Burr And Feinstein Release Their Anti-Encryption Bill... And It's More Ridiculous Than Expected

from the are-they-serious? dept

They've been threatening this for months now, but Senators Richard Burr and Dianne Feinstein have finally released a "discussion draft" of their legislation to require backdoors in any encryption... and it's even more ridiculous than originally expected. Yesterday, we noted that the White House had decided to neither endorse nor oppose the bill, raising at least some questions about whether or not it would actually be released. Previously, Feinstein had said she was waiting for the White House's approval -- but apparently she and Burr decided that a lack of opposition was enough.

The basics of the bill are exactly what you'd expect. It says that any "device manufacturer, software manufacturer, electronic communication service, remote computing service, provider of wire or electronic or any person who provides a product or method to facilitate communication or the processing or storage of data" must respond to legal orders demanding access to said information. First off, this actually covers a hell of a lot more than was originally expected. By my reading, anyone providing PGP email is breaking the law -- because it's not just about device encryption, but encryption of communications in transit as well. I wonder how they expect to put that genie back in the bottle.

But, let's dig into a few other bits of insanity in the bill. It starts out with an insane assertion, right upfront:

It is the sense of Congress that--

1. no person or entity is above the law;
2. economic growth, prosperity, security, stability, and liberty require adherence to the rule of law;

What an absurd way to start the bill. As we've discussed over and over again, despite FBI director James Comey's statements, no one is claiming to be "above the law" here. When they offer end-to-end encryption they're not "above the law," they're just building a system to which they don't have the key. That's like saying that the safe maker who doesn't keep copies of the keys to every safe they sell is above the law. But no one requires safemakers to keep copies of every key.

Next, the claim that economic growth, prosperity, security, stability and liberty somehow depend on all of this is ridiculous. The second this bill becomes law, the US loses a massive economic advantage. Basically all of our technology becomes suspect globally, and the entire cybersecurity industry moves off shore. It will devastate American businesses outside of the US. Burr and Feinstein are basically offering a bill that completely undermines the economic prosperity of the American tech industry. This is especially insane coming from Feinstein, given that she supposedly represents so many tech companies in California.

all providers of communications services and products (including software) should protect the privacy of United States persons through implementation of appropriate data security and still respect the rule of law and comply with all legal requirements and court orders;

And they do... when they can. But what this bill requires is for tech companies to undermine the basics of encryption to make everyone less safe. This is not about disrespecting the rule of law, but about building systems as secure as possible to protect people from malicious attacks. You know, the very kinds of attacks that Senators Burr and Feinstein kept screaming about just months ago when they were demanding a bogus cybersecurity (really: surveillance) bill get passed by Congress. And yet now they want to undermine the very core concept of cybersecurity in the US.

to uphold both the rule of law and protect the interests and security of the United States, all persons receiving an authorized judicial order for information or data must provide, in a timely manner, responsive, intelligible information or data, or appropriate technical assistance to obtain such information or data;

And if that's literally impossible, as is the case with strong encryption or end-to-end encryption?

Let's be clear, here. This bill makes effective cybersecurity illegal. Think about that for a second. This is insane.

Then there's this kicker:

Nothing in this Act may be construed to authorize any government officer to require or prohibit any specific design or operating system to be adopted by any covered entity.

Yeah, except for the entire bill which absolutely prohibits the kind of design that basically all security experts say you need to adequately protect data and communications.

There are lots of other issues as well. As Jonathan Zdziarski notes, the bill is so ridiculously drafted that it doesn't distinguish between encrypted data and deleted data. Thus, if someone deletes all their data, companies are still on the hook to magically get it back. It also requires that any information that is requested be delivered "in an intelligible format." But what if the information itself is not intelligible? What if, prior to encrypting the data through technological means, the people doing the communications used some sort of cypher or code themselves to further obfuscate the information?

The whole thing is a mess and provides much more evidence for the fact that Feinstein and Burr have absolutely no clue what they're talking about on this particular issue. Of course, there are lots of clueless people, but it's pretty disturbing that these two particularly clueless people happen to be the highest ranking members on the Senate Intelligence Committee. Perhaps, like some others, they should talk to actual intelligence community professionals, who have also been arguing that backdooring encryption is a bad idea and puts Americans at much greater risk of being victims of computer attacks.

Filed Under: backdoors, dianne feinstein, encryption, richard burr

Remember, It Was A 'Lawful Access' Tool That Enabled iCloud Hacker To Download Celebrity Nudes

from the lawful-access-opens-a-door-that's-difficult-to-close dept

You may have heard, recently, that the guy who was apparently behind the celebrity nudes hacking scandal (sometimes called "Celebgate" in certain circles, and the much more terrible "The Fappening" in other circles) recently pled guilty to the hacks, admitting that he used phishing techniques to get passwords to their iCloud accounts. But... that's not all that he apparently used. He also used "lawful access" technologies to help him grab everything he could once he got in.

