No, The New Agreement To Share Data Between US And UK Law Enforcement Does Not Require Encryption Backdoors

from the sounds-messed-up-but-hardly-changes-anything dept

It's no secret many in the UK government want backdoored encryption. The UK wing of the Five Eyes surveillance conglomerate says the only thing that should be "absolute" is the government's access to communications. The long-gestating "Snooper's Charter" frequently contained language mandating "lawful access," the government's preferred nomenclature for encryption backdoors. And officials have, at various times, made unsupported statements about how no one really needs encryption, so maybe companies should just stop offering it.

What the UK government has in the works now won't mandate backdoors, but it appears to be a way to get its foot in the (back)door with the assistance of the US government. An agreement between the UK and the US -- possibly an offshoot of the Cloud Act -- would mandate the sharing of encrypted communications with UK law enforcement, as Bloomberg reports.

Social media platforms based in the U.S. including Facebook and WhatsApp will be forced to share users’ encrypted messages with British police under a new treaty between the two countries, according to a person familiar with the matter.

The accord, which is set to be signed by next month, will compel social media firms to share information to support investigations into individuals suspected of serious criminal offenses including terrorism and pedophilia, the person said.

The reporting here is borderline atrocious. The article insinuates that this agreement will force Facebook and WhatsApp to turn over decrypted communications or install a backdoor. It won't. The platforms may be compelled to turn over encrypted messages but all UK law enforcement will get is encrypted messages. The reporting here makes it appear as though social media platforms are being compelled to provide plaintext. They aren't.

Sharing information is fine. Social media companies have plenty of information. What they don't have is access to users' encrypted communications, at least in most cases. Signing an accord won't change that. There might be increased sharing of encrypted communications but it doesn't appear this agreement actually requires companies to decrypt communications or create backdoors.

Facebook has already issued a statement saying it opposes any plan that would require the creation of backdoors. It points out the Cloud Act does not mandate backdoors. While it does give the US government permission to engage in extraterritorial searches of US companies' data stores located overseas, it does not demand companies decrypt data or communications for it.

The other factor pointing in the direction of the UK law enforcement beneficiaries ending up with useless garbage is the Cloud Act itself. UK tech lawyer Graham Smith points out the Cloud Act requires agreements like these to be "encryption neutral," meaning neither side can mandate backdoors. Consequently, UK and US government agencies will get what they get when utilizing this new agreement. This means in some cases demands for data and communications will produce incomprehensible text, rather than anything useful.

That said, the UK government dream of encryption backdoors hasn't died. The Bloomberg article quotes UK Home Secretary Priti Patel, who has previously claimed encryption "empowers criminals." This is pretty much the same thing her predecessor, Amber Rudd, said. The less-than-implicit suggestion is that companies providing encrypted communications to users are siding with criminals, rather than the forces of law and order. Any perceived benefits of secure communications apparently pale in comparison to the government's "right" to access the content of communications.

This new accord likely won't (and probably can't) mandate backdoors -- no matter how the Bloomberg article skews it. But an international partnership created solely for the purpose of accessing communications and data applies a lot more pressure than parallel efforts from both sides of the pond.

Filed Under: cloud act, data sharing, encryption, law enforcement, priti patel, uk, us
Companies: bloomberg, whatsapp

DOJ Asks Supreme Court To Dump Microsoft Case, Let It Use New CLOUD Act To Demand Overseas Data

from the sighs-and-eyerolling-from-DOJ-counsel dept

As expected, the DOJ has asked the Supreme Court to toss the Microsoft case. The appeal sitting before the court deals with collecting data overseas using US-issued warrants, rather than mutual assistance treaties. As the DOJ argues in its motion to vacate [PDF], the passage of the CLOUD Act -- stapled to the tail end of 2,200-page budget bill -- makes this argument moot. For all intents and purposes, the new law (which apparently still has no effective date) grants the government the power to demand production of data stored overseas by US companies using a regular magistrate's warrant.

The motion goes further than just asking the Supreme Court to drop the case. It also takes some time to complain about Microsoft inconveniencing the DOJ by forcing it to acquire another warrant for the same info under the newly-granted authority. The DOJ, despite its apparent compliance with Microsoft's request, spends a few paragraphs explaining why it shouldn't need to do the thing it already did.

