New York Appeals Court Says Facebook Can't Challenge The 381 Broad Warrants Handed To It By New York Prosecutors

from the no-standing-and-no-remedy dept

Almost four years ago, Manhattan DA Cyrus Vance's office issued 381 warrants seeking information on Facebook subscribers. The warrants arrived almost immediately after the first Snowden leaks, which quite possibly pushed Facebook towards challenging the multitude of overbroad warrants.

Once the gag order was lifted, Facebook was able to reveal the astonishing breadth of the DA's demands. Hoping to dig up info on participants in a disability fraud scheme -- one that had already resulted in the arrests of more than 100 former police officers and firemen -- the 381 warrants demanded everything Facebook had on the named accounts, including private messages, Friends lists, and a variety of non-public content.

Facebook spent the next three years fighting the warrants in New York courts. It hasn't gone particularly well. There's the issue of standing, which few courts are willing to grant to third parties seeking to protect the privacy of their subscribers and users.

The case has reached the top of the New York judicial system, and the result is a loss for both Facebook and its users. The state's top court has rejected Facebook's appeal on procedural grounds, saying the company lacks standing to challenge the warrants. According to the court, it's up to individual users to challenge the validity of the warrants, something they can only do after the warrants have been served and fulfilled.

Facebook sought to have the warrants treated as subpoenas, which would have given it a bit more standing to challenge prosecutors' demands. It pointed out the warrants used by Vance's office more resembled subpoenas, as they weren't deployed by law enforcement to perform a search of the target's residence/papers, but rather served to a third party to demand digital data. A subpoena would be challengeable by Facebook, seeing as it's both the target and the recipient.

The lower court didn't find this persuasive and neither does the New York Supreme Court. From the decision [PDF]:

[A]n SCA warrant compels a third party -- here, Facebook -- to compile and turn over digital data under its control, and the presence of a law enforcement officer is not required for service or execution of the warrant. A traditional search warrant, by comparison, authorizes law enforcement to enter, search, and seize property. These differences in execution, however, can be easily explained by the nature of the material sought. The service provider is more likely to be better equipped to access and conduct a search of its own digital information than law enforcement personnel, and the data may be stored in different locations. Thus, the framework of execution for SCA warrants ensures efficiency and minimizes intrusion into the provider's business while promoting and protecting legitimate law enforcement interests in criminal investigation.

Despite the minor similarities between SCA warrants and subpoenas, in this post-digital world, we are not convinced that SCA warrants -- which are required under the statute to obtain certain content-based information that cannot be obtained with a subpoena due to heightened privacy interests in electronic communications -- should nevertheless be treated as subpoenas.

With that argument out of the way, the court affirms the lower court's ruling: Facebook does not have standing to challenge the 381 warrants issued by prosecutors. If Facebook doesn't like it, it's welcome to take it up with its Congressional representatives.

The dissenting opinion is less kind to the majority's opinion -- and to the actions of DA Vance's office. Judge Wilson lays down this scathing description of the warrants the court says Facebook can't challenge.

The facts are these: On the basis of a single 93-page affidavit (not subsequently shown to Facebook, or to its users whose files were seized, or to the Appellate Division, or to this Court), Supreme Court issued 381 warrants. Those bulk warrants authorized the seizure of what the District Attorney tepidly describes as "specified categories of information," but which functionally amounts to 381 users' entire histories on the platform. At least several of the users were high school students who are unlikely to have themselves been suspects in the investigation.

The warrants compelled Facebook to produce not only any and all text, photos, or videos a user had shared with her limited universe of friends, but also any private messages exchanged between the user and another individual (who could have been a spouse, doctor, religious figure, or attorney), as well as information the user had chosen to no longer share with anyone, such as a previous email address, a deleted friend, or a hidden post, and information the user had never intended to share with anyone, such as her searches and location.

It also compelled Facebook to produce content shared by users who were not named in the 381 warrants, and may not even have known anyone named in the 381 warrants, but had the misfortune of posting on the timelines of those users, uploading photos of those users, or simply belonging to any one of the groups with which a named user was affiliated.