We keep hearing from people who think that just "giving law enforcement only" access to encrypted data is something that's easy to do. It's not. Over and over again, security experts keep explaining that opening up a hole for law enforcement means opening up a hole for many others as well, including those with malicious intent. ACLU technologist Chris Soghoian reminds us of this by pointing to an earlier article about how the guy used a "lawful access" forensics tool designed for police to get access to such data (warning, link may ask ask you to pay and/or disable adblocker):

On the web forum Anon-IB, one of the most popular anonymous image boards for posting stolen nude selfies, hackers openly discuss using a piece of software called EPPB or Elcomsoft Phone Password Breaker to download their victims’ data from iCloud backups. That software is sold by Moscow-based forensics firm Elcomsoft and intended for government agency customers. In combination with iCloud credentials obtained with iBrute, the password-cracking software for iCloud released on Github over the weekend, EPPB lets anyone impersonate a victim’s iPhone and download its full backup rather than the more limited data accessible on iCloud.com. And as of Tuesday, it was still being used to steal revealing photos and post them on Anon-IB’s forum.

Obviously, the situation with encryption on the iPhone is a bit different, but the same basic principle applies. Opening up a door is, by definition, opening up a vulnerability. And we should be very, very, very wary about opening up any kind of vulnerability. It's tough enough to find and close vulnerabilities. Deliberately opening one can be catastrophic.

Filed Under: backdoors, celebgate, celebrity nudes, hacking, icloud, law enforcement, lawful access, nudes
Companies: apple, elcomsoft

Apple's VP Of Software Engineering: No, We Have Never Given A Backdoor To Any Government

from the shut-up-DOJ dept

One of the more ridiculous claims in the DOJ's filing against Apple last week, was its decision to pick up on former NSA lawyer Stewart Baker's conspiracy theory that Apple had built backdoors into its products for China (side note: I met Stewart in person for the first time recently, and he mocked me about this, saying that I should agree with him on this point). However, as we noted in our post last week, there doesn't seem to be much evidence to support Baker's claims. The two key issues were using the Chinese wireless standard WAPI -- which some have claimed includes some sort of backdoor, but it was also the only real local area wireless tech in China for a while -- and the decision to store iCloud data in China. However, as we noted, there have been reports that the Chinese government tried to then conduct a man in the middle attack against the iCloud servers. If Apple had actually given the government a backdoor, then why would it need to do that?

Either way, in a declaration attached to Apple's response, Apple had Craig Federighi, its senior VP of software engineering, tell the court directly that it has never installed a backdoor for any government ever:

Apple uses the same security protocols everywhere in the world.

Apple has never made user data, whether stored on the iPhone or in iCloud, more technologically accessible to any country's government. We believe any such access is too dangerous to allow. Apple has also not provided any government with its proprietary iOS source code. While governmental agencies in various countries, including the United States, perform regulatory reviews of new iPhone releases, all that Apple provides in those circumstances is an unmodified iPhone device.

It is my understanding that Apple has never worked with any government agency from any country to create a "backdoor" in any of our products or services.

Now, some may push back on the point about WAPI, but again, making use of a third party technology that potentially has backdoors (some of which could be protected against) and being told by the government to build special backdoors just for that government are still vastly different scenarios.

Filed Under: all writs act, backdoors, china, craig federighi, doj, encryption, fbi, going dark, icloud, wapi
Companies: apple

Senators Burr And Feinstein, Once Again, Threatening New Bill To Backdoor Encryption

from the yeah-that's-not-going-to-go-over-well dept

They've been promising it for months now, without ever actually doing anything, but Senators Dianne Feinstein and Richard Burr (the two top members of the Senate Intelligence Committee) now insist that they're finally ready to release their anti-encryption bill.

Feinstein told The Hill she passed the text along earlier this week to White House chief of staff Denis McDonough.

“My hope is since I was the one that gave it to Denis McDonough, they will take a look at it and let us know what they think,” she said.

The Obama administration’s response will determine the bill’s timing, Burr added.

The introduction “depends on how fast the White House gets back to us,” he said.

Since, to date, the administration has actually indicated that it does not support such a bill, one hopes that means the introduction will continue to be "sometime around never." Even if it is introduced, it sounds like the bill may actually have a tough time getting anywhere. As we've noted, recent hearings suggest that many in Congress are quite skeptical of the FBI/DOJ's claim that it needs backdoors into encryption. Indeed, even many in the intelligence community (which you'd think would have indicated this to Burr and Feinstein) don't seem particularly enthusiastic about this. Reliable Feinstein/Burr allies like former NSA and CIA director Michael Hayden, former Homeland Security director Michael Chertoff and former NSA director Mike McConnell have spoken out strongly against such plans.

Given all that, it's bizarre and ridiculous that Feinstein and Burr are continuing to move forward with this plan. Hopefully, the White House educates them on the issue and tells them to toss this bill into the garbage where it belongs.

Filed Under: backdoors, dianne feinstein, encryption, going dark, richard burr

White House Apparently Not Necessarily In Agreement With FBI's Position On Encryption Backdoors

from the say-something-dammit dept

There is a (reasonable) tendency to argue that in this big fight over encryption backdoors and "going dark" and "should Apple help the FBI" to assume that the various DOJ/FBI efforts to force backdoors into encryption are the official position of the Obama administration. After all, the Justice Department is a part of the administration and the head of the DOJ, Attorney General Loretta Lynch, reports to President Obama. And the FBI is a part of the DOJ. But it's also been quite clear for some time that there are a variety of opinions within the White House on these issues, with many outside of the DOJ not supporting backdooring encryption at all. In fact, many are actively opposed to such ideas. And now it's reaching the stage where people are starting to push stories that the White House is not at all happy with FBI Director James Comey and his crusade on this issue.