The application of the CLOUD Act to the original Section 2703 warrant at issue in this case would not be retroactive. Microsoft’s production of the requested information has not been “completed,” Landgraf, 511 U.S. at 270, as it remains possible for Microsoft to comply fully with the government’s demand for disclosure. The Section 2703 warrant remained valid after the CLOUD Act, and no real consequences have attached to Microsoft’s failure to comply with the warrant up to this point.

[...]

Nevertheless, Microsoft has refused to acknowledge either that the CLOUD Act applies to the Section 2703 warrant at issue in this case or that Microsoft plans to disclose the required information under the original warrant.

Microsoft's objection hinges on unresolved contempt charges stemming from the case it successfully appealed twice. According to Microsoft, its compliance with the old warrant might trigger retroactive charges, which would be problematic for it. The DOJ points out no sanctions were ever threatened by the district court, which only entered contempt charges to allow the decision to be appealed.

Nonetheless, an exasperated DOJ has complied with Microsoft's demand that a new warrant issued under the CLOUD Act be provided.

Accordingly, on March 30, 2018, the government applied for a new warrant covering the relevant information requested in the Section 2703 warrant at issue in this case. A magistrate judge issued the warrant that same day. Under the new warrant, which will replace the original warrant and which the CLOUD Act indisputably governs, Microsoft must produce any covered information within its “possession, custody, or control.” CLOUD Act § 103(a). Microsoft no longer has any basis for suggesting that such a warrant is impermissibly extraterritorial because it reaches foreign-stored data, which was the sole contention in its motion to quash.

And it returns to the subject again to remind the court how much of a pain in the ass Microsoft is being about all of this.

The government does not believe that seeking a new warrant was necessary in order to compel Microsoft to act: In light of the CLOUD Act, Microsoft should have simply complied with the existing warrant, to which it can have no valid legal objection...

The last loose end the government seeks to have tied up is the appeals court decision, which the DOJ claims could cause future jurisdictional issues for warrants issued by that circuit. It also lets the Supreme Court know it thinks the lower decision should also be vacated because it's just so (subjectively) wrong.

Leaving the court of appeals’ decision in place as circuit precedent could therefore generate uncertainty in future extraterritoriality, Fourth Amendment, or subpoena cases arising in the Second Circuit. Given the serious flaws in the court’s reasoning, this case implicates the traditional need for vacatur to “clear[] the path for future relitigation of the issues” and to “eliminate[] a judgment, review of which was prevented through happenstance.”

The DOJ gets the win it wanted, but won't have circuit precedent to rely on. Instead, it got a whole new law to use to force US companies to turn over data stored outside of the US. It will now be able to meddle in international affairs and open the door for similar meddling by other countries not quite as respectful of civil liberties as we are.

Filed Under: 4th amendment, cloud act, data, doj, due process, overseas data, privacy, subpoenas, supreme court, surveillance, warrants
Companies: microsoft

House Staples Extraterritorial Search Permissions Onto 2,232-Page Budget Bill; Passes It

from the hearty-debate-was-enjoyed-by-none dept

Just as the Supreme Court is considering the legality of extraterritorial demands for communications held by US internet service providers in overseas data storage, Congress is doing all it can to short-circuit the debate. Tucked away towards the back of a 2,200-page spending bill is something called the "Clarifying Lawful Overseas Use of Data Act" or (of course) "CLOUD Act." (h/t Steve Vladeck)

The CLOUD Act [PDF - starting at p. 2201] would make any decision by the Supreme Court extraneous. If it agrees with Microsoft -- as lower courts have -- that the US has no right to demand communications stored overseas with a normal warrant, the Act would immediately overturn the decision. If it decides against Microsoft, it will be aligned with the new law. As it stands now, the route most likely to be taken by the Supreme Court is a punt. Legislation on point is in play and the Court will probably be more than happy to let legislators make the final call.

Beyond the obvious problem of giving US law enforcement permission to use regular warrants to bypass mutual assistance treaties, the law also allows for reciprocation. We can't go around waving SCA (Stored Communications Act) warrants in foreign lands without expecting pushback from locals. So, we'll have to give foreign countries the same privileges, even if the criminal charges being investigated wouldn't be considered criminal acts in this country and the country enjoying this reciprocation doesn't care much about its own citizens' rights and privacy.

