Federal Case Shows Cops Still Have Plenty Of Options When Dealing With Device Encryption

from the you-don't-need-a-backdoor-if-the-front-door-has-been-left-open-inadvertently dept

If no one's going to give you an encryption backdoor, maybe you just need to inconspicuously prop open the front door. That's what one cop did in this case discussed by a federal court in Minnesota. (via FourthAmendment.com)

After being picked up by Task Force Officer (TFO) Adam Lepinski on suspicion of being involved in a shooting, Johnnie Haynes asked for some phone numbers off the phone Lepinski had taken from him. (A side note: TFO Lepinski was off-duty, moonlighting as security for a parking lot when he arrested Haynes. But he was still in his full uniform. This seems problematic.)

Lepinski gave the phone back to Haynes who unlocked it with his thumb print. Haynes told Officer Lepinski the numbers and the officer wrote them down for him. He then gave the phone back to the officer with an indication he wished to have his phone locked again. From the order [PDF]:

While reading numbers with the phone in his hand, Haynes said “This the last number right here, man. And then I’m going to turn my phone off.”

That's not what happened. Lepinski's testimony and his body camera footage show the officer instead made sure the phone would not return to a locked state while he sought a warrant.

After “a matter of minutes,” TFO Lepinski changed the settings on the cell phone, which was still unlocked. TFO Lepinski disabled the automatic-lock feature by changing the settings to a setting called “never lock” to prevent the screen from going to sleep or locking. TFO Lepinski believed this was the first instance where he had changed the settings on a cell phone. TFO Lepinski testified that he changed the settings because he did not have the passcode for the phone and believed that he would be able to get into the phone easier to get the data off the phone if it remained unlocked.

No one denies the suspect made it clear he wanted his phone returned to its locked state. The officer handling Haynes and his phone not only ensured it would not lock again by changing its internal settings, he also lied to Haynes about the phone's unlocked state.

At Haynes’s request, TFO Lepinski went back inside the precinct and retrieved another phone number from Haynes’s cell phone. After writing down the phone number on a piece of paper, TFO Lepinski placed the cell phone in a manila envelope, held the envelope flat to prevent the phone from locking, and returned to the squad car. TFO Lepinski handed the piece of paper to the officer in the squad car and notified Haynes of that action. At that time, Haynes asked TFO Lepinski “Did you lock my phone back up? Is it locked up?” TFO Lepinski, carrying the phone in the manila envelope, said the phone was “right here” and would be property inventoried. Haynes responded, “But did you lock it up” and TFO Lepinski responded, “Yes, it is,” to which Haynes continued, “or did you go in it?” TFO Lepinski replied, “I got the number out of it. You asked me to, right?” and Haynes responded, “Oh, OK. Yeah.” TFO Lepinski testified that the cell phone was actually unlocked when he told Haynes that it was locked.

Once a warrant was obtained, the phone was hooked up to a GrayKey device to extract data and communications. According to the officer that performed the search, the phone being on, rather than powered down (a state called "after first unlock" or "AFU"), made it a little easier to extract data from it.

Officer Gustafson later testified that “[t]he GrayKey cannot access 100 percent of Apple devices, but I would say if the device is left on at the time it is seized, whether it is locked or unlocked, and the user has been using the device, I would say roughly 90 percent or more of Apple devices can be accessed.” If the cell phone is left on, the chances increase of being able to access it with GrayKey.

[...]

Officer Gustafson estimated that he retrieved over 95 percent of the data that was on Haynes’s cell phone.

Haynes moved to suppress the evidence pulled from his phone, arguing that TFO Lepinski's original "search" -- the one where he changed settings to prevent the phone from locking -- was illegal. And if that search was illegal, so was the more in-depth search that followed.

The government argued -- citing the Supreme Court's Riley decision of all things -- that Lepinski's changing of the phone settings was nothing more than "securing the scene" of a suspected crime. The Riley decision is cited because of the judges' speculation about how law enforcement could handle edge cases involving device encryption or remote wiping. The judges said using a Faraday cage/bag or putting the phone in airplane mode could prevent remote wiping. And encryption might not pose a problem if the device was seized in an unlocked state, allowing officers to keep it in an unlocked state until evidence could be collected from it.

But there's a difference here. This wasn't "securing a scene." In fact, it diverges greatly from the hypothetical posed by the Supreme Court.

The Government argues that TFO Lepinski’s act in changing the settings was tantamount to securing a scene pending a search warrant. The Court has some concerns about this argument. TFO Lepinski did not “happen to seize a phone in an unlocked state” as contemplated in Riley. The cell phone was seized when TFO Lepinski walked Haynes to the First Precinct and searched him incident to arrest. The phone was locked when TFO Lepinski took it out of Haynes’ pocket during the search incident to arrest. It was not unlocked until TFO Lepinski retrieved it to obtain the phone numbers requested by Haynes and Haynes unlocked it with his thumbprint for that purpose.

[...]

Under these circumstances, it is not clear that the dicta in Riley suggesting that law enforcement can change settings on a phone to prevent encryption if they happen to seize a phone in an unlocked state or the case law authorizing securing a scene to maintain the status quo pending a warrant would apply to the facts of this case.

Unfortunately, even if this act was a search -- which the court doesn't expressly agree it is -- it had little bearing on what happened following it. The phone was searched with a GrayKey device that likely would have pulled as much information from it even if it had been locked. What mattered most, apparently, was that the phone had been on and unlocked previously ("after first unlock"). The court says the overall success rate of GrayKey searches makes this inevitable discovery from an independent source, rather than a violation of the Fourth Amendment.

