UK Government Apparently Hoping It Can Regulate End-To-End Encryption Out Of Existence

from the sure-hope-'the-children'-are-grateful-for-the-shitty-future-being-handed dept

Politicians -- those motivated by the notion of "doing something" -- want to end encryption. They don't want this to affect their communications and data security. But they don't see the harm in stripping these protections from the general public. Often, the argument is nothing better than "only criminals want end-to-end encryption," something they trot out as a truism despite plenty of evidence to the contrary.

But these politicians (and government officials) are cowards. They refuse to call a backdoor a backdoor. They come up with all sorts of euphemisms while pretending compliance with proposed laws won't result in the creation of backdoors that can be exploited by everyone, not just the "good guys." They also deploy other euphemisms to attack encryption that protects millions of members of the public, referring to good encryption as "warrant-proof" or "military-grade." Those terms never survive examination, but the narrative persists because most members of the public have no interest in closely examining falsehoods uttered by governments.

The UK government has expressed an unhealthy determination to undermine encryption for years now. It has the fanciest of plans to undo protections enjoyed by UK residents for reason ranging from "the children" to "the terrorists." The underlying intent never changes even if the name on the office doors do. Regulators come and go but the desire remains. Even the bills get renamed, as though a different shade of lipstick would make the UK's anti-encryption pig any more desirable.

Rebranding from "Online Harms" to "Online Safety" only changed the tablecloths in the Titanic's dining room. The UK government wants encryption dead. But presumably "safety" sounds better than "harms," especially when the government affirmatively wants to harm the safety of millions of UK residents.

The Internet Society has taken a look at the revamped and rebranded bill and has delivered a report [PDF] that explains exactly where on the Internet doll the UK government plans to engage in inappropriate touching. There's no mention of backdoors or broken encryption, but complying with the law means possibly doing both.

The draft Online Safety Bill places a duty of care on service providers within the scope of the draft bill to moderate illegal and harmful content on their platforms, with fines and penalties for those that fail to uphold this duty. The only way for service providers that offer end-to-end encryption to comply with this duty of care would be to remove or weaken the encryption that they offer.

That's the end result of these demands. But the politicians and regulators pushing this are unwilling to directly refer to the harms the bill will cause. There's no ban on end-to-end encryption. There's no mandate for backdoors. Instead, the bill hopes to achieve these ends by applying regulatory pressure that makes both of these outcomes unavoidable.

Service providers deploying end-to-end encryption obviously cannot see the content of communications between users. The UK government says that's no longer acceptable. Providers need to be proactive in preventing the spread of certain content. That leaves them with only one option.

Ofcom can require that service providers use “accredited technology” to identify harmful content and “swiftly take down that content”. To comply with this requirement and fulfil their “duty of care”, service providers will likely need to resort to upload filters and other mechanisms that may interfere with the use of end-to-end encryption.

Basically, the same thing that saw Apple catch a considerable amount of heat will be expected to be standard operating procedure for any tech company doing business in the UK. Client-side filtering is the most efficient way to prevent the uploading and sharing of "harmful content." Shutting it off at the source means either invading devices or removing at least one end of the end-to-end encryption. And once those options are available, it will only be a matter of time before the UK government starts demanding access to unencrypted devices and/or messages.

And the UK government has specifically cited Apple's now-defunct plans to strip protections it previously extended to users and device owners as evidence the proposed law is a net gain for society.

[I]n the Daily Telegraph article announcing the Safety Challenge Fund, Home Secretary Priti Patel points to Apple’s client-side scanning proposal as a positive example, raising concerns about the criteria for evaluating Challenge Fund proposals.

In its quest for easy wins, the UK government is ignoring the long-term fallout of these demands. While it may have no problem stripping UK residents of strong data and communication protections, it may find it more difficult to talk powerful businesses into accepting less-than-solid protections for their financial interactions and transmission of sensitive proprietary info. And government employees still rely heavily on third-party contractors for communication services and data transmission/storage. These same employees also rely on devices and cell phones manufactured by companies that will now be forced to make their products less secure for everyone who uses them.

Everyone loses. But the people who will lose more and lose it faster simply don't matter. Before the cold reality of broken encryption hits home for politicians, they'll have already collected the PR wins needed to secure more terms in office. And with more time comes more power. Eventually, the UK government may find a way to exempt it from the impositions placed on the private sector, elevating them above the people they serve. In the end, very little will have actually been done to address the problems (child exploitation, terrorism) cited to justify these impositions. The only guarantee is that devices, communication services, and the internet at large will be expected to make huge sacrifices in service to the UK government's talking points.