The EFF is especially critical of the shoehorned-in CLOUD Act. As it points out, the law would result in backdoor searches of anyone's communications via reciprocal communication demands. In the US, we've already seen the Fourth Amendment circumvented by US government agencies via their access to NSA collections. The same would happen in reverse when other countries start playing by the CLOUD Act's new rules.

When foreign police use their power under CLOUD Act executive agreements to collect a foreign target’s data from a U.S. company, they might also collect data belonging to a non-target U.S. person who happens to be communicating with the foreign target. Within the numerous, combined foreign investigations allowed under the CLOUD Act, it is highly likely that related seizures will include American communications, including email, online chat, video calls, and internet voice calls.

Under the CLOUD Act’s rules for these data demands from foreign police to U.S. service providers, this collection of Americans’ data can happen without any prior, individualized review by a foreign or American judge. Also, it can happen without the foreign police needing to prove the high level of suspicion required by the U.S. Fourth Amendment: probable cause.

In addition, the law allows the US to enter into agreements with almost any country on earth, even those whose respect for human rights is nearly nonexistent. There's a provision in the law that says countries must meet a vague human rights standards before they're allowed to start searching US-based cloud services, but those guidelines are roughly 100% useless. Unless a more rigorous vetting standard is applied, countries like Turkey could soon be trawling for US persons' communications. As the ACLU points out, Turkey might still be considered to be compliant with the humans rights guidelines despite its ever-increasing level of citizen-directed abuse.

For example, in early 2014, Turkey may have met the CLOUD Act’s vague human rights criteria; Freedom House even rated it a three and four on its index for political and civil rights. But since the attempted coup in mid-2016, the Turkish government has arrested more than 50,000 people — including journalists and activists such as the chair and director of Amnesty International’s Turkey section — many on bogus terrorism charges. According to U.N. experts: “Most of these accusations of terrorism are based solely on actions such as downloading data protection software, including the ByLock application, publishing opinions disagreeing with the Government’s anti-terrorism policies, organizing demonstrations, or providing legal representation for other activists.”

Under the CLOUD Act, neither Congress nor U.S. courts would be able to prompt a review or a temporary moratorium for a case like Turkey. Users, without notice, would have little practical ability to lodge complaints with the U.S. government or providers. Even if the U.S. government were to take action, the CLOUD Act fails to ensure a sufficiently quick response to protect activists and others whose safety could be threatened.

What few positives the bill provides revolve around challenging demands for communications. The bill provides avenues for US tech companies to challenge orders targeting foreign servers, as well as pushing back against foreign government demands for communications held in the US. But these will mainly be of use to the largest tech companies with the manpower and legal acumen to throw at the problem. Smaller companies will likely just find themselves handing over anything to anyone who comes asking, rather than risk punitive action by domestic and foreign governments.

And the standards are extremely weak. While the bill claims to hold foreign countries to US standards, it never specifically says foreign countries demanding communications need to have US-equivalent rights. It refers to "international universal human rights" which sounds great, but this is a feel-good term that isn't recognized by US or international law.

Even if communications are subject to some restrictions, metadata isn't. Anything foreign governments collect on American citizens can be handed over to the US government without further legal review. And it carves out a hole for wiretapping electronic communications, allowing demands like these to bypass the privacy protections of the Wiretap Act.

Considering it's been stapled to end of must-pass funding bill, chances are the bill will receive zero debate before being forwarded to the president. The House has already passed its version, which means the Senate needs to step up to block the CLOUD Act stuffed into its spending bill. As we saw during the last several months of 2016, very few reps were in any hurry to challenge the expansion of Rule 41 authorities, despite having more than a year to generate opposition. Even when time is a luxury, inaction is the preferred response. The CLOUD Act, hidden under more than 2,000 pages of funding requests, is probably as close to a sure thing as it's ever been. And it will do little more than further damage privacy protections across the globe.

Filed Under: cloud act, extraterritorial, jurisdiction, omnibus, privacy, search, stored communications act, surveillance, warrants