Haynes’ argument assumes that the only options TFO Lepinski had were (1) turn the phone off to prevent remote wiping or (2) place the phone in airplane mode (which he contends is an illegal search). That is not accurate. TFO Lepinski had the option of doing nothing, and leaving the phone in a powered-on, locked state—the status quo of the phone when seized. Indeed, it appears unlikely that TFO Lepinski would have turned the cell phone off due to remote wiping concerns, because that would lock the phone. If the phone had been kept in its powered-on, locked state, it would have been in an AFU state, and GrayKey would have extracted the same data that was extracted from the phone in its unlocked state. For these reasons, the Court finds that the results of the search of Haynes’ cell phone after TFO Lepinski obtained a warrant constitute an independent source of the evidence, and recommends denial of the Motion and Supplemental Motion on that basis.

This order shows there's more than one way to approach the challenges raised by device encryption. Rather than just complain about it to legislators, law enforcement officers can keep devices unlocked or adjust their settings to keep them unlocked without worrying too much about the Fourth Amendment. But that's only if they constrain themselves from looking at other stuff while changing settings. And that's only in this case in this court where cops used a data extraction device that would have given them pretty much everything they got even if the officer hadn't changed the sleep settings.

However, the Fourth Amendment could swiftly come back into play if law enforcement uses one of Grayshift's other offerings: spyware that allows officers to keylog passcodes and PINs if they're given an opportunity to install the software. This case shows just how easily such a thing could be done. Installing malware would be far more intrusive than simply changing sleep/security settings. Then again, at least one court has held that simply glancing at the lockscreen of a phone constitutes a search, so there's a chance this suppression order might be overturned if it's appealed.

Filed Under: encryption, going dark, law enforcement, settings

Researcher Buys Axon Cameras On eBay, Finds They're Still Filled With Recordings

from the not-even-using-'password'-for-the-password dept

Data isn't secure just because nothing happened to it when it was still in your possession. It can still "leak" long after the storage device has gone onto its second life in someone else's hands.

The Fort Huachuca Military Police were just apprised of this truism by Twitter user KF, who had purchased some used Axon body cameras on eBay. The cameras still contained their microSD storage cards. And contained on those storage cards were a bunch of recordings (including audio) that hadn't been wiped by the MPs before the cameras ended up on eBay.

The whole thread is worth a read (here's an unrolled version if you prefer to go somewhere other than Twitter). No one seems to know how the cameras ended up on eBay, but it's pretty amazing they ended up in the secondary market with their recordings still intact.

What's more amazing (but somehow simultaneously less surprising) is that the recordings weren't encrypted or protected by a password. Axon responded to the Arizona Mirror's reporting of this secondary-market breach by saying it was "looking into the matter." It also said it would be putting more effort into telling its law enforcement customers what they should already know.

“We are… reevaluating our processes to better emphasize proper disposal procedures for our customers.”

What's more reassuring is that this data disposal carelessness is no longer as much of an issue for Axon customers. The cameras in KF's hands are first-generation models produced in 2015. Axon's latest version encrypts recordings and, presumably, forces officers to select passwords to ensure this encryption isn't rendered useless by a lack of login protection.

eBay also responded to questions from the Mirror, stating that it forbids the sale of surveillance devices like the ones KF was able to purchase. It also said sellers are responsible for making sure internal storage is wiped before making devices eBay says it does not allow to be sold on the site are made available for sale on the site.

Security matters. But situations that demand the utmost in care are too often handled in ways that an octogenarian using their first computer ever would find amateurish. KF's site contains this amusing/scary security test of police in-car camera systems -- cameras the researchers were able to view live after discovering zero authentication was needed to access this stream. And the system itself was only "protected" by the default login/password, which the researchers found in a PDF copy of the device's manual after a little bit of Googling.

For all the talk from law enforcement officials about the need to redact and/or withhold recordings out of concern for people's privacy, they don't seem to be very concerned that these recordings are ending up in the hands of the public. Nor does there seem to be much concern that recordings might be improperly accessed by other personnel with access to the devices while the cameras were still being used by the Fort Huachuca police. The lack of password protection is just as alarming as the apparent lack of proper disposal procedures. This is consumer-grade carelessness exercised by a taxpayer-funded entity with a whole lot of power and the obligation to be better public servants.

Filed Under: body cameras, disposal, encryption, evidence, fort huachuca, recordings
Companies: axon, ebay

New EARN IT Act Creates An Insane New Dilemma: Either Encrypt All Or Spy On All

from the this-seems-counterproductive dept

Last week, as predicted, the Senate Judiciary Committee voted unanimously to replace the original EARN IT Act, with a new one. As part of the markup, they also voted to approve Senator Patrick Leahy's amendment which some might read to say that EARN IT cannot be used to block encryption -- but the reality is a lot more complicated. As I'll explain, this new bill is terrible in a different way than the old bill: it will create a new dilemma in which internet services will either feel compelled to encrypt everything or in which the only way you'll be able to use any internet service is if you hand over a ton of personal information to the service provider -- potentially putting your privacy at extreme risk.

First lets acknowledge an oddity about this new bill. Both bills involve the creation of a commission to come up with "best practices" in trying to stop "child sexual abuse material" or CSAM (the concept formerly known as child porn). In the old bill, if sites didn't follow the commission's best practices, they could lose their Section 230 protections. This resulted in fears that the commission would outlaw encryption as a "best practice." The new bill retains the commission, but for no recognizable purpose. Instead, it does away with the pretense and just says that a bunch of sites should lose Section 230 protections no matter what. It seems quite odd to first say "we need a commission to determine best practices" and then on a second pass say that before the commission has done anything we're just going to make massive changes to Section 230 based on... nothing at all. No evidence saying that this would create better outcomes. No evidence that Section 230 is a problem with regards to CSAM. Just... nothing.

