FBI Cites Guidelines That Don't Actually Forbid Social Media Monitoring As The Reason It Was Blindsided By The January 6 Attack

from the some-monitoring-is-more-equal-than-others dept

The FBI has spent thousands on social media monitoring software. These contracts are public, making it literally unbelievable the agency has managed to stave off FOIA requests by handing out "neither confirm nor deny" non-answers. A court didn't buy the FBI's excuse for its Glomar, pointing out that confirming public information would not give criminals a heads-up on surveillance software the FBI is currently using.

The FBI's inability to honestly discuss its social media monitoring programs continues. The January 6th raid on the US Capitol building has resulted in hundreds of arrests. A lot of the evidence for these prosecutions has come from social media posts by members of the ad hoc raiding party.

The FBI continues to provide contradictory responses when questioned about its social media monitoring programs. Its Congressional testimony has kind of eluded direct questions about the FBI's incursions into First Amendment territory -- something the FBI is now using to explain why it wasn't more aware of the impending threat prior to January 6th.

Quinta Jurecic's post for Lawfare points out the FBI lack of awareness was somewhat stunning, given the vast amount of publicly available information circulating social media prior to the Capitol raid.

The only document the FBI produced warning about Jan. 6 was a single bulletin issued by the bureau’s Norfolk, Virginia, field office. This absence of warning is particularly striking given that a significant amount of the planning for the Jan. 6 riot took place in public on social media platforms like Facebook, Gab and Parler. Anyone with a Twitter account and an hour of time to kill could have warned about the potential for violence on Jan. 6—and many did.

FBI Director Chris Wray has been questioned about the FBI's lack of preparedness. And his responses haven't cleared much up. According to Wray, FBI guidelines forbid agents from camping out on social media and searching for evidence of potential criminal activity.

“We’re not allowed to ... just sit and monitor social media and look at one person’s posts … just in case,” Wray told the House Judiciary Committee recently.

But that's not strictly true. The agency's guidelines do not strictly forbid this activity. The FBI can monitor social media platforms. It just usually doesn't. Wray says guidelines prevent agents from "collecting First Amendment activities," but there's nothing in the rules that says the FBI can't monitor open-source information like public posts.

This has been Wray's line through several hearings this year. But the guidelines say something completely different.

[A]ssessments may be undertaken proactively with such objectives as detecting criminal activities; obtaining information on individuals, groups, or organizations of possible investigative interest, either because they may be involved in criminal or national security-threatening activities or because they may be targeted for attack or victimization by such activities; and identifying and assessing individuals who may have value as human sources. For example, assessment activities may involve proactively surfing the Internet to find publicly accessible websites and services through which recruitment by terrorist organizations and promotion of terrorist crimes is openly taking place…

So, perhaps the problem was the January 6th raid was carried out by the wrong kind of terrorists. The FBI is certainly proactive when it comes to monitoring the Muslim community "just in case." When it comes to white insurrectionists, the agency apparently just hangs back and lets things take their course until it becomes imperative for the FBI to get involved.

Wray, at best, is only partly right.

In other words, Wray is correct that the bureau needs an authorized purpose to review social media, and that First Amendment considerations are involved. But his testimony leaves out the fact that the DIOG specifically authorizes FBI employees to review social media posts potentially protected by the First Amendment under certain circumstances—circumstances that could well have been met in the case of the soon-to-be Capitol rioters. After all, wouldn’t Facebook posts announcing plans to invade a government building raise criminal or national security concerns under the FBI’s definition of “authorized purpose”?

It's not that we should be encouraging the FBI to engage in more proactive monitoring of social media -- something that's sure to raise some First Amendment issues. It's that the FBI has never been shy about focusing this attention on certain kinds of people while appearing to ignore others who haven't historically been considered a threat to national security by the agency.

Perhaps this take isn't accurate and the FBI takes a similar hands-off approach when keeping an eye on other potential threats involving less-white people. But given the FBI's long history of utilizing social media to radicalize local adherents of Islam into attempting to commit criminal acts, it hardly seems likely the FBI follows these guidelines (the ones that don't say what the FBI Director says they do) consistently. It has experienced this sort of colorblindness in the past. And the conclusion one can easily draw -- especially when the FBI hasn't offered up a better explanation for why it missed the warning signs for the January 6th attack -- is that the agency largely feels white people are nothing to worry about.

Filed Under: chris wray, fbi, insurrection, january 6th, public information, social media, social media monitoring

FBI Director Ignores More Than 500 Ongoing Capitol Raid Prosecutions To Complain That Encryption Is Keeping Criminals From Being Caught

from the why-are-all-these-trees-blocking-my-view-of-the-forest? dept

FBI Director Chris Wray needs to shut the fuck up about encryption.

It has been 1,112 days since the FBI promised to perform a recount of encrypted devices in its possession, after overstating it by thousands for months in service of former director Jim Comey's "going dark" haymaking.

As of November 2016, the number in the FBI's possession was only around 880 devices. It suddenly jumped to 3,000 six months later. Then it doubled to 6,000 in less than five months. By the end of that fiscal year, four months later, the FBI had added another 1,775 uncrackable devices to its total.

That brought the alleged total to nearly 8,000 devices. The actual number -- should the FBI ever get around to releasing it -- is expected to be under 2,000.

