We Read All 20 Filings In Support Of Apple Against The FBI; Here Are The Most Interesting Points

from the it's-a-crypto-party dept

Support our crowdfunding campaign to help us keep covering stories like these!

In the last week or so, it became quite clear that a fair number of tech companies and organizations in the civil liberties community would file amicus (friend of the court) briefs urging magistrate judge Sheri Pym to side with Apple over the Justice Department and the FBI. However, now that the briefs are in, it's fairly staggering just how many companies, organizations and individuals signed onto briefs supporting Apple. Yes, many of them teamed up and filed briefs together, but it's still a ton. And that's especially true for an issue at the district court level in front of a magistrate judge. Here's the big list put together by Apple, including links to various blog posts and press releases about the filings:

Amicus Briefs

• 32 Law Professors
• Access Now and Wickr Foundation | Press Release
• ACT/The App Association | Medium Post
• Airbnb, Atlassian, Automattic, CloudFlare, eBay, GitHub, Kickstarter, LinkedIn, Mapbox, Medium, Meetup, Reddit, Square, Squarespace, Twilio, Twitter and Wickr | Automattic & WordPress.com Blog Post | Tweet from Twitter
• Amazon, Box, Cisco, Dropbox, Evernote, Facebook, Google, Microsoft, Mozilla, Nest, Pinterest, Slack, Snapchat, WhatsApp, and Yahoo | Tweet from Box | Evernote Blog Post  | Facebook Statement | Microsoft Blog Post | Mozilla Blog Post | Snapchat Blog Post | WhatsApp Facebook Post | Yahoo Tumblr Post
• American Civil Liberties Union, ACLU of Northern California, ACLU of Southern California, and ACLU of San Diego and Imperial Counties | Blog Post
• AT&T | Public Policy Blog Post
• AVG Technologies, Data Foundry, Golden Frog, the Computer & Communications Industry Association (CCIA), the Internet Association, and the Internet Infrastructure Coalition | Golden Frog Blog | CCIA News
• BSA|The Software Alliance, the Consumer Technology Association, the Information Technology Industry Council, and TechNet | Press Release
• Center for Democracy & Technology | Insight
• Electronic Frontier Foundation and 46 technologists, researchers, and cryptographers | Blog Post | Press Release
• Electronic Privacy Information Center (EPIC) and eight consumer privacy organizations | EPIC Top News
• Intel | Blog Post
• iPhone security and applied cryptography experts including Dino Dai Zovi, Dan Boneh (Stanford), Charlie Miller, Dr. Hovav Shacham (UC San Diego), Bruce Schneier (Harvard), Dan Wallach (Rice) and Jonathan Zdziarski | Blog Post
• The Media Institute | Press Release
• Privacy International and Human Rights Watch

Letters to the Court

• Beats, Rhymes & Relief, Center for Media Justice, The Gathering for Justice, Justice League NYC, Opal Tometi and Shaun King
• David Kaye, United Nations Special Rapporteur on the promotion and protection of the right to freedom of opinion and expression | Supporting Document
• Salihin Kondoker, San Bernardino, CA

Not entirely sure why, but Apple (at least as I'm writing this) did not include one other amicus brief on its side, which is from Lavabit, the one company out there should should have tremendous perspective on Apple's situation, given that it shut down its entire business to avoid having to hand over its encryption keys to the government. At this point, we just have Lavabit's motion for leave to file its brief, rather than the full brief. If and when that brief is released, we may address it separately.

I've also put all of these together in a collection which are embedded below (which also lets you search through the text of them all).

Having read through many of them (and skimmed the rest), there are certainly some common themes. Frankly, an awful lot of them do really feel like they're just a rehashing of Apple's motion to vacate, repeating the claim that the All Writs Act should not apply (and that CALEA already covers this issue and doesn't allow such a solution). Obviously, all the filings from the various tech companies are getting a lot of the press attention, and they're worth reading to perhaps better understand a few of the key legal points that Apple is raising. Similarly, the filings from civil liberties/human rights groups aren't all that surprising either -- focusing more on some of the human rights questions. The EFF brief is a bit different in focusing on the First Amendment issue, which many expect won't even be looked at by the courts. It's really the only brief that digs deeply into that issue and is worth a read for that reason (I've seen legal experts in fairly strong disagreement about the applicability of the First Amendment argument here).