Specifically, the new bill makes a change to Section 230 that looks similar to the change that was made with FOSTA, saying that you don't get 230 protections if you advertise, promote, present, distribute, or solicit CSAM. But here's the thing: CSAM is already a federal crime and all federal crimes are already exempted from Section 230. On top of that, it's not as if there are a bunch of cases anyone can trot out as examples of Section 230 getting in the way of CSAM prosecutions. There's literally no evidence that this is needed or will help -- because it won't.

As we've detailed before, the real scandal in all of this is not that internet companies are facilitating CSAM, but that the DOJ has literally ignored its Congressional mandate to go after those engaged in CSAM production and distribution. Congress tasked the DOJ with tackling CSAM and the DOJ has just not done it. The DOJ was required to compile data and set goals to eliminate CSAM... and has just not done it. That's why it's bizarre that EARN IT is getting all of the attention rather than an alternative bill from Senators Wyden, Gillibrand, Casey and Brown that would tell the DOJ to actually get serious about doing its job with regards to CSAM, rather than blaming everyone else.

But digging into the details, the real problem here is that, as structured, the new EARN IT Act would be a disaster in trying to achieve the goals the sponsors have set out for it. First off, thanks to the addition of Senator Leahy's Amendment, some may see the bill as one that effectively requires encryption to avoid liability for CSAM. Even that's not totally clear, however. While you can read Leahy's amendment to say that encryption is protected, the actual structure of the final bill punts many issues to state law, and that means having to comply with 50 different state laws. Some, like Illinois, have lower standards for the mens rea regarding CSAM, and the worry is that we won't know whether or not offering end-to-end encryption would be seen as violating state laws until long and costly cases go through their lengthy process.

Either way, this weird CSAM carveout from Section 230 is somewhat equivalent to the moderator's dilemma that other attempts to change Section 230 create. Because most of those other reforms put in place a "knowledge" standard, it gives many sites a reason to never look at the content on their platform. In this case, due to the explicit call out saying that encryption isn't impacted, that would effectively say that if you want to keep 230 protections, you should encrypt absolutely everything. Which, ironically, is the exact opposite of what Attorney General Bill Barr has been asking for.

But, as with the moderator's dilemma, there's also a flipside (if you don't want to ignore everything, then you have to greatly restrict what you allow through). Under the new EARN IT, the flipside is that the government more or less says that you are now responsible for being able to track and identify anyone on your service who is not using encryption -- meaning you would need to carefully verify every user of your platform. No more simple signups. No more anonymity. And, incredibly, this would mean that sites would need to collect a ton of data on every user. Want to use this new service? First submit your phone number, driver's license, etc.

At a time when people are saying they trust big internet companies less and less with their data, why would Senators Graham, Blumenthal, Feinstein, and Hawley (HAWLEY!?!?) be encouraging websites to collect even more (and more intrusive) data on all their users?

Since this is somewhat different than the traditional moderator's dilemma, it might be called the "censor's dilemma" or possibly the "middleman's dilemma," in that this is even more tied to the government's demand that websites block certain content entirely, which puts them in the role of a government middleman or censor (which, not coincidentally, would raise serious constitutional issues with the EARN IT Act turning private entities into state censors).

Either way it is difficult to see how these two outcomes are what Congress (or, for that matter, the DOJ) actually wants:

• Much greater encouragement for websites to encrypt everything
• Much greater encouragement for websites to demand much more personal and private information on users.

And yet, thanks to Congress' standard bungling, that's what we have with the current EARN IT Act. And while it might be nice if the law actually did encourage more encryption, don't pin your hopes on that. As noted above, it's not entirely clear that it really does lead to that outcome, and we might not know until after a whole bunch of litigation. Furthermore, if that is is the end result, it will almost certainly lead to a different kind of backlash and support for even worse laws that seek to blow up encryption through other methods.

In short: the EARN IT Act is bad. At best it might encourage more encryption, but it would also create a whole host of unintended consequences, including much less privacy and no more anonymity on many websites. It's difficult to see how that accomplishes any of the goals of the bill's supporters.

Filed Under: censor's dilemma, data, dilemma, earn it, earn it act, encryption, lindsey graham, middleman's dilemma, moderator's dilemma, patrick leahy, privacy, richard blumenthal, verification

Senate Waters Down EARN IT At The Last Minute; Gives Civil Liberties Groups No Time To Point Out The Many Remaining Problems

from the this-is-still-a-bad-bill dept

As expected, the EARN IT Act is set to be marked up this week, and today (a day before the markup) Senators Graham and Blumenthal announced a "manager's amendment" that basically rewrites the entire bill. It has some resemblance to the original bill, in that this bill will also create a giant "national commission on online child sexual exploitation prevention" to "develop recommended best practices" that various websites can use to "prevent, reduce, and respond to the online sexual exploitation of children," but then has removed the whole "earn it" part of the "EARN IT" Act in that there seems to be no legal consequences for any site not following these "best practices" (yet). In the original bill, not following the best practices would lose sites their Section 230 protections. Now... not following them is just... not following them. The Commission just gets to shout into the wind.

Of course, we've seen mission creep on things like this before, where "best practices" later get encoded into law, so there remain significant concerns about how this all plays out in the long run, even if they've removed some of the bite from this version.