With regards to the Apple standoff, "It's just not clear [Comey] is speaking for the administration," said Richard Clarke, a former White House counterterrorism and cybersecurity chief. "We know there have been administration meetings on this for months. The proposal that Comey had made on encryption was rejected by the administration."

[....]

"I have been very surprised at how public and inflammatory, frankly, the FBI and the Justice Department’s approach has been on this," said Chris Finan, a former National Security Council cybersecurity adviser.

"That doesn't tend to be the administration’s preferred approach to handling things."

There are a lot more quotes in the article suggesting similar things (and also discussing FBI issues beyond just the Apple/encryption debate).

Indeed, back last fall, we noted that leaked documents showed that many in the White House did not agree with Comey or the FBI on this issue -- and some pushed for a public statement opposing backdooring encryption. Unfortunately, the administration later took the cowardly approach of agreeing not to push for legislation, but refusing to take a strong public stance on the issue, because they didn't want to anger the law enforcement community. So, instead, you have the DOJ and FBI -- representatives of the administration -- now running wild, pushing dangerous legal theories that will undermine key elements of computer security, and lots of people think that's the administration's official position.

The White House failed badly in not taking a public stance on this months ago, and it should fix that now.

Filed Under: backdoors, doj, encryption, fbi, james comey, loretta lynch, white house

GCHQ Boss Says Tech Companies, Government Should Work Together To Give The Government What It Wants

from the putting-the-'I'-back-in-'team' dept

The head of GCHQ has decided to make some belated overtures to the tech companies intelligence agencies have alienated over the past few years. With the UK's ever-evolving Investigatory Powers Act hanging around like an unwanted, hungover and extremely nosy houseguest, GCHQ Director Robert Hannigan says it's time for the government and tech companies to work together for the mutual betterment of both to give government agencies the access they're stopping just short of legislating into existence.

He starts by stating he doesn't want to ban encryption or demand backdoors…

“It should be possible for technical experts to sit down together and work out solutions,” he said. “I am not in favor of banning encryption. Nor am I asking for mandatory back doors. …

...before stating that backdoors would be a wonderful thing. They just might need to undergo rebranding.

"Not everything is a back door, still less a door which can be exploited outside a legal framework."

OH. You want those kinds of backdoors: the ones that can only be solely exploited within a legal framework. Sorry, we're fresh out. It's not that tech companies don't want to help, but even "technical experts" can't craft an exploitable "not a backdoor" that can only be exploited by whoever the government decides should be able to exploit it. ("Working together" or not, it will be the government that determines access, rather than the technical experts at tech companies who designed it.)

So, Hannigan doesn't want a backdoor. He wants another set of keys for the front door and is requesting that all parties work together to decide whether this set should be left in the mailbox or under the welcome mat. This skewed view likely comes from Hannigan's assumption that the many years of tech compnany cooperation intelligence and law enforcement agencies have enjoyed comes from a deep well of heartfelt goodwill, rather than numerous laws compelling them to do so.

Nonetheless, Hannigan—making just his second appearance in a public forum since taking the helm of GCHQ in 2014—said tech companies should work more closely with governments to try to come up with ways to give law enforcement what it wants. “The perception that there is nothing but conflict between governments and the tech industry is a caricature,” he said in his speech. “In reality, companies are routinely providing help within the law, and I want to acknowledge that today.”

It may have been less of a caricature pre-2013, but it was never simply about tech companies giving the government whatever it wanted whenever it asked for it. That's why the world's intelligence agencies are hoarding exploits, buying malware from shady merchants, and intercepting hardware shipments to add their own backdoors.

And so, yet another request goes out for cooperation in the ongoing search for an intelligence/law enforcement unicorn while War's "Why Can't We Be Friends?" plays in the background. Nothing's going to move forward until officials like Hannigan admit the thing they want (a safe backdoor) isn't something they can actually have -- at least not without a lot of collateral damage. If they can at least be honest enough to state they want it no matter how many problems it causes elsewhere, then maybe they'll be ready to move to the next level of discussion -- even if the "next level" means the discussion has reached its logical endpoint.

Filed Under: backdoors, encryption, gchq, robert hannigan, uk
Companies: apple

Of Cockpits And Phone Encryption: Tradeoffs And Probabilities

from the think-this-through dept

Support our crowdfunding campaign to help us keep covering stories like these!

Blake Ross (boy genius Firefox founder and later Facebook product guy) has written a somewhat bizarre and meandering -- but totally worth reading -- article about the whole Apple v. FBI fight, entitled (believe it or not): Mr. Fart's Favorite Colors. There are a few very good points in there, about the nature of programming, security and the government (some of which even make that title make sense). But I'm going to skip over the farts and colors and even his really excellent description of the ridiculousness of TSA security theater in airports, and leap forward to a key point raised in the article, focused on airplane security, which presents a really good analogy for the iPhone encryption fight. He points out that the only thing that has truly helped stop another 9/11-style plane hijacking (as Bruce Schneier points out repeatedly) is not the TSA security theater, but reinforced, locked cockpit doors that make it impossible for people in the cabin to get into the cockpit.

