So, If Someone Could Just Kill A Child And Let The FBI And DOJ Get Their Anti-Phone Encryption Legislation Going, That Would Be Great

from the 'terrorism'-no-longer-'motivational'-enough dept

The discussion over cellphone encryption continues, with much of the "discussion" being FBI director James Comey's insistence that Apple and Google simply can't do the very thing they're doing... and offering zero legal reasons why they can't. There have been a lot of horribles paraded around during the past few weeks, mainly of the terrorist or pedophile variety. None of it has been very persuasive to anyone not wearing a badge. The converts continue to love the preaching while those on the outside look on in bemusement.

It's not just Apple and Google at this point. Whatsapp, the messaging app Facebook recently purchased, will be providing end-to-end encryption. Twitter is fighting National Security Letter gag orders in court.

The Wall Street Journal's recent article provides a closer look at the reactions of the upper echelon of law enforcement (DOJ and FBI) but only finds more of the same.

The No. 2 official at the Justice Department delivered a blunt message last month to Apple Inc. executives: New encryption technology that renders locked iPhones impervious to law enforcement would lead to tragedy. A child would die, he said, because police wouldn’t be able to scour a suspect’s phone, according to people who attended the meeting.

"A child would die." That's the argument. That's almost the only argument.

I'd hate to have people look at me and say, 'Well how come you can't save this kid,' 'how come you can't do this thing.'" (Sept. 25)

Smartphone communication is “going to be the preferred method of the pedophile and the criminal.' [Washington DC Police Chief Cathy Lanier] (Sept. 30)

Eric Holder: 'When a child is in danger, law enforcement needs to be able to take every legally available step to quickly find and protect the child...' (Oct 1st)

As a result, child predators, terrorists, and other criminals could go free, he [James Comey] warned. (Oct. 30)

Unsurprisingly, when the subject was first broached in this fashion, Apple reacted as any company would when faced with the insinuation that its latest feature would kill children.

The meeting last month ended in a standoff. Apple executives thought the dead-child scenario was inflammatory. They told the government officials law enforcement could obtain the same kind of information elsewhere, including from operators of telecommunications networks and from backup computers and other phones, according to the people who attended.

There are other options, but the FBI and DOJ only want the easiest route. To get it, the same argument is presented again and again. The FBI, along with other law enforcement officials, have accused Apple and Google of marketing to criminals. The companies have reasonably responded by presenting the alternatives the FBI and others are willfully ignoring. Files stored on phones are often stored elsewhere. Talk to service providers. Demand the information from the suspects themselves.

James Comey says he wants to have a "discussion," but plugs his ears and shouts about pedophiles and dead children when options other than a law enforcement-only "back door/front door" are brought up. Apple and Google have told the FBI to change the law if it doesn't like the new reality. James Comey and the DOJ's second-in-command, James Cole, know this is the route they have to take if they want to force Apple and Google to drop encryption. They also know the current backlash against government surveillance makes this pursuit anything but a foregone conclusion.

And, so, Comey and Cole exhume the corpses of child victims and give them lead roles in their pathetic, ghoulish puppet show -- something they perform for any halfway-sympathetic audience. Comey and others in law enforcement know what it will take to pass legislation or amendments in their favor.

[Deputy Attorney General James] Cole predicted that [law change] would happen, after the death of a child or similar event.

So, it would appear that both sides of the argument are waiting for a watershed event to prove their respective points. Apple's Tim Cook believes "something major" will happen that will prove to customers that his company's decision to provide encryption by default was the right one. The DOJ and FBI, on the other hand, are apparently waiting for something much more tragic: the severe abuse and/or death of a child at the hand of criminal in possession of an encrypted phone.

One side is waiting for a horrible event their customers are shielded from. The other side is waiting for a horrible event to convert into legislative currency. If the side looking to exploit a tragedy strikes first, the second watershed event -- the one Tim Cook posits -- will have no positive outcome. The FBI isn't just willing to use dead children to achieve its aims. It's also willing to sacrifice the public's privacy and security at the same time.