Instead, the major "change" with this version of EARN IT, is that it basically replicates FOSTA in creating a specific "carve out" for child sexual abuse material (CSAM, or the artist formerly known as "child porn"). It's almost an exact replica of FOSTA, except instead of "sex trafficking and prostitution" they say the same thing about 230 not impacting laws regarding CSAM. This is... weird? And pointless? It's not like there is some long list of cases regarding CSAM where Section 230 got in the way. There are no sites anyone can point to as "hiding behind Section 230" in order to encourage such content. This is all... performative. And, if anything, we're already seeing people realize that FOSTA did nothing to stop sex trafficking, but did have massive unintended consequences.

That said, there are still massive problems with this bill, and that includes significant constitutional concerns. First off, it remains unclear why the government needs to set up this commission. The companies have spent years working with various stakeholders to build out a set of voluntary best practices that have been implemented and have been effective in finding and stopping a huge amount of CSAM. Of course, there remains a lot more out there, and users get ever sneakier in trying to produce and share such content -- but a big part of the problem seems to be that the government is so focused on blaming tech platforms for CSAM that they do little to nothing to stop the people who are actually creating and sharing the material. That's why Senator Wyden tried to call law enforcement's bluff over all of this by putting out a competing bill that basically pushes law enforcement to do its job, which it has mostly been ignoring.

On the encryption front: much of the early concern was that this commission (with Attorney General Bill Barr's hand heavily leaning on the scales) would say that offering end-to-end encryption was not a "best practice" and thus could lead to sites that offered such communication tools losing 230 protections for other parts of their site. This version of EARN IT removes that specific concern... but it's still a threat to encryption, though in a roundabout way. Specifically, in that FOSTA-like carve out, the bill would allow states to enforce federal criminal laws regarding CSAM, and would allow states to set their own laws for what standard counts as the standard necessary to show that a site "knowingly" aided in the "advertisement, promotion, presentation, distribution or solicitation" of CSAM.

And... you could certainly see some states move (perhaps with a nudge from Bill Barr or some other law enforcement) to say that offering end-to-end encryption trips the knowledge standard on something like "distribution." It's roundabout, but it remains a threat to encryption.

Then there are the constitutional concerns. A bunch of people had raised significant 4th Amendment concerns in that if the government was determining the standards for fighting CSAM, that would turn the platforms into "state actors" for the purpose of fighting CSAM -- meaning that 4th Amendment standards would apply to what the companies themselves could do to hunt down and stop those passing around CSAM. That would make it significantly harder to actually track down the stuff. With the rewritten bill, this again is not as clear, and there remain concerns about the interaction with state law. Under this law, a site can be held liable for CSAM if it was "reckless" and there are reasons to believe that state laws might suggest that it's reckless not to do monitoring for CSAM -- which could put us right back into that state actor 4th Amendment issue.

These are not all of the problems with the bill, but frankly, the new version is just... weird? It's like they had that original "earn" 230 idea worked out, and were convinced that couldn't actually work, but were too wedded to the general idea to try to craft a law that actually works. So they just kinda chucked it all and said "recreate FOSTA" despite that not making any sense.

Oh, and they spring this on everybody the day before they mark it up, giving most experts almost no time to review and analyze. This is not how good lawmaking is done. But what do you expect these days?

Filed Under: 4th amendment, best practices, child porn, commission, csam, earn it, encryption, section 230, states

Senator Loeffler's New Section 230 Reform Bill Would Threaten Encryption And Pressure Websites To Keep Spam & Porn

from the sorry,-your-spam-filter-violates-the-law dept

Senator Kelly Loeffler has apparently jumped on the grandstanding bandwagon in trying to destroy Section 230 of the Communications Decency Act without understanding the first thing about how any of this works. Loeffler was already a co-sponsor of Josh Hawley's latest dumb bill to reform Section 230 and somehow decided that she had to introduce her own, even dumber, bill. It is clear that Loeffler, the wealthiest elected official in Congress (by a lot), has never spent any time with the actual working people who do content moderation. Because her bill is written by someone who doesn't understand the first thing about how all of this works.

The key to Loeffler's bill is the unconstitutional dream that some ignorant people have that websites shouldn't be able to remove any speech except speech that isn't covered by the 1st Amendment. Among the things her bill would do is change Section 230's famous Section (c)(1) (the so-called "26 words that created the internet" by saying that no website is liable for 3rd party speech) to only apply if a website is focused on moderating "unlawful" speech. Under her bill (c)(1) would go from:

No provider or user of an interactive computer service shall be treated as the publisher or speaker of any information provided by another information content provider.

To:

(A) In General —No provider or user of an interactive computer service that takes reasonable steps to prevent or address the unlawful use of the interactive computer service or unlawful publication of information on the interactive computer service shall be treated as the publisher or speaker of any information provided by another information content provider.

(B) DEFINITION.—For purposes of this paragraph, the term ‘unlawful use of the interactive computer service or unlawful publication of information on the interactive computer service’ includes cyberstalking, sex trafficking, trafficking in illegal products or activities, child sexual exploitation, and any other activity relating to the use of, or publication of information on, an interactive computer service that is otherwise proscribed by Federal law.

This on its own may create tremendous problems for encryption, because one might read this to say, a la the EARN IT Act, that offering end-to-end encryption means that you are not "taking reasonable steps to prevent or address the unlawful use." That's a massive problem, and very, very dangerous.

Then her bill would change (c)(2) -- the less widely used part of Section 230 that says there's no liability for moderation choices targeting "otherwise objectionable" content, would change that part massively to say that it only applies if your moderation is "viewpoint-neutral" and if the site has "a compelling reason for restricting that access or availability."