However, Ross notes, there are scenarios in which those in the cockpit need to leave the cockpit (usually to use the bathroom), and therein lies an interesting security challenge for those designing the security of the planes. How do you let that pilot (or another crew member) back in, but not a bad guy? Here's the solution that airlines have come up with, as described by Ross (or you can read the NY Times version, which is a little drier):

1. When the pooping pilot wants to reenter the cockpit, he calls the flying pilot on the intercom to buzz him in.
2. If there’s no answer, the outside pilot enters an emergency keycode. If the flying pilot doesn’t deny the request within 30 seconds, the door unlocks.
3. The flying pilot can flip a switch to disable the emergency keypad for 5 to 20 minutes (repeatedly).

Like Asimov’s three laws, these checks and balances try to approximate safety while accounting for contingencies. If the flying pilot risked Delta’s gefilte fish and passed out, you want to make sure the other pilot can still re-enter. But add all the delays and overrides and backstops you want; you still have to make a fundamental decision. Who controls entry: the people on the inside, or the people on the outside?

Governments decided that allowing crew members to fully override the flying pilot using a key code would be insecure, since it would be too easy for that code to leak. Thus, there is nothing the outside pilot can do — whether electronically or violently — to open the door if the flying pilot is both conscious and malicious.

And as Ross notes, this is a pretty reasonable tradeoff in nearly all circumstances. It's quite difficult for someone bad to get in, and yet those in the cockpit can mostly be okay with leaving and getting back in even if a pilot remaining in the cockpit suddenly drops dead. But, there is still one scenario in which that security gets totally messed up -- and it's with Germanwings Flight 9525 almost a year ago, in which a mentally ill co-pilot locked the captain out of the cockpit and then deliberately crashed the plane into a mountain.

As Time Magazine noted, this is the tricky part of security systems: "sometimes it’s important to keep people out; sometimes it’s important to get inside."

And, of course, there's a little of that in the Apple v. FBI fight. The FBI is arguing that it's important to let people in, because 14 people died after a husband and wife killed 14 people and wounded more. But lots of other people are pointing out that there are much bigger security benefits in keeping people out. And that's why this is really a debate about "security v. security" rather than "security v. privacy."

Strong encryption on devices is like that locked cockpit door. Under most scenarios, it keeps people much safer. It's a useful and powerful security feature. But, yes, in some cases -- such as that of the suicidal Germanwings co-pilot -- it is less secure. And, there do seem to be ways to mitigate that kind of risk without harming the wider security (many airlines now require that even if someone leaves the cockpit, a second crew-member must be present in the cockpit). But, in the end, we look at the likelihood and probability of the need for such security solutions. And it's not hard to realize that, in the grand scheme of things, locking people out protects many, many, many more people from the rare instances of suicidal co-pilots (and or quasi-terrorist attacks).

And that's the real issue here. Strong encryption on our devices is much more likely to lead to much more protection and security for many more people than without such encryption. Nearly all of us are likely to be safer because of strong encryption. But, that might not include everyone. Yes, there will be some instances -- though likely few and far between -- where such encryption allows someone to secretly plan and (potentially) get away with some sort of heinous act. And it will be reasonable and expected that people will whine and complain about how the security feature got in the way of stopping that attack. But the likelihood of that is much, much smaller, than the very real possibility of attacks on weak phones affecting many of us.

Or, as Ross concludes (in a way that makes even more sense if you read the whole piece...):

Unfortunately it’s not that complicated, which means it’s not that simple. Unbreakable phones are coming. We’ll have to decide who controls the cockpit: The captain? Or the cabin? Either choice has problems, but — I’m sorry, Aunt Congress — you crash if you pick 2.

But when you have people like the technically ignorant San Bernardino District Attorney Michael Ramos insisting that he needs to be able to get into that iPhone, just recognize that he's arguing that we should unlock cockpit doors just in case there's a suicidal co-pilot in there, without recognizing how frequently such unlocked cockpit doors will be used by others who wish to do even more harm.

Support our crowdfunding campaign to help us keep covering stories like these!

Filed Under: backdoors, blake ross, cockpits, congress, doj, encryption, fbi, security, tradeoffs
Companies: apple, germanwings

French Parliament Votes For Law That Would Put Tech Execs In Jail If They Don't Decrypt Data

from the goodbye-computer-security-in-france dept

Okay, this is just getting silly now. A bunch of reactionary French politicians have voted to put tech execs in jail if they refuse to decrypt data for criminal investigations:

The controversial amendment, drafted by the rightwing opposition, stipulates that a private company which refuses to hand over encrypted data to an investigating authority would face up to five years in jail and a €350,000 (£270,000) fine.

Telecoms operating companies would be liable to lesser penalties but would still face up to two years in jail.

Of course, this comes at the same time that basically the entire tech industry is rallying in support of Apple's stance of refusing to hack into its own systems to remove security features and make it easier to decrypt data. And it's coming right as the world was ridiculing Brazil for arresting (and then releasing) a Facebook exec for refusing to hand over data from subsidiary Whatsapp.

This kind of move is so stupid on so many levels that it defies any kind of logic. It's bad for security, because weak encryption puts us all at much greater risk than the threat of terrorists or criminals using encryption (in part, because this kind of thing won't stop them from using secure encryption, and in part because those threats are very low probability risks). It's also bad for the economy, because you've just given a ton of important tech companies every reason in the world to no longer operate in France due to such a ridiculous law that may put execs in jail. It's bad for the public in that it will mean less secure services and devices that put them at risk, while also potentially cutting off more innovative and useful products and services.