Filed Under: backdoors, encryption, end-to-end encryption, going dark, online harms, online safety, online safety bill, uk

Germany's New Government Promises To Support End-To-End Encryption And Reject Backdoors

from the finally-someone-is dept

A bit of welcome news as the war on encryption continues around the globe. Germany's new government has said that it plans to come out more strongly in favor of end-to-end encryption and against backdoors. According to a report in Euractiv:

According to Jens Zimmermann, the German coalition negotiations had made it “quite clear” that the incoming government of the Social Democrats (SPD), the Greens and the business-friendly liberal FDP would reject “the weakening of encryption, which is being attempted under the guise of the fight against child abuse” by the coalition partners.

Such regulations, which are already enshrined in the interim solution of the ePrivacy Regulation, for example, “diametrically contradict the character of the coalition agreement” because secure end-to-end encryption is guaranteed there, Zimmermann said.

Introducing backdoors would undermine this goal of the coalition agreement, he added.

“What is sometimes proposed in the ePrivacy Regulation goes far beyond what we envisage in terms of vulnerability management,” Zimmermann told EURACTIV, adding that implementation would “mean actively creating vulnerabilities.”

This is certainly good to see, but it's also important to have a country with as much clout as Germany standing up and saying this. Indeed, Zimmermann is also quoted as saying that the new German government plans to take a more vocal and proactive role on this issue.

Unfortunately, not all of the new coalition government's views on the internet appear to be as good or as helpful. The same article also notes that while some parts of the new governing coalition had campaigned on getting rid of Germany's truly awful NetzDG internet censorship law, the new government does not plan to support such a position, and may, in fact, support a similar EU-wide plan within the Digital Services Act (DSA) which is currently up for debate in the EU.

Germany’s Network Enforcement Act (NetzDG), which has a similar scope to the EU’s DSA and has served as its model, according to Zimmermann, is not without controversy in the country.

The FDP campaigned for its abolition during the Bundestag election campaign because, according to the liberal party, it encroached too much on civil liberties.

But Zimmermann does not believe the liberal party would drag its reservations on the NetzDG into discussions on the EU’s DSA.

“It is no longer a question of winning any symbolic victories, but we simply have to see that we get a good regulation in the end,” Zimmermann said.

That's an odd statement that seems to suggest that protesting the disastrous and censorial NetzDG is "symbolic." It's not. It's a terrible law that has been abused repeatedly and should be ditched entirely, not spread to the EU.

Filed Under: backdoors, censorship, civil liberties, content moderation, encryption, germany

Hikvision's Director Of Cybersecurity And Privacy Says IoT Devices With Backdoors 'Can't Be Used To Spy On Companies, Individuals Or Nations'

from the O-RLY? dept

Hikvision describes itself as "an IoT solution provider with video as its core competency". It hasn't cropped up much here on Techdirt: it was mentioned earlier this year as one of two surveillance camera manufacturers that had been blacklisted by the US government because they were accused of being "implicated in human rights violations and abuses" in Xinjiang. Although little-known in the West, Hikvision is big: it has "more than 42,000 employees, over 20,000 of which are R&D engineers." Given the many engineers Hikvision employs, the following comment by Fred Streefland, Director of Cybersecurity and Privacy at Hikvision EMEA (Europe, the Middle East and Africa), reported by IPVM, is rather remarkable:

even devices with backdoors can't be used to spy on companies, individuals, or nations. The security features built into devices, networks, and data centres, combined with end-users data-protection responsibilities, make espionage and other misuses of backdoors impossible.

Streefland expanded on why data protection laws make espionage "impossible":

the end-users who buy these cameras are responsible for the data/video footage they generate. In other words, they're the data custodians who process the data and control the video footage, which is legally required to be kept private. Secret access to video footage on these devices is impossible without the consent of the end-user.

An interesting theory, but not one that security guru Bruce Schneier has much time for. IPVM asked him to comment on Streefland's statements:

I would say that only someone who doesn't understand cybersecurity at all would say something like that. But he's a CSO [Chief Security Officer], so he's probably deliberately saying something that stupid in order to sell you something.

That's a polite way to put it. As many stories on Techdirt attest, IoT products in general, and video cameras in particular, have huge security problems, often caused by backdoors, that have led to all kinds of spying at every level.

It seems that someone at Hikvision has realized just how ludicrous Streefland's comments were. The original source for the IPVM story is an interview with Streefland published by Benchmark Magazine. That interview is taken almost verbatim from a post on Hikvision's own blog, called "Debunking myths in the security industry." By an amazing coincidence, both the original interview and the blog post now lead to "404 not found" messages. Happily, the Internet Archive's indispensable Wayback Machine still has copies of both the interview and the blog post, where Streefland's words of wisdom quoted above can be found, along with some other choice thoughts on security.

Follow me @glynmoody on Twitter, Diaspora, or Mastodon.