Add to this the fact that the FBI doesn't seem to be having much trouble hunting down criminals and terrorists. The FBI ran its own backdoored encrypted chat software for months, leading to dozens of arrests around the world. It ran seized child porn servers in order to deliver malware that coughed up identifying info about visitors to illicit dark web sites. Its crack team of undercover agents and informants have put a large number of terrorists behind bars, even though these successes are tainted by the agency's willingness to radicalize people just so it can bust them. And it has obtained all sorts of evidence to use against more than 500 defendants in the January 6th Capitol raid cases.

Despite all of this, Chris Wray is still complaining about encryption's supposed ability to render the FBI (and other law enforcement agencies) blind and useless. His recent testimony before the House Judiciary Committee takes time to highlight all the FBI's successes. But it also allows Wray to show off the latest in dead horse-beating rhetorical devices.

The proliferation of end-to-end and user-only-access encryption is a serious issue that increasingly limits law enforcement’s ability, even after obtaining a lawful warrant or court order, to access critical evidence and information needed to disrupt threats, protect the public, and bring perpetrators to justice.

If this were true, the FBI wouldn't have nearly as many success stories to entertain its Congressional oversight with. The FBI appears to be doing just fine, despite Wray's protestations otherwise.

And he's preaching to a choir that remains unconverted. The FBI has been complaining for the better part of a half-decade and it's no closer to obtaining favorable legal precedent or encryption-breaking legislation than it was back then. The FBI's directors have only one record. And it's broken. Enjoy this supremely shitty tune you've all heard too many times before.

The FBI remains a strong advocate for the wide and consistent use of responsibly-managed encryption—encryption that providers can decrypt and provide to law enforcement when served with a legal order.

Ah, yes. "Responsibly-managed encryption." Apparently allowing the government on-demand access through built-in flaws or storage of encryption keys where anyone -- even criminals -- can access them is more "responsible" than what's being offered to the public now. The only acceptable encryption is broken encryption, according to the FBI. Backdoors, keys under the doormat, keys behind the counter at the front desk that can be obtained by request… all of these euphemisms fit the FBI's encryption ideal, which is obviously far from ideal and anything but a net gain for public safety.

Chris Wray refuses to move past the "denial" stage of his self-inflicted grief.

What we mean when we talk about lawful access is putting providers who manage encrypted data in a position to decrypt it and provide it to us in response to the legal process. We are not asking for, and do not want, any “backdoor,” that is, for encryption to be weakened or compromised so that it can be defeated from the outside by law enforcement or anyone else.

It's a backdoor. Providers holding keys presents an opening for others… you know, "law enforcement or anyone else." It may present itself as a front door with a doorman willing to oblige visiting cops, but it's still an entrance that isn't there presently, when providers allow users to hold their own encryption keys. To meet Wray halfway, it's a door. But it's a door whose presence exists solely because law enforcement desires it and which will present an enticing target for enterprising cybercriminals and state-sponsored hackers.

As I was saying, Chris Wray can fuck right off.

Unfortunately, too much of the debate over lawful access has revolved around discussions of this “backdoor” straw man instead of what we really want and need.

Hey, it's your straw man, dude. While other people present the facts -- that encryption cannot be "safely" broken -- Wray and his DOJ/FBI ilk continue to insist this common sense response is nothing more than a straw man offered up by people arguing in bad faith.

But it's the FBI that's been arguing in bad faith for years. It also insists encryption is zero sum: either law enforcement has access or the criminals win. This willfully ignores the FBI's numerous options for obtaining communications and data that do not require forcing its way through the front of someone's seized phone. And since the FBI won't be honest about the extent of the problem it claims it faces -- i.e., not updating the number of locked devices in its possession for more than THREE YEARS -- no one should feel obliged to meet it halfway, much less engage in an "adult conversation" with a bunch of children who have misrepresented the facts for years.

Filed Under: backdoors, chris wray, encryption, fbi, going dark

FBI Director Uses January 6 Insurrection To, Once Again, Ask For Encryption Backdoors

from the FBI-really-needs-to-write-some-new-material dept

FBI Director Chris Wray needs to shut the fuck up about encryption.

Let me explain sum up:

For years, consecutive FBI Directors have claimed encryption is preventing law enforcement from doing law enforcement. And for years, public records, efforts by researchers, and court documents have shown encryption isn't much of an impediment to investigations.

Most importantly -- in the FBI's case -- the agency overstated the amount of locked devices in its possession for years while agitating for encryption backdoors. It turns out the FBI's "locked device" spreadsheet performed some faulty math, greatly misstating the number of locked devices in its possession. While the FBI said it has over 8,000 impregnable electronics allegedly preventing law enforcement from investigating crimes, the correct amount is expected to be less than a quarter of that.

That discovery was made in May 2018. The FBI has yet to provide an accurate count of these devices.

So. Shut. The fuck. Up.

Wray is shameless and incapable of shutting the fuck up, even after the agency admitted to Congressional oversight it really didn't know how many locked devices it had or how often encryption actually prevented investigators from investigating.

And yet, here's Chris Wray, leveraging the January 6th insurrection to complain about encryption yet again.

There doesn't appear to be any lack of open source data capable of aiding the FBI in its investigation of this event. Hundreds have already been charged for their participation in the raid on the US Capitol building.

This event has forced US law enforcement to admit domestic terrorism is an actual threat -- a threat propelled mainly by white extremists and others aligned with the pathetic ideal that white makes right. This threat includes far too many law enforcement officers, who have also aligned themselves with the same ideals. That's why it's been ignored for so long and that's why it's a much bigger problem now than it should be.