Separately, I thought that the filing from EPIC was worthwhile as well, in focusing in on the importance of encryption on phones these days because so much personal information is accessible from phones and because unencrypted phones are such a big target for criminals. That's a slightly different perspective that isn't covered nearly as much by other filings and actually could be a useful perspective for the court.

However, the most interesting filing of all may be the one filed by a group of iPhone Security and Applied Cryptography Experts, and put together by Jennifer Granick and Riana Pfefferkorn from Stanford's Center for Internet and Society. That brief is super educational in getting down into the weeds of just how dangerous it would be for Apple to create this code. Since so many people -- including the DOJ -- seem to think that Apple can just create this code and then make it disappear, this filing is super useful in debunking that claim. It first notes that the Court did try to put in some "safeguards" against abuse of the code, but then explains why those won't help:

These rules are not meaningful barriers to misuse and abuse of the forensic capabilities this Court is ordering Apple to create. First, the Order assumes that Apple will create the Custom Code without any vulnerabilities in its implementation. Vulnerabilities are common in software code, including Apple’s iOS, and despite Apple’s best efforts. The government dismissively downplays the effort required to develop and update the Custom Code, stating that Apple “writes software code as part of its regular business,” including “routinely patch[ing] security or functionality issues” in iOS and “releas[ing] new versions of [iOS] to address issues.” Application at 15. But creating software (especially secure software) is complex, and software development requires rigorous testing.

Vulnerabilities are common in software code, despite vendors’ best efforts. To address this problem, vendors employ extensive pre-release testing; after-thefact audits, including by independent security researchers; and regular updates. Yet none of these practices, alone or in concert, can ensure that software will not be vulnerable and subject to misuse. Yet, given the circumstances of this case, this code is unlikely to go through this lifecycle, increasing the risk that it will introduce vulnerabilities into the iPhone ecosystem.

For example, since first introducing the earliest iPhone, Apple has waged a cat-and-mouse battle with “jailbreakers,” software developers who identified and exploited vulnerabilities in the devices in order to run software other than that signed by Apple and to defeat carrier locks that tied handsets to particular cellular providers. Apple warns its users against jailbreaking and the practice is contrary to Apple’s terms of service. Jailbreaking involves modifying the iPhone firmware so that it will run software code without checking to see if the code has been signed by Apple. When Apple releases a new iOS, scores of independent programmers study the code, successfully finding ways to circumvent Apple’s imposed restrictions. In response, Apple issues software updates to defeat these jailbreaks. Eventually, the jailbreaking community finds new ways to circumvent controls built into Apple’s increasingly secure iOSes. Today, all iOS versions through 9.2 are jailbroken, even though doing so is increasingly harder due to Apple’s efforts.

In other words, vulnerabilities in Apple’s software have persisted for years even though Apple very much does not want them to. This is a lesson for this case. Apple can try its very hardest to create this Custom Code as the Court directs. Nevertheless, it may well fail, as it has acknowledged to the Court.... Even with time and extensive testing, which the government’s sense of urgency seems designed to deny Apple, it is extremely difficult to write bug-free code. Software bugs can interact with existing code in complex ways, creating unanticipated new paths for bypassing iPhone security and exploiting the phone.

This is a point that so few people outside of the tech world seem to get. Security vulnerabilities exist and software (and hardware) are incredibly complex. Purposefully creating vulnerabilities likely creates even more vulnerabilities and those can be pretty dangerous. And that's especially true in a situation -- such as this one -- where Apple will have to create the code entirely by itself, and without any outside security audit possible.

