Ahead Of His Senate Hearing, James Comey Pushes His 'Going Dark' Theory

from the same-old-Comey,-same-bad-arguments dept

Ahead of his testimony before the Senate Judiciary Committee on Wednesday, FBI Director James Comey released his planned testimony, which covers a variety of subjects Comey hoped to cover during the hearing. A lot of the talking points were touched on, but Comey spent most of his time fielding questions from pissed-off senators about how much they were disappointed in recent FBI investigations.

The testimony Comey planned to give contains another discussion of the FBI-centric "going dark" issue. According to Comey, device encryption has blocked FBI's searches nearly 50% of the time, preventing it from pulling data from more than 3,000 phones. Comey also says other approaches -- such as using metadata or cellphone forensic software -- won't work. They're too expensive and won't scale. Left unsaid is Comey's desire for legislation or a few precedential court decisions to force manufacturers to compromise their customers' security.

He makes this argument by conflating privacy and security and using this conflation to arrive at a completely wrong conclusion. From Comey's testimony [PDF]:

Some observers have conceived of this challenge as a tradeoff between privacy and security. In our view, the demanding requirements to obtain legal authority to access data—such as by applying to a court for a warrant or a wiretap — necessarily already account for both privacy and security. The FBI is actively engaged with relevant stakeholders, including companies providing technological services, to educate them on the corrosive effects of the Going Dark challenge on both public safety and the rule of law. The FBI thanks the committee members for their engagement on this crucial issue.

Warrants and court orders cover the "privacy" end of the argument, but using court orders (or legislation) to force device makers to build backdoors in users' devices throws security out the window. The balancing act in the encryption debate has never been "privacy vs. security." It's been "security vs. insecurity." Comey's false equation presents privacy and security as two sides to the same coin, yet somehow completely separable in the presence of a court order. Fourth Amendment protections cover the privacy end, but showing up at a device backdoor with a warrant in hand does nothing for anyone's security.

Comey doesn't want a balancing act, despite all his assertions about "adult conversations" and deferring to the "smart people" at tech companies. He wants device owners to sacrifice security in exchange for protections they're already guaranteed by the Fourth Amendment.

Filed Under: backdoors, encryption, fbi, going dark, james comey

EU Plans To Weaken Encrypted Communications Despite Countless Warnings It Can't Be Done Safely

from the even-with-the-necessary-hashtags dept

Last week, the UK's Home Secretary Amber Rudd said that WhatsApp risked becoming a "place for terrorists to hide." Then, like many others that have used this tired old trope, she went on to call for the development of some magic unicorn key to unlock all encrypted communications, one that was somehow available only to those on the side of truth, beauty, law and order, and not to the other lot. In doing so, her cluelessness was particularly evident, as her invocation of the "necessary hashtags" emphasized, but she's not alone in that. Despite the chorus of experts pointing out for the thousandth time why it's not possible, the EU Justice Commissioner has just said that the EU must have magic unicorn keys, too. As EurActiv reports:

The European Commission will propose new measures in June to make it easier for police to access data on internet messaging apps like WhatsApp, EU Justice Commissioner Věra Jourová said yesterday (28 March), heeding calls from national interior ministers.

Jourová said she will announce "three or four options" including binding legislation and voluntary agreements with companies to allow law enforcement authorities to demand information from internet messaging apps "with a swift, reliable response".

...

Jourová said the measures would make it easier for law enforcement authorities to request and access data from online services that are registered outside their jurisdictions.

Jourová went on to complain that law enforcement authorities are currently dependent on service providers to provide voluntary access to encrypted communications. But as Techdirt pointed out recently, that's just not true: there are a number of encryption workarounds available. You might expect politicians to be at sea when it comes to complex digital technologies, but you would hope that their expert advisors would fully understand things. And yet here is what Gilles de Kerchove, the EU's anti-terrorism coordinator, told EurActiv:

the question is, can you open a backdoor for Europol [the EU's law enforcement agency] only, or would that at the same time create a vulnerability and open a backdoor for the Russian mafia or third party state spies?