But here's what Chris Wray has chosen to focus on with his allotted testimonial time before the Senate: encryption. Wray says it's a "lawful access" problem. And he begins with what can only be considered an overstatement of the threat, considering the FBI has done nothing but overstate the problem for years.

The problems caused by law enforcement agencies’ inability to access electronic evidence continue to grow. Increasingly, commercial device manufacturers have employed encryption in such a manner that only the device users can access the content of the devices. This is commonly referred to as “user-only-access” device encryption. Similarly, more and more communications service providers are designing their platforms and apps such that only the parties to the communication can access the content. This is generally known as “end-to-end” encryption. The proliferation of end-to-end and user-only-access encryption is a serious issue that increasingly limits law enforcement’s ability, even after obtaining a lawful warrant or court order, to access critical evidence and information needed to disrupt threats, protect the public, and bring perpetrators to justice.

Yes, encryption can prevent "easy" investigative efforts. But it doesn't prevent investigations. Lots of data and communications can be obtained from service providers and cloud services that store copies of their own. There are at least a couple of vendors providing law enforcement with forensic tools that appear capable of pulling vast amounts of data from "locked" devices. And while it may be accurate to say the "problem" continues to "grow" given the increased deployment of encryption, the FBI has yet to honestly depict the problem it's already facing, so there's no way of quantifying this "growth" to judge its impact on investigations.

And Wray continues to be dishonest about what he wants. He wants encryption backdoors. But when asked directly, he'll claim he doesn't want backdoors. Instead, he wants a mythical form of encryption that is capable of protecting users from malicious threats but not government entities armed with a warrant.

The FBI remains a strong advocate for the wide and consistent use of responsibly managed encryption, encryption that providers can decrypt and provide to law enforcement when served with a legal order.

This sure sounds like a backdoor, but Chris Wray is in permanent denial.

We are not asking for, and do not want, any “backdoor,” that is, for encryption to be weakened or compromised so that it can be defeated from the outside by law enforcement or anyone else.

It's the everyone else who is wrong.

Unfortunately, too much of the debate over lawful access has revolved around discussions of this “backdoor” straw man instead of what we really want and need.

LOL. Get fucked, Chris. The reason no serious security professional agrees this is possible is because it isn't. A hole for law enforcement is a hole for anyone. Once providers start storing encryption keys for law enforcement, those encryption keys are a target for malicious hackers. Criminals who find the keys will do the same thing Wray is asking companies to do, bypassing encryption to obtain communications and personal data.

The only person trotting out straw men is the FBI Director, who appears to believe any counterargument is made in bad faith. His straw men may be uncaptured terrorists or dead kids or whatever, but they're still straw men, especially considering the FBI still has yet to provide an accurate count of encrypted devices in its possession.

And those are his straw men. Wray cites both terrorist attacks and child sexual exploitation as reasons to eliminate actually secure encryption. This ignores the FBI's willingness to radicalize people solely for the purpose of arresting them on terrorist charges. And it ignores the fact the FBI has -- on more than one occasion -- seized and operated servers distributing child porn in order to catch other child porn distributors. Whether or not we agree with the FBI's actions in these cases, it illustrates breaking encryption isn't the only way to address these problems.

Wray also claims the rest of the law enforcement community is suffering from the proliferation of end-to-end encryption.

Our state and local law enforcement partners have been consistently advising the FBI that they, too, are experiencing similar end-to-end and user-only-access encryption challenges, which are now being felt across the full range of state and local crime. Many report that even relatively unsophisticated criminal groups, like street gangs, are frequently using user-only-access encrypted smartphones and end-to-end encrypted communications apps to shield their activities from detection or disruption.

But this really hasn't been observed by anyone else but Wray. (And we know Wray can't be trusted.) The FBI has made constant noise about encryption. Local agencies -- despite having far fewer resources -- haven't said much publicly about encryption or its challenges, outside of the outsized racket whipped up by Manhattan DA Cy Vance. And Vance is no more trustworthy or credible than Chris Wray.

Chris Wray will take any chance given to complain about encryption and a lack of "lawful access." But he doesn't have facts or history on his side.

Filed Under: backdoors, chris wray, encryption, fbi, going dark, january 6

Why Is The US Trying To Punish Hackers For Accessing Vaccine Research We Should Be Sharing With The World?

from the what-a-stupdendous-waste-of-time dept

Back in May, I wondered why the US was trying to hide vaccine data from the Chinese. In fact, it was bizarre that the US government seemed concerned about Chinese hackers trying to access vaccine data, because why would anyone keep such data secret in the first place. This is a global pandemic and the way you solve a global pandemic is with a global solution, and the way to get there faster (and better) is with the open sharing of information. Hoarding and locking up information regarding a potential vaccine makes no sense at all. And yet, this morning, the DOJ made a big showing of how it had indicted Chinese hackers for trying to hack COVID-19 related research.

The Justice Department on Tuesday accused two Chinese hackers of stealing hundreds of millions of dollars of trade secrets from companies across the world and more recently targeting firms developing a vaccine for the coronavirus.

This is totally performative, as those hackers are in China and the US can't do a damn thing about them, other than allow for Attorney General Bill Barr and FBI Director Chris Wray to grandstand and pretend they're doing something useful. And, again, the really shameful part is the fact that this research is "secret" in the first place.