Furthermore, the brief notes the fact that, contrary to what many keep insisting, there's a high likelihood that any such code will leak out:

This Court also allowed the Custom Code to stay with Apple, rather than go to the FBI. Simply put, if no one else has the Custom Code, no one else should be able to use it, at least not without Apple’s knowledge. However, once created, this software is going to be very valuable to law enforcement, intelligence agencies, corporate spies, identity thieves, hackers, and other attackers who will want to steal or buy the Custom Code. Keeping the Custom Code secret is essential to ensuring that this forensic software not pose a broader security threat to iOS users. But the high demand poses a serious risk that the Custom Code will leak outside of Apple’s facilities.

Other governments, or ours, may eventually compel Apple to turn the Custom Code over so that law enforcement officials can unlock phones without delay or Apple oversight. Authoritarian governments will likely be the most enthusiastic customers for the Custom Code this Court is contemplating ordering Apple to create and sign. The software will be used in China, Russia, Turkey, the United Arab Emirates, and other governments with poor human-rights records where iPhones are sold.

Inadequate security practices by those governments increase the risk that attackers will acquire and use the Custom Code. Given the Custom Code’s value, unscrupulous government officials in corruption-plagued jurisdictions could foreseeably sell the Custom Code to third parties. For example, if the Russian government compelled Apple to hand over the Custom Code, it could end up being sold by a corrupt agent to a Russian identity-theft ring. Even without selling it, corrupt officials could also use the code for their own agendas, such as to target political or personal enemies who had broken no law. Journalists, human-rights advocates, religious and sexual minorities, and others in those countries are at much greater risk if software that can bypass passcode limitations exists.

There is also a danger that the Custom Code will be lost or stolen. The more often Apple must use the forensic capability this Court is ordering it to create, the more people have to have access to it. The more people who have access to the Custom Code, the more likely it will leak. The software will be valuable to anyone eager to bypass security measures on one of the most secure smartphones on the market. The incentive to steal the Custom Code is huge. The Custom Code would be invaluable to identity thieves, blackmailers, and those engaged in corporate espionage and intellectual property theft, to name a few.

Those technicians responsible for using the Custom Code to comply with access demands will likely be targeted by phishing attacks—emails carefully designed to seem legitimate but which contain malware—that seek to steal the Custom Code. The same technicians will be approached with offers to buy the software. The price offered could be irresistibly high, as the Custom Code will be worth a lot to foreign national security officials and organized crime syndicates, and can be sold to multiple customers. Or Apple technicians may be blackmailed to the same end. In short, the Custom Code will be exceedingly valuable and in danger of leaking or being stolen.

Finally, that brief also notes a key point being raised increasingly by security experts: that if a company can be forced to remove security features in an automatic update, it creates incentives for people not to update their devices, which will open up many more serious security problems:

Automatic updates are an important way that software companies ensure their users are as protected as possible from attackers, without inconvenience, significant effort, or technical savvy on the part of the user (who is more likely to install security updates when there is little or nothing she needs to do). These autoupdates are one of the reasons why the millions of iPhones currently in use worldwide are very secure.

Consumers (and their devices) trust these auto-updates because they are signed by the vendor. A cryptographic signature from Microsoft or Apple assures the user that the software she is about to install legitimately comes from the company she trusts. It is akin to Apple saying, “This is Apple, and we stand behind this software.” Here, however, the Court is contemplating ordering Apple to sign software it does not stand behind and in fact considers “too dangerous to build.” .... And the next logical step if this Court enforces its Order is for the FBI to ask to compel other vendors, in addition to Apple, to sign other software that bypasses other customer security measures, creating new and different risks.

This is why compelling cryptographic signatures is extremely risky. Automatic software updates are a crucial vehicle for maintaining the security of iOS devices and other computers, but they can be effective only so long as users continue to trust them. If the Court compels Apple to create and sign the Custom Code in this high-profile case, then all computer users, especially those for whom smartphone privacy may already be a concern, could become suspicious of all software updates going forward. That is because a member of the public could reasonably fear that in the future, even a signed software update from a trusted vendor will bypass passcode limitations, convert her iPhone into an audio or video recording device, or otherwise interfere with her property, privacy, or security interests. Users will know that these updates could be software designed to extract private data from the user’s machine, but which a company was forced to sign at the behest of some court, law enforcement, or other government official. The code would be indistinguishable from a genuine update created, signed, and transmitted of the vendor’s own free will.