Finally, the bill would require any website that wants to get these (now greatly limited) protections to put into their user agreement or terms of service something that will "clearly explain the practices and procedures used by the provider in restricting access to or availability of any material" and that if a site restricts content that it "shall provide a clear explanation of that decision to the information content provider that created or developed the material."

In short, this is a bill that would turn Section 230 into what a bunch of ignorant people already think Section 230 is -- one that requires content moderation decisions focused mostly on just speech unprotected by the 1st Amendment, that any content moderation decisions must be done in a "viewpoint-neutral" manner, that it's possible to clearly delineate content moderation policies to the public, and that anyone who has their content moderated should be able to get a full explanation.

Again, these are ideas that sound reasonable if you've never spoken to anyone who's ever done any of this work. Let's just use Techdirt and the way our comments are moderated as an example of why this bill would be insane. As many of you know, our comments are moderated based on user voting, in which users can vote if a comment is "insightful" or "funny" (or both!). They can also vote if a comment is spam/trollish. If a comment meets a key threshold for insightful or for funny, it gets a little icon next to that comment indicating as such (that's a form of content moderation). It is not viewpoint-neutral. It's literally based on the subjective viewpoints of our users, about how they feel. "Neutral" in this context makes no sense. Are we biased against non-insightful, non-funny comments? Hell yes. And we should be.

Of course, these viewpoint decisions are protected by the 1st Amendment, and they would also be if the "bias" were on the silly "left/right" political spectrum. Congress can no more order social media sites to only moderate content in a "viewpoint-neutral" manner than it can tell Fox News or Breitbart to stop only presenting the president's delusional view of the world. They have a 1st Amendment right to do so, just as we have a 1st Amendment right to not give participation trophies to non-funny comments.

Similarly, with our comments that are voted spammish or trollish, if they reach a certain threshold, those comments get "minimized" such that users need to click through to view them. If the comments are truly spammish, then they may get removed entirely. Under Loeffler's bill, we'd then have to spend a ridiculous amount of time explaining to trolls and spammers why we removed or minimized their comments. Which seems like a massive fucking waste of time, and would just lead to dishonest trolls and spammers insisting that their disingenuous arguments were neither trolling nor spamming.

Also, since this is almost entirely determined by user voting, we wouldn't even be able to explain most of the time, since we wouldn't even be the ones making the decisions! I can't explain why our users voted someone's comments to be trollish (or funny or insightful) because I don't know. Yet, under Loeffler's bill... we'd be required to "provide a clear explanation of that decision." Would "because people voted you that way" be clear enough? Who the hell knows, but will Loeffler use some of her immense wealth to pay for the litigation costs for us and everyone else to find out?

Also, it's entirely unclear to me if a platform can actually delete spam under this bill. Is deleting spam "viewpoint-neutral"? Or is it anti-spam? There's an interpretation (and thus, almost certainly expensive litigation) to go through before we find out if sites are protected in deleting spam. Even if deleting spam is considered "viewpoint-neutral" the bill would require sites to explain to every spammer why their content is being deleted, which would be a massive waste of time and resources, such that many sites would simply choose to (a) host all the spam, or (b) stop hosting any user generated content at all, because of all the spam.

What this bill would really do is turn any platform that hosted 3rd party speech into a garbage dump of spam, abuse, porn and harassment. Because the "cost" of removing that "lawful" speech now becomes extremely high. It does seem odd that a Republican Senator would be pushing for a bill that would lead to a lot more porn on the internet in places that formerly had policies against that, but if that's what Loeffler wants... that's what she'll get.

Filed Under: 1st amendment, content moderation, encryption, free speech, kelly loeffler, section 230, viewpoint neutral

Comcast And Mozilla Partner Up To Help Encrypt DNS

from the strange-bedfellows dept

Over at our Tech Policy Greenhouse, Article19's Joey Salazar and Consumer Reports' Benjamin Moskowitz just discussed how it's long past time to encrypt the Domain Name Server (DNS) system at the heart of the internet. Thanks to the GOP demolishing of FCC broadband privacy rules in 2017, ISPs have carte blanche to monetize this data as they see fit, storing and selling access to your DNS browsing data to data brokers who continue to build detailed user profiles with little to no meaningful oversight.

At the forefront of encrypting DNS have been Google and Mozilla, both of which have been pushing for a standard known as "DNS over HTTPS," a significant security upgrade to DNS that encrypts and obscures your domain requests, making it more difficult (though not impossible) to see which websites a user is visiting. The proposal doesn't come without downsides, and has seen opposition from ISPs that are either eager to continue to profit off of this data, or are worried that somebody else will (usually Google) if they can't.

Comcast, AT&T, and others had previously been trying to demonize the Google and Mozilla efforts any way they could, from insisting the move constitutes an antitrust violation on Google's part (it doesn't), to saying it's a threat to national security (it's not), to suggesting it even poses a risk to 5G deployments (nah).

After Mozilla claimed to Congress that ISPs were being disingenuous with their opposition to the plan, at least one major ISP appears to have come around to the proposal. This week Mozilla announced that Comcast had joined the Firefox Trusted Recursive Resolver (TRR) program, which requires encrypted-DNS providers to not only meet privacy and transparency standards, but to promise not to block or filter domains by default "unless specifically required by law in the jurisdiction in which the resolver operates." From the blog post:

"This program aims to standardize requirements in three areas: limiting data collection and retention from the resolver, ensuring transparency for any data retention that does occur, and limiting any potential use of the resolver to block access or modify content. By combining the technology, DoH, with strict operational requirements for those implementing it, participants take an important step toward improving user privacy."