Filed Under: children, doj, encryption, fbi, fud, james comey, legislation, mobile encryption
Companies: apple, google

Good News: WhatsApp Gets Serious About End To End Encryption

from the good-to-see dept

We recently noted that it was really good news to see companies like Google and Apple finally taking end user encryption seriously, and it appears that's spreading. The super-popular chat messaging app WhatsApp, which was acquired by Facebook not too long ago, just turned on full end-to-end encryption, powered by Open Whisper Systems, the makers of such great tools as TextSecure, which is the basis for the new encryption:

The most recent WhatsApp Android client release includes support for the TextSecure encryption protocol, and billions of encrypted messages are being exchanged daily. The WhatsApp Android client does not yet support encrypted messaging for group chat or media messages, but we’ll be rolling out support for those next, in addition to support for more client platforms. We’ll also be surfacing options for key verification in clients as the protocol integrations are completed.

WhatsApp runs on an incredible number of mobile platforms, so full deployment will be an incremental process as we add TextSecure protocol support into each WhatsApp client platform. We have a ways to go until all mobile platforms are fully supported, but we are moving quickly towards a world where all WhatsApp users will get end-to-end encryption by default.

It sounds like this project started prior to the Facebook acquisition, so it's great to see it continue to move forward either way. Just recently, the EFF rated various messaging apps for their security (which resulted in some controversy...), and WhatsApp didn't score all that well, while TextSecure got a perfect score. Making messaging more and more secure is incredibly important, so it's great to see it happening here.

Filed Under: encryption, messaging
Companies: whatsapp, whisper systems

EFF, Others Launch New Free Security Certificate Authority To 'Dramatically Increase Encrypted Internet Traffic'

from the very-cool dept

The EFF and Mozilla along with some others, have teamed up to announce "Let's Encrypt" which is a new, free, certificate authority that is hoping to dramatically increase encrypted internet traffic when it launches next summer. The effort is being overseen by the Internet Security Research Group, which is the non-profit coalition of folks contributing to this effort. Not only is the effort going to offer free certificates, but also make it much easier to enable encryption. We've argued for a long time about the importance of increasing encryption online, so it's great to see this effort.

Filed Under: certificate authority, encryption, https, let's encrypt, security, ssl
Companies: cisco, eff, internet security research group, mozilla

Demonizing Strong Encryption: Welcome To The Crypto Wars 2.0

from the paedophiles,-murderers-and-terrorists dept

Recently Techdirt wrote about the extraordinary tirade by the new GCHQ boss, Robert Hannigan, which boiled down to: "however much we spy and censor online today, it's still not enough." It was so full of wrong-headed and dangerous ideas that it was hard to capture it all in one post. Here's one thing we didn't have room for last time:

Isis also differs from its predecessors in the security of its communications. This presents an even greater challenge to agencies such as GCHQ. Terrorists have always found ways of hiding their operations. But today mobile technology and smartphones have increased the options available exponentially. Techniques for encrypting messages or making them anonymous which were once the preserve of the most sophisticated criminals or nation states now come as standard. These are supplemented by freely available programs and apps adding extra layers of security, many of them proudly advertising that they are "Snowden approved". There is no doubt that young foreign fighters have learnt and benefited from the leaks of the past two years.

Leaving aside the rather pathetic dig at Snowden at the end there, and the unsubstantiated statement that terrorists have benefited from his leaks, the key message here is that strong encryption is now used routinely by the wrong people, and that it presents an "even greater challenge" to the world's security services. If that lament sounds familiar, it's because suddenly, over the last few weeks, it has become the persistent refrain of law enforcement agencies in both the US and UK.

First we had the FBI Director James Comey talking about his agency's fears about things "going dark" because of encryption; then we heard from NYPD Commissioner Bill Bratton about how encryption "does a terrible disservice to the public"; a couple of weeks later, former NSA General Counsel Stewart Baker suggested the reason Blackberry had failed was because it used "too much encryption".

Now it seems that the baton has been passed to the UK. The day after Hannigan led the way with his piece in the Financial Times, the head of London's Metropolitan Police added his voice to the chorus of disapproval, as the London Evening Standard reports:

London's police chief today warns society against letting parts of the internet become a "dark and ungoverned" space populated by paedophiles, murderers and terrorists.