This distrust would have serious ramifications for computer security at large. In response, some users would likely stop accepting iOS updates (which users must choose to install), in which case their machines will remain unprotected against vulnerabilities that legitimate automatic updates would have patched. Importantly, the impact of unpatched devices is not limited to those devices. Vulnerable software that has not been updated can become a vector for spreading malware, potentially compromising other machines on the network. The more users who turn off automatic updates, the more devices, the more information, the more people put at risk. Just as herd immunity to a disease is lost if enough members of the group are not vaccinated against the disease, if enough users stop auto-updating their devices, it will weaken the entire device security ecosystem. Indeed, one computer security expert has likened automatic updates to “a public health system for the Internet.” It is this whole system which the Court ultimately threatens to put at risk should it enforce its Order to Apple.

Good stuff. One hopes that the judge will read this brief, in particular, carefully.

The other two things that were most interesting were not amicus briefs, but merely two of the letters to the judge. First was the letter from the UN Special Rapporteur on "the protection and promotion of the freedom of opinion and expression," David Kaye. He adds in some additional perspective about how the right to secure communications and encryption is a fundamental part of freedom of expression, including quoting from his own report on the benefits of encryption for the public, along with the challenges it presents for law enforcement. As he concludes:

My concern is that the subject order implicates the security, and thus the freedom of expression, of unknown but likely vast numbers of people, those who rely on secure communications for the reasons identified above and explicated in more detail in the report. This is fundamentally a problem of technology, one where compromising security for one and only one time and purpose seems exceedingly difficult if not impossible. Again from the report, “States must show, publicly and transparently, that other less intrusive means are unavailable or have failed and that only broadly intrusive measures, such as backdoors, would achieve the legitimate aim.” ... It is not clear that the Government has tried other means short of compelling Apple’s code-writing in this case, such as enlisting the technical expertise of other agencies to access this particular phone.

Finally, there's the letter from Salihin Kondoker, whose wife, Anies, was one of the people shot, but not killed, in the attack. That letter is truly worth reading. He notes that while he has been "frustrated that there isn't more information" as to why the attack occurred, and that he was initially frustrated that Apple might be a roadblock. But then, as he understood more of the details, he supports Apple's decision.

When I first learned Apple was opposing the order I was frustrated that it would be yet another roadblock. But as I read more about their case, I have come to understand their fight is for something much bigger than one phone. They are worried that this software the government wants them to use will be used against millions of other innocent people. I share their fear.

I support Apple and the decision they have made. I don’t believe Tim Cook or any Apple employee believes in supporting terrorism any more than I do. I think the vicious attacks I’ve read in the media against one of America’s greatest companies are terrible.

In my opinion it is unlikely there is any valuable information on this phone. This was a work phone. My wife also had an iPhone issued by the County and she did not use it for any personal communication. San Bernardino is one of the largest Counties in the country. They can track the phone on GPS in case they needed to determine where people were. Second, both the iCloud account and carrier account were controlled by the county so they could track any communications. This was common knowledge among my wife and other employees. Why then would someone store vital contacts related to an attack on a phone they knew the county had access to? They destroyed their personal phones after the attack. And I believe they did that for a reason.

[....]

Finally, and the reason for my letter to the court, I believe privacy is important and Apple should stay firm in their decision. Neither I, nor my wife, want to raise our children in a world where privacy is the tradeoff for security. I believe this case will have a huge impact all over the world. You will have agencies coming from all over the world to get access to the software the FBI is asking Apple for. It will be abused all over to spy on innocent people.

You never know how much weight a court will put on these things. Amicus briefs often are little more than a chance for some publicity for those filing them. But many of these briefs (and letters) are detailed, thoughtful and actually do add compelling and important perspectives on the larger issues involved in this case. Hopefully the judge pays attention.

Support our crowdfunding campaign to help us keep covering stories like these!