This is the kind of kneejerk reaction from people who are too ignorant and too scared to understand the actual technology and the actual issues at stake. Why do citizens in these countries continue to allow ignorant scared people to make such blatantly bad rules?

Filed Under: backdoors, criminal, encryption, execs, france, jail

We Read All 20 Filings In Support Of Apple Against The FBI; Here Are The Most Interesting Points

from the it's-a-crypto-party dept

Support our crowdfunding campaign to help us keep covering stories like these!

In the last week or so, it became quite clear that a fair number of tech companies and organizations in the civil liberties community would file amicus (friend of the court) briefs urging magistrate judge Sheri Pym to side with Apple over the Justice Department and the FBI. However, now that the briefs are in, it's fairly staggering just how many companies, organizations and individuals signed onto briefs supporting Apple. Yes, many of them teamed up and filed briefs together, but it's still a ton. And that's especially true for an issue at the district court level in front of a magistrate judge. Here's the big list put together by Apple, including links to various blog posts and press releases about the filings:

Amicus Briefs

• 32 Law Professors
• Access Now and Wickr Foundation | Press Release
• ACT/The App Association | Medium Post
• Airbnb, Atlassian, Automattic, CloudFlare, eBay, GitHub, Kickstarter, LinkedIn, Mapbox, Medium, Meetup, Reddit, Square, Squarespace, Twilio, Twitter and Wickr | Automattic & WordPress.com Blog Post | Tweet from Twitter
• Amazon, Box, Cisco, Dropbox, Evernote, Facebook, Google, Microsoft, Mozilla, Nest, Pinterest, Slack, Snapchat, WhatsApp, and Yahoo | Tweet from Box | Evernote Blog Post  | Facebook Statement | Microsoft Blog Post | Mozilla Blog Post | Snapchat Blog Post | WhatsApp Facebook Post | Yahoo Tumblr Post
• American Civil Liberties Union, ACLU of Northern California, ACLU of Southern California, and ACLU of San Diego and Imperial Counties | Blog Post
• AT&T | Public Policy Blog Post
• AVG Technologies, Data Foundry, Golden Frog, the Computer & Communications Industry Association (CCIA), the Internet Association, and the Internet Infrastructure Coalition | Golden Frog Blog | CCIA News
• BSA|The Software Alliance, the Consumer Technology Association, the Information Technology Industry Council, and TechNet | Press Release
• Center for Democracy & Technology | Insight
• Electronic Frontier Foundation and 46 technologists, researchers, and cryptographers | Blog Post | Press Release
• Electronic Privacy Information Center (EPIC) and eight consumer privacy organizations | EPIC Top News
• Intel | Blog Post
• iPhone security and applied cryptography experts including Dino Dai Zovi, Dan Boneh (Stanford), Charlie Miller, Dr. Hovav Shacham (UC San Diego), Bruce Schneier (Harvard), Dan Wallach (Rice) and Jonathan Zdziarski | Blog Post
• The Media Institute | Press Release
• Privacy International and Human Rights Watch

Letters to the Court

• Beats, Rhymes & Relief, Center for Media Justice, The Gathering for Justice, Justice League NYC, Opal Tometi and Shaun King
• David Kaye, United Nations Special Rapporteur on the promotion and protection of the right to freedom of opinion and expression | Supporting Document
• Salihin Kondoker, San Bernardino, CA

Not entirely sure why, but Apple (at least as I'm writing this) did not include one other amicus brief on its side, which is from Lavabit, the one company out there should should have tremendous perspective on Apple's situation, given that it shut down its entire business to avoid having to hand over its encryption keys to the government. At this point, we just have Lavabit's motion for leave to file its brief, rather than the full brief. If and when that brief is released, we may address it separately.

I've also put all of these together in a collection which are embedded below (which also lets you search through the text of them all).

Having read through many of them (and skimmed the rest), there are certainly some common themes. Frankly, an awful lot of them do really feel like they're just a rehashing of Apple's motion to vacate, repeating the claim that the All Writs Act should not apply (and that CALEA already covers this issue and doesn't allow such a solution). Obviously, all the filings from the various tech companies are getting a lot of the press attention, and they're worth reading to perhaps better understand a few of the key legal points that Apple is raising. Similarly, the filings from civil liberties/human rights groups aren't all that surprising either -- focusing more on some of the human rights questions. The EFF brief is a bit different in focusing on the First Amendment issue, which many expect won't even be looked at by the courts. It's really the only brief that digs deeply into that issue and is worth a read for that reason (I've seen legal experts in fairly strong disagreement about the applicability of the First Amendment argument here).

Separately, I thought that the filing from EPIC was worthwhile as well, in focusing in on the importance of encryption on phones these days because so much personal information is accessible from phones and because unencrypted phones are such a big target for criminals. That's a slightly different perspective that isn't covered nearly as much by other filings and actually could be a useful perspective for the court.