Hey, Gilles, let a dozen of the world's top security and crypto experts save you time and effort by giving you the answer to that crucial question: "No, you can't." Got it? Can we please move on now?

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: backdoors, encryption, eu, going dark, vera jourova

James Comey's New Idea: An International Encryption Backdoor Partnership

from the let's-all-share-the-pain-equally dept

FBI Director James Comey is still pitching encryption backdoors, despite there being almost no one -- from the Intelligence Community to legislators around the world -- interested in what he's selling. Comey claims to be sitting on a pile of encrypted devices the FBI can't get into, even with help from outside contractors.

His latest backdoor idea was floated at a national security symposium at the University of Texas. Knowing any legislated backdoors might result in US device customers turning to overseas suppliers, Comey thinks he can minimize domestic fiscal damage by getting the rest of the world to fall in line with an idea most foreign governments still find unpalatable, even as they suffer terrorist attacks with a far greater frequency than we do at home. Michael Kan has more details at ComputerWorld:

Speaking on Thursday, Comey suggested that the U.S. might work with other countries on a “framework” for creating legal access to encrypted tech devices.

“I could imagine a community of nations committed to the rule of law developing a set of norms, a framework, for when government access is appropriate,” he said on Thursday.

Comey doesn't say how he plans to set this in motion. He's had no luck on the domestic front, so hoping for an "international framework" to spring into existence is, at best, inordinately hopeful. He directly addressed one of the many concerns device makers have about encryption backdoors, stating he had no desire to "chase innovation" out of the US. But that doesn't mean he's not interested in harming US innovation. He simply believes every country in the partnership should suffer equally.

As always happens when Comey opens his mouth about encryption, plenty of experts in the field are on hand to criticize his comments.

“I don’t think it makes sense,” said Nicholas Weaver, a researcher at the International Computer Science Institute at the University of California Berkeley.

Comey’s idea means that all countries will essentially agree to weaken the security in their vendors’ tech products, Weaver said. However, other countries will balk, fearing that the U.S. might exploit the cooperation for spying purposes.

“Would you still use a U.S. product, even if you know the NSA (National Security Agency) could have the rights to it?” he said.

Most of our allies around the world are still stinging a bit from multiple national security leaks -- some of which have exposed nearly as much intrusiveness of their own security agencies as they have about the NSA's reach and grasp. With the NSA heavily-involved in diverting hardware shipments to implant backdoors, no one's in any hurry to add their country to the list of "buyer beware" electronics.

Even if most of Europe agrees to weaken encryption to make law enforcement easier, there's no preventing non-partner countries from taking advantage of security holes to engage in greater domestic spying and civil rights abuses.

And, as is always the case when Comey opens his mouth about encryption, it's again suggested the nerds of the world are simply not applying themselves when it comes to "safe" backdoors.

[O]n Thursday, Comey said the tech industry can find an approach that creates government access, while keeping malicious actors out.

“I reject the, ‘it’s impossible’ response,” he said. “I just think we haven’t actually tried it.”

Counterpoint from Nate Cardozo of the EFF:

“It’s childish to stomp your foot, and say, ‘nerds you have to try harder,’” Cardozo said.

That's Comey all over: insisting he's right despite nearly no one else in the world agreeing with him. The phones he can't get into are apparently viewed as a personal insult -- a middle finger from device makers to the feds. He claims device makers shouldn't "decide how [their customers] live" by providing default encryption. He feels it should be left up to customers whether or not they want that level of security.

He makes this claim while pitching backdoors that remove that choice, allowing the FBI to tell Americans how to live: less securely, because criminals and terrorism. Again, classic Comey -- who handles every discussion of encryption like a child. He's not guileless, not by far. But he so deeply believes in the inherent "rightness" of his arguments that he's unable to see their inconsistency and incoherence. Or worse, he does... but just doesn't care.