Wilson's dissent goes on to point out the end result of this "our hands are tied by a perverse combination of federal, state, and local laws" decision: Facebook will be forced to entertain even more of these overly-broad warrants. The court's decision eliminates any possible remedy for service providers.

Finally, this appeal is the only opportunity to litigate fully the rights Congress granted to Facebook. The grounds underlying at least one portion of Facebook's motion to quash are specific to Facebook, not its users, and Facebook is before us to defend not only the constitutional rights of its users (where the majority has focused its analysis), but also its own business interests.

Even if those users could realistically seek relief for their own injuries through pretrial suppression hearings or Section 1983 suits -- which the majority believes, but I dispute -- Facebook will not be a party to those actions and the hypothetical resolution of their claims would not address or remedy Facebook's injuries. The majority does not suggest an alternative means for the company to vindicate its right to be free of unusually voluminous or unduly burdensome requests.

[...]

Under the majority's decision, this Court is powerless to protect the business interests of a major company [or] return information seized from either the 381 individuals, many of whom were never suspected of wrongdoing, or the thousands of innocent individuals who communicated or simply happened to share an interest with a user named in the bulk warrants…

This is a straight-up win for DA Cy Vance's office and New York law enforcement. It does nothing for anyone else involved in the equation, including the vast majority of those swept up in the "search." As the dissent notes, only 62 of those named in the warrants ever faced criminal charges. Most of those whose information was sought were innocent bystanders who had the unforeseeable misfortune of communicating with -- or being Facebook friends of -- people caught up in an incredibly broad and far-reaching fraud investigation.

Filed Under: cyrus vance, new york supreme court, sca, stored communications act, warrants
Companies: facebook

Manhattan DA Continues To Claim 'We Don't Want Crypto Backdoors...' By Which He Means He Wants Crypto Backdoors

from the same-old-song dept

Ever since last year, Manhattan DA Cy Vance has been singing the same old tune: demanding backdoors to encryption while insisting that he's not demanding backdoors. The only way this makes sense is that he doesn't seem to have the slightest clue about what he's talking about. Either that or he's willfully misrepresenting things. Neither is a good look.

He's back at it again, speaking at a cyber security conference and repeating his ridiculously clueless mantra:

Vance, speaking at the International Conference on Cyber Security here, said that law enforcement officials did not need an encryption "backdoor," sidestepping a concern of computer-security experts and device makers alike.

Instead, Vance said, he only wanted the encryption standards rolled back to the point where the companies themselves can decrypt devices, but police cannot. This situation existed until September 2014, when Apple pushed out iOS 8, which Apple itself cannot decrypt.

Right. You see, that "point" where companies themselves can decrypt? THAT'S A BACKDOOR. And it makes everyone less safe from malicious hackers and criminals. And that's why companies are moving to real encryption -- because they want to keep the public safer. You'd think that someone like the Manhattan District Attorney would be in support of a plan that keeps the public much safer. But Vance just doesn't get it.

"Tim Cook was absolutely right when he told his shareholders that the iPhone changed the world," Vance said. "It's changed my world. It's letting criminals conduct their business with the knowledge we can't listen to them."

First of all, criminals have always had ways to conduct business with the knowledge that law enforcement can't listen to them. It's called meeting in person with people. Or using code words and phrases. Encryption doesn't change that. And, of course, using encryption properly isn't easy, and it still leaves plenty of other clues. Law enforcement is never supposed to be able to get absolutely everything already. And these days, there's so much more data available to law enforcement than ever before -- things like location data from mobile phones, or information from other connected devices. The idea that his job has become more difficult is complete hogwash.

Vance's speech seems to be a repeat of what he's said before, but it's been debunked before and he just keeps making it. It's difficult to take him seriously when he keeps being so ridiculously wrong.

Filed Under: backdoors, cy vance, cyrus vance, encryption, going dark, unlock justice

Cy Vance Still Arguing For Mandated Encryption Backdoors; Believes Third Party Doctrine Supports His Theory

from the a-bunch-of-bad-ideas,-all-wrapped-up-in-self-righteousness dept

The United States Senate Committee on Armed Services held a hearing about the coming darkness cellphone encryption Friday morning. There was almost no attempt made to address both sides of the issue, most likely because Senator John McCain -- who headed up the "discussion" -- has already made up his mind on how this problem should be handled.

