand-in for "profit seeking" when speaking about the uptick in default encryption.

The underlying message of his last speech was that American tech companies should spurn profits for helping out the government by unwrapping one end of end-to-end encryption. The same pitch is made here, softened slightly in the lede thanks to the presence of UK tech companies in the audience. The language may be less divisive, but the arguments are no less stupid this time around.

In the United States, when crime is afoot, impartial judges are responsible for balancing a citizen’s reasonable expectation of privacy against the interests of law enforcement. The law recognizes that legitimate law enforcement needs can outweigh personal privacy concerns. That is how we obtain search warrants for homes and court orders to require witnesses to testify.

Warrant-proof encryption overrides our ability to balance privacy and security. Our society has never had a system where evidence of criminal wrongdoing was impervious to detection by officers acting with a court-authorized warrant. But that is the world that technology companies are creating.

I'm not sure what this "system" is Rosenstein speaks about, but there has always been evidence that's eluded the grasp of law enforcement. Prior to common telephone use, people still communicated criminal plans but no one insisted citizens hold every conversation within earshot of law enforcement. Even in a digital world, evidence production isn't guaranteed, even when encryption isn't a factor.

Going on from there, the rest of speech is pretty much identical to his earlier one. In other words: really, really bad and really, really wrong.

Rosenstein believes the government should be able to place its finger on the privacy/security scale without being questioned or stymied by lowly citizens or private companies. Even if he's right about that (he isn't), he's wrong about the balance. This isn't privacy vs. security. This is security vs. insecurity. For a speech so front-loaded with tales of security breaches and malicious hacking, the back end is nothing more than bad arguments for weakened encryption -- something the government may benefit from, but will do nothing to protect people from malicious hackers or malicious governments.

All the complaints about a skewed balance are being presented by an entity that's hardly a victim. Electronic devices -- particularly cellphones -- generate an enormous amount of data that's not locked behind encryption. The government can -- without a warrant -- track your movements, either post-facto, or with some creative paperwork, in real time. Tons of other "smart" devices are generating a wealth of records only a third party and a subpoena away. And that's just the things citizens own. This says nothing about the wealth of surveillance options already deployed by the government and those waiting in the wings for the next sell off of civil liberties

It also should be noted Rosenstein is trying to make "responsible encryption" a thing. He obviously wants the word "backdoor" erased from the debate. While it's tempting to sympathize with Rosenstein's desire to take a loaded word out of the encryption debate lexicon, the one he's replacing it with is worse. As Rob Graham at Errata Security points out, the new term is loaded language itself, especially when attached to Rosenstein's bullshit metric: "measuring success in prevented crimes and saved lives."

I feel for Rosenstein, because the term "backdoor" does have a pejorative connotation, which can be considered unfair. But that's like saying the word "murder" is a pejorative term for killing people, or "torture" is a pejorative term for torture. The bad connotation exists because we don't like government surveillance. I mean, honestly calling this feature "government surveillance feature" is likewise pejorative, and likewise exactly what it is that we are talking about.

Then there's the problem with Rosenstein deploying rhetorical dodges in his discussions about encryption, which presumably include a number of government officials. Alex Gaynor, who worked for the United States Digital Service and participated in the Obama Administration's discussion of potential encryption backdoors, points out Rosenstein's abuse of his position.

Mr. Rosenstein plainly wants to reopen the "going dark" debate that began under the previously administration, spearheaded by FBI Director Jim Comey. While I disagree vehemently with him, it's a valid policy position - and I have every reason to believe him that there are investigations in which encryption does hamper the Justice Department and FBI's ability to investigate. However, he is not entitled to mislead the public in order to make that point. And make no mistake. Attempting to use the spectre of familiar computer security challenges in order to make the argument that his policy is necessary, even though his policy has nothing to do with these challenges, is the height of intellectual dishonesty.

There's an endgame to Rosenstein's dishonest rhetoric. And it won't be tech companies being guilted into participating in his "responsible encryption" charade. It will be backdoors. And they will be legislated.

The Deputy Attorney General says that he is interested in "frank discussion". However, his actual remarks demonstrate he is interested in anything but -- his goal is to secure legislation akin to CALEA for your cellphone, and he doesn't care who he has to mislead to accomplish this. Mr. Deputy Attorney General, I expect better.