Filed Under: backdoors, encryption, fbi, going dark, james comey

US Secret Service Prefers Belt Sanders And Third-Party Vendors To Cell Phone Encryption Backdoors

from the 80-grit-backdoor dept

The Christian Science Monitor has posted an interesting article detailing some (but certainly not all) of the ways the US Secret Service can obtain data from locked phones. In all the cases discussed in the article, the data itself wasn't encrypted, but was otherwise inaccessible without the password.

In addition to using third-party forensic software and hardware (like that of recently-hacked Cellebrite), the Secret Service also engages in a lot of manual labor to recover phone data. In one instance, the Secret Service was able to pull out the phone's flash memory and grab data from it -- although this process took it nearly a week.

A Huawei phone obtained by the agency called for a very unique brute force approach.

In another case, involving a password-locked Huawei H883G phone, agents bought multiple copies of the same model and practiced carefully polishing off material from the back of the device with an automated sander.

Often, agents can apply heat to phones to open them up. But Huawei built this particular model in a way that applying too much heat could damage its memory. So, agents sanded off material from the back of the Huawei H883G device to excise sexually explicit images for a case involving a different New Hampshire man.

What's not contained in the article are complaints about encryption. Either the Secret Service doesn't encounter that much of it, or it just doesn't find it to be that much of an obstacle when it does. Dave Aitel, a former NSA research scientist, is the only person quoted in the article who says anything about encryption -- and even he believes the Secret Service's combination of hardware and software is a better approach than giving government agencies encryption backdoors.

Watering down encryption on phones is "not a good path," says Dave Aitel, a former National Security Agency research scientist who currently runs the cybersecurity firm Immunity. "The path of hacking is much nicer – from a policy perspective."

[...]

"If a device is using encryption at rest ... that could be problematic, especially if the implementation of the encryption is good,” he said.

It could be problematic, but encryption keeps bad guys out the same way it keeps the good guys out. And there's nothing covered here that suggests the Secret Service is as opposed to encryption as FBI Director James Comey is. Granted, the Secret Service probably runs into fewer encrypted phones than the FBI does, but even in its more-limited selection, it seems to be making the progress it needs without suggesting the government force companies to give them all-access backdoor keys.

One other somewhat surprising revelation contained in the piece is the fact that small phone manufacturers might (inadvertently) be making more secure phones than the Apples and Samsungs of the world. Why? Because the limited market draws less interest from government contractors who develop cell phone-cracking tools. If there are fewer government buyers interested in cracking Brand X, no company is going to expend research resources trying to find a way around the phone's built-in protections.

"A cheaper phone that might be less popular, it seems like it'd be easier for the vendors to get into it," says [James] Darnell of the Secret Service phone lab. "But it's actually quite the opposite."

What's covered here indicates James Comey's "sky is falling darkening" proclamations are pretty much his alone. Law enforcement at large isn't demanding encryption backdoors. It's just the same handful of holdouts, albeit ones with inordinately-large soapboxes.

Filed Under: backdoors, belt sanders, encryption, hacking, secret service

Cell Phone Hacking Company Hacked; 900 GB Of Logins, Log Files, And Forensic Evidence Taken

from the let-he-who-is-without-security-breaches-throw-the-first-All-Writs-Order dept

Everything is compromised. In the latest case of a hacking company being hacked, Israel's Cellebrite is the latest to have its internal data hauled off by hackers. Joseph Cox of Motherboard was given inside details by the crew that claims to have spirited away login info and other data from the cell phone-cracking company.

Motherboard has obtained 900 GB of data related to Cellebrite, one of the most popular companies in the mobile phone hacking industry. The cache includes customer information, databases, and a vast amount of technical data regarding Cellebrite's products.

Included in the data haul are some other nifty surprises: evidence files from forensic searches of cell phones and logs from Cellebrite devices.