In a call for action, Met Commissioner Sir Bernard Hogan-Howe says encryption on computers and mobile phones is frustrating police investigations, meaning parts of the web are becoming "anarchic places".

What's particularly interesting is that as part of his visit to New York to make this speech, Hogan-Howe was also planning to meet all the senior US officials who had just voiced their concerns about encryption in precisely the same terms:

Sir Bernard has spent several days in talks with New York and Washington police chiefs about the threat of terrorism and what he calls "the challenges and opportunities" of technology. Today he was meeting FBI director James Comey.

He was also telling law enforcement experts behind closed doors at the New York police department that the internet is now a safe haven for criminality, adding: "Privacy is important but in my view the security of communications methods and devices is growing beyond what any genuine domestic user could reasonably require."

It's hard not to see this as part of a concerted and organized counter-attack against growing calls to rein in US and UK surveillance in the wake of Snowden's revelations. The common line on both sides of the Atlantic is that encryption has gone too far -- that "the security of communications methods and devices is growing beyond what any genuine domestic user could reasonably require". The clear implication is that only "paedophiles, murderers and terrorists" would want strong crypto, and that for law-abiding citizens with nothing to hide, crypto with backdoors is good enough.

But it isn't, of course. Law-abiding citizens with nothing to hide have a perfect right to real privacy online, just as they have a right to use doors, walls and curtains to screen off their private lives from the world's gaze. As Techdirt has noted before, placing backdoors in nominally secure systems simply makes them completely insecure, since there is no way to stop the bad people from using them too. Moreover, weakening crypto would not only make the Internet vastly less secure for billions of users, it would also undermine millions of online businesses and thus the economies with which they are now so deeply intertwined.

We can expect more of these blatant attempts to demonize strong cryptography, and to paint its mere use as a sure sign of terrorism and depravity. But we have been here before. During the 1990s the US government tried to introduce backdoors into secure communications using the Clipper chip. Civil society won those first Crypto Wars; now it needs to gird its loins to fight and win Crypto Wars 2.0.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: bernard hogan-howe, crypto wars, demonized, encryption, james comey, mobile encryption, robert hannigan, stewart baker
Companies: apple, google

James Comey Again Demands Tech Companies Do As He Says And Grant The FBI Complete Access To Whatever It Wants

from the please-please-please-let-me-get-what-I-want dept

FBI director James Comey -- (again) citing no legal authority or precedent -- is demanding Google and Apple hand over the keys to their default phone encryption.

The director of the FBI on Monday doubled down on demands that Silicon Valley giants cooperate in the course of criminal investigations, saying that tech companies such as Apple and Google have to unlock cellphones, if authorities request it.

And what has all this "demanding" and "doubling down" netted Comey? Nothing really. He still needs a compliant legislative body to oblige his fantasies of subservient tech companies opening wide for fat-fingered g-men.

Comey's latest attempt to sell the government's plan to exchange fear for all-access mobile phone passes came at a counterterrorism conference hosted by Fordham University. And, once again, Comey followed up his baseless demands with a whole lot of nothing.

Comey didn't specify what he wants Apple and Google to do but said that to find a solution requires an "honest debate."

"I don't want to tell people what to do," he said. "But I want to try to foster a national conversation about this."

"There has to be some solution that will allow us with lawful authority to be able to have the company unlock the device," he added.

There's nothing honest about Comey's approach and walking around claiming that phone encryption will lead to new highs in terrorist attacks and pedophilia is only part of the dishonesty. Comey claims he doesn't want to "tell people what to do," apparently completely unaware that throwing around the weight of his agency and position and demanding phone makers play by his rules is the very definition of "telling people what to do."

Unfortunately for Comey, throwing around this weight just isn't enough anymore. No one in the tech world is going to be cowed into obeisance. Not anymore. Now, everyone wants to stick it to The Man, even many of those that worked in close proximity with government agencies over the past several years. Why? Because the nation's intelligence and investigative agencies are always hungry. They always want more.