Filed Under: all writs act, amicus briefs, backdoors, calea, doj, encryption, fbi
Companies: apple

Judge In Different Apple Case Says That All Writs Act Doesn't Mean Apple Needs To Help Feds Break Into Phone

from the paper-trail dept

Everybody has obviously been focused on the DOJ's All Writs Act request on Apple in the case involving the San Bernardino attacker's work iPhone, but as we've been covering there are a other cases where the feds have made use of the All Writs Act as well, including a key one in NY in the court of Magistrate Judge James Orenstein that we've been covering for a while now. Orenstein has already expressed skepticism about the government's argument, and now has come out with a well timed order denying it.

Judge Orenstein is no fool, and knows that the world will pay close attention to his order -- so it's pretty detailed. Also, and this is important, it basically mimics the key argument that Apple has made in its filing in the San Bernardino case, saying that the All Writs Act is preempted by other laws (mainly CALEA) and therefore, Apple cannot be compelled to help. In short, Congress has addressed this more specific issue and hasn't passed a law that allows the government to get what it wants, so the government can't just fall back on the All Writs Act to do what Congress failed to do:

More specifically, the established rules for interpreting a statute's text constrain me to reject the government's interpretation that the AWA empowers a court to grant any relief not outright prohibited by law. Under a more appropriate understanding of the AWA's function as a source of residual authority to issue orders that are "agreeable to the usages and principles of law," 28 U.S.C. § 1651(a), the relief the government seeks is unavailable because Congress has considered legislation that would achieve the same result but has not adopted it. In addition, applicable case law requires me to consider three factors in deciding whether to issue an order under the AWA: the closeness of Apple's relationship to the underlying criminal conduct and government investigation; the burden the requested order would impose on Apple; and the necessity of imposing such a burden on Apple. As explained below, after reviewing the facts in the record and the parties' arguments, I conclude that none of those factors justifies imposing on Apple the obligation to assist the government's investigation against its will. I therefore deny the motion.

In the case -- involving drug trafficking (not terrorism) charges against Jun Feng -- the DEA seized Feng's iPhone 5 (with iOS7) and wanted to use the All Writs Act to compel Apple to help open it up. The case was complicated by the fact that as this was being debated, Feng took a plea deal. However, the government still wanted to move forward to set a precedent (it claimed the information might be useful in sentencing or to find other partners and customers of Feng). Judge Orenstein "agreed" with the government that the issue is not moot, based on this, but uses it as a chance to shoot down its All Writs Act argument entirely.

In going into detail, Judge Orenstein basically repeats the basic argument that CALEA rules here, and the All Writs Act does not apply:

I believe Apple has the better argument – both because it is arguable that CALEA explicitly absolves a company like Apple of any responsibility to provide the assistance the government seeks here and also because even if CALEA does not have such an explicit prohibition, it is part of a larger legislative scheme that is so comprehensive as to imply a prohibition against imposing requirements on private entities such as Apple that the statute does not affirmatively prescribe.

Judge Orenstein goes on for many pages, in great detail, explaining why CALEA applies over the AWA and why it says that Apple need not help the government here. It's worth a read, but it follows pretty closely on Apple's own arguments.

There are also some pretty good lines and takedowns of government arguments, and I'll just note one here, involving how the government's argument could be so widely abused, in particular how the DOJ says that because Apple just "licenses" the software instead of selling it, then Apple retains a relationship which makes the All Writs Act demands apply. Judge Orenstein points out how insane such a reading of the law would be:

If Apple's retention of intellectual property rights in the software deployed in a device sold to the public sufficed to render it sufficiently close, for purposes of the AWA, to any crime committed by any user of such a device, it would eventually render the first discretionary factor under N.Y. Tel. Co. a dead letter. As constantly increasing computing power is continually squeezed into ever smaller storage devices, the category of consumer products containing licensed software will continue to grow. In a world in which so many devices, not just smartphones, will be connected to the Internet of Things, the government's theory that a licensing agreement allows it to compel the manufacturers of such products to help it surveil the products' users will result in a virtually limitless expansion of the government's legal authority to surreptitiously intrude on personal privacy.