Cellebrite is a major supplier to US law enforcement, as well as to government agencies in countries with sketchier human rights records like Turkey, Russia, and the United Arab Emirates. In many ways, the company is similar to Italy's Hacking Team, which found itself hacked and its emailed dirty laundry aired by enterprising hackers unimpressed by the company's malleable morality.

What's truly interesting about this hack (and those similar to it) is that they go right to the heart of what's wrong with the DOJ's insistence that any "one-time" phone crack -- like the one they pursued in the San Bernardino mass shooting case -- would be safe as houses in the government's hands.

Riana Pfefferkorn -- who helped write an amicus brief on Apple's behalf (along with several other security researchers and professors) -- pointed out on Twitter that Cellebrite's hacking is exactly the sort of risk the government refused to seriously contemplate during its pursuit of an All Writs Order forcing Apple to open up the phone for the FBI.

If such a hack were created by Apple in response to a court order, there's no way for the FBI, Apple, or anyone else to plausibly claim it would be kept out of the hands of malicious actors. Companies in the business of breaking into devices aren't impervious to outside attacks. Neither is the US government, which has proven consistently weak when it comes to securing the massive amount of personally-identifiable information it collects from US citizens.

So far, the collected files haven't been shown to anyone but a few journalists, but Cox points out unauthorized access to Cellebrite isn't exactly a new thing.

Access to Cellebrite's systems has been traded among a select few in IRC chat rooms, according to the hacker.

“To be honest, had it not been for the recent stance taken by Western governments no one would have known but us,” the hacker told Motherboard. The hacker expressed disdain for recent changes in surveillance legislation.

Cellebrite's response to the hack is to claim that the only thing affected was a legacy server for end user licenses. Customers are being encouraged to change their passwords, but that comes a little too late to do much good. That license server may be the only thing breached through unauthorized means, but the log files and obtained evidence the hackers appear to have could easily have been taken out of the front end with compromised credentials.

The underlying fact is this: breaking protections like encryption or purchasing exploits to defeat it is something the FBI and other law enforcement entities will continue to advocate for, even while aware that it's impossible to claim definitively that the tools used won't be hijacked by someone else with more malicious motives. The Shadow Brokers' heist of NSA exploits shows that even if the government takes steps to protect what it has stored on its own servers, it can't prevent a disgruntled analyst from leaving a blackhat toolbag behind for others to find once a surveillance job is finished.

Filed Under: backdoors, encryption, hacking, phones
Companies: cellebrite

Congressional Committees Say Backdooring Encryption Is A Bad Idea

from the sorry,-Jim,-but-thanks-for-asking! dept

Two bipartisan Congressional committees are the latest to express their opposition to government-mandated encryption backdoors. The House Judiciary Committee and the House Energy and Commerce Committee have arrived at the same conclusion as the experts FBI director James Comey insists on ignoring: encryption backdoors are a net loss for everyone, no matter what gains might be experienced by law enforcement and intelligence agencies.

This is stated plainly in the first bullet point of its encryption report [PDF]:

Any measure that weakens encryption works against the national interest

While the committees acknowledge encryption can impede investigative efforts, the downsides of backdoors cannot be offset by making things easier for certain government agencies.

[S]takeholders from all perspectives acknowledged the importance of encryption to our personal, economic, and national security. Representatives of the national security community told the EWG that strong encryption is vital to the national defense and to securing vital assets, such as critical infrastructure. Civil society organizations highlighted the importance of encryption for individual privacy, freedom of speech, human rights, and protection against government intrusion at home and abroad. Private sector stakeholders—in particular, their information security officers—and members of the academic community approached the question from an engineering perspective—against a wide array of threats, foreign and domestic, encryption is one of the strongest cybersecurity tools available.

However, the committees still believe there might be a way to reconcile competing interests, even though it has more questions than answers at this point. The report suggests more "collaboration" between tech companies and law enforcement agencies -- a term that generally means most of the compromises will be made by the private sector. Whether this means companies collecting more data and communications and storing them where law enforcement can access them or creating "one time" backdoors in response to court orders remains to be seen.