The "solution" Comey's looking for runs through Congress. Historically, legislators have almost always come down on the side of law enforcement. The twin specters of terrorism and child molestation have resulted in plenty of government expansion and law enforcement leeway over the years. But maybe even the legislators are beginning to realize that this is something that can never be satiated. You can give and give and give and the same people will return over and over again, asking for just a little more. The government is -- and has been for years -- a mixture of junkies and their enablers.

Maybe we're at the point that a certain number of enablers have become sick of the constant need. Maybe they'll cut Comey and his ilk off and put up with the keening, inarticulate sounds of their withdrawal. Or maybe they'll meet them out back and slip them a fix when they think no one's looking. As I've said before, the voices out front are claiming the FBI will find no assistance here. It's the large number of those who've offered no opinion we need to keep an eye on. Law enforcement's emotional blackmail has worked for years. It may have recently lost its edge, but it's still too powerful to count out completely.

"In one way or another, our entire lives — our social lives, our work lives — reside online and on these devices," Comey said. "And that's a great thing. But that's also where the bad guys are."

Yeah. As in "real life" itself. I guess we should expect him to ask for "golden key" access to every front door in America. As long as he's transparent about it, what's there to be concerned about? Comey just wants to keep America safe. Who are we to deny complete access to our "entire lives?"

Filed Under: back doors, encryption, fbi, front door, james comey, mobile encryption
Companies: apple, google

Former NSA Lawyer Says Reason Blackberry Failed Was 'Too Much Encryption' Warns Google/Apple Not To Make Same Mistake

from the give-it-a-rest,-stew dept

There are times that I wonder if former NSA General Counsel Stewart Baker is just trolling with his various comments, because they're so frequently out of touch with reality, even though he's clearly an intelligent guy. His latest is to join in with the misguided attacks on Apple and Google making mobile encryption the default on iOS and Android devices, with an especially bizarre argument: protecting the privacy of your users is bad for business. Oh really? Specifically, Baker engages in some hysterically wrong historical revisionism concerning the rise and fall of RIM/Blackberry:

Baker said encrypting user data had been a bad business model for Blackberry, which has had to dramatically downsize its business and refocus on business customers. “Blackberry pioneered the same business model that Google and Apple are doing now - that has not ended well for Blackberry,” said Baker.

He claimed that by encrypting user data Blackberry had limited its business in countries that demand oversight of communication data, such as India and the UAE and got a bad reception in China and Russia. “They restricted their own ability to sell. We have a tendency to think that once the cyberwar is won in the US that that is the end of it - but that is the easiest war to swim.”

While it's true that some countries, like India, demanded the right to spy on Blackberry devices, the idea that this was the reason for the company's downfall is ludicrous. First of all, RIM gave in to some of those demands anyway. But, more importantly, the reason that Blackberry failed was because the company just couldn't keep up from an innovation standpoint -- and that's because early on it made the decision to focus onenforcing patents, rather than truly innovating. RIM got fat and lazy by getting an early lead and then focusing on protecting it, rather than keeping up with the market. And... one of the reasons it got that early lead was because companies were willing to buy into the Blackberry in part because of its strong encryption.

The idea that encryption was bad for business because China and Russia couldn't spy on people is not only ridiculous and silly, but it appears to be Baker supporting authoritarian states spying on its citizenry. What the hell, Stewart?

Beyond that, Baker insists that, really, the public doesn't want encryption anyway, and if people only knew what was really going on with the "bad guys," we'd all be willing to give up our privacy:

Baker said the market for absolute encryption was very small, and that few companies wanted all their employees’ data to be completely protected. “There’s a very comfortable techno-libertarian culture where you think you’re doing the right thing,” said Baker.

“But I’ve worked with these companies and as soon as they get a law enforcement request no matter how liberal or enlightened they think they are, sooner to later they find some crime that is so loathsome they will do anything to find that person and identify them so they can be punished.

Right. And that's what basic police and detective work is for. It doesn't mean that you need to weaken the security and privacy of everyone else. Anyway, let's see if Baker goes out and shorts Apple and Google's stock now that he believes encryption and protecting the privacy of their users is really so bad for business.