While Comcast has a well-deserved and terrible reputation for anti-competitive behavior, lobbying shenanigans and comically awful customer service, the company's engineering folks remain top notch, and obviously appreciate the benefits of encrypting the DNS in the wholesale snoopvertising age. In conversations, the company continues to insist to be they've never monetized this data (not that anybody in government would ever have the ability or courage to confirm this), and had been running a beta version of its own encrypted DNS offering since last year.

Mozilla helping to standardize this and forming a coalition with Comcast is foundational, and under the partnership, Comcast is promising to not "retain, sell, or transfer to any third party (except as may be required by law) any personal information, IP addresses, or other user identifiers, or user query patterns from the DNS queries sent from the Firefox browser." Now it's just a matter of Comcast transparently proving that they're actually adhering to those standards.

Filed Under: dns, dns over https, encryption
Companies: comcast, mozilla

Senators Launch Full On Nuclear War Against Encryption: Bill Will Require Broken Encryption, Putting Everyone At Risk

from the stop-pushing-this-bullshit dept

Another day, another bad bill. Just as we're coming to terms with the EARN IT Act moving forward in Congress, three Senators -- Lindsey Graham, Tom Cotton, and Marsha Blackburn -- have announced a direct attack on encryption. The full bill is here. It's 51 pages of insanity that would effectively destroy privacy and security on the internet. This is five-alarm fire bad.

For what it's worth, Graham is also a co-sponsor of the EARN IT Act, which makes me wonder if he's going to agree to an amendment of EARN IT that keeps encryption out of it while pushing this bill instead. That's now the rumor making the rounds, and I even received a press release from an anti-porn activist group supporting this bill because they think it will help clarify that EARN IT won't end encryption (none of that makes sense to me either, but...)

The announcement of the bill includes all the usual "think of the children" nonsense, claiming that we can't have encryption because some bad people might use it for bad stuff. The press release summarizes what they claim the bill will do:

Highlights of the Lawful Access to Encrypted Data Act:

• Enables law enforcement to obtain lawful access to encrypted data.

• Once a warrant is obtained, the bill would require device manufacturers and service providers to assist law enforcement with accessing encrypted data if assistance would aid in the execution of the warrant.
• In addition, it allows the Attorney General to issue directives to service providers and device manufacturers to report on their ability to comply with court orders, including timelines for implementation.

• The Attorney General is prohibited from issuing a directive with specific technical steps for implementing the required capabilities.
• Anyone issued a directive may appeal in federal court to change or set aside the directive.
• The Government would be responsible for compensating the recipient of a directive for reasonable costs incurred in complying with the directive.

Incentivizes technical innovation.

• Directs the Attorney General to create a prize competition to award participants who create a lawful access solution in an encrypted environment, while maximizing privacy and security.

Promotes technical and lawful access training and provides real-time assistance.

• Funds a grant program within the Justice Department’s National Domestic Communications Assistance Center (NDCAC) to increase digital evidence training for law enforcement and creates a call center for advice and assistance during investigations.

In short, this basically says "break encryption, but we won't tell you how." We're right back to "nerd harder" except that this time it's "nerd harder, or you're breaking the law."

The problems with this should be evident from all the times we've discussed this before, so I'm really not interested in going over it all again. But the quick summary: installing a "backdoor" or "lawful access" to encrypted communications is not a simple technical problem. As cryptography expert Matt Blaze once said, it's like saying "well, if you can land a man on the moon, why can't you land a man on the sun." A backdoor to encryption literally breaks the encryption and opens up a huge host of other problems, none of which are readily solvable. Instead, you just find more and more problems, each of which makes everyone less secure.

The actual text of the bill is even worse than the summary. It's crazy long so I won't do a full breakdown here, but will call out a few scary, scary bits. The key part is that this basically requires the end of encryption. While there is some language early on about it not applying if "technically impossible," there is other language that more or less cancels that out. Specifically, it requires Apple and other large device sellers to backdoor encryption. It is not an option, but a requirement:

DEVICE MANUFACTURERS.—A device manufacturer that sold more than 1,000,000 consumer electronic devices in the United States in 2016 or any calendar year thereafter, or that has received an assistance capability directive under section 3513, shall ensure that the manufacturer has the ability to provide the assistance described in subsection (b)(2) for any consumer electronic device that the manufacturer—

‘‘(A) designs, manufactures, fabricates, or assembles; and ‘‘(B) intends for sale or distribution in the United States.

So, if you sell more than a million consumer electronic devices in the US, you are required to make sure they have backdoors. That's... going to be a LOT of backdoors. Every Alexa device. Every smart TV. And, of course, every phone. That's devices. How about apps and services? More of the same:

PROVIDERS OF REMOTE COMPUTING SERVICE; OPERATING SYSTEM PROVIDERS.—A provider of remote computing service or operating system provider that provided service to more than 1,000,000 subscribers or users in the United States in 2016 or any calendar year thereafter, or that has received an assistance capability directive under section 3513, shall ensure that the provider has the ability to provide the assistance described in subparagraphs (A) and (B) of subsection (b)(2) for any remotely stored data that the provider processes or stores.

That's... a lot of websites that will be barred from using real end-to-end encryption. The "shall ensure" part is what should scare everyone.

That's still talking about data stored on those servers though. As for "data in motion" again, services will have to provide backdoors under this bill. The reference to "technically impossible" only seems to apply to "independent actions of an unaffiliated entity that make it technically impossible to do". So, the only way to avoid having to break encryption on your own services is to... outsource it to an unaffiliated entity who can make it impossible for you to break the encryption?