This being a NY district court, the ruling has no direct precedential value (and certainly not in the Central District of California where the other big case is happening), but at the very least sets up the possibility of a circuit split that could get the issue to the Supreme Court relatively quickly. Also, just in general, it's good to see a judge not just roll over for the DOJ on requests like this and give due recognition to the legal concerns at issue.

Filed Under: all writs act, calea, dea, doj, encryption, fbi, james orenstein, jun feng
Companies: apple

How Existing Wiretapping Laws Could Save Apple From FBI's Broad Demands

from the calea-to-the-rescue? dept

There are all sorts of interesting (and frustrating and challenging) legal questions raised by the FBI's use of the All Writs Act to try to force Apple to build a system to allow the FBI to hack Apple's customers. But there's one interesting one raised by Albert Gidari that may cut through a lot of the "bigger" questions (especially the Constitutional ones that everyone leaps to) and just makes a pretty simple point: the DOJ is simply wrong that the All Writs Act applies here, rather than the existing wiretapping statute, the Communications Assistance for Law Enforcement Act, or 47 USC 1002, better known by basically everyone as CALEA. CALEA is the law that some (including the DOJ) have wanted "updated" in ways that might force internet companies and mobile phone companies to make their devices more wiretap-ready. But that hasn't happened.

And, as Gidari points out, it seems clear that CALEA preempts the All Writs Act and explicitly forbids what the FBI is requesting here. The DOJ is claiming that CALEA doesn't apply to Apple:

Put simply, CALEA is entirely inapplicable to the present dispute [because] Apple is not acting as a telecommunications carrier, and the Order concerns access to stored data rather than real time interceptions and call-identifying information

But Gidari notes that's misrepresenting CALEA, which also does apply to "manufacturers and providers of telecommunications support services" and Apple could be seen as qualifying, since it's providing the "equipment" here. And then if CALEA, rather than the All Writs Act applies, the DOJ's argument is basically dead on arrival. As many have noted, CALEA already says that you can't force a provider to decrypt encrypted communications:

A telecommunications carrier shall not be responsible for decrypting, or ensuring the government’s ability to decrypt, any communication encrypted by a subscriber or customer, unless the encryption was provided by the carrier and the carrier possesses the information necessary to decrypt the communication.

Now, some may argue that in this case Apple "possesses the information necessary," but that's not actually the case. Apple doesn't possess the information necessary to decrypt. It's being asked to build a system that would let the FBI then hack the system to decrypt. And that's different. And on that point, there's this in CALEA as well:

(1) Design of features and systems configurations. This subchapter does not authorize any law enforcement agency or office

(a) to require any specific design of equipment, facilities, services, features, or system configurations to be adopted by any provider of a wire or electronic communication service, any manufacturer of telecommunications equipment, or any provider of telecommunications support services;

(b) to prohibit the adoption of any equipment, facility, service, or feature by any provider of a wire or electronic communication service, any manufacturer of telecommunications equipment, or any provider of telecommunications support services.

In a follow up post, Gidari looks at the legislative history of CALEA as well, and notes that it was a compromise between law enforcement (who wanted access to everything) and telcos (who didn't want to give that much access). And the end result was that CALEA was designed to be clear that, no, law enforcement can't always get anything, and certainly can't force companies to build new tools:

Indeed, Congress outright rejected the government’s initial CALEA proposal to actually prevent deployment of new technologies that didn’t have a wiretap back door. As Congress noted, “[t]his is the exact opposite of the original versions of the legislation, which would have barred introduction of services or features that could not be tapped.” In other words, Congress accepted the fact that some new technologies would put some evidence that law enforcement wanted, needed, and may have had access to in the past, beyond its reach in some cases.

Congress also determined that carriers would have no responsibility to decrypt encrypted communications unless the carrier provided the encryption and could in fact decrypt it. CALEA did not prohibit a carrier from deploying an encryption service for which it did not retain the ability to decrypt communications for law enforcement access, period. Here again, CALEA recognized that some evidence that may be necessary to an investigation will not be available to the government because it is encrypted and the provider lacks the key to access it.