And, of course, last week we had a repeat of the story from May, except that this time it wasn't "Chinese hackers" trying to get vaccine data, but theoretical Russian hackers:

Russian cyber actors are targeting organizations involved in coronavirus vaccine development, according to a new warning by US, UK and Canadian security officials on Thursday that details activity by a Russian hacking group called APT29, which also goes by the name "the Dukes" or "Cozy Bear."

An advisory published by the UK National Cyber Security Centre (NCSC) details activity by the Russian hacking group and explicitly calls out efforts to target US, UK and Canadian vaccine research and development organizations.

"APT29's campaign of malicious activity is ongoing, predominantly against government, diplomatic, think tank, healthcare and energy targets to steal valuable intellectual property," a press release on the advisory said.

I'm sure within a month or two we'll have another performative press conference from Barr and Wray announcing pointless show charges against Russian hackers as well, because why not?

And, again, rather than recognize that saving and protecting global health is the key priority here, the US government is responding by worrying that others might save the world first. House Minority Leader Rep. Kevin McCarthy is even introducing a bill to "sanction foreign hackers" for trying to get US COVID-19 vaccine information in his somewhat pointless Defend COVID Research from Hackers Act".

The bill is pointless on multiple levels. Foreign hackers are not subject to US jurisdiction, so this wouldn't do anything in the first place. Second, given the indictments announced today, it's not as if law enforcement actually needs greater authority. They seem to have the authority they need to go after hackers. But, (to repeat myself) more importantly, we should be sharing this research widely and getting everyone else to pool their research efforts as well in order to move everyone forward as quickly as possible in order to save as many lives as possible. This isn't a zero sum game where one country "wins" and another "loses." This is about stopping a devastating global pandemic.

As even CNN is admitting, there are no good health reasons for keeping this info secret or worrying about hacks, it's literally a completely wasteful attempt to want to claim bragging rights.

Given the inevitable confusion ahead, getting to the head of the line just does not make sense as an explanation, at least from a financial windfall perspective or a saving lives perspective. But the need to dominate voiced both by Trump and the leader of Russian vaccine efforts, Dmitriev, makes the likely reason for any sneak attack all too clear. It's less about saving the world with a vaccine than about beating the other guy and taking home the first place medal.

What a stupid, stupid reason. Leadership is about doing the right thing even if it makes you look bad. The right thing here is figuring out how to save as many lives as possible and to end the pandemic as quickly as possible. McCarthy's bill would do the opposite of that, and is a total waste of time. I get that it's still driven by the silly belief that everything related to drug discovery must be "owned" and "patented," but actual lives are on the line right now, and Rep. McCarthy should be ashamed that he's wasting time and holding back research, instead of encouraging more open sharing of information.

Filed Under: china, chris wray, covid-19, hacking, information sharing, innovation, kevin mccarthy, patents, russia, sharing, vaccines, william barr

On The Same Day The FBI Claimed No Vendor Could Crack IPhones, Another Way To Crack IPhones Made The News

from the way-to-stay-ahead-of-the-news-cycle,-Chris dept

At the same time the FBI director was claiming the private sector (other than Apple) couldn't help agents break into encrypted iPhones, the private sector was once again demonstrating it could do exactly that. Chris Wray's remarks to the press centered less on the underwhelming news that the FBI had conclusively linked the Pensacola Air Base shooter to al Qaeda than on Apple's supposed unhelpfulness.

The FBI claimed it had found a way to access data on the shooter's phones, but provided no details on its method. Maybe agents brute forced a passcode. Maybe they just found a side door that allowed them to exfiltrate the data they were looking for. Whatever it was, it wasn't something provided by a vendor. In fact, Chris Wray went so far as to claim the media was misleading the public about the availability of encryption-breaking/bypassing tech.

We canvassed every partner, and every company, that might have had a solution to access these phones. None did, despite what some claimed in the media.

Within a few hours of this assertion by Wray, the media was again reporting on another tech solution for encrypted iPhones. Here's Olivia Solon for NBC News:

[A]nother tool, previously unknown to the public, doesn't have to crack the code that people use to unlock their phones. It just has to log the code as the user types it in.

Software called Hide UI, created by Grayshift, a company that makes iPhone-cracking devices for law enforcement, can track a suspect's passcode when it's entered into a phone, according to two people in law enforcement, who asked not to be named out of fear of violating non-disclosure agreements.

The software is deployed by existing GrayKey devices -- the same ones Grayshift claims can crack iPhone passcodes by installing a user agent to bypass Apple's lockout countdown. This would be the same software/hardware Chris Wray claims can't do any of these things, despite extensive reporting on claims the manufacturer itself makes.

After dropping the surreptitious tracker on the targeted phone, the phone is returned to the suspect in hopes that they'll input their passcode.

For example, a law enforcement official could tell the suspect they can call their lawyer or take some phone numbers off the device. Once the suspect has done this, even if they lock their phone again, Hide UI will have stored the passcode in a text file that can be extracted the next time the phone is plugged into the GrayKey device. Law enforcement can then use the passcode to unlock the phone and extract all the data stored on it.

The software also disables airplane mode and disables wiping of the device. A snapshot of the system is taken to track any attempted deletion of phone contents.

This seems to do all the things the FBI claims no one can actually do. Sure, it won't scale -- especially since it requires a fair bit of subterfuge on the part of investigators and relies on the trust of criminal suspects who might find it suspicious their seized phone has suddenly been returned to them. But no technique for bypassing encryption ever will. And none of them should.