More encouragingly, the report suggests the "smart guys" in law enforcement haven't fully taken advantage of the tools and data available to them.

It also remains unclear whether the law enforcement community is positioned to fully leverage the unencrypted information still held by many companies. A number of stakeholders acknowledged the potential benefit of improving law enforcement’s understanding of what data or information is available, who controls it, and how it could be useful to investigators. In particular, companies are often able to provide volumes of unencrypted metadata associated with their products or services. In some cases, this source of information could be useful to investigators. In others, one representative of a law enforcement agency told the EWG, access to a stream of metadata might be more like “looking for a particular grain of sand on the beach.”

This is probably the result of the law enforcement mindset. It often seems agencies are more interested in what is quickest and easiest, rather than what might be more productive, if just a bit more difficult. (A number of cases where warrants were never obtained, despite officers having both the time and probable cause to do so, is evidence of this mindset.) The report suggests this is one area where things could be improved by collaboration with private companies. It's not a terrible suggestion but it's one that requires agencies to move on from their defeatist attitudes and to stop pretending advances in technology are always far more beneficial to criminals than to law enforcement.

The report also inadvertently points out just how disingenuous it is to shrug off mass surveillance concerns by saying, "It's just metadata."

Metadata may not completely replace the loss of encrypted content, but metadata analysis could play a role in filling in the gap. The technology community leverages this information every day to improve services and target advertisements. There appears to be an opportunity for law enforcement to better leverage this information in criminal investigations.

The report also touches on "legal hacking" as a potential solution -- albeit one with very limited practical application. If this is the route the government chooses to go more frequently in response to encrypted devices, it will signal the end of the already mostly-worthless Vulnerabilities Equity Process. It would also -- as the report acknowledges -- only further the "us vs. them" conflict between tech companies and law enforcement, as the government's interest in keeping vulnerabilities secret would tend to outweigh its obligation to divulge security holes to affected companies.

While the report breaks very little new ground in terms of issues raised, it does at least signal that legislative efforts to undermine encryption aren't likely to find much bipartisan support. So, for the time being, device encryption is still safe. It's the other issues raised -- legal hacking, compelled disclosure, etc. -- that will need to be watched closely in the future.

Filed Under: backdoors, congress, crypto wars, encryption, going dark, house energy & commerce committee, house judiciary committee, james comey

European Information Security Advisory Says Mandating Encryption Backdoors Will Just Make Everything Worse

from the solving-little,-breaking-lots dept

More and more entities involved in government work are coming out in support of encryption. (Unfortunately, many governments are still periodically entertaining backdoor legislation...) While recognizing the limits it places on law enforcement and surveillance agencies, they're not quite willing to sacrifice the security of everyone to make work easier for certain areas of the government.

The European Union for Network and Information Security (ENISA) has just released its report [PDF] on encryption and finds it to be pretty much essential for everyone's security. Any efforts to undermine this harms the public more than it helps them. (h/t Tom's Hardware)

There is a legitimate need to protect communications among individuals and between individuals and public and private organisations. Cryptography provides the electronic equivalent of letter cover, seal or rubber stamp and signature. In the light of terror attacks and organised crime, law enforcement and intelligence services have requested to create means to circumvent these protection measures. While their aims are legitimate, limiting the use of cryptographic tools will create vulnerabilities that can in turn be used by terrorists and criminals, and lower trust in electronic services, which will eventually damage industry and civil society in the EU.

Mandating backdoors will hurt the countries where they're implemented, sending customers in search of secure computer equipment and services elsewhere. Beyond that, there's the fact that all backdoors can be exploited. Thousands or millions of device users could be negatively affected while very few criminals will suffer adverse effects. If a backdoor exists, it can be exploited by either "side," but only the criminal side will be able to protect itself from unwanted intrusion. Because if you're going to break a few laws, why not break one that forbids you from owning or operating devices with non-backdoored encryption?