Filed Under: backdoors, cybersecurity, fred streefland, iot, privacy, surveillance
Companies: hikvision

Belgian Government Wants To Add Encryption Backdoors To Its Already-Terrible Data Retention Law

from the it-can-always-get-worse dept

Earlier this year, a data retention law passed by the Belgian government was overturned by the country's Constitutional Court. The law mandated retention of metadata on all calls and texts by residents for one year, just in case the government ever decided it wanted access to it. Acting on guidance from the EU Court on laws mandating indiscriminate data retention elsewhere in the Union, the Constitutional Court struck the law down, finding it was neither justified nor legal under CJEU precedent or under Belgium's own Constitution.

[T]he Constitutional Court finds that the Data Retention Act aims at broader objectives than safeguarding national security, combating serious crime and preventing serious threats to public security and that the interference is thus not limited to what is strictly necessary. In addition, the Constitutional Court points out that such requirement to retain traffic and location data should be the exception, not the rule, must set out clear and precise rules regarding the scope and application of such measure, whereby certain minimum requirements should be implemented, and should ensure that the interference is limited to what is strictly necessary.

That prompted an immediate rewrite and a hasty propulsion of the law through the legislative process. This ruling was handed down in April. By May 10th, the government had another legislative proposal ready to go. Then it expanded it, adding encrypted messaging services to the list of entities obliged to collect and retain communications metadata.

But the demands go even further than metadata. Either incapable or unwilling to understand how end-to-end encryption works, legislators want a form of encryption that can be stripped away whenever the government wants access to communications. This is from an open letter sent to the Belgian government by 81 organizations and cybersecurity experts.

The Draft law on the collection and storage of identification, traffic and location data in the electronic communications sector and their access by the authorities, or “the Data Retention Legislation,” would require operators of encrypted systems to enable law enforcement to be able to access on request content produced by specific users after a specified date in the future. That is, they would have to be able to “turn off” encryption for specific users.

If you can't see where this is going, you might be a Belgian legislator.

There is no way to simply “turn off” encryption; providers would need to create a new delivery system and send targeted users into that separate delivery system. Not only would this require significant technical changes, but it would thereby break the promises of confidentiality and privacy of end-to-end encrypted communications services.

It's a backdoor. Backdoors don't work. Or rather, they do, but then the encryption doesn't work. Legislators and those pressuring legislators to mandate encryption backdoors don't like to use that term, so they dance around it. In the US, they call it technical assistance or whatever the opposite of "warrant-proof encryption" is. In Belgium, they stuff it into a bill that originally targeted phone service providers and call it "data retention."

It's unclear how the legislature thinks this version will be found constitutional by the courts, unless it's relying on the addition of some minimal targeting requirements to change it from a bulk data collection the government can access at any time to a slightly smaller bulk data collection the government can access at any time -- one that now includes metadata collected by encrypted communications platforms which will have to backdoor their own encryption to comply with demands for data.

If this is allowed to become law, everyone's communications will be less secure, not just those belonging to people the state wants to surveil or lock up.

Undermining encryption by introducing backdoors to encrypted communications would leave Belgium exposed to attacks, including its journalists, doctors, lawyers, public sector employees, and other citizens, as well as businesses and institutions, including governments.

If that's an acceptable tradeoff for the government, the bill will become law. But it will have to survive another legal challenge once it goes live. And from what's seen here, it looks like more of the stuff that was already struck down by the court, only with bonus encryption backdoors. If Belgian legislators aren't willing to protect their constituents, hopefully the courts will pick up the slack.

Filed Under: backdoors, belgium, data retention, encryption, surveillance

Researchers Who Built Similar System Explain Why Apple's CSAM Scanning System Is Dangerous

from the it's-not-good dept

Jonathan Mayer, a Princeton University professor and former chief technologist at the FTC, is one of the smartest people I know. Every time I've spoken with him I feel like I learn something. He's now written a quite interesting article for the Washington Post noting how he, and a graduate researcher at Princeton, Anunay Kulshrestha, actually built a CSAM scanning system similar to the one that Apple recently announced, which has security experts up in arms over the risks inherent to the approach.

Mayer and Kulshretha note that while Apple is saying that people worried about their system are misunderstanding it, they are not. They know what they're talking about -- and they still say the system is dangerous.

We wrote the only peer-reviewed publication on how to build a system like Apple’s — and we concluded the technology was dangerous. We’re not concerned because we misunderstand how Apple’s system works. The problem is, we understand exactly how it works.

Mayer and Kulshretha are certainly not making light of the challenges and problems associated with stopping CSAM. It's why they started their project to see if there was an effective way to identify CSAM even in end-to-end encrypted systems. And they even built a system to do just that. And what they found is that the risks are simply too great.

We were so disturbed that we took a step we hadn’t seen before in computer science literature: We warned against our own system design, urging further research on how to mitigate the serious downsides. We’d planned to discuss paths forward at an academic conference this month.