Asking a suspect for the combination to a safe will only unlock that safe, not every safe seized during searches. Phones are as unique as the individuals carrying them. So are the circumstances surrounding the attempted searches. One size should not fit all and the encryption backdoors Chris Wray wants only ensure everyone -- criminal or not -- will be negatively affected by law enforcement's newly-greased wheel.

Then there's the secrecy surrounding this tech. The NDAs Grayshift force on law enforcement customers means judges, defendants, and defense lawyers aren't being told what's being used to open up phones and search their contents. We've spent years detailing the opacity shrouding the deployment of Stingray devices -- something that has allowed law enforcement to avoid having warrant requirements imposed on them. The same thing is happening here. There's a legal way to do this. But the secrecy imposed by the tech provider tends to provide the cover officers need to operate these unlawfully. Here's the best case scenario, followed immediately by the most likely scenario.

“Law enforcement use of this ‘agent’ keylogger feature can be legal, so long as the warrant the government gets to search and seize the device spells out that the investigators are permitted to use it,” said Riana Pfefferkorn, associate director of surveillance and cybersecurity at Stanford Law School’s Center for Internet and Society. “In general, I don't think that magistrate judges authorizing search warrants would expect that the government plans to implant malware on a device it has seized.”

There are solutions out there. And they're not legislative mandates compelling assistance breaking encryption or backdoors for law enforcement. There are ways to bypass or crack what Bill Barr and Chris Wray have decided to call "warrant-proof encryption." Pretending there isn't while using an investigation press conference as a grandstand for Apple bashing isn't moving the conversation forward. It's just giving everyone one more reason not to trust Bill Barr or Chris Wray.

Filed Under: chris wray, cracks, encryption, fbi, hide ui, iphone
Companies: apple, grayshift

FBI Holds Press Conference To Claim Apple Prevented It From [Checks Notes] Verifying Attribution In The Pensacola Air Base Shooting

from the what-a-compelling-argument-for-broken-encryption dept

The FBI held a very performative press conference to announce it had finally gained access to communications and data originating from the Pensacola Naval Air Station shooter. The coup, apparently, is that the FBI was able to -- after months of fighting iPhone encryption -- um... nail down attribution. Here's CNN's report on the FBI's press conference:

The Saudi military trainee who killed three US sailors and wounded several others in a terror attack last year on a military base in Pensacola, Florida, was in touch with a suspected al Qaeda operative, according to multiple US officials briefed on the matter.

US investigators uncovered the al Qaeda connection after the FBI broke through the encryption protecting the Saudi attacker's iPhones, the officials said.

So, the FBI discovered that a shooter who al Qaeda claimed to be one of theirs was actually one of theirs. I'm sure the FBI found a few more leads to investigate -- potentially targeting US persons involved with the terrorist group -- but it's far from the wealth of evidence the agency continually asserted was definitely present on the phones agents weren't able to access.

It's big news in a smaller way.

If Alshamrani was directed or trained by al Qaeda, it would mark the first time since 9/11 that a foreign terrorist organization had done so in a deadly attack in the US, according to New America, a think tank.

That's an 18-year gap between foreign terrorist group-directed attacks on US soil. Not much to write home about, but the FBI seems to feel we all should be writing about it. Hopefully, this isn't the FBI's linchpin argument, because something that happens once every other decade is hardly worth the broad undermining of encryption the agency seeks.

CNN's report says something the FBI doesn't actually say: the "FBI broke through the encryption" statement. Chris Wray's remarks at the press conference don't actually state that the FBI broke the phones' encryption. (And nothing is said about the iPhone that was damaged by a bullet, which possibly rendered it completely useless.)

On the topic of innovation—I want to thank and congratulate the men and women at the FBI who devoted months of hard work to accessing these devices. They successfully tackled a problem that required tenacity, creativity, and technical expertise. Those qualities are valuable in any organization—so I know how fortunate we are, and how fortunate the American people are, that we have so many people with those qualities at the Bureau. That’s why we work to recruit the kind of people we do.

The magnitude of the challenge they faced is hard to overstate.

[...]

Unfortunately, the technique that we developed is not a fix for our broader Apple problem—it’s of pretty limited application. But it has made a huge difference in this investigation.

This doesn't clarify anything. This just says the FBI was finally able to access some of the contents, which means it could have found a way to exfiltrate or recover some data without actually breaking encryption.

What I've excised in this quote shows that this press conference wasn't about announcing these findings. It was an anti-encryption pep rally pretending to be a dry announcement about an ongoing investigation. The FBI's ulterior motives made their way to the forefront, starting with this:

We received effectively no help from Apple.

Wrong. The FBI received all the help Apple could give it. Apple was compliant with turning over all data and communications it could access. What it didn't do was offer to break the encryption on the seized devices. And while Wray may talk about delays and (no, seriously) agents "toiling through the pandemic," it was the FBI that sat on this investigation, waiting a month before asking Apple for assistance.

Then there's this statement, in which Wray says everyone's been misinformed about encryption-breaking tools sold by a handful of vendors.

We canvassed every partner, and every company, that might have had a solution to access these phones. None did, despite what some claimed in the media.

"What some claimed in the media" is a fucking disingenuous statement. This is what was claimed by vendors offering tools that bypassed Apple's built-in protections to provide access to iPhone contents. The media didn't spin this. If vendors over-promised and under-delivered, that's on them, not the journalists reporting on the latest in encryption-breaking tech.