So while CALEA provided law enforcement with some surveillance capabilities on phone networks (which the Federal Communications Commission later extended to broadband Internet access and two-way Voice over IP), it precluded the government from requiring “any specific design of equipment, facilities, services, features, or system configurations to be adopted by any manufacturer of telecommunications equipment.” Requiring Apple by court order to create and implement a work-around for the iPhone’s security features is, in fact, doing what CALEA prohibited.

While a big Constitutional battle may be more interesting (and more long lasting), it's possible that an argument like this one might win the actual lawsuit.

Of course, then the battle will shift back to Congress to try to update CALEA...

Filed Under: backdoors, calea, doj, encryption, fbi, hacking, iphone
Companies: apple

Ron Wyden Introduces Legislation Aimed At Preventing FBI-Mandated Backdoors In Cellphones And Computers

from the may-be-cited-as-'Up-Yours,-Comey-Act-of-2014' dept

The FBI had better start polishing up its "front door" pitch because Sen. Ron Wyden is pitching legislation that would prevent it from crafting its own backdoors.

The Secure Data Act will prohibit Federal agencies from requiring that private entities design or alter their commercial information technology products for the purpose of facilitating government surveillance.

Wyden's one-page summary of the bill [pdf link] notes that FBI Director James Comey's ongoing push to create some sort of "law enforcement only" security holes in Apple and Google's on-by-default encryption undermines the government's push for better personal and professional security as well as does further damage to the limited amount of trust remaining in the wake of the Snowden leaks and increasing evidence of law enforcement overreach.

U.S. government and independent experts have extensively documented the multi-billion dollar threat posed by constant cyberattacks from criminal organizations and foreign government-sponsored hackers. The U.S. government also urges private companies and individuals to protect sensitive personal and business data, including through the use of data security technologies such as encryption. The recent proposals from U.S. law enforcement officials to undercut the development and deployment of strong data security technologies by compelling companies to build backdoors in the security features of their products work against the overwhelming economic and national security interest in better data security.

Moreover, the decision of government officials to repeatedly misled the American public about domestic surveillance activities has resulted in an erosion of public trust. Requiring computer hardware and software companies to now create intentional gaps in their data security products to facilitate further government access to personal data will undermine the effort to restore trust in the U.S. digital economy.

Government-driven technology mandates to weaken data security for the purpose of aiding government investigations would compromise national security, economic security and personal privacy.

Here's the actual wording of the backdoor ban [pdf link], which has a couple of loopholes in it.

(a) IN GENERAL.—Except as provided in subsection (b), no agency may mandate that a manufacturer, developer, or seller of covered products design or alter the security functions in its product or service to allow the surveillance of any user of such product or service, or to allow the physical search of such product, by any agency.

Subsection (b) presents the first loophole, naming the very act that Comey is pursuing to have amended in his agency's favor.

(b) EXCEPTION.—Subsection (a) shall not apply to mandates authorized under the Communications Assistance for Law Enforcement Act (47 U.S.C. 1001 et seq.).

Comey wants to alter CALEA or, failing that, get a few legislators to run some sort of encryption-targeting legislation up the Congressional flagpole for him. Wyden's bill won't thwart these efforts and it does leave the NSA free to continue with its pre-existing homebrewed backdoor efforts -- the kind that don't require mandates because they're performed off-site without the manufacturer's knowledge.

This still in early draft form and will likely be finessed as it heads towards becoming a finished product, hopefully addressing a few of these issues on the way. If nothing else, it sends yet another message to James Comey and like-minded law enforcement officials that there's a whole bunch of legislators waiting to thwart their pushes for instant, permanent access to the American public's cellphones.