This is what the DOJ wants. But Rosenstein is too weak-willed to say it out loud. So he spouts this contradictory, misleading, wholly asinine garbage to whatever audience will have him. Rosenstein is obtuse enough to be dangerous. Fortunately, most legislators (so far) seem unwilling to sacrifice the security of citizens on the altar of lawful access.

Filed Under: backdoors, doj, going dark, james comey, nerd harder, responsible encryption, rod rosenstein

WhatsApp Reportedly Rejected UK Government Demand For Encryption Backdoor

from the under-pressure dept

The UK government has apparently already asked WhatsApp to provide it with an encryption backdoor, according to Sky News. The app developers were told they needed to come up with a way to give law enforcement access to message content but WhatsApp politely declined the probably not-all-that-polite "request."

That doesn't mean WhatsApp doesn't have anything it can give the government when it comes asking.

Sky News understands that WhatsApp co-operates with law enforcement to provide the metadata it does hold - the name of an account, when it was created, the last seen date, the IP address and associated email address.

WhatsApp says it "appreciates the work that law enforcement agencies do to keep people safe around the world. We are prepared to carefully review, validate and respond to law enforcement requests based on applicable law and policy".

But it does point out it can't give law enforcement what it doesn't actually have.

[T]he company argues that it can't provide data that WhatsApp itself does not collect in the first place, including the contents of a message.

Encryption didn't seem to be much of an issue in many recent terrorist attacks, but its use is undoubtedly on the rise. It's unclear what the government showed or told Sky News, but this assertion seems dubious at best.

Sky News understands that 80% of investigations into terrorism and serious crime are now impacted by encryption.

As is the case over here, law enforcement officials are arguing WhatsApp and other encrypted message services should sacrifice user security for the good of the government. While cybersecurity experts continue to point out the nonexistence of backdoored-but-secure unicorns, intelligence officials continue to assert it can be done. All that needs to happen is for messaging services to make their products a little bit less safe.

UK intelligence officials believe a compromise could be possible - pointing out that cybersecurity isn't binary and that services offer different levels of cybersecurity to deal with different levels of threats.

WhatsApp is unlikely to budge on its backdoor rejection, leaving it with the real possibility of exiting the UK market if the government turns its requests into encryption-targeting law. And, as the UK goes, so goes Australia. The Australian government has been echoing the anti-encryption rumbling of Theresa May and other officials, indicating it too would like encrypted services to not be quite so encrypted.

It's not as though UK law enforcement/intelligence services don't have lawful options if WhatsApp refuses to budge. As cryptography expert Riana Pfefferkorn points out, there's more that can be done, even if it won't be as easy as firing off a warrant.

Riana Pfefferkorn, a cryptography policy fellow at Stanford University, said she sees a legal battle coming if the UK continues to force the issue, but she doesn't necessarily think the UK wants that fight.

If courts determine that the Investigatory Powers Act is too broad, the public defeat in their fight against encryption would be a lot for the UK to overcome. Instead, Pfefferkorn said the government might just try hacking for the information they want, a power that the IP Act also allows.

"There are other avenues they can take to try to achieve the same end," she said.

For now, WhatsApp message content is still out of reach of everyone but users engaged in conversation. Metadata and lawful hacking are still in play, even though most officials prefer an easier route. If pressure continues to mount, WhatsApp may exit markets rather than compromise its users. As much as intelligence officials may believe cybersecurity to be something other than "binary," the companies they're applying pressure to really only have two choices: give in to the government or exit market left. Neither are palatable options.

Filed Under: backdoors, communications, encryption, uk
Companies: whatsapp

UK Home Secretary Doesn't Want Backdoors; She Just Wants Companies To Stop Offering Encryption Because No One Wants It

from the insanity-plea dept

UK Home Secretary Amber Rudd, perhaps now most famously known for not knowing the "necessary hashtags," is back to beating up on encryption because it (no citation provided) helps terrorists get away with terrorism. Her op-ed piece for The Telegraph begins as so many pleas to undermine encryption do: with the horrors perpetrated by terrorists. Only now, the parade of horrors tends to sound something like a "CSI: Cyber" exposition outtake.

Nearly every plot we uncover has a digital element to it. Go online and you will find your own “do-it-yourself” jihad at the click of a mouse. The tentacles of Daesh (Isil) recruiters in Syria reach back to the laptops in the bedrooms of boys – and increasingly girls – in our towns and cities up and down the country. The purveyors of far-Right extremism pump out their brand of hate across the globe, without ever leaving home.