This is twice as disingenuous when you remember the FBI refused to seek outside options in the San Bernardino shooter case because it really would rather have had legal precedent. While the FBI and DOJ went after Apple in court, vendors tried to offer their assistance. When the FBI finally decided to work with a still-undisclosed vendor to obtain the (useless) contents of the shooter's iPhone, FBI officials were upset this had derailed their attempt to obtain judicial blessing for compelled decryption. This is pure spin and it was delivered by the head of the FBI solely to portray Apple as an enemy of the rule of law and the public's safety.

Flow my collective tears, the federal policeman said.

Public servants, already swamped with important things to do to protect the American people—and toiling through a pandemic, with all the risk and hardship that entails—had to spend all that time just to access evidence we got court-authorized search warrants for months ago. Our engineers and computer scientists working to access these phones were also needed on other, pressing, national security and criminal investigations.

But the delay getting into these devices didn’t just divert our personnel from other important work. It’s also seriously hampered this investigation.

Finally getting our hands on the evidence al-Shamrani tried to keep from us is great. But we really needed it months ago, back in December, when the court issued its warrants.

Needed it for what? Confirming what al Qaeda said after the shooting? If that's all there is, it really isn't worth undermining the security of millions of encryption users, including those who work at the FBI. And it sure as hell didn't stop the FBI from performing an investigation. Wray states the FBI interviewed 500 people and obtained all the evidence it could from sources other than the locked iPhones. The investigation continued and personnel still worked round-the-clock "through a pandemic" to put this case together. Apple's contribution (or lack thereof) is only a footnote, but Wray insists it's the headline.

Don't be swayed by Wray's cheap shots. This press conference was held to directly (in Apple's case) and indirectly smear every US company that offers encryption to their users. If the FBI had held an intellectually honest press conference, it simply would have noted it found evidence linking the Pensacola shooter to al Qaeda and left it at that. (It also might have explained why it still hasn't updated its count of encrypted devices in its possession.) Instead, Wray grabbed a bunch of nails and hung his agency on the cross, punctuating every hammer strike with oblique assertions that a refusal to create encryption backdoors may result in another foreign-directed terrorist strike on the homeland sometime in the next twenty years. When the facts alone aren't compelling, the rhetoric has to make up the difference. And all we have here is a lot of anti-encryption filler.

Filed Under: al qaeda, chris wray, encryption, fbi, iphone, pensacolar, phones, terrorism
Companies: apple

Filings In Facebook's Lawsuit Against NSO Show FBI Director Chris Wray Was For Encryption Before He Was Against It

from the just-a-little-awkward dept

I have opined that FBI Director Chris Wray needs to shut the fuck up about encryption. Wray has presented a completely skewed perspective on the issue, following in the footsteps of Jim Comey. Wray claims encryption is leading to a criminal apocalypse, even as crime rates remain at historic lows. He also claims encryption is making it impossible to follow through with investigations, but has presented no evidence to back this claim.

The best argument the FBI could present was its always-growing number of encrypted devices in its possession. In the space of a couple of years, the number jumped from less than 900 to nearly 8,000. This seemed to indicate encryption was a growing problem, but when the FBI tried to verify this number for Congress, it found out it had overstated the amount of locked devices in its possession. In reality, the number of locked devices is likely less than 2,000 -- hardly the apocalypse of impregnability Wray and Comey continuously presented. This was discovered in May 2018. The FBI has yet to hand over an accurate count of these devices.

Now, there's this bit of news, which surfaced during Facebook's lawsuit against malware developer, NSO Group. Chris Wray was for encryption before he was against encryption. Documents filed by Facebook detail Wray's defense of WhatsApp and its encryption in an earlier legal battle while Wray was working for the King & Spalding law firm. [paywall-free link here]

In the earlier case, which has never been made public, Mr. Wray, then a partner at King & Spalding, was hired to “analyze and protect” WhatsApp’s software from a Justice Department effort to weaken its encryption in order to conduct wiretap of a WhatsApp user’s data.

The arguments made by Mr. Wray’s firm in favor of WhatsApp’s encryption may undercut his recent calls to push tech firms — including his previous client WhatsApp — to roll back encryption, a move many security experts have likened to a government “backdoor.”

Facebook wants King & Spalding booted from the case, citing its previous involvement in defending WhatsApp against actions brought against it by the DOJ. Facebook raises a good point: someone with intimate knowledge of WhatsApp's inner workings shouldn't be allowed to use this inside information to defend itself against this lawsuit.

Facebook's redacted motion [PDF] names Chris Wray as one of the litigators with inside information, gleaned during a still-sealed legal proceeding that appears to have dealt with the DOJ seeking a court's permission to break (or block) WhatsApp's encryption to deploy wiretaps.

At the time, WhatsApp was in the process of implementing end-to-end encryption of communications sent on its platform.

[...]

WhatsApp was jointly represented by King & Spalding and ZwillGen PLLC. Specifically, Christopher Wray, Catherine O'Neil, Nick Oldham, and Paul Mezzina of King & Spalding…

Another filing [PDF] -- a letter sent from Facebook's legal reps to NSO Group after it became apparent it was seeking to retain King & Spalding -- names Chris Wray as well.

The man who declared Facebook's move to encrypt Messenger communications as a gift to the world's criminals once defended WhatsApp's encryption against the DOJ's attempt to have it broken or blocked. This apparently occurred around the same time the DOJ was trying to get Apple to break the encryption protecting the San Bernardino shooter's iPhone.