Or you could just roll your own...

Technology is changing at a very fast pace. It is questionable if solutions such as backdoors will be effective given that criminals can develop their own encryption technologies.

As ENISA points out, it's not just exploitation by criminals that's the problem. It's also exploitation by government agencies, which may use the handy backdoors to collect/intercept far more than they're legally allowed to.

Judicial oversight may not be a perfect solution as different interpretations of the legislation may occur.

One agent's facially-invalid search warrant is the same agent's legally-unassailable judicial order. This is enough of a problem in the US, where multiple federal districts have resulted in contradictory opinions on identical legal arguments. In the European Union, the problem is only exacerbated. Not only are there multiple courts, but also multiple nations, all with their own laws. Sure, there's an attempt to unify guidance on technical/legal issues under the EU, but only so much can be done. Deciding what is or isn't abusive use of government-mandated backdoors is going to be far from consistent. And that, of course, requires a unified European stance on encryption backdoors, which isn't likely to happen either.

Ultimately, ENISA concludes that tech advancements do pose legitimate challenges to law enforcement/national security efforts, but backdoors are no way to solve the problem. But the solution it does suggest isn't much better. Here in the US, courts routinely defer to Congress when the remedy sought isn't within their power. Over in the EU, ENISA suggests legislative measures are the wrong approach.

Other procedural approaches should be explored that focus on the power of the judicial process to find solutions.

Unfortunately, ENISA does not drop any hints about how EU courts might be able to address government agencies' complaints about encryption. This suggests some sort of All Writs Ordering might be the way around being locked out of devices and computers -- blanket court orders that compel assistance from service providers and manufacturers under the threat of whatever the court can come up with. While this would cause less damage to security than mandated backdoors, a court-ordered backdoor is still a backdoor, and judicial oversight wouldn't be enough to prevent government abuse of these "one time only," purposefully-induced security holes.

Filed Under: backdoors, encryption, enisa, eu, europe, security

Encryption Survey Indicates Law Enforcement Feels It's Behind The Tech Curve; Is Willing To Create Backdoors To Catch Up

from the trading-brute-force-for-extra-keys dept

To get a general feel for European law enforcement encryption sentiment (so to speak), the European Union sent questionnaires to member countries, asking for details on what forms of encryption are encountered most frequently and what these agencies feel would be the best approach to tackling encrypted data going forward.

Surprisingly, the EU received several responses and most have been published in full. (The list of PDFs/HTML versions can be found near the bottom of this page.) They were issued in response to a public records request by Rejo Zenger of Dutch digital rights group, Bits of Freedom.

Security researcher Lukasz Olejnik went through the posted documents to find the highlights/lowlights of the submissions. Several countries responded to the EU's questionnaire, but only twelve of those made their answers public. (And, in the case of the UK and the Czech Republic, some answers were redacted.)

Most responding agencies in most countries are running into the same encryption issues.

Countries point to difficulty of tackling encrypted data, in particular: encrypted data at rest (using solutions such as TrueCrypt),encrypted data in transit (e.g. SSH, HTTPS, Tor), use of instant messengers such as Skype, WhatsApp, etc., and encrypted mobile devices

Countries disclose they lack resources such as technology, money or personnel, to effectively fight cybercrime

But not every country treats encryption "problems" the same way. A few didn't consider HTTPS to be an encryption form worth noting, perhaps because it doesn't cover the sort of data or communications they frequently target.

Others, like agencies in Italy (in an ALL CAPS reply), aren't so much worried about encrypted data in transit as much as they are worried about very specific data at rest, located in very specific consumer devices.

AS FOR OFFLINE ENCRYPTION, ONE MAIN PROBLEM IS WITH ONE OF THE MAJOR DEVICES COMPANY.

Hmm. I wonder which "major devices company" that would be? It seems this same "devices company" also thwarts law enforcement's wiretap efforts...