Filed Under: backdoors, calea, encryption, james comey, ron wyden, wiretapping

FBI Holds Secret Meeting To Scare Congress Into Backdooring Phone Encryption

from the just-in-time-for--halloween dept

In September, both Apple and Google announced plans to encrypt information on iOS and Android devices by default. Almost immediately, there was a collective freakout by law enforcement types. But, try as they might, these law enforcement folks couldn't paint any realistic scenario of where this would be a serious problem. Sure, they conjured up scenarios, but upon inspection they pretty much all fell apart. Instead, what was clear was that encryption could protect users from people copying information off of phones without permission, and, in fact, the FBI itself recommends you encrypt the data on your phone.

But it didn't stop FBI director James Comey from ignoring the advice of his own agency and pushing for a new law that would create back doors (he called them front doors, but when asked to explain the difference, he admitted that he wasn't "smart enough" to understand the distinction) in such encryption.

So, now, of course, the FBI/DOJ gets to go up to Congress and tell them scary stories about just how necessary breaking encryption would be. And it's being done in total secrecy, because if it was done in public, experts might debunk the claims, like they've done with basically all of the scenarios provided in public to date.

FBI and Justice Department officials met with House staffers this week for a classified briefing on how encryption is hurting police investigations, according to staffers familiar with the meeting. The briefing included Democratic and Republican aides for the House Judiciary and Intelligence Committees, the staffers said. The meeting was held in a classified room, and aides are forbidden from revealing what was discussed.

It's almost guaranteed that someone will introduce some legislation, written primarily by the FBI, pushing for this (such a bill is almost certainly already sitting in some DOJ bureaucrat's desk drawer, so they just need to dot some i's, cross some t's and come up with a silly acronym name for the bill). So far, many in Congress have been outspoken against such a law, but never underestimate the ability of the FBI to mislead Congress with some FUD, leading to all sorts of scare stories about how we need this or we're all going to die.

Filed Under: back doors, calea, congress, doj, fbi, front doors, james comey, mobile encryption

Government Sues Sprint For Overcharging For Wiretaps Under CALEA

from the everybody-loses dept

As we just got done discussing, AT&T, Verizon and Sprint recently were able to dodge a long-running lawsuit alleging the companies have been dramatically overcharging the government for wiretaps for more than a decade. The lawsuit was filed by former New York Deputy Attorney General John Prather, who spent thirty years in the AG's office (and six years on the Organized Crime Task Force in NY) helping to manage wiretaps and invoices for wiretap provisioning. Prather filed the suit on behalf of the U.S. government, but telco lawyers were able to have the suit dismissed by arguing that Prather couldn't technically sue the telcos under the False Claim Act as a whistleblower, because he filed the original complaint while working for the government.

Now it appears that at least one of the telcos is being focused on for round two, with the news that the government is suing Sprint for overcharging for wiretaps under CALEA. Under CALEA phone companies are allowed to recoup "reasonable expenses," but the lawsuit claims that Sprint overcharged the government to the tune of $21 million, overinflating charges by approximately 58 percent between 2007 and 2010. The Prather case claimed the telcos overcharge for taps in general, but have historically dodged culpability by simply hitting the government with large bills that don't itemize or explain why a wiretap should magically cost $50,000 to $100,000.

Sprint appears to have been specifically nabbed by the Justice Department’s Inspector General because it wasn't clever enough about passing on the costs of modifying its network to adhere to CALEA back to the government, something the law prohibits:

"Despite the FCC’s clear and unambiguous ruling, Sprint knowingly included in its intercept charges the costs of financing modifications to equipment, facilities, and services installed to comply with CALEA. Because Sprint’s invoices for intercept charges did not identify the particular expenses for which it sought reimbursement, federal law enforcement agencies were unable to detect that Sprint was requesting reimbursement of these unallowable costs."

It should be interesting to see if AT&T and Verizon face similar lawsuits down the road, or if their lawyers and accountants were simply better at obscuring overbilling. It's kind of a lose-lose scenario for you and me either way. Not only do we get to be spied on, we likely paid for these wiretaps both on the taxpayer side and on the telco side as the companies passed on both real and imaginary wiretap costs to you.

Filed Under: calea, john prather, new york, wiretap
Companies: at&t, spring, verizon