The New York Times learned of the 2015 matter through confidential sources. At the time, the Justice Department was also engaged in a court battle with Apple, pushing the company to unlock an iPhone belonging to one of the gunmen in a shooting in San Bernardino, Calif. The government ultimately dropped its case after security researchers helped them bypass Apple’s security.

The FBI sees no problem with Wray's shifting allegiance to encryption. Its statement to the New York Times says the agency supports Wray, no matter how inconsistent his stance. Apparently, it's fine that he's willing to change his views to match his employer's.

"Like all other lawyers, his duty of loyalty was to his client, and he did not put his personal views ahead of his clients’ interests or allow them to affect the legal work he did for clients. Today, as director of the FBI, his duty is to act in the best interests of the American people.”

If that's his new duty, he's falling short. He's acting in the best interest of the FBI and federal prosecutors -- the same FBI that also used to recommend people secure their devices with encryption. Strong encryption is in the best interests of the American people. Wray isn't serving the nation with nearly as much fervor as he apparently defended encryption back when he was getting paid to defend it. WhatsApp's encryption remains unbroken, despite the DOJ's efforts. If he didn't feel it was worth defending then, he probably shouldn't have defended it. This change of heart doesn't necessarily make him a hypocrite but it is just one more reason he needs to shut the fuck up about the subject.

Filed Under: backdoors, chris wray, encryption, fbi
Companies: facebook, nso, whatsapp

Since The FBI Can't Be Bothered To Do It, Motherboard Has Compiled A Database Of Attempts To Access Encrypted IPhones

from the thanks-for-nothing,-g-men dept

The FBI continues to avoid playing its hand honestly in the "going dark" debate. It continues to do things like call strong encryption "warrant-proof" encryption, damning it by associating its very existence with unlawfulness. FBI Director Chris Wray continues to claim he's not asking for encryption backdoors while calling for encryption backdoors. And for nearly two years, the FBI has refused to update its erroneous count of uncracked devices in its possession.

The last time the FBI delivered a number, it claimed it had about 7,800 devices in its possession that it couldn't get into. After being questioned by Congress about its claims, the FBI went back to count devices and found its tracking method had resulted in a severe miscount. No real number has been delivered yet, but the early estimate was that the actual number was slightly over 1,000 devices. Not quite the apocalypse the FBI needed us (and our Congressional reps) to believe it was.

As usual, when the government fails, private citizens step in to do the work that government agencies are spending our tax dollars not doing. The DOJ and FBI have spent years hardly bothering to compile an accurate accounting of police use of deadly force, resulting in a small cottage industry of journalists, activists, and hobbyists doing the work for them.

The same thing can be said about the "going dark" narrative. The FBI loves the narrative but can't be bothered to provide any hard data backing its assertions that encryption is destroying the criminal justice system. So, it's left up to people like Joseph Cox and his team members at Motherboard to try to get a grip on how often device encryption is disrupting criminal investigations.

Using information gathered from more than 500 iPhone search warrants and other court records, Motherboard has compiled a database that gives readers a better idea of encryption's impact on law enforcement investigations -- a narrative stripped of all the competing narratives, if you will.

In conclusion, Going Dark is a land of contrasts:

[T]he records compiled by Motherboard show that the capability to unlock iPhones is a fluid issue, with an ebb and flow of law enforcement sometimes being able to access devices and others not. The data solidifies that some law enforcement officials do have trouble accessing data stored on iPhones.

What this doesn't answer is the question the FBI and DOJ want answered in their favor: should access to encrypted content and communications be guaranteed? Is it better for citizens to be less secure but possibly more "safe" by making encryption inherently flawed? Of course, the answer is "no," but those at the top of the law enforcement food chain are never going to stop arguing that their lofty ideals should trump the rights and protections of all the little people below them. Only a criminal would want encryption because innocent people have nothing to hide and all of that garbage.

But Motherboard is providing a valuable service -- one the government refuses to do itself: it's providing data about the law enforcement v. encryption battle which should better inform everyone on both sides of the issue. For all of its insistence that encryption is an evil that's not even necessary, the FBI has done next to nothing than provide a handful of anecdotes about its experience with encrypted devices. And for more than a half-decade, these anecdotes have been backed by extremely faulty numbers. Let's hope throwing a little more reality around will bring the agency back to earth -- and more in agreement with the millions of people who ensure it stays funded.

Filed Under: chris wray, encryption, fbi, going dark, law enforcement, william barr

FBI Director Chris Wray Pitches Weakened Encryption At A Cyber Security Conference

from the piling-on-the-unintended-irony dept

On May 29, 2018, the FBI promised to deliver an updated count of encrypted devices in its possession. As James Comey and his replacement, Chris Wray, continued to advocate for weakened encryption, the number of phones the FBI couldn't get into swelled from 880 in 2016 to over 7,800 by the time the FBI realized its phone-counting method was broken.

This number still hasn't been updated. An early internal estimate by the FBI put the real number of locked devices at ~1,200. But the official number still hasn't been released. This hasn't stopped Chris Wray from continuing his attacks on encryption, painting pictures of a dark future that isn't supported by the small number of encrypted devices in the agency's possession.

The attacks continue. They're more subtle than Attorney General Bill Barr's aggressive pitches, but they're still happening. Chris Wray spent his time at a recent cyber security conference in Boston making the case for strong encryption before (yet again) making a plea for tech companies to give law enforcement the encryption backdoors Wray still refuses to call backdoors.