THERE ARE DIFFERENT TECNIQUE ADOPTED CASE BY CASE IN ORDER THE TRY TO DECRYPT THE INTERCEPTED DATA. ALSO USING THIRD PARTIES (PRIVATE INDUSTRIES/COMPANIES) RESOURCES.

IN ADDITION THE MAIN IUSSES OFTEN CONCERN THE DIFFICULTY IN REMOTELY INSTALLING THE “WIRETAP TROJAN” ONTO SUSPECTS’ DEVICE, ESPECIALLY WITH REGARD TO ONE OF THE MAJOR BRAND.

...aaaand forensics efforts.

THE MAIN IUSSES RESULT FROM THE TECHNICAL IMPOSSIBILITY OF DECRYPTING ONE OF THE MAJOR BRAND’S DEVICES.

There seems to be no consensus on mandated encryption backdoors, but there are more than a few countries leaning that way. Estonia believes the problem is of a "technical nature," rather than one that should be solved through mandated backdoors. Belgium's submission flat-out states the country isn't interested in seeking mandated backdoors.

A regulation to prohibit or to weaken encryption for telecommunication and digital services has to be ruled out, in order to protect privacy and business secrets.

On the other end of the spectrum, Poland openly calls for deliberately weakened/compromised encryption.

One of the most crucial aspect will be adopting new legislation that allows for acquisition of data stored in EU countries “in the cloud” without need to apply for MLAT. There is also need to encourage software/hardware manufactures to put some kind “backdoors” for LEA or to use only relatively weak cryptographic algorithms.

The call for backdoors is echoed by Latvia and Italy.

In between, there are several countries that allude vaguely to working in conjunction with tech companies to find some sort of balance between user security and law enforcement's desires. (Then there's Italy, which mostly seems interested in seeing Apple devices wiped from the face of the earth.)

There are almost as many approaches as there are responding countries. We can only speculate on the contents and assertions made by countries that have refused to release their answers for "national security" reasons, but one would expect those with the most to "hide" would be more likely to expect citizens to give up their security for the good of the nation.

Filed Under: backdoors, encryption, going dark, law enforcement

Manhattan DA Cy Vance Wraps Up 2016 With Another Call For Gov't-Mandated Encryption Backdoors

from the stay-the-course dept

Manhattan DA Cyrus Vance is still riding James Comey's anti-encryption coattails. Another year passes and Vance still comes to the same conclusions about phone encryption: it's bad for law enforcement and something (legislative) needs to be done to keep the criminal apocalypse at bay.

His opening remarks at a recent cybercrime symposium set the tone:

In my Office alone, 423 Apple iPhones and iPads lawfully seized since October 2014 remain inaccessible due to default device encryption. Approximately 10% of our warrant-proof devices pertain to homicide or attempted murder cases, and 9% to sex crimes. And while we’ve been locked out of approximately 34% of all Apple devices lawfully recovered since October 2014, that number jumped to approximately 42% of the devices recovered in the past three months.

With over 96% of all smartphones worldwide operated by Apple and Google, and with devices running older operating systems rapidly aging out, the trend is only poised to continue. In other words, the risks associated with warrant-proof encryption remain, and are growing.

This is all just Vance's pitch for the 2016 edition of his "Phone Encryption is Bad" report. It's available at the DA's website but you'll have to dig around for it. (Or simply download it using this link.) It's the same things Vance said last year, only with some added bold print surrounding his pitch for legislated backdoors. (All emphasis in the original.)

As illustrated by the San Bernardino domestic terrorist attack in December 2015, as well as by the ever-increasing number of smartphones lawfully seized by law enforcement that cannot be accessed by law enforcement or by Apple, the threat to public safety is increasing rapidly.

This isn't much of a pitch. The FBI fought a long battle seeking a favorable precedential ruling before turning the phone over to a foreign company. The FBI likely believed the phone was as useless as it ended up being (it was a work-issued phone -- hardly the sort of place someone stores incriminating communications), but it wanted something it could take to the next legal battle over encrypted data. The presumed increase to "public safety threats" is never more than a theory -- one that presumes every locked phone contains a wealth of usable evidence.