Testimony -- all from government officials -- was presented, with Manhattan DA Cyrus Vance leading off. Vance's tune hasn't changed. Encryption is still (apparently) an insurmountable problem and the only "answer" runs directly through Congress. Vance spent most of his speaking time [PDF] criticizing Apple and suggesting its decision to provide encryption by default on its phones was done purely to spite him and the government.

Given Apple’s own statements about the security of iOS 7, shortly after Apple’s reengineering of its phones to prevent search warrant access by law enforcement, I asked it in a letter dated March 2015, whether there was a bona fide security reason to make its new operating system, iOS 8, warrant-proof. Apple chose not to answer me, but in March of this year, the House Judiciary Committee compelled Apple to answer the same question. That Committee asked Apple the following question, in writing, “Was the technology you possessed to decrypt these phones”—and the clear reference is iOS7 phones and their predecessors—“ever compromised?” Apple’s written response was: “The process Apple used to extract data from locked iPhones running iOS 7 or earlier operating systems was not, to our knowledge, compromised.” (Emphasis added.)

Apple’s answer to this crucial question shows what we have long suspected: That Apple’s method of data extraction under iOS 7 posed no documented security problems. That being so, then there should be no unreasonable security risk going forward if we return to the procedure where court-ordered warrants can be honored by extracting responsive data off of smartphones.

In Vance's view, encryption protocols should not be altered until they've been compromised -- a view that aligns nicely with his presumption that the government should always have access to phone contents but runs counter to good security practices. Vance wants Apple to go back to holding the encryption keys and be on hand to unlock the door whenever the government asks.

Vance is still pushing his "encryption is a godsend to criminals" narrative -- based on little more than same single recorded prison phone call he referenced months ago. Vance may have a pile of cellphones law enforcement can't break into, but that hardly suggests a majority of criminals are gravitating towards encrypted services. The rise in the number of encrypted communications methods will benefit some criminals, but even high-profile terrorist attacks have been coordinated and planned using methods still open to interception and investigation.

The solution is legislation, according to the DA. Vance provides a list of prior legislation crafted to aid law enforcement as support for his theory the government should be allowed access to phone contents. However, his list covers only records collected and stored by third parties -- not the content and communications he's seeking access to.

Federal regulation is already important in the communications industry. When telephone companies went from using copper wires to using fiber optics and digital signals, the police could no longer use their old techniques of executing wiretap orders, and so Congress passed the Communications Assistance for Law Enforcement Act (CALEA), mandating that telecom providers build into their systems mechanisms for law enforcement to install court-ordered wiretaps. CALEA has worked. It has saved lives, and it has withstood Constitutional challenge. It has not stifled innovation, as its opponents feared…

[...]

Here are a few other examples: DEA regulations require all U.S. pharmacies to maintain paper and electronic prescriptions bearing the name of the patient and prescriber, drugs dispensed, and dates filled. FTC regulations require any business that checks a customer’s identification to maintain and provide victims and law enforcement with transaction records relating to identity theft. State regulations require private schools to maintain student data records, including records of attendance and suspected child abuse. I could go on.

The point is that companies in nearly every industry are required by law to maintain voluminous customer records and produce criminal evidence when they receive a court order. When your introduction of goods and services into the stream of commerce overlaps with public safety, this is the price of doing business in the United States.

In other words: the government should have access to iPhone contents because it has access to other stuff. It's a clumsy comparison at best. At worst, it's a blueprint for unprecedented government intrusion. Vance may be trying to demonstrate that the government has historically had access to a wealth of information thanks to regulators and the Third Party Doctrine and should continue to be granted access, but this inept analogy is worse than apples-to-oranges. Connecting Vance's dots suggests he views personal data and communications as just another set of records "collected" by cellphone providers. He may not openly suggest these are nothing more than "third party" records, but he obviously believes private corporations "owe" this sort of access to the government.

Vance says he doesn't want a legislated encryption backdoor, but his solution is basically a legislated encryption backdoor.