That dialogue never happened. The week before our presentation, Apple announced it would deploy its nearly identical system on iCloud Photos, which exists on more than 1.5 billion devices. Apple’s motivation, like ours, was to protect children. And its system was technically more efficient and capable than ours. But we were baffled to see that Apple had few answers for the hard questions we’d surfaced.

The potential dangers that Mayer and Kulshretha are exactly what many had warned about when Apple announced its plans:

After many false starts, we built a working prototype. But we encountered a glaring problem.

Our system could be easily repurposed for surveillance and censorship. The design wasn’t restricted to a specific category of content; a service could simply swap in any content-matching database, and the person using that service would be none the wiser.

A foreign government could, for example, compel a service to out people sharing disfavored political speech. That’s no hypothetical: WeChat, the popular Chinese messaging app, already uses content matching to identify dissident material. India enacted rules this year that could require pre-screening content critical of government policy. Russia recently fined Google, Facebook and Twitter for not removing pro-democracy protest materials.

We spotted other shortcomings. The content-matching process could have false positives, and malicious users could game the system to subject innocent users to scrutiny.

That's already pretty damning. But there's some other even more damning information that has come out as well. As we noted in our earlier posts (and as Mayer and Kulshretha noted in their research), the risk of false positives is extremely high. And late last week, the hypothetical became a lot more real. Someone reverse engineered the NeuralHash algorithm that Apple is using and put it on Github.

It did not take long for people to point that, first of all, there are collisions with totally unrelated images:

Now, you might say that since that second image is not really an image, maybe it's not that big a deal? Well, about that...

And, of course, one of the issues with any hash-based system is the idea that subtle changes to the image would output a totally different hash, thus making it easy for some to simply route around the scanning. Apple had suggested its system could defeat that, but...

This is part of the reason that we highlighted earlier that security researchers are so up in arms about this. Apple seemingly ignored so much of the research and conversations that were happening about these approaches, and just barged right in announcing that it had a solution without exploring the tradeoffs and difficulties associated with it -- leaving that for security experts to point out afterwards.

Apple is trying to downplay these findings, saying that it expected the collisions at least, and that it's system would also do a separate server side hashing comparison which would stop the false collisions. Though, as Bruce Schneier points out, if this was "expected," then why wasn't it discussed in the initial details that were released? Similarly, I have yet to see a response to the flip side issue of changing the images in a way that fool NeuralHash while still looking the same.

I know Apple keeps wanting to insist that it's thought through all of this, but it doesn't seem to have thought through any of how the security community would see all of this, and it's after-the-fact scrambling is not exactly reassuring.

Filed Under: backdoors, client side scanning, csam, encryption, hash clash, jonathan mayer, surveillance
Companies: apple

Apple's New Scanning Tools Raising More Concerns, Even Inside Apple

from the take-a-step-back dept

Last week, we wrote about our concerns about Apple's newly announced scanning efforts that the company claimed were to protect children. Lots of security experts raised concerns about how this was being rolled out -- and none of the complaints were meant to take away from the very real and legitimate concerns about child sexual abuse. Security guru Alex Stamos wrote one of the most thoughtful threads about the whole thing, noting (as with so many of these issues) that there are no easy answers here. I highly recommend you read the entire thread, but here's a little snippet:

Similar to many of these debates involving nuanced tech policy issues with no easy answers, a big part of the problem here is, as Stamos notes in his thread, there are tons of conversations happening about the nuances and tradeoffs, and even though Apple's approach is not as disastrous and dangerous as it could have been (i.e., clearly a lot of thought was put by the team at Apple into minimizing many -- though not all -- of the risks here), this approach was still done without talking to the many, many people who have been trying to find a reasonable balance here. And that messes a lot of stuff up.

Stamos, along with computer science professor/security guy Matt Green, have now published a good piece in the NY Times highlighting their concerns. The article notes there is less concern about the iMessage child safety features (Apple's initial description of that seemed much more concerning, but the details show why it's not that bad). But the photo scanning on the phone raises a lot of concerns:

But the other technology, which allows Apple to scan the photos on your phone, is more alarming. While Apple has vowed to use this technology to search only for child sexual abuse material, and only if your photos are uploaded to iCloud Photos, nothing in principle prevents this sort of technology from being used for other purposes and without your consent. It is reasonable to wonder if law enforcement in the United States could compel Apple (or any other company that develops such capacities) to use this technology to detect other kinds of images or documents stored on people’s computers or phones.

While Apple is introducing the child sexual abuse detection feature only in the United States for now, it is not hard to imagine that foreign governments will be eager to use this sort of tool to monitor other aspects of their citizens’ lives — and might pressure Apple to comply. Apple does not have a good record of resisting such pressure in China, for example, having moved Chinese citizens’ data to Chinese government servers. Even some democracies criminalize broad categories of hate speech and blasphemy. Would Apple be able to resist the demands of legitimately elected governments to use this technology to help enforce those laws?