However, the most interesting filing of all may be the one filed by a group of iPhone Security and Applied Cryptography Experts, and put together by Jennifer Granick and Riana Pfefferkorn from Stanford's Center for Internet and Society. That brief is super educational in getting down into the weeds of just how dangerous it would be for Apple to create this code. Since so many people -- including the DOJ -- seem to think that Apple can just create this code and then make it disappear, this filing is super useful in debunking that claim. It first notes that the Court did try to put in some "safeguards" against abuse of the code, but then explains why those won't help:

These rules are not meaningful barriers to misuse and abuse of the forensic capabilities this Court is ordering Apple to create. First, the Order assumes that Apple will create the Custom Code without any vulnerabilities in its implementation. Vulnerabilities are common in software code, including Apple’s iOS, and despite Apple’s best efforts. The government dismissively downplays the effort required to develop and update the Custom Code, stating that Apple “writes software code as part of its regular business,” including “routinely patch[ing] security or functionality issues” in iOS and “releas[ing] new versions of [iOS] to address issues.” Application at 15. But creating software (especially secure software) is complex, and software development requires rigorous testing.

Vulnerabilities are common in software code, despite vendors’ best efforts. To address this problem, vendors employ extensive pre-release testing; after-thefact audits, including by independent security researchers; and regular updates. Yet none of these practices, alone or in concert, can ensure that software will not be vulnerable and subject to misuse. Yet, given the circumstances of this case, this code is unlikely to go through this lifecycle, increasing the risk that it will introduce vulnerabilities into the iPhone ecosystem.

For example, since first introducing the earliest iPhone, Apple has waged a cat-and-mouse battle with “jailbreakers,” software developers who identified and exploited vulnerabilities in the devices in order to run software other than that signed by Apple and to defeat carrier locks that tied handsets to particular cellular providers. Apple warns its users against jailbreaking and the practice is contrary to Apple’s terms of service. Jailbreaking involves modifying the iPhone firmware so that it will run software code without checking to see if the code has been signed by Apple. When Apple releases a new iOS, scores of independent programmers study the code, successfully finding ways to circumvent Apple’s imposed restrictions. In response, Apple issues software updates to defeat these jailbreaks. Eventually, the jailbreaking community finds new ways to circumvent controls built into Apple’s increasingly secure iOSes. Today, all iOS versions through 9.2 are jailbroken, even though doing so is increasingly harder due to Apple’s efforts.

In other words, vulnerabilities in Apple’s software have persisted for years even though Apple very much does not want them to. This is a lesson for this case. Apple can try its very hardest to create this Custom Code as the Court directs. Nevertheless, it may well fail, as it has acknowledged to the Court.... Even with time and extensive testing, which the government’s sense of urgency seems designed to deny Apple, it is extremely difficult to write bug-free code. Software bugs can interact with existing code in complex ways, creating unanticipated new paths for bypassing iPhone security and exploiting the phone.

This is a point that so few people outside of the tech world seem to get. Security vulnerabilities exist and software (and hardware) are incredibly complex. Purposefully creating vulnerabilities likely creates even more vulnerabilities and those can be pretty dangerous. And that's especially true in a situation -- such as this one -- where Apple will have to create the code entirely by itself, and without any outside security audit possible.

Furthermore, the brief notes the fact that, contrary to what many keep insisting, there's a high likelihood that any such code will leak out:

This Court also allowed the Custom Code to stay with Apple, rather than go to the FBI. Simply put, if no one else has the Custom Code, no one else should be able to use it, at least not without Apple’s knowledge. However, once created, this software is going to be very valuable to law enforcement, intelligence agencies, corporate spies, identity thieves, hackers, and other attackers who will want to steal or buy the Custom Code. Keeping the Custom Code secret is essential to ensuring that this forensic software not pose a broader security threat to iOS users. But the high demand poses a serious risk that the Custom Code will leak outside of Apple’s facilities.

Other governments, or ours, may eventually compel Apple to turn the Custom Code over so that law enforcement officials can unlock phones without delay or Apple oversight. Authoritarian governments will likely be the most enthusiastic customers for the Custom Code this Court is contemplating ordering Apple to create and sign. The software will be used in China, Russia, Turkey, the United Arab Emirates, and other governments with poor human-rights records where iPhones are sold.

Inadequate security practices by those governments increase the risk that attackers will acquire and use the Custom Code. Given the Custom Code’s value, unscrupulous government officials in corruption-plagued jurisdictions could foreseeably sell the Custom Code to third parties. For example, if the Russian government compelled Apple to hand over the Custom Code, it could end up being sold by a corrupt agent to a Russian identity-theft ring. Even without selling it, corrupt officials could also use the code for their own agendas, such as to target political or personal enemies who had broken no law. Journalists, human-rights advocates, religious and sexual minorities, and others in those countries are at much greater risk if software that can bypass passcode limitations exists.

There is also a danger that the Custom Code will be lost or stolen. The more often Apple must use the forensic capability this Court is ordering it to create, the more people have to have access to it. The more people who have access to the Custom Code, the more likely it will leak. The software will be valuable to anyone eager to bypass security measures on one of the most secure smartphones on the market. The incentive to steal the Custom Code is huge. The Custom Code would be invaluable to identity thieves, blackmailers, and those engaged in corporate espionage and intellectual property theft, to name a few.

Those technicians responsible for using the Custom Code to comply with access demands will likely be targeted by phishing attacks—emails carefully designed to seem legitimate but which contain malware—that seek to steal the Custom Code. The same technicians will be approached with offers to buy the software. The price offered could be irresistibly high, as the Custom Code will be worth a lot to foreign national security officials and organized crime syndicates, and can be sold to multiple customers. Or Apple technicians may be blackmailed to the same end. In short, the Custom Code will be exceedingly valuable and in danger of leaking or being stolen.