Vance's push for anti-encryption legislation continues, even as he notes there's very little in terms of precedent for what he's proposing.

Several foreign nations, often spurred by the fear of terrorism, have addressed the question of whether manufacturers and software providers can be compelled to extract data from smartphones that they manufacture or for which they provide software. These nations’ efforts in this endeavor have been halting.

The few legislative efforts he can name are all dead in the water, including a few state efforts that have seen little forward momentum. This leads Vance to the conclusion that the only way to fix this is to make it a federal effort, something that still seems to have little chance of success.

Federal legislation is required to address the problem of smartphones whose contents are impervious to search warrants. Two proposed bills, the Compliance with Court Orders Act, drafted by Senators Richard Burr and Dianne Feinstein, and a bill drafted by our Office, would adequately address the problem.

Elsewhere in the report, Vance details other law enforcement agencies' struggles with encrypted devices. Then he throws out this statement, which makes it clear those fighting device encryption are still unwilling to provide accurate numbers about how often locked phones thwart investigations.

These figures [number of locked devices] are almost certainly artificially low, because law enforcement agents who encounter a locked device in the field often do not have the time to make note of the device before moving on to the next investigative step.

You would think that law enforcement agencies -- those presumably interested in the possibility of legislated backdoors -- would be tracking each and every instance in which encryption is encountered. But Vance's speculation seems to indicate that other law enforcement agencies aren't nearly as troubled by encryption as he is... or that they're just generally kind of sloppy when handling potential evidence.

The entire report presents a world where ever-growing encrypted "darkness" is turning law enforcement agencies into useless extensions of the government. A world where even the best-funded agencies with the access to a variety of tech solutions can be beaten by a consumer communication product. It's not exactly apocalyptic, but it does present the situation as being wholly untenable without the federal government stepping in and kicking open a backdoor.

Vance -- like others who only see mandated backdoors/encryption bans as workable -- also claims tech and law enforcement should work together to create solutions -- a statement that really means tech companies should be more willing to compromise their principles for the greater good of the government.

Filed Under: backdoors, cy vance, encryption, going dark

If The FBI Can't Stop All These Leaks About An Investigation, Why Would it Be Able To Keep Encryption Backdoor Secret?

from the bunch-of-leakers dept

In the last 10 days or so, James Comey sent two letters to Congress -- the first one notifying Congress of some new information in an "unrelated" investigation that may pertain to Hillary Clinton's emails. And then the one from yesterday admitting that there was nothing important in those emails. That was effectively all that Comey said officially. Yet, in between all of that a ton of information leaked from the FBI about the investigation. We learned what it pertained to (the Anthony Weiner investigation), heard estimates of the number of emails involved, heard that the FBI found them weeks ago but only told Comey right before he sent the letter, that the FBI didn't have a warrant to read the emails -- and then that it did, and that a whole bunch of people inside both the FBI and DOJ have opinions on both sides of this whole mess.

Basically, the FBI (and the DOJ) were leaking information like it was the last chance they'd ever have to leak information and their lives depended on who could leak the most.

And, remember, this is the same damn agency that is so insistent on forcing tech companies to put backdoors into any encryption to make sure the FBI can get into anything it wants. Yet, they can't keep the basic details of an investigation secret? And then they expect everyone to just accept it when they say that we can trust them to keep backdoors secret and to only use them appropriately? That seems like a huge leap of faith for a government bureau that has done almost nothing to deserve that kind of support.

The next time (and it's coming...) the FBI starts talking about "Going Dark" and how it needs to break basic technology tools, perhaps stand up and remind people that this is an organization that can't keep its own secrets very well. Perhaps we shouldn't trust it with all of our secrets as well.

Filed Under: backdoors, encryption, fbi, going dark, james comey, leaks