My Office’s proposed solution is to enact a federal statute providing that data on any smartphone made or sold in the United States must be accessible—not by law enforcement, but by the maker of the smartphone’s operating system—when the company is served with a valid search warrant. And if a person or entity such as Apple offers encryption software, it has to have the ability to provide data in response to a judicial order.

The backdoor may be located at the company's headquarters, but it's a backdoor all the same.

His testimony also suggests more legislation might be needed to further subvert encryption. Like James Comey, Vance suggests harder nerding will make the impossible possible.

This solution is limited to data at rest on smartphones. It would not affect encryption of data in motion. I cannot at this time offer a technical fix to address data in motion. I am confident, however, that engineers from industry and government, working together in good faith, can find one.

"Good faith." That's hilarous. The only time law enforcement is interested in a "good faith" discussion is when it's trying to salvage an illegal search.

Vance -- like Comey -- believes all concessions must come from the private sector. That's how he defines "working together." He's also concerned a 12-month study from a Congressional committee won't address the issue fast enough.

Twelve months of taking testimony resulting in non-binding recommendations in a report will not adequately address the urgency of the problem that local law enforcement faces. Time is not a luxury that local law enforcement, crime victims, or communities can afford.

With a nod to civil liberties:

Our laws require speedy trials. Victims require justice. And criminals must be held accountable before they can reoffend.

I would think that if you don't have the evidence -- if it's on phones that can't be broken into -- you just don't have the evidence. I sincerely hope people aren't being locked up until Congress creates the backdoor Vance is looking for. Of course, we know that is happening, but hopefully not on the scale Vance suggests with his list of police-resistant devices still being held by law enforcement agencies (who assume they contain evidence of criminal activity).

The end result of the encryption study can't be determined at this point. But given the nature of this committee -- and its decision to only present one side of the issue -- it appears its greatest purpose may be nothing more than buying time until backdoor/ban legislation is reintroduced.

Vance's side hasn't budged an inch. While deference is continually paid to the "smart people" at tech companies, it's only done so under the assumption that they're just holding out on the government. The solution Vance, et al want is supposedly possible, even if it isn't. Any arguments to the contrary are continually treated as deliberate antagonism, rather than basic facts. Backdoored encryption -- no matter who holds the keys -- is a security problem. And it's not going to go away, no matter how many times the same arguments are repeated.

Filed Under: cy vance, cyrus vance, encryption, going dark, john mccain, manhattan da
Companies: apple

Ignorant Anti-Encryption Law Enforcement Groups Made A Logo And A Hashtag... And It All Backfired

from the do-you-even-social-media? dept

Yesterday morning, things kicked off with a ridiculous tweet from the NY Police Department, announcing that it "stood with" the Manhattan DA in calling for "encryption" legislation. Of course, that's inaccurate. What it was really calling for was anti-encryption legislation.

Today, 11am at City Hall we stand with @ManhattanDA & advocates to call for encryption legislation. #UnlockJustice pic.twitter.com/hqjRxtAzYO

— NYPD NEWS (@NYPDnews) April 18, 2016

But, suddenly we discovered that not only was Manhattan District Attorney -- and proudly technologically ignorant -- Cyrus Vance continuing to push his dangerous anti-encryption views, but he had somehow created a hashtag and a logo for it (I've sent in a FOIA request to see how much tax payer dollars were spent on the logo, though I doubt I'll get a response). Vance held quite the grandstanding press conference over this, in which he repeated the same misleading claims as in the past about how horrible encryption is, and then trotted out some sob stories of cases where law enforcement failed to do their job, and then blamed it on encryption.

DA Vance: Crime victims are entitled to stronger protections than criminals #UnlockJustice pic.twitter.com/003FmSGwYn

— Cyrus Vance, Jr. (@ManhattanDA) April 18, 2016

You can watch the half-hour press conference below if you have the stomach for it: Of course, just about everything about this is ridiculous. It took place just a few days after Patrick O'Neill, over at the DailyDot, revealed some details of a FOIA request he'd made with Vance's office about all those cases he claimed he needed to get into phones for -- and found that, of the ones that were listed all had resulted in convictions anyway, even without getting into the phones. And most didn't appear to be for really serious crimes.