The scale of what is happening cannot be downplayed. Before he mowed down the innocents on Westminster Bridge and stabbed Pc Keith Palmer, Khalid Masood is thought to have watched extremist videos. Daesh claim to have created 11,000 new social media accounts in May alone. Our analysis shows that three-quarters of Daesh propaganda stories are shared within the first three hours of release – an hour quicker than a year ago.

An hour quicker! In internet time, that's practically a millennium. It's tough to tell what Rudd's attempting to make of this technobabble. Is she suggesting future Masoods will act quicker because they'll be able to complete their viewing of extremist videos faster? If that's the case, maybe regulators need to step in and throttle broadband connections. The more the video buffers, the less likely it is someone will watch it… and the less likely it is someone will carry out an attack. The math(s) work out.

Unfortunately, this is not where the op-ed is heading. Sadly, Rudd is here to take a swing at encryption. But she takes a swing at it in prime passive-aggressive, Ike Turner-style, saying she loves it even as the blows rain home.

Encryption plays a fundamental role in protecting us all online. It is key to growing the digital economy, and delivering public services online.

I ain't mad at ya.

But, like many powerful technologies, encrypted services are used and abused by a small minority of people. The particular challenge is around so called “end-to-end” encryption, where even the service provider cannot see the content of a communication.

But you mess me up so much inside.

To be very clear – Government supports strong encryption and has no intention of banning end-to-end encryption. But the inability to gain access to encrypted data in specific and targeted instances – even with a warrant signed by a Secretary of State and a senior judge – is right now severely limiting our agencies’ ability to stop terrorist attacks and bring criminals to justice.

In a fun twist, Rudd doesn't call for harder nerding. (Note: Rudd is visiting Silicon Valley to meet with tech leaders, so it's safe to assume requests for harder nerding will be made, even if not directly in this op-ed.)

No, Rudd doesn't want the impossible: secure, backdoored encryption. Instead, she wants to know if tech companies will just take the encryption off one end of the end-to-end. Her bolstering argument? The public doesn't give a shit about encryption. It just wants easy-to-use communication tools.

Real people often prefer ease of use and a multitude of features to perfect, unbreakable security. So this is not about asking the companies to break encryption or create so called “back doors”. Who uses WhatsApp because it is end-to-end encrypted, rather than because it is an incredibly user-friendly and cheap way of staying in touch with friends and family? Companies are constantly making trade-offs between security and “usability”, and it is here where our experts believe opportunities may lie.

Having set up her straw app user, Rudd moves towards her conclusion… which is severely lacking in anything cohesive or coherent. The "opportunities" lie in persuading tech companies to provide users with less secure communications platforms. Should be an easy sale, especially if the average user doesn't care about security. But maybe the company does and doesn't want to give bad people an easy way to access the communications of others. Hence encryption. Hence end-to-end, so even if the provider is breached, there's still nothing to access.

What Rudd is looking for can't be called a trade-off. The government has nothing tech companies want. All they can offer is platitudes about fighting crime and national security. The government, meanwhile, wants tech companies to write software the way the government wants it, rather than how the company or its users want it. That's not a trade-off. That's a one-way street where every internet communication platform becomes a proxy government agency.

Rudd's idea is bad and she should feel bad. But I get the feeling that no matter how many tech experts she talks to, she's still going to believe her way is the right and best way.

Filed Under: amber rudd, backdoors, encryption, fud, terrorism, uk

Moving Beyond Backdoors To Solve The FBI's 'Going Dark' Problem

from the though-it-seems-the-FBI-should-be-doing-more-to-solve-it... dept

Former FBI Director James Comey stated on more than one occasion that he'd like to have an "adult conversation" about device encryption. He wasn't sincere. What he actually meant was he'd like to have all the "smart people" in the tech world solve his problems for him, either by capitulating to his requests for encryption backdoors or by somehow crafting the impossible: a secure backdoor.

Comey is gone, but his legacy lives on. The FBI wants to keep the "going dark" narrative alive. Deputy Attorney General Rod Rosenstein has already asked Congress for $21 million in "going dark" money, supposedly to help the agency explore its options.

The problem is, the options could be explored for a much lower price. Kevin Bankston offers up a few solutions -- or at least a few improved adult conversational gambits -- for the low price of $free over at Lawfare. The starting point is Comey's "adult conversation" talking point. Bankston points out you can't hold an adult conversation if you refuse to act like one.