Another worry is that the new technology has not been sufficiently tested. The tool relies on a new algorithm designed to recognize known child sexual abuse images, even if they have been slightly altered. Apple says this algorithm is extremely unlikely to accidentally flag legitimate content, and it has added some safeguards, including having Apple employees review images before forwarding them to the National Center for Missing and Exploited Children. But Apple has allowed few if any independent computer scientists to test its algorithm.

The computer science and policymaking communities have spent years considering the kinds of problems raised by this sort of technology, trying to find a proper balance between public safety and individual privacy. The Apple plan upends all of that deliberation. Apple has more than one billion devices in the world, so its decisions affect the security plans of every government and every other technology company. Apple has now sent a clear message that it is safe to build and use systems that directly scan people’s personal phones for prohibited content.

In a separate thread, Stamos has a suggested path forward for Apple, which involves pumping the brakes quite a bit on some of these features.

Meanwhile, Reuters revealed on Thursday that inside Apple there are widespread concerns as well.

Apple employees have flooded an Apple internal Slack channel with more than 800 messages on the plan announced a week ago, workers who asked not to be identified told Reuters. Many expressed worries that the feature could be exploited by repressive governments looking to find other material for censorship or arrests, according to workers who saw the days-long thread.

Past security changes at Apple have also prompted concern among employees, but the volume and duration of the new debate is surprising, the workers said. Some posters worried that Apple is damaging its leading reputation for protecting privacy.

The article notes that many of the concerns are coming from outside of the security team at Apple -- suggesting that the concerns are more about perception than they are technical. But, really, this highlights the same problem that Stamos noted earlier: Apple's standard operating procedure of doing everything alone, and then also doing "surprise" announcements regarding products. That's great for a new gadget in your pocket. It's not so great for dealing with a massively challenging and very legitimate problem with no easy answers, where getting things even a little wrong can have significant negative consequences.

Unlike many companies that rush out offerings that do more harm than good, I do think that Apple did think this through internally with lots of smart and thoughtful people. But these are problems and challenges that go beyond just one company -- and Apple's famously insular approach is exactly the wrong thing for this sort of challenge.

Filed Under: backdoors, csam, encryption, icloud, iphones, privacy, scanning, security, surveillance
Companies: apple

Phones Backdoored By The FBI Are Being Sold To Unsuspecting People Just Wanting A Cheap Replacement Device

from the retooling-the-tools-of-the-trade dept

Now that it's been revealed the FBI -- along with an unnamed conspirator linked to encrypted phone development -- created a honeypot device to harvest communications between suspected criminals, the backdoored devices are making their debut in the (non-criminal) public domain.

Following the exposure of the FBI-created "Anom" chat service -- a backdoored service placed on secure phones supposedly only sold to members of large criminal organizations -- multiple law enforcement agencies announced the arrest of dozens of suspected criminals. The devices, however, are still out there. And they're showing up on classified ad sales sites and potentially suckering in people just looking for a cheap Android device.

Whatever the price is, you're getting screwed, as Joseph Cox reports for Motherboard.

Unlocking the Google Pixel 4a with a PIN code reveals some common apps: Tinder, Instagram, Facebook, Netflix, and even Candy Crush. But none of those apps work, and tapping their icons doesn't do anything. Resetting the phone and typing in another PIN opens up an entirely different section of the device, with a new background and new apps. Now in place of the old apps sit a clock, a calculator, and the device's settings.

Clicking the calculator doesn't open a calculator—it opens a login screen.

The devices have a sole purpose: to enable secure chats between owners of these devices. Their original usefulness was subverted by law enforcement agencies able to intercept the compromised communications. Now that they're ostensibly free of law enforcement meddling, they're equally useless. The only option is a chat app known to be a honeypot for law enforcement investigators. Whether or not they're still being monitored no longer matters. That the service itself is compromised makes it an untenable option.

If you want a phone that doesn't do phone stuff, these pre-compromised devices are an option, I guess.

"I bought this phone online, for ridiculously low price, now I understand why," that second person said. That person also provided Motherboard with photos and a video of their device. In that case, the Anom login screen appeared inaccessible, but other settings such as the decoy PIN code remained. "Probably this phone was used by some drug dealer :D," they said.

Hobbyists and other developers are trying to help people who've purchased phones that do nothing more than offer them the opportunity to share their communications with law enforcement agencies around the world. If they can get them to work like other Android devices, purchasers may find themselves with potentially more secure devices once they abandon the Anom app crafted by FBI agents.

There appears to be no way to activate location tracking (or turn it off, for that matter), suggesting these phones do not harvest this data. A built-in option allows for PIN scrambling that randomly rearranges digits to defeat shoulder surfing when detained perps input their passcodes. Users can also set up a wipe code that will wipe the device from the lockscreen or perform this task automatically if the phone is not logged into after a certain amount of time. This feature can be accessed from the status bar, making it ideal for quick deletion of incriminating content.