Finally, that brief also notes a key point being raised increasingly by security experts: that if a company can be forced to remove security features in an automatic update, it creates incentives for people not to update their devices, which will open up many more serious security problems:

Automatic updates are an important way that software companies ensure their users are as protected as possible from attackers, without inconvenience, significant effort, or technical savvy on the part of the user (who is more likely to install security updates when there is little or nothing she needs to do). These autoupdates are one of the reasons why the millions of iPhones currently in use worldwide are very secure.

Consumers (and their devices) trust these auto-updates because they are signed by the vendor. A cryptographic signature from Microsoft or Apple assures the user that the software she is about to install legitimately comes from the company she trusts. It is akin to Apple saying, “This is Apple, and we stand behind this software.” Here, however, the Court is contemplating ordering Apple to sign software it does not stand behind and in fact considers “too dangerous to build.” .... And the next logical step if this Court enforces its Order is for the FBI to ask to compel other vendors, in addition to Apple, to sign other software that bypasses other customer security measures, creating new and different risks.

This is why compelling cryptographic signatures is extremely risky. Automatic software updates are a crucial vehicle for maintaining the security of iOS devices and other computers, but they can be effective only so long as users continue to trust them. If the Court compels Apple to create and sign the Custom Code in this high-profile case, then all computer users, especially those for whom smartphone privacy may already be a concern, could become suspicious of all software updates going forward. That is because a member of the public could reasonably fear that in the future, even a signed software update from a trusted vendor will bypass passcode limitations, convert her iPhone into an audio or video recording device, or otherwise interfere with her property, privacy, or security interests. Users will know that these updates could be software designed to extract private data from the user’s machine, but which a company was forced to sign at the behest of some court, law enforcement, or other government official. The code would be indistinguishable from a genuine update created, signed, and transmitted of the vendor’s own free will.

This distrust would have serious ramifications for computer security at large. In response, some users would likely stop accepting iOS updates (which users must choose to install), in which case their machines will remain unprotected against vulnerabilities that legitimate automatic updates would have patched. Importantly, the impact of unpatched devices is not limited to those devices. Vulnerable software that has not been updated can become a vector for spreading malware, potentially compromising other machines on the network. The more users who turn off automatic updates, the more devices, the more information, the more people put at risk. Just as herd immunity to a disease is lost if enough members of the group are not vaccinated against the disease, if enough users stop auto-updating their devices, it will weaken the entire device security ecosystem. Indeed, one computer security expert has likened automatic updates to “a public health system for the Internet.” It is this whole system which the Court ultimately threatens to put at risk should it enforce its Order to Apple.

Good stuff. One hopes that the judge will read this brief, in particular, carefully.

The other two things that were most interesting were not amicus briefs, but merely two of the letters to the judge. First was the letter from the UN Special Rapporteur on "the protection and promotion of the freedom of opinion and expression," David Kaye. He adds in some additional perspective about how the right to secure communications and encryption is a fundamental part of freedom of expression, including quoting from his own report on the benefits of encryption for the public, along with the challenges it presents for law enforcement. As he concludes:

My concern is that the subject order implicates the security, and thus the freedom of expression, of unknown but likely vast numbers of people, those who rely on secure communications for the reasons identified above and explicated in more detail in the report. This is fundamentally a problem of technology, one where compromising security for one and only one time and purpose seems exceedingly difficult if not impossible. Again from the report, “States must show, publicly and transparently, that other less intrusive means are unavailable or have failed and that only broadly intrusive measures, such as backdoors, would achieve the legitimate aim.” ... It is not clear that the Government has tried other means short of compelling Apple’s code-writing in this case, such as enlisting the technical expertise of other agencies to access this particular phone.

Finally, there's the letter from Salihin Kondoker, whose wife, Anies, was one of the people shot, but not killed, in the attack. That letter is truly worth reading. He notes that while he has been "frustrated that there isn't more information" as to why the attack occurred, and that he was initially frustrated that Apple might be a roadblock. But then, as he understood more of the details, he supports Apple's decision.

When I first learned Apple was opposing the order I was frustrated that it would be yet another roadblock. But as I read more about their case, I have come to understand their fight is for something much bigger than one phone. They are worried that this software the government wants them to use will be used against millions of other innocent people. I share their fear.

I support Apple and the decision they have made. I don’t believe Tim Cook or any Apple employee believes in supporting terrorism any more than I do. I think the vicious attacks I’ve read in the media against one of America’s greatest companies are terrible.

In my opinion it is unlikely there is any valuable information on this phone. This was a work phone. My wife also had an iPhone issued by the County and she did not use it for any personal communication. San Bernardino is one of the largest Counties in the country. They can track the phone on GPS in case they needed to determine where people were. Second, both the iCloud account and carrier account were controlled by the county so they could track any communications. This was common knowledge among my wife and other employees. Why then would someone store vital contacts related to an attack on a phone they knew the county had access to? They destroyed their personal phones after the attack. And I believe they did that for a reason.

[....]