As for messaging services: again, the bill "shall ensure" assistance:

A provider of wire or electronic communication service that had more than 1,000,000 monthly active users in the United States in January 2016 or any month thereafter, or has received an assistance capability directive under section 3513, shall ensure that the provider has the ability to provide the information, facilities, and technical assistance described in section 2518(4).

And it gets worse. The bill allows the Attorney General to order someone to break encryption:

If a person fails to comply with a directive issued under subsection (b), the Attorney General may file a petition for an order to compel the person to comply with the directive in the United States District Court for the District of Columbia, which shall have jurisdiction to review the petition.

There's also a giant "NERD HARDER" section, which explains Bill Barr's comments above. Basically it creates a contest, run by the Attorney General, to create a type of backdoored encryption where the Attorney General and his hand-picked judges will determine which technology wins. And by "wins" I mean loses, because that technology will be broken in no time at all, putting everyone at risk.

This whole thing is so incredibly dangerous, and it's not even clear that encryption is a real problem for law enforcement. The basic cost-benefit analysis here is that this law would put everyone, and all our communications, at risk of attack, for a possible benefit in a tiny number of cases, where there remains no evidence that a backdoor would have helped stop any crime. I can't see how the tradeoff is worth it, and any elected official pushing this nonsense should be asked to explain how they weigh these costs and benefits. And if they answer like Bill Barr by saying "smart techies can figure it out" they should have their views discounted for being idiots.

Meanwhile, the press release leads off with quotes from the three sponsors, all of which are head-bangingly wrong, but designed to do the usual tugging at the emotional strings rather than any actual recognition of what they're pushing here:

“Terrorists and criminals routinely use technology, whether smartphones, apps, or other means, to coordinate and communicate their daily activities. In recent history, we have experienced numerous terrorism cases and serious criminal activity where vital information could not be accessed, even after a court order was issued. Unfortunately, tech companies have refused to honor these court orders and assist law enforcement in their investigations. My position is clear: After law enforcement obtains the necessary court authorizations, they should be able to retrieve information to assist in their investigations. Our legislation respects and protects the privacy rights of law-abiding Americans. It also puts the terrorists and criminals on notice that they will no longer be able to hide behind technology to cover their tracks,” said Graham.

There remains little evidence that terrorists have been able to communicate without law enforcement being able to access the info. Remember, the FBI flat out lied about how many devices it had in its possession that it couldn't get into, and has since refused to give an updated number (despite multiple requests). At the same time, every time the FBI does come out and point to a situation where it can't get into a phone, a few months later, they seem to admit that, well, actually, there was a technology that let them get in.

On top of that, we've discussed how law enforcement and the FBI have access to so much other information thanks to social media, and various open source intelligence tools, that the idea that they need to attack encryption is just ridiculous.

And that leaves out something else too: if we put backdoors into encryption, guess what will become a huge target for "terrorists and criminals"? That's right: all of our communications.

“Tech companies’ increasing reliance on encryption has turned their platforms into a new, lawless playground of criminal activity. Criminals from child predators to terrorists are taking full advantage. This bill will ensure law enforcement can access encrypted material with a warrant based on probable cause and help put an end to the Wild West of crime on the Internet,” said Cotton.

This is just a joke. The internet is not "lawless" and there's no indication of increased criminal activity, nor any evidence that law enforcement cannot solve crimes because of encryption or the internet. This bill won't ensure anything other than opening up a new avenue for terrorists and criminals to terrorize.

“User privacy and public safety can and should work in tandem. What we have learned is that in the absence of a lawful warrant application process, terrorists, drug traffickers and child predators will exploit encrypted communications to run their operations,” said Blackburn.

Yes, user privacy and public safety do work in tandem. But you know would would ruin that? Breaking encryption and throwing both of those things into the gutter.

This bill should be trashed and these three Senators (and the Attorney General) deserve mockery for a technically ignorant, totally clueless and dangerous bill that would harm Americans and destroy both privacy and security, because some law enforcement agencies are too lazy to do their jobs. Frankly, the intelligence community should come out screaming about this bill as well, as they know full well how much more dangerous this will make their own work. This is a ridiculous attack on the internet.

Filed Under: backdoors, doj, earn it, encryption, fbi, going dark, laed, lindsey graham, marsha blackburn, tom cotton, william barr

Terrible, Dangerous EARN IT Act Set To Move Forward In The Senate; Attack On Both Encryption And Free Speech Online

from the bad,-no,-bad,-stop-it dept

The attacks never stop. After rumors last week, the Senate Judiciary Committee has officially put the EARN IT Act onto the schedule for this week, though many expect that it will get held over and marked up next week on July 2nd, which, conveniently, is a neat time to sneak through legislation when lots of people are not paying any attention (right before July 4th). In short, this means that there's a decent chance the EARN IT bill will be moving forward and could potentially pass.

This would be very, very bad. I won't go back over everything in it, but the general intent of the bill is to undermine both encryption and Section 230 by trying to make Section 230 dependent on not offering encryption. That's at the highest level. Now, the bill is written in a sneaky way to let some Senators pretend it won't impact encryption, since encryption is not mentioned in the bill. However, the bill does condition 230 protections on meeting certain "best practices" that would be developed through a process mostly controlled by the Attorney General, who has made it clear his number one priority regarding the internet is to kill off real encryption. As we've discussed, the EARN IT Act creates a very dangerous moderator's dilemma that will act to suppress both free speech online and the ability to communicate securely and privately.