But those features can only be trusted if one assumes the limited OS is not also compromised. Given what we know about the built-in chat service, only the ignorant would assume any of these features would actually prevent investigators from recovering data.

So, if you're in the market for a pre-compromised phone, there are options out there. But most people looking for a cheap phone aren't going to be happy with the limitations of this device and even less so when they discover these are little more than an investigational tool for law enforcement agencies around the world.

Filed Under: anom, backdoors, doj, fbi, honeypots, resale market, used phones

FBI Director Ignores More Than 500 Ongoing Capitol Raid Prosecutions To Complain That Encryption Is Keeping Criminals From Being Caught

from the why-are-all-these-trees-blocking-my-view-of-the-forest? dept

FBI Director Chris Wray needs to shut the fuck up about encryption.

It has been 1,112 days since the FBI promised to perform a recount of encrypted devices in its possession, after overstating it by thousands for months in service of former director Jim Comey's "going dark" haymaking.

As of November 2016, the number in the FBI's possession was only around 880 devices. It suddenly jumped to 3,000 six months later. Then it doubled to 6,000 in less than five months. By the end of that fiscal year, four months later, the FBI had added another 1,775 uncrackable devices to its total.

That brought the alleged total to nearly 8,000 devices. The actual number -- should the FBI ever get around to releasing it -- is expected to be under 2,000.

Add to this the fact that the FBI doesn't seem to be having much trouble hunting down criminals and terrorists. The FBI ran its own backdoored encrypted chat software for months, leading to dozens of arrests around the world. It ran seized child porn servers in order to deliver malware that coughed up identifying info about visitors to illicit dark web sites. Its crack team of undercover agents and informants have put a large number of terrorists behind bars, even though these successes are tainted by the agency's willingness to radicalize people just so it can bust them. And it has obtained all sorts of evidence to use against more than 500 defendants in the January 6th Capitol raid cases.

Despite all of this, Chris Wray is still complaining about encryption's supposed ability to render the FBI (and other law enforcement agencies) blind and useless. His recent testimony before the House Judiciary Committee takes time to highlight all the FBI's successes. But it also allows Wray to show off the latest in dead horse-beating rhetorical devices.

The proliferation of end-to-end and user-only-access encryption is a serious issue that increasingly limits law enforcement’s ability, even after obtaining a lawful warrant or court order, to access critical evidence and information needed to disrupt threats, protect the public, and bring perpetrators to justice.

If this were true, the FBI wouldn't have nearly as many success stories to entertain its Congressional oversight with. The FBI appears to be doing just fine, despite Wray's protestations otherwise.

And he's preaching to a choir that remains unconverted. The FBI has been complaining for the better part of a half-decade and it's no closer to obtaining favorable legal precedent or encryption-breaking legislation than it was back then. The FBI's directors have only one record. And it's broken. Enjoy this supremely shitty tune you've all heard too many times before.

The FBI remains a strong advocate for the wide and consistent use of responsibly-managed encryption—encryption that providers can decrypt and provide to law enforcement when served with a legal order.

Ah, yes. "Responsibly-managed encryption." Apparently allowing the government on-demand access through built-in flaws or storage of encryption keys where anyone -- even criminals -- can access them is more "responsible" than what's being offered to the public now. The only acceptable encryption is broken encryption, according to the FBI. Backdoors, keys under the doormat, keys behind the counter at the front desk that can be obtained by request… all of these euphemisms fit the FBI's encryption ideal, which is obviously far from ideal and anything but a net gain for public safety.

Chris Wray refuses to move past the "denial" stage of his self-inflicted grief.

What we mean when we talk about lawful access is putting providers who manage encrypted data in a position to decrypt it and provide it to us in response to the legal process. We are not asking for, and do not want, any “backdoor,” that is, for encryption to be weakened or compromised so that it can be defeated from the outside by law enforcement or anyone else.

It's a backdoor. Providers holding keys presents an opening for others… you know, "law enforcement or anyone else." It may present itself as a front door with a doorman willing to oblige visiting cops, but it's still an entrance that isn't there presently, when providers allow users to hold their own encryption keys. To meet Wray halfway, it's a door. But it's a door whose presence exists solely because law enforcement desires it and which will present an enticing target for enterprising cybercriminals and state-sponsored hackers.

As I was saying, Chris Wray can fuck right off.

Unfortunately, too much of the debate over lawful access has revolved around discussions of this “backdoor” straw man instead of what we really want and need.

Hey, it's your straw man, dude. While other people present the facts -- that encryption cannot be "safely" broken -- Wray and his DOJ/FBI ilk continue to insist this common sense response is nothing more than a straw man offered up by people arguing in bad faith.