Meanwhile, as is often the case, an attempt by law enforcement to co-opt whatever "the kids these days" are doing by setting up a hashtag failed spectacularly. First off, Vance's office just happened to pick a hashtag that was already in use. Even worse, it was in use by the Quakers to push for criminal justice reform that would "start to reverse the failed 40-year 'war on drugs.' Ooops.

Then, of course, the folks who actually understand technology took the hashtag and ran with it, explaining why Vance's campaign was idiotic.

Remember: encryption protects the families of police too. If you break it, you put them at risk. #unlockJustice

— Keeper of Lore (@munin) April 18, 2016

Strong crypto prevents serious crimes like identity theft, stalking, sabotage and espionage. #UnlockJustice with strong security and crypto.

— matt blaze (@mattblaze) April 18, 2016

People deserve stronger protection than criminals. Default strong encryption protects civilians against muggers and thieves. #UnlockJustice

— the grugq (@thegrugq) April 18, 2016

iPhone encryption helps prevent theft, freeing up NYPD to investigate and solve other crimes. #UnlockJustice

— emptywheel (@emptywheel) April 18, 2016

Encryption protects the safety of those who have been abused by intimate partners or family members, even if the police don't #UnlockJustice

— Riana Pfefferkorn (@Riana_Crypto) April 18, 2016

And you're genuinely arguing that encryption wouldn't help protect victims of cybercrime? #unlockjustice pic.twitter.com/LhOzwh5zzk

— Jenna McLaughlin (@JennaMC_Laugh) April 18, 2016

Encryption protects me and my family from criminals who may steal our portable devices. #UnlockJustice

— Chris Wysopal (@WeldPond) April 18, 2016

Weakening everyone's security for the vague possibility of catching a few crooks is insanity. #UnlockJustice

— Bill Budington (@legind) April 18, 2016

In its quest for total surveillance over our lives, law enforcement is willing to empower criminals by weakening encryption #unlockjustice

— Daniel Nazer (@danielnazer) April 18, 2016

I don't trust people who still use fax machines with my sensitive data. #UnlockJustice

— Cathy Reisenwitz (@CathyReisenwitz) April 18, 2016

NYPD: We want New Yorkers to be more vulnerable to phone & identity theft, robbery, and data breaches #UnlockJustice https://t.co/KRkUZNobMb

— Trevor Timm (@trevortimm) April 18, 2016

Giving government authority over every intimate aspect of your private life is a wide gate to enslavement #UnlockJustice

— Jonathan Zdziarski (@JZdziarski) April 19, 2016

Legislate weak encryption and do a big favor for swindlers, identity thieves and nefarious foreign regimes. #UnlockJustice

— michael petricone (@mpetricone) April 19, 2016

After going through lots and lots of tweets, I have to admit that I couldn't find any -- outside of those from the DA's office and various law enforcement people that were actually supportive of the campaign. It really makes you wonder, just who does Cyrus Vance think he's protecting?

Filed Under: cyrus vance, encryption, going dark, nypd, unlock justice, unlockjustice

MIT Tech Review Tries To Blame Apple Encryption For Wrongful Arrest

from the innocent-people-getting-locked-up-because-of-encryption,-etc. dept

Brian Bergstein should know better. As the executive editor of the MIT Technology Review with fifteen years of technology journalism under his belt, he really shouldn't be asking "What if Apple is Wrong?" -- at least not in the way he does.

Bergstein glosses over the security implications of requiring phone manufacturers to hold the decryption keys for devices and services and instead presents his argument as an appeal to emotion. Those on Apple's side -- including Apple CEO Tim Cook -- are given only the briefest of nods before alarmists like Manhattan District Attorney Cy Vance are given the stage.

Bergstein does at least ask an interesting question: what if exonerating evidence is locked up in a phone? But his test case for "What if Apple is wrong?" doesn't apply as well as he seems to hope it does.

Devon Godfrey was killed in his apartment in 2010 -- and police arrested the wrong person. Somehow, Bergstein wants to blame the police screwing up on Apple. Investigators had only a week to pull evidence together to present to a grand jury. Some of that evidence happened to be located on a passcode-locked iPhone. But the evidence ultimately compiled and used has nearly nothing to do with that locked phone.