Today we’re worried about a wider-than-ever range of threat actors, from multi-national cyber syndicates to nation-state adversaries. And we’re concerned about a wider-than-ever gamut of methods continually employed in new ways, like the targeting of managed service providers—MSPs—as a way to access scores of victims by hacking just one provider.

[...]

We’re also battling the increasing sophistication of criminal groups that places many hackers on a level we used to see only among hackers working for governments. The proliferation of malware as a service, where darkweb vendors sell sophistication in exchange for cryptocurrency, increases the difficulty of stopping what would once have been less-dangerous offenders. It can give a ring of unsophisticated criminals the tools to paralyze entire hospitals, police departments, and businesses with ransomware. Often the hackers themselves haven’t actually gotten much more sophisticated—but they’re renting sophisticated capabilities, requiring us to up our game as we work to defeat them, too.

These all sound like arguments for strong encryption. They're not, I guess. Because the very next thing out of Wray's mouth is this:

We’re having to fight these increasingly-dangerous threats while contending with providers increasingly shielding indispensable information about those threats from any form of lawful access—through warrant-proof encryption.

"Warrant-proof encryption" is just encryption. It's protecting all the people Chris Wray says need to be protected from cyber threats. Just because it's made gathering evidence slightly more difficult is no reason to portray encryption as an evil the nation needs to be saved from.

But Wray's disingenuousness doesn't stop there.

We are all for strong encryption—and contrary to what you might hear, we’re not advocating for “back doors.” We’ve been asking for providers to make sure that they themselves maintain some kind of access to the encrypted data we need, so they can still provide it in response to a court order.

It's still a door -- one that wasn't there previously. Trying to dodge the "backdoor" term by asking service providers to leave themselves a key under the doormat is a weak and transparent effort to pre-distance Wray from any subsequent damage his desires might cause. Wray doesn't want to be the villain if anti-encryption laws are ever enacted. But he won't waste any time availing himself of the access it provides, even as it undermines the security of the nation.

Filed Under: chris wray, doj, encryption, fbi

The FBI Can Get Into The Latest IPhones, So Why Is It Asking Apple To Break Encryption On Older Models?

from the reminder:-the-FBI-still-hasn't-updated-its-locked-device-count dept

The FBI has asked Apple to break the encryption on devices owned by the Pensacola Naval Base shooter. It hasn't made this request officially -- there's no court order being sought to compel Apple's assistance -- but it's asking nonetheless.

Attorney General Bill Barr put a little more muscle behind the FBI's informal request. His statement insinuated that Apple was making the country less safe by refusing to break encryption. He also stated that time was of the essence in cases like this and Apple's general unhelpfulness wasn't acceptable.

Apple fired back by again stating it would not break phone encryption for the US government. It also pointed out the FBI did not inform of it a second locked device until a month after the shooting. If the government was concerned about time slipping away, it did not act with alacrity during this latest investigation.

Donald Trump followed Bill Barr's lead, attacking Apple via Twitter with a particularly stupid tweet that suggests the president is still all about quid pro quo.

The administration is trying to turn public opinion against Apple. This will make it easier to push anti-encryption laws and policies. But the FBI doesn't seem to need Apple to break encryption for it. It has options it's apparently decided not to use in this case.

As we've noted earlier, a handful of tech companies offer devices that break or bypass encryption to pull data and communications from locked phones. Yes, it's still an arms race, with companies like Apple patching the flaws these tools exploit, but there's plenty of money to be made cracking open devices for government agencies.

The FBI isn't interested in these tools, except when it's convenient for the agency. Legal precedent compelling phone manufacturers to break encryption is infinitely more useful to the FBI. So, it chooses to ignore these options when it thinks it has a compelling case for encryption backdoors. That's what appears to be happening here.

Thomas Brewster of Forbes says the FBI has used third-party hacking tools to access the contents of Apple's latest iPhone.

Last year, FBI investigators in Ohio used a hacking device called a GrayKey to draw data from the latest Apple model, the iPhone 11 Pro Max. The phone belonged to Baris Ali Koch, who was accused of helping his convicted brother flee the country by providing him with his own ID documents and lying to the police.

If the FBI can get into the newest devices, why does it need Apple to break encryption on the shooters' phones, which are much older?

Given the models in the Pensacola shooting case are iPhones 5 and 7, it’s unclear why a GrayKey hasn’t proven useful in that investigation. Forbes has previously revealed a GrayKey brochure that showed it worked on older devices, too.

It's a question the DOJ probably doesn't want to answer. It will have to, though. Senator Ron Wyden has already asked the DOJ to explain its actions in this case.

The most obvious answer is this: this case pushes all the buttons the administration wants pressed. It involves the shooting of US military members by a foreigner. The San Bernardino shooting was pretty much the same thing: the shooting of government employees by foreigners. These are the only two cases where the FBI has gone public about its desire to force Apple to undermine its own encryption. For everything else, there are third-party hacking tools that actually give the FBI the evidence it wants without undermining the security of millions of iPhone users.

The FBI will only push for precedent when it thinks it has the public's support. It failed to read the room during the San Bernardino case. It hasn't gotten any better at gauging public opinion since then. Even with Barr and Trump going on the attack, the public's mood hasn't shifted. Compelled encryption-breaking makes everyone less secure, not just the targets of investigations. Trying to parlay dead people's phones into court precedent is not a good look for the agency. But the agency -- and the administration running it -- don't particularly care what the public wants or is best for it.

Filed Under: chris wray, doj, encryption, fbi, going dark, graykey, pensacola, technology, william barr