But it's the FBI that's been arguing in bad faith for years. It also insists encryption is zero sum: either law enforcement has access or the criminals win. This willfully ignores the FBI's numerous options for obtaining communications and data that do not require forcing its way through the front of someone's seized phone. And since the FBI won't be honest about the extent of the problem it claims it faces -- i.e., not updating the number of locked devices in its possession for more than THREE YEARS -- no one should feel obliged to meet it halfway, much less engage in an "adult conversation" with a bunch of children who have misrepresented the facts for years.

Filed Under: backdoors, chris wray, encryption, fbi, going dark

FBI Flexes Rule 41 Powers, Uses Remote Access Technique To Neutralize Compromised Software All Over The US

from the computers-on-blast dept

Great news, everyone! The FBI has been fighting a cyberwar on your behalf… perhaps utilizing your own computer. Here's Zack Whittaker with some details:

A court in Houston has authorized an FBI operation to “copy and remove” backdoors from hundreds of Microsoft Exchange email servers in the United States, months after hackers used four previously undiscovered vulnerabilities to attack thousands of networks.

The Justice Department announced the operation on Tuesday, which it described as “successful.”

Hundreds of computers have been accessed by the FBI under the theory that these beneficiaries of government tech largesse won't complain too much about the FBI's (however brief) intrusion. This is the DOJ's official coat of gloss:

Authorities have executed a court-authorized operation to copy and remove malicious web shells from hundreds of vulnerable computers in the United States. They were running on-premises versions of Microsoft Exchange Server software used to provide enterprise-level email service.

Through January and February 2021, certain hacking groups exploited zero-day vulnerabilities in Microsoft Exchange Server software to access email accounts and place web shells for continued access. Web shells are pieces of code or scripts that enable remote administration. Other hacking groups followed suit starting in early March after the vulnerability and patch were publicized.

Many infected system owners successfully removed the web shells from thousands of computers. Others appeared unable to do so, and hundreds of such web shells persisted unmitigated. This operation removed one early hacking group’s remaining web shells which could have been used to maintain and escalate persistent, unauthorized access to U.S. networks. The FBI conducted the removal by issuing a command through the web shell to the server, which was designed to cause the server to delete only the web shell (identified by its unique file path).

So, what does this mean? Well, it means a few things. First of all, it appears Microsoft was unable to mitigate the problem on its own. The threat that remained was due to end users either uninformed or unwilling to take steps to prevent further infection or damage.

Then there's the how. And that has to do with the FBI's expanded powers under Rule 41(b). Prior to 2016, jurisdictional limits were placed on warrants and searches. If the government wanted to search/seize, it had to request a warrant in the jurisdiction where the search/seizure would take place. The government found this too limiting. The jurisdictional limits were causing it trouble in court. Its investigations of dark web child porn servers led to use of network investigative technique -- a search of computers connecting to servers that resulted in the deployment of malware to collect identifying info. Legal challenges were raised under Rule 41, which required warrants to be executed within the court's jurisdiction. The NITs deployed by the FBI were distributed to computers all over the world.

The jurisdictional limits are gone. The FBI's warrant [PDF] says that Rule 41(b) now allows it to travel far outside the Southern District of Texas, where the warrant request was made. No one can say for sure how far the FBI's web shell-targeting efforts traveled. Not even the FBI:

The presumptively U.S.-based Microsoft Exchange Servers, corresponding to the approximately web shells in Attachment A appear to be located in five or more judicial districts, according to publicly available Whois records and IP address geolocation. These districts include, but are not limited to, the following: Southern District of Texas, District of Massachusetts, Northern District of Illinois, Southern District of Ohio, District of Idaho, Western District of Louisiana, Northern District of Iowa and Northern District of Georgia.

There's the presumption. All servers might all be in the US. Then again, they may not. But no one knows for sure until after the warrant is executed and all the data is in.

No one targeted by the Rule 41 warrant is suspected of committing crimes. Instead, they've done nothing more than run unpatched software that presents a security risk to them and anyone else they come in contact with. The FBI has decided it's up to the government to come to the rescue of computer users around the US (and perhaps around the world) to prevent further malicious hacking by suspected Chinese state operatives.

So, where does this leave computer users who'd rather not have the government meddle with their unpatched software? On the outside and in the minority, it would appear. The FBI was able to deactivate backdoors in several targets but estimates "hundreds" of servers remain vulnerable because the FBI's hacking tool was unable to find and eliminate the threat under the confines of the court order it obtained.

Now that the court order has been unsealed, the FBI is reaching out to those whose computers the agency briefly accessed. And it definitely should. Not just because of the unexpected intrusion, but because the FBI could only do so much with its webshell-hunting software.

The Justice Department also said the operation only removed the backdoors, but did not patch the vulnerabilities exploited by the hackers to begin with or remove any malware left behind.