Cell phones had been found in Godfrey’s apartment, including an iPhone that was locked by its passcode. Arnold recalls doing what he always did in homicides back then: he obtained a search warrant for the phone and put a detective on a plane to Cupertino, California. The detective would wait in Apple’s headquarters and return with the data Arnold needed. Meanwhile, investigators looked more closely at the apartment building’s surveillance video, and Arnold examined records sent by Godfrey’s wireless carrier of when calls and texts were last made on the phones.

With this new evidence in hand, the case suddenly looked quite different. From the wireless carrier, Arnold saw that someone—presumably Godfrey—had sent a text from the iPhone at a certain time. But the recipient of that text had used a disposable “burner” phone not registered under a true name. So who was it? The iPhone itself had the crucial clue. Arnold could see that Godfrey referred to the person by a nickname. People who knew Godfrey helped police identify the man who went by that nickname. It was not the man who was originally arrested. It was Rafael Rosario—who also appeared in the apartment surveillance footage. Rosario confessed and later pleaded guilty.

A text message and a contact list, both of which are usually backed up to cloud storage, where they can be accessed without cracking the phone or breaking its encryption. As James Comey himself has pointed out while making an argument against Apple's stance in several ongoing All Writs-involved cases, law enforcement can access iCloud contents without breaking phone encryption.

“Today, Apple encrypts the iCloud but decrypts it in response to court orders,” he said. “So are they materially insecure because of that?”

Comey later reiterated this point, saying, “I see Apple today encrypting the iCloud and decrypting it in response to court orders. Is there a hole in their code?”

The frequency of the backups will vary from person to person, but this still gives investigators access to plenty of information supposedly "stored" in an uncrackable phone.

From there, the argument against Apple only gets worse, as the arguments themselves are sourced from the sort of people who'd rather see insecure devices than face obstacles when prosecuting suspects. Cy Vance, of course, has argued for outright encryption bans.

Vance also loves a good appeal to emotion.

Vance makes no dramatic claims about “going dark,” preferring a measured, lawyerly form of argument. When I tell him that his statistics on inaccessible iPhones don’t yet impress many computer scientists, he makes a facial expression equivalent to a shrug. “Some people have made the determination that not being able to do the kinds of work we do is an acceptable collateral damage,” he says. “I’m not sure how the individual would respond if someone close to him or her were the victim of a crime and the case might depend on the ability to access a phone. Easy to say, unless it’s you. We deal with a lot of victims. We talk to the people it’s actually happened to.”

The assumption is that everyone loves locking cops out of phones until they're a crime victim. But this assertion is just as false as Comey's exaggerated laments about "going dark." But even in the most famous case involving a locked iPhone -- one that involved an apparent act of terrorism manifesting itself as a mass shooting -- the relatives of victims were far from unanimous in their support of the FBI's efforts. Two people who lost close relations in the shooting -- including a mother who lost her son -- spoke out against the FBI's efforts to undermine cell phone security.

Her son was killed in the San Bernardino, Calif., massacre — but Carole Adams agrees with Apple that personal privacy trumps the feds’ demands for new software to break into iPhones, including the phone of her son’s killer.

The mom of Robert Adams — a 40-year-old environmental health specialist who was shot dead by Syed Rizwan Farook and his wife — told The Post on Thursday that the constitutional right to privacy “is what makes America great to begin with.”

Then there's the belief -- offered by Vance, Comey and others -- that law enforcement should have access to communications simply because they have a warrant. But what isn't acknowledged is that this is unprecedented access. Texting/messaging has largely replaced telephone calls and face-to-face conversations.

Prior to the advent of texting, these conversations could not have been recorded without a wiretap warrant, which is a last resort effort that has to be carried out in real time. What law enforcement has access to now -- if not walled off by encryption -- are hundreds or thousands of conversations it never would have had access to before, even with a search warrant, which does not cover the interception of communications. And it's a technique that would be almost completely useless to investigators after a criminal act like a murder has been committed. The fact that a murder victim had a phone in the house would have prompted detectives to look at call records -- something they can still do without breaking a phone's encryption. What was said during those phone calls would still remain a mystery, warrant or no. So, law enforcement isn't as far behind technology as it likes to pretend it is.