Recently in Slate I responded to Comey’s repeated calls for an “adult conversation” on this seemingly endless debate. I replied that an “adult conversation” means moving past any discussion of discouraging or undermining the deployment of unbreakable encryption, in light of the broad consensus outside of the FBI that such a move would be dangerously bad policy. Rather than continuing to argue about whether or how we might force encryption technology to adapt to law enforcement’s needs, our time would be better spent focusing on how we can help law enforcement adapt to the technology.

This is a point many have tried to make, but Comey refused to listen. Let's stop talking about crafting magical backdoors and accept the fact it just isn't possible. Once this is accepted, everyone can move on. Plenty of options remain for law enforcement and, with the exception of the usual post-terrorist attack calls for backdoors, no one is really pushing backdoor legislation. Legislators are well-aware of the fact that weakening encryption causes far more problems than it solves and asks citizens to sacrifice their safety and security for the good of the nation a single federal law enforcement agency.

Bankston moves the discussion forward by discussing three areas the FBI could explore. The first involves lawful device hacking, which uses exploits and/or external hardware/software to access the content of locked devices. This sounds more nefarious than it actually is (vulnerability disclosure concerns aside). Basically, this just means doing what the FBI did to open up the iPhone seized in the San Bernardino shooting case.

The main problem Comey had with this approach is that it wouldn't scale. But that's kind of the point.

[T]he objection that hacking will never give law enforcement as much access as would a backdoor into or a ban on user-controlled encryption misunderstands the problem we’re trying to solve. The societal goal here is not to ensure that law enforcement can access every piece of data it might ever seek, but that it can get enough information to do its job, and hacking is certainly a part of the solution.

This route also involves legislation, both to define the limits of lawful hacking as well as to act as oversight for these activities. Obviously, both of these are things Congress doesn't do all that well: oversight and writing computer laws. So, there will be concerns that need to be addressed, but hacking is a far better solution than legislated backdoors or judicial precedent that does the same thing by allowing a 1789 law to govern access to smartphones and other locked devices.

Another key area Bankston addresses is the tech curve itself. Law enforcement often laments it's losing the Tech War to the bad guys. It's not as though this needs to be a foregone conclusion. Criminal minds are rarely the brightest minds. Even though the same could be said for law enforcement minds, the good guys do have a distinct advantage: the ability to coordinate talent and expertise for the benefit of all agencies. That, and a mostly cooperative bunch of tech companies that still want to help the good guys beat the bad guys.

Another key aspect of upping government investigators’ tech game is making sure that they all know exactly what data they can lawfully obtain from internet companies today, without any new technical mandates. That means we need companies to step up and educate law enforcement and everyone else about the data they have—all of it, and not just the data they typically offer as matter or course in response to legal process.

It's not like there's only one path to data and communications stored on a suspect's phone. Almost everything is backed up somewhere else by service providers. Concerns about users' privacy will need to be addressed by everyone involved, starting with a revamping of the Third Party Doctrine. But tech companies will also need to be more honest with their customers, letting them know exactly what's being stored outside of their devices and what law enforcement needs to have (warrant, subpoena, etc.) before the company turns over information.

[C]omprehensive transparency to law enforcement and the public about what data the companies are creating and storing is the only way that policymakers or the market will ever be able to enforce any real accountability over those practices, and I think (or at least hope) that the overall benefit to consumers’ privacy from that accountability will balance out the harmful effects of giving the government a full menu of data.

The final aspect Bankston addresses is obtaining data and communications stored overseas. Much of this is academic now that jurisdiction limitations have been removed by the recent Rule 41 changes. Unfortunately, there's little positive to note here. Mutual assistance treaties take too long to be of much use (6-12 months for compliance) and there being little direct translation of civil liberties between participating countries makes this even more difficult.

Unfortunately, as Bankston points out, American exceptionalism doesn't seem to be working out in our favor. It appears President Trump is trying to work out an exclusive deal with the UK to make this process easier. But "easier" just means more collateral damage to civil liberties and privacy on both sides of the pond. This may work in law enforcement's favor, but it's hardly the best solution to "going dark," seeing as it ignores 99% of the stakeholders (citizens) to give each government what it wants.

The answers aren't easy and they will involve compromises not everyone will be happy with. But it's far better than taking the FBI's approach, which appears to be demanding concessions from every tech company it might have to deal with. The discussion does need to push forward, with or without the FBI's input. It can't stay hung up where it is now, due to Comey's stubborn refusal to ask for anything but the impossible.