Filed Under: blackberry, china, cryptowars, encryption, india, nsa, russia, stewart baker, surveillance
Companies: apple, blackberry, google, rim

Adobe Discovers Encryption, Cuts Back On Its eBook Snooping A Bit

from the drm-is-bad,-mmkay? dept

The whole DRM for ebooks effort is still pretty braindead all around. It's amazing to me that everyone hasn't realized what the music industry figured out years ago (after many earlier years of kicking and screaming): DRM doesn't help the creators or the copyright holders in the slightest. It pisses off end users and tends to help give platform providers a dominant position by creating lock-in with their users. Time and time again we see copyright holders demanding DRM, not realizing that this demand actually gives all the leverage to the platform provider. And, of course, there are all the technical problems with DRM, from making "purchased" content disappear once DRM servers are turned off, to making it more difficult to actually use legitimately authorized content, to the fact that DRM tends to lead to privacy and security problems as well.

A few weeks ago, Nate Hoffelder discovered that Adobe's ebook reader, Digital Editions 4, was spying on your ebooks, collecting a ton of information about them, and then uploading it all to Adobe's servers in an unencrypted format, potentially revealing a lot of information about users of the product. Adobe came out with a ridiculously mealy-mouthed response that clearly had been worked over by a crisis team PR person, when what it should have done is say, "Uh, we screwed up."

Now, a couple of weeks later, Adobe has quietly updated Digital Edition, complete with encryption... and with greatly reduced snooping. It no longer does anything on non-DRM'd ebooks, only contacting the server for DRM'd books (which, as explained, is a dumb idea, but...). So, Adobe has corrected the egregious errors of its original snooping (though, frankly, the company should also (1) apologize to the public and (2) thank Hoffelder for pointing out the company's crappy practices).

Hoffelder goes even further, arguing that what Adobe should really do is stop the data collection entirely:

This is less a case of a company screwing up in supporting users than it is one of a major tech company grabbing more user info than is required and then, when they are caught, trying to write it off with a “My bad” and a promise to add encryption.

That is entirely the wrong response. What they should have said was that they would stop the spying, not that they would make it more difficult for the world to listen in.

From all appearances, the real problem here is... DRM. Adobe's designed a DRM system that requires a server check-in to make it work. This is dumb for a variety of reasons, and also means that when -- inevitably -- the server goes away, those "purchased" works are likely to disappear as well.

Filed Under: digital editions, drm, ebooks, encryption
Companies: adobe

FBI Director Says Congress Will Fix Phone Encryption 'Problem;' Congress Says 'Bite Us'

from the Bureau-cordially-invited-to-go-fuck-itself dept

James Comey's pleas that something must be done for the [potentially-molested] children of the United States seem to be falling on mostly deaf ears. Mostly. After realizing that there's nothing in current laws that compels Google and Apple to punch law enforcement-sized holes in their default encryption, Comey has decided to be the change he wishes to force in others.

Having set the stage with a Greek chorus comprised of law enforcement officials chanting "iPhones are for pedophiles," Comey is now making overtures to legislators, targeting an already-suspect law for further rewriting: CALEA, or the Communications Assistance for Law Enforcement Act. As it stands now, the law specifically does NOT require service providers to decrypt data or even provide law enforcement with the means for decryption. Up until this point, the FBI's director seemed to consider Congressional support a foregone conclusion.

Last week, FBI director James Comey suggested that encryption "threatens to lead all of us to a very dark place" and suggested that if Apple and Google don't remove default encryption from iOS and Android then "Congress might have to force this on companies."

Now, Congress members are firing back at Comey, reminding him that Congress doesn't have to do shit.

"To FBI Director Comey and the Admin on criticisms of legitimate businesses using encryption: you reap what you sow," California Republican Rep. Darrell Issa tweeted. "The FBI and Justice Department must be more accountable—tough sell for them to now ask the American people for more surveillance power."

Rep. Zoe Lofgren estimates Comey's legislative "fix" has a "zero percent" chance of passing. This tepid statement is the warmest response Comey's received so far.