And beyond moving forward with such a bad proposal, and trying to sneak it through during a holiday week, it's astounding that this is happening right at the very moment when more people than ever are relying on the internet to work from home -- a situation in which open speech platforms and strong encryption are more important than ever. Indeed, Senator Blumenthal, one of the sponsors of the bill who insisted it wouldn't be used to target encryption, is the same senator who got angry when he found out Zoom video calls weren't end-to-end encrypted.

If he wants to support encryption and promise that EARN IT won't be used to undermine encryption, he should write that explicitly into the law.

In short, the EARN IT Act would:

• Put encryption, privacy, and cybersecurity at risk at a time when we need all three things more than ever.
• Put free speech and open internet platforms at risk, at a time when people need to be able to speak out more than ever.
• Not do a damn thing to actually make anyone safer
• Create a constitutional mess, that might even make it easier for bad actors to get away with things by turning companies into state actors with regards to private info, thereby creating 4th Amendment issues regarding disclosure of information.

It is extremely unclear why anyone thinks (1) this is a good bill, or (2) it needs to move forward right now. But, since everyone wants to hate on Section 230 right now, none of that seems to matter.

Filed Under: earn it, encryption, free speech, privacy, section 230, security, senate judiciary committee

Trump's Plan To Turn US Global Media Operations Into State-Sponsored Breitbart... Could Threaten The Open (And Encrypted) Internet

from the everything-is-terrible dept

Earlier this week you may have heard about the so-called "Wednesday night massacre", in which the newly Trump-appointed head of the US Agency for Global Media (USAGM), Michael Pack, got rid of the heads of the various divisions he now runs:

The heads of four organizations overseen by the US Agency for Global Media (USAGM) were all dismissed Wednesday night -- a move likely to heighten concerns that new Trump-appointed CEO Michael Pack intends to turn the agency into a political arm of the administration.

In what a former official described as a "Wednesday night massacre," the heads of Middle East Broadcasting, Radio Free Asia, Radio Free Europe/Radio Liberty, and the Open Technology Fund were all ousted, multiple sources told CNN.

Two days earlier, the top officials at Voice of America (the other major part of USAGM) resigned after Pack made it clear that rather than being an independent, non-partisan media operation, he intended to turn the various media operations he controlled into Breitbart-style propaganda machines, pushing the President's messaging.

Now, there are some who have claimed that the radio operations, like Voice of America and Radio Free Europe, have always been forms of American propaganda. On the whole that's an inaccurate portrayal. They have built up a pretty strong reputation over the years of being useful, independent news agencies, and it's a shame that their reputation is likely to be smashed because our President and his allies are so insecure they feel the best way to accomplish their goals is to control everything and push lies and propaganda.

But, even more concerning is that the fallout from this could have a tremendous impact on the open web and encryption technologies. That's because while much of the focus is on the various media parts of USAGM, we should be much, much, much more concerned about what is perhaps the less well known part: the Open Technology Fund. Open Technology Fund has been the (not "a" but "the") main funder of key elements of the open internet over the past decade. Originally a subset of Radio Free Asia, it was set up to help fund the development of internet technologies that would help activists and dissidents route around censorship and government surveillance. It has helped fund part of the Tor Project. It's funded Simply Secure, which helps a variety of different projects targeting vulnerable populations ensure their efforts are designed with safety and privacy in mind. It's also helped fund important security audits of basically every key piece of technology that protects the internet from unwanted intrusions and surveillance.

In short, keeping OTF doing what's it's doing is hugely important. And that's why it's extremely worrying that OTF's CEO, Libby Liu, was pushed out as part of this purge, in part because of the new direction Pack is pushing OTF to move in:

"As you all know, OTF's flexible, transparent, and competitive funding model has been essential to our success in supporting the most secure and effective internet freedom technologies and innovative projects available," she wrote. "I have become aware of lobbying efforts to convince the new USAGM [U.S. Agency for Global Media] CEO to interfere with the current FY2020 OTF funding stream and redirect some of our resources to a few closed-source circumvention tools."

A group of very concerned folks have now set up a page at SaveInternetFreedom.tech, with a sign-on letter for Congress, asking it to continue to back the Open Technology Fund to continue to do its important work supporting open technologies that enable people to communicate online safely.

Despite OTF’s important work, there are serious concerns that the new leadership within the USAGM will seek to dismantle OTF and re-allocate all of its US government funding to support a narrow set of anti-censorship tools without a transparent and open review process. Moreover, these technologies are closed-source, limiting the number of people around the world who are able to access them and making the tools less secure, thus jeopardizing the safety of users and the global public's trust in US-supported internet freedom technologies. Such an approach also fails to recognize the numerous threats to internet freedom and the much larger set of actions that are required to help those being targeted by repressive governments.

Around the world, intrepid journalists and dedicated activists are taking great personal risks to further freedom and democracy. OTF's open, fair, competitive, and evidence-based award process ensures that those brave individuals have the best tools and technologies available to protect themselves. OTF funds open-source technologies and has funded over 100, independent, third-party security audits of internet freedom technologies to ensure only those with the highest security standards are supported with US-government funds.

Authoritarian regimes have made it clear that they are willing to do whatever it takes to control the internet. It is crucial that the US safeguards the internet as a democratic space for free expression. We urge Congress to respond to these escalating attacks on freedom of speech by protecting the internet through its continued and strong bipartisan support for OTF.

The changes regarding the various US broadcasting components is concerning enough, but most people hopefully can see those for what they are. The threat to an open, private, and secure internet, on the other hand, could have devastating consequences.

Filed Under: encryption, michael pack, open internet, open technology fund, propaganda, radio free asia, radio free europe, security, tor, usagm, voice of america