Filed Under: backdoors, encryption, fbi, going dark

James Clapper Says Nerd Magic Can Solve Terrorist Content Filtering, Create Safe Encryption Backdoors

from the harry-potter-but-for-lawful-access dept

Former Director of National Intelligence James Clapper went from having a comfortable, shadowy job in a comfortable, shadowy office to being the face of the American surveillance state after the Snowden leaks. Instead of only being periodically hassled by a couple of Intelligence Committee members (mainly Ron Wyden), Clapper was called to account for the NSA's apparent surveillance sins. And he handled it badly.

After plenty of evasive discussion, Clapper finally said, "Oh, you mean those phone records," and ushered in a new era of slightly less bulk metadata collection. But he still made the most of his speaking opportunities to pin the woes of the terrorized world on Snowden, noting his leaks "sped up encryption adoption by seven years." It was an oddly precise estimate, especially given the contradicting evidence showing terrorists hadn't really changed their communication methods in response to the Snowden leaks.

Clapper is no longer the Intelligence Director, but he's still beating the encryption drum during interviews. And it appears he's aligned himself with another former government employee, James Comey. Speaking to the National Press Club in Australia, Clapper called for both harder nerding and tech companies being a (possibly compelled) source of light in the growing darkness.

As governments around the world face the ongoing threat of extremism, former US Director of National Intelligence James Clapper says tech companies have a social "responsibility" to take better care of what appears on their platforms.

[...]

"I do think there is a role to play here in some screening and filtering of what appears in social media," he said.

"In the same way that these companies very directly capitalise on the information that we make available to them and exploit it, it seems that that same ingenuity could be applied in a sensitive way to filtering out or at least identifying some of the more egregious material that appears on social media."

How social media companies are supposed to auto-filter all terrorist content is, of course, left unexplained. When companies like Facebook can't even filter human breasts without screwing it up, it's a stretch to say the problem of terrorist content and communications is just a coding breakthrough away. Considering the vast amount of content posted everyday on major networks, it's not as simple as applying a bit more mental elbow grease. Much of this is relegated to algorithms, simply because there's not enough manpower in the world to handle the input of billions of social media users.

Clapper also called for tech companies to "work with" law enforcement to provide access to encrypted communications.

Clapper suggested that cooperation could mean "law enforcement particularly would be allowed access to encryption" if it could be done in a "safeguarded way."

"I hear the argument about if you share once with one person and it's forever compromised. I'm not sure I really buy into that," he said.

It really doesn't matter whether Clapper "buys" this or not. It's a fact. And it's a fact that's been demonstrated in explicit detail by the leak of NSA software exploits. A hole is hole -- one that can be used for good or for evil. The world's top intelligence agency can't even keep its exploits secure. How are we expected to believe law enforcement agencies are going to keep these backdoors from being discovered and exploited?

Clapper grooved on the Comey vibe during this talk, acting as though tech expertise is some sort of dark art used deliberately to stick it to The Man. Anyone who uses the phrase "miraculous technological things like iPhones" shouldn't expect to have their assertions taken seriously. It suggests the person making them still has trouble distinguishing between innovation and magic. Consequently, it's these sort of people who continually claim "safe" backdoors are possible, rather than being the mythical deus ex machina they actually are.

Filed Under: backdoors, encryption, filtering, james clapper, nerd harder

Australia's AG Says Public Will Be Cool With Encryption Backdoors Because They Use Facebook

from the talking-(out-of-your-ass)-points dept

In what has become standard operating procedure following a terrorist attack in any part of the (western) world, a top government official is calling for encryption backdoors. This call is being made despite the lack of evidence supporting the theory terrorists are encrypting their communications. And this particular call, being made by Australian Attorney General George Brandis, is being made despite Brandis claiming he's not calling for encryption backdoors.

Shot:

Brandis told the Sun Herald he plans to give agencies freer access to encrypted messaging, insisting the government didn't want to force companies like Facebook and Apple to have a "back door" into its messaging platforms.

Chaser:

"At one point or more of that process, access to the encrypted communication is essential for intelligence and law enforcement," Brandis said.

"If there are encryption keys then those encryption keys have to be put at the disposal of the authorities."