Finally, and the reason for my letter to the court, I believe privacy is important and Apple should stay firm in their decision. Neither I, nor my wife, want to raise our children in a world where privacy is the tradeoff for security. I believe this case will have a huge impact all over the world. You will have agencies coming from all over the world to get access to the software the FBI is asking Apple for. It will be abused all over to spy on innocent people.

You never know how much weight a court will put on these things. Amicus briefs often are little more than a chance for some publicity for those filing them. But many of these briefs (and letters) are detailed, thoughtful and actually do add compelling and important perspectives on the larger issues involved in this case. Hopefully the judge pays attention.

Support our crowdfunding campaign to help us keep covering stories like these!

Filed Under: all writs act, amicus briefs, backdoors, calea, doj, encryption, fbi
Companies: apple

Techdirt Needs Your Help To Fight Encryption Fearmongering

from the please-support-us dept

TL;DR: Support our coverage of the encryption battle!
In the summer of 2014, we ran a crowdfunding campaign to help support Techdirt, in order to do more in-depth reporting on the big net neutrality fight happening in Washington, DC (and, more broadly, around the globe). That campaign was successful beyond our wildest expectations, and allowed us to do much more thorough reporting (including bringing on Karl Bode to help cover these issues) on such an important issue. We ended up writing well over 300 articles since that campaign ended, and that initiative is still ongoing.

Now, we're launching another crowdfunding campaign for an issue that's even more important: the fight over encryption. And so I wanted to ask you to support us again in this new campaign. We literally cannot do this without you:

Techdirt needs your help to fight encryption fearmongering.
As you almost certainly know, this battle has ramped up in the last few years -- first in response to the Snowden revelations, followed by a rush by many, including Apple, to better encrypt their services and devices. However, law enforcement and the intelligence communities are less than pleased about all of this, and have been pushing for backdoors and other legislative solutions. This is not new. They pushed for such things in the 1990s, in the original "Crypto Wars," and lost. But now they see a new opening to try again. In the last couple weeks, this issue has blown up even more, as the DOJ sought, and received, a court order directing Apple to effectively write special software to allow the FBI to hack into an iPhone to get around existing encryption and security features.

And, it's not just about this current Apple fight. Or just the US. Congress is looking at this issue, and other governments are eagerly considering how they can use the US's efforts to serve their own wishes. And that's not to mention various other technologies and companies that have been impacted by this debate already.

This is a big deal. It will impact how technology works and how you maintain your security and privacy going forward. It will impact what you get to do on your own devices, and what the government can force companies to do. And not just in the US. The rest of the world is watching closely how this battle plays out, to figure out what they might be able to get away with as well.

And, frankly, most of the reporting is abysmal or, at the very least, confused. When the story of the Apple court order broke, most initial reports falsely stated that the court ordered Apple to "break the encryption" on its phones. We were the first site (and for a while, the only site) to post the actual court order and to discuss what it actually said.

And this is a case where the specifics and the details matter... a lot. We want to be able to do a lot more reporting like this, really digging into the issues and explaining them in a way that everyone can understand and focus on the facts, rather than the fearmongering.

But to do that, we need your support. Believe it or not, writing about the arcane details at the intersection of technology and policy does not attract big time advertisers. In fact, we've lost many advertisers due to our willingness to call out bad behavior by large companies.

So, please support our campaign:

Techdirt needs your help to fight encryption fearmongering.
As with the last campaign, the focus is in funding our ongoing reporting on this issue, but we also are hoping to do some creative experiments as well, to further expand the reach of that reporting. So, if we can reach our initial target of $20,000, we'll use some of that money to buy a large number of targeted ads in publications that are read by policymakers in DC (and their constituents), that link back to our reporting. For each $10,000 beyond that that we reach, we'll add another experiment in ways to have our reporting actually reach more people -- including policymakers, the public, and the press.

If you supported us last time around (or in other ways, such as via our Techdirt Insider Shop), I can't thank you enough for your support, and I hope that you found our reporting on net neutrality useful and valuable. If you haven't supported us in the past, please consider doing so now. We strive to not only do great reporting on these issues -- which means actually going beyond just the "he said, she said" versions to calling out blatant lies and hypocrisy when we see it -- but to also build a community here. That means we work extra hard to welcome in people to comment and discuss issues, and we try to avoid the practices adopted by many other sites to push people away. We don't do "paywalls." We don't demand that you turn off ad blockers. Hell, we let you turn ads off on the site. And we also do things like better protect you by still being one of only a few news sites that is fully HTTPS encrypted.

But all of that costs us. Calling out companies means that lots of companies don't want to advertise with us. The ability to turn off ads and only accept HTTPS ads means that our ad revenue is significantly limited. But we still think it's worth it, because focusing on building a better, more engaged community here, where you're welcome to participate, is really important to us. But it also means that, every so often, we may reach out for some help. And now is one of those times. So please consider supporting us.

Techdirt needs your help to fight encryption fearmongering.
Oh, and if you need one last reason to support us... yesterday I emailed backers of the original campaign to give them a heads up about this, and look how someone reacted:

@mmasnick Oh neat, an email from Mike, wonder what he and @techdirt are up to now . . .

. . . oh god pic.twitter.com/4dIaEFyJ2s

— NSA Public Relations (@NSA_PR) February 25, 2016

Filed Under: backdoors, crowdfunding, doj, encryption, fbi, going dark, support, techdirt