There it is. The attempt to neutralize a threat only neutralized some of it. But the FBI had permission to neutralize whatever it encountered that met its definition of a threat, no matter where the target was located. This is the FBI using its powers for good, which makes this effort pretty benign. But the FBI's definition of "good" is, at some point, going to cause considerable collateral damage because Rule 41(b) no longer limits it to a single jurisdiction. This was a search, as the FBI freely admits. That it was strictly limited in this case speaks more to the operational aspects of the job, rather than the FBI's better judgment. We can only hope in the future -- as the FBI flexes its jurisdictional free pass -- that the agency shows as much restraint in the future when there's more than some unpatched computers at stake.

Filed Under: backdoors, doj, fbi, microsoft exchange, patch, rule 41
Companies: microsoft

DOJ Says Encryption Is Just For Criminals As It Goes After Another Secure Phone Purveyor

from the dark-mode-engaged dept

The DOJ has indicted another company for supposedly making it easier for criminals to elude law enforcement. The true target, though, isn't the company whose principals have been indicted, but encryption itself.

A couple of years ago the DOJ decided to bring RICO charges against Phantom Secure, a cellphone provider that catered to the criminal element with "uncrackable" phones/messaging services built on existing Blackberry hardware/software.

The FBI approached Phantom Secure, asking for an encryption backdoor that would allow it to snoop on its customers. Phantom Secure declined the FBI's advances. Its phones -- originally marketed to professionals desirous of additional security -- were soon marketed to criminals, a market sector that truly valued the security options offered by Phantom.

But rejecting the FBI and selling to criminals causes problems. The DOJ went after Phantom Secure, arresting the owner and charging him with a bunch of RICO and RICO-adjacent crimes.

It is happening again. The DOJ has decided encryption is a crime when companies offering encrypted communications choose to sell to people the DOJ considers to be criminals.

Here's the DOJ's portrayal of its crime-fighting efforts -- one supported by people who rarely find a sandwich they don't think can be criminally charged.

A federal grand jury today returned an indictment against the Chief Executive Officer and an associate of the Canada-based firm Sky Global on charges that they knowingly and intentionally participated in a criminal enterprise that facilitated the transnational importation and distribution of narcotics through the sale and service of encrypted communications devices.  

Jean-Francois Eap, Sky Global’s Chief Executive Officer, and Thomas Herdman, a former high-level distributor of Sky Global devices, are charged with a conspiracy to violate the federal Racketeer Influenced and Corrupt Organizations Act (RICO). Warrants were issued for their arrests today.

But here's where it gets sketchy. The DOJ is basically trying to hold a phone provider responsible for the criminal acts of its customers. In order to do that, it needs to depict encryption as an unnecessary evil that serves mainly to allow criminals to escape justice.

According to the indictment, Sky Global’s devices are specifically designed to prevent law enforcement from actively monitoring the communications between members of transnational criminal organizations involved in drug trafficking and money laundering. As part of its services, Sky Global guarantees that messages stored on its devices can and will be remotely deleted by the company if the device is seized by law enforcement or otherwise compromised.

"Or otherwise compromised." There are plenty of non-criminal reasons to want to remotely wipe a phone that has ended up in the hands of someone other than its owner. Some of those reasons are ones even the DOJ finds legitimate, like the protection of trade secrets. But in this case, the DOJ only sees an evil that must be stopped. And the fact that Sky Global's market share is so small it amounts to a rounding error isn't stopping the DOJ from attempting to make the company pay for the sins of some of its users.

There are at least 70,000 Sky Global devices in use worldwide, including in the United States. The indictment alleges that for more than a decade, Sky Global has generated hundreds of millions of dollars in profit by facilitating the criminal activity of transnational criminal organizations and protecting these organizations from law enforcement.

Allegations are just that: allegations. Sky Global may have had some legitimate customers who felt vanilla phone offerings by Google, Apple, and a host of Android-based manufacturers weren't secure enough, but those people's concerns don't matter when criminals are also using the same phones to conduct criminal activity.

The real enemy is encryption, according to the DOJ. The DOJ says preventing law enforcement from "actively monitoring communications" is its own evil, even while multiple messaging services now offer end-to-end encryption that prevents law enforcement from listening in. This is the foot in the door. If the FBI and DOJ can make enough noise about a company that supposedly marketed its product to criminals, it can make further inroads towards demonizing encryption as a threat to the security of the nation, if not an aider and abettor of criminal activity.

This is the ongoing PR war being fought by our government against a feature that provides more security to phone users. And it's being done by an agency that has yet to be completely honest about how much of a problem encryption actually poses to criminal investigations. For that reason alone, the DOJ's accusations shouldn't be granted credence. Its efforts to undermine the safety of millions of non-criminal phone users shouldn't be ignored either, because it's clear at this point the security concerns of the American public mean nothing to it.

Filed Under: backdoors, criminal, doj, encryption, fbi, jean-francois eap, rico, secure phones, thomas herdman
Companies: sky global