Bergstein, along with Lawfare's Susan Hennessey (who Bergstein quotes), both claim a corporation can't possibly decide what's best for Americans.

So is Apple ultimately fighting to uphold personal privacy and civil liberties? Or is it fighting for the right to sell any kind of phone it thinks its customers want while other people deal with the negative consequences? If it’s the latter, that’s understandable; like any public company, Apple is obligated to maximize its value to its shareholders. But society is not necessarily best served by letting Apple make whatever phones are optimal for its chosen business strategy, which is to create a shiny mobile vault that people will trust with every aspect of their lives.

But somehow they both feel it's perfectly acceptable for another party with a vested interest in total access to make that same decision for Americans.

Filed Under: brian bergstein, cyrus vance, encryption, going dark, law enforcement, police
Companies: apple

NY DA Cy Vance Asks Law Enforcement About Problems With Encryption; Won't Take 'No Problems' For An Answer

from the click-'submit'-to-confirm-bias dept

Manhattan District Attorney Cy Vance must be exhausted. Vance has been the New York face of the anti-encryption push -- a state-level James Comey with the NYPD as his backing band. He's held histrionic press conferences and issued editorials via The Paper of Record. He's also leveraging the web to muster his anti-encryption forces. As Lorenzo Franceschi-Bicchierai reports for Motherboard, he's asking law enforcement officers to show him on the webform where the encrypted phone abused the investigation.

[T]he Manhattan District Attorney’s office quietly put out a questionnaire last fall using the online platform Survey Monkey. The survey was made with the goal of compiling “statistics on the national scope of the problem,” according to a district attorney’s spokesperson, who explained that it was created for the International Association of Chief of Police conference in Chicago.

The survey didn’t get much attention, but it was spotted and tweeted out by Declan McCullagh, a former CNET reporter who now works on a news app called Recent News.

The survey contains a variety of questions that would receive interjections of "objection: leading" from opposing counsel. The SurveyMonkey form (which you can fill out for fun and noise here) assumes every responding law enforcement official/officer will have been stymied by an encrypted phone at some point. Answering "no" to a question like "Have you encountered a smartphone, or other device, that you have been unable to get into because of encryption?" doesn't end that particular line of questioning. Instead, the respondent is forced to answer an unskippable follow-up question, as pointed out by Franceschi-Bicchierai.


The spokesperson for Cy Vance's office declined to state whether the results of the survey would be made public or how the office "independently verifies" the law enforcement status of respondents. But Joan Vollero did object to Motherboard portraying the survey's release as "quiet," stating that it "posted publicly" on the office's website. It was apparently released in conjunction with Cy Vance's "white paper" on encryption, the one where he stated he wasn't calling for a ban on encryption before calling on lawmakers to prevent the sale and use of encrypted phones, possibly with some sort of a ban. However, this white paper + survey was not accompanied by a press release, so its release was stealthier than most.

Because respondents aren't given the option to talk about their lack of problems with encrypted phones, Vance will be able to compile plenty of data that agrees with his conclusions. The data may never be made public in raw form, but it will certainly be used at some point to support his arguments during future press conferences and Congressional testimony.

Filed Under: cyrus vance, district attorney, encryption, evidence, going dark, iphones, manhattan

FBI Insists It's Not Trying To Set A Precedent, But Law Enforcement Is Drooling Over Exactly That Possibility

from the going-to-court-to-force-you-to-hack-your-customers dept

In Jim Comey's defensive blog post over the weekend, he insisted that the FBI was absolutely not doing this to set a precedent or to do anything other than get into a single phone:

The San Bernardino litigation isn't about trying to set a precedent or send any kind of message....

The particular legal issue is actually quite narrow. The relief we seek is limited and its value increasingly obsolete because the technology continues to evolve. We simply want the chance, with a search warrant, to try to guess the terrorist's passcode without the phone essentially self-destructing and without it taking a decade to guess correctly. That's it. We don't want to break anyone's encryption or set a master key loose on the land.