You can call a backdoor "keys under the doormat," but it's still a backdoor even if you're going in the front. Keys held by anyone are keys that can be compromised. It is impossible for law enforcement/intelligence agencies to claim a backdoor is a secure way to protect people's privacy while providing lawful access. See also: the dumping of CIA/NSA software exploits. See also: leaking is still a thing. See also: the TSA's (physical) master keys have been cloned… thanks to the TSA's carelessness. And etc.

But it's all OK even if someone evil manages to make copies of the encryption keys. Why? Because Facebook.

[H]e said the public's attitudes towards privacy were changing, pointing to the so-called "Facebook generation".

"I think also community attitudes, particularly among younger people towards the concept of privacy are changing," Brandis said.

"In the Facebook generation when people put more and more of their own personal data out there, I think there is an entirely different attitude to privacy among young people then there was than perhaps a generation or two ago."

Hello, false equivalency! Brandis makes statements about the government accessing people's private messages (he specifically mentioned Whatsapp and iMessages) and thinks no one will have a problem with it because of what they publicly share on social media. One would hope -- for the sake of their own sanity -- that Brandis is being deliberately obtuse for the sake of pushing his non-backdoor backdoors. The only other explanation is that Brandis is an idiot who can't suss out the difference between private communications and public sharing.

He backs up his baffling, possibly disingenuous assertion with a factoid generated out of thin air:

He suggested the the majority of people in Australia didn't prioritise privacy over giving security agencies more "tools" to fight terrorism.

This person -- who represents the public interest -- should probably spend a bit more time actually listening to the public. The only people making these sorts of assertions are government officials. You rarely hear private citizens -- especially not a majority of them -- arguing for more government intrusion, even in the wake of terrorist attacks.

Nothing stops the fear train, though, not even simple logic. Backdoors that aren't backdoors, backed with the conflation of public and private communications, and capped off with a declaration that this is what the public wants, even though the public has never expressed any such desire. It's a bullshit Triple Crown win for Brandis, who certainly shouldn't be allowed to handle any heavy government machinery in the future.

Filed Under: australia, backdoors, encryption, george brandis, going dark, social media

Theresa May Tries To Push Forward With Plans To Kill Encryption, While Her Party Plots Via Encrypted Whatsapp

from the so-about-that... dept

As we've discussed a few times, Theresa May and her colleagues have been pushing to break real encryption as part of the party's manifesto. And they've used recent terrorist attacks as an excuse to ramp up that effort -- even though the perpetrators of recent attacks were already known to law enforcement and there's no evidence encryption played any role. Earlier in the year, Home Secretary Amber Rudd had insisted that encrypted communications were completely unacceptable, and specifically namechecked Whatsapp:

It is completely unacceptable. There should be no place for terrorists to hide.

We need to make sure that organisations like WhatsApp, and there are plenty of others like that, don’t provide a secret place for terrorists to communicate with each other.

Of course, as you've certainly heard by now, last Thursday's general election in the UK (understatement alert!) didn't quite go according to Theresa May's plan, and she's now left in a much weaker position with many people expecting she will not survive long as Prime Minister. And yet, showing her uncanny ability to double down on the absolute wrong thing, May is insisting she's moving ahead with her plans to regulate the internet, which will require vast censorship and a breaking of encryption. On the encryption angle, she's already got some Parliamentary support given that (as we and others warned at the time!) the Snooper's Charter ("Investigatory Powers Act") included a bit that would require anyone offering encrypted communications to unencrypt those communications (which is impossible if the encryption is strong end-to-end, and only possible with broken, insecure, fake "encryption").

This is both dumb and... hilarious. Because while all of this is going on, Theresa May's own party has been trying to figure out what the hell they're going to do. And, of course, the way they're communicating with each other is with the encrypted Whatsapp software that Amber Rudd was trashing just months ago:

Former minister Ed Vaizey told the BBC that he supports May staying on, but that Tories were discussing possible replacements. Asked whether members were calling one another to plot May’s ouster this weekend, he denied it.

“That’s so 20th century,” he said. “It’s all on WhatsApp.”

Indeed, soon after this came out, one of the possible candidates to replace May, Boris Johnson, claimed that he was sticking by May and... released screenshots of his own Whatsapp conversations to prove that he was supporting her.

So, there you have it. Theresa May is pushing forward to break encrypted chat apps like Whatsapp, while her own party is using encrypted chat apps, like Whatsapp, to discuss whether or not to keep her in place as Prime Minister.

Filed Under: backdoors, boris johnson, encryption, privacy, theresa may, uk
Companies: whatsapp