“It's going to be a tough fight for sure,” Rep. James Sensenbrenner (R-Wis.), the Patriot Act’s original author, told The Hill in a statement.

Of course, in this anti-surveillance climate, there aren't too many representatives willing to openly support toxic rewrites like the one Comey desires. But give it a few more years and anything's possible. This is the time to start watching upcoming bills closely. It's not completely unheard of for unpopular legislation to be tacked onto other bills whose popularity (or complete mundanity) gives them a higher chance of passing.

Comey also still seems to think that it's simply a matter of wording. He's done all he can to portray the encrypted future as a nightmarish world where child abusers, drug dealers and terrorists run amok while law enforcement fumbles around in the dark. This clumsy propaganda machine has done little to soften up the public or its representatives. Now, he's shifting gears, pretending that it's not a "backdoor" he's seeking, but rather some sort of magical doggie door for law enforcement.

“We want to use the front door with clarity and transparency,” he said.

How that word picture converts to real life remains to be seen. Comey doesn't seem to have any idea but believes the answer runs through an amended CALEA. The good news is that no one's in any hurry to help him out. The FBI (and much of law enforcement) is so used to getting what they want (as well as being completely absent when it's time to reap what's been sown) with minimal resistance that this pushback has forced them to think on their feet -- something they're clearly not comfortable doing. Between talk of "golden keys" and the hilarious assumption that Congress would simply do as it's told, the FBI's anti-encryption fit-pitching is looking more ridiculous by the moment.

Filed Under: darrell issa, encryption, fbi, james comey, jim sensenbrenner, phones, zoe lofgren

NY Police Commissioner Bill Bratton Latest To Complain About Phone Encryption

from the law-enforcement-still-trending-at-100%-opposed dept

The latest law enforcement official to enter into the "debate" over phone encryption is none other than NYPD Commissioner Bill Bratton, most famous around Techdirt for being "not Ray Kelly." Bratton sees eye-to-eye with pretty much every other critic of Google's and Apple's move to provide encryption by default: this is bad for us (meaning "law enforcement"), therefore new laws.

Police Commissioner Bill Bratton ratcheted up the rhetoric against Google and Apple Friday, vowing to push for legislation now that the tech giants have announced operating systems with encryptions that block law enforcement access.

“It does a terrible disservice to the public, ultimately, and to law enforcement, initially,” he said. “It really does impede our investigation of crimes.

That's some mighty fine spin by Bratton. Something that will make a vast majority of the public's data less susceptible to hackers' attacks is a "disservice to the public" because in a very small number of cases, this encryption could hamper an investigation. Because some criminals might use this encryption, no one should be allowed to have it.

Bratton also fired the following (cheap) shot across the bow of the cell phone giants, insinuating that the companies are profiting from law enforcement pain, deliberately.

“For them to consciously, for profit and gain, to thwart those legal constitutional efforts, shame on them.”

Businesses turn profits. Otherwise, they're not businesses (or not in business for long). Offering encryption by default does not -- in itself -- make Apple and Google more money. Nor does "thwarting legal constitutional efforts." It could actually be argued that this will cost both companies more money in the long run, considering they will both be facing additional legal challenges and very-specifically-targeted legislation.

Manhattan DA Cyrus Vance, who notes that he's in "lockstep" with Bratton's views, sounds like he's in lockstep with the former keepers of NYC's security state -- Ray Kelly and Michael Bloomberg -- when he opines that the balance between privacy and security should always be tilted towards law enforcement.

"I think that the balance, however ... can’t be one where saving people’s lives, solving serious crimes from child abuse to terrorism, is the price we have to pay for blanket privacy.”

I keep hearing "child abuse" and "terrorism," but keep envisioning law enforcement's desired encryption backdoor being used for the same thing Stingray devices and cast-off military gear are used for: plain vanilla drug warring and other assorted "normal" criminal investigations. Tears are shed over the pedophile who got away, but in practice, it's rarely anything more than Officer Smith flipping through the digital rolodex of some low-level meth dealer.

Filed Under: bill bratton, encryption, nypd, phone encryption, phones