Yeah, except that's clearly bullshit. They absolutely want the precedent, and if the FBI's PR strategy is to now insist this precedent won't be useful beyond this case, perhaps it should have coordinated those talking points with others in law enforcement. Because if you talk to them, they're happy to tell everyone just how badly they want this precedent so they, too, can demand Apple build hacking tools into iPhones. Jenna McLaughlin at The Intercept has put together examples of law enforcement people practically drooling over the possibilities that will be opened up should the FBI win.

In Suffolk County, Massachusetts, district attorney’s office spokesperson Jake Wark said prosecutors “can’t rule out” bringing their own case of a locked cellphone before a judge, too. “It may be a question of finding the right case,” he told the Wall Street Journal.

“It’s going to have significant ramifications on us locally,” Matt Rokus, deputy chief of Wisconsin’s Eau Claire Police Department, told the city’s Leader-Telegram newspaper on Monday.

In South Dakota, Minnehaha County State’s Attorney Aaron McGowan told the Sioux Falls Argus Leader that “the court’s ruling could have a significant impact on conducting sensitive criminal investigations.”

And then of course, there's Cyrus Vance, the Manhattan DA who also has been quite vocal in asking for backdoors into encryption, who has admitted that he basically wants the same power the FBI is now trying to exert. And, meanwhile, Senator Richard Burr used the Apple case as a keying off point to try to push for legislation he's been working on for a while that would effectively mandate such backdoors.

So it's fairly difficult to believe the FBI and Director Comey when not only does everyone know he's lying, but his friends and colleagues in law enforcement can't even be bothered to play along with the script.

Update: Oh, and even the DOJ is off-script as well. It's now being reported that the DOJ is currently seeking similar orders on 12 more iPhones. So, yeah, Comey's flat out lying.

Filed Under: cyrus vance, doj, encryption, fbi, going dark, james comey, law enforcement, police, precedent
Companies: apple

DA Cyrus Vance Throws Encrypted Phones On Table And Hands In Air As Criminals Take Over New York City

from the admits-law-enforcement-will-never-solve-crimes-again dept

Manhattan DA Cyrus Vance can't stop griping about phone encryption. He's basically a one-issue politician at this point. His creaky platform is the coming criminal apocalypse, currently being ushered in by smartphone manufacturers. The only person complaining more about phone encryption is FBI Director James Comey, but in Comey's defense, his jurisdiction is the whole of the United States. Vance has only his district, but it encompasses the NYPD -- a police force that often seems to view itself as the pinnacle of American policing.

So, with the battle between the FBI and Apple underway in a California court, Vance is back at it, attempting to grab the national spotlight from his position on the opposite coast.

Manhattan District Attorney Cyrus R. Vance Jr. said at a news conference that investigators cannot access 175 Apple devices sitting in his cybercrime lab because of encryption embedded in the company’s latest operating systems.

“They’re warrant proof,” he said, adding that the inability to peer inside the devices was especially problematic because so much evidence once stored in file cabinets, on paper, and in vaults, is now only on criminals’ smartphones.

Tough luck, that. But considering the information inside is encrypted, it's a bit bold to declare that whatever's contained there that the NYPD hasn't seen would be useful to investigators. The assumption seems to be that if it's encrypted and on a device seized by law enforcement, then it must be composed of smoking guns and signed confessions in PDF format.

Even if we buy the assumption that the phones contain massive amounts of useful data, there are other pathways to this data. It doesn't have to run through the smartphone provider. And the efforts made to lock out cops (as it's always presented) also keeps criminals from accessing the personal data and communications of others. So, there's that.

Vance claims investigations are being hindered by encryption. Supposedly, the NYPD is sitting on 175 uncracked devices -- some of which were displayed during the press conference. But other than this number being cited, very little was offered in the way of further detail. Instead, Vance photo-opped a pile of supposedly inaccessible devices and let the press draw its own conclusions. Police Commissioner Bill Bratton was on hand to back up Vance's assertions with the sort of jailhouse hearsay Detective Vincent Hanna would find patently ridiculous.

Bratton said criminals are increasingly aware of the protection offered by their devices. He said a prisoner in a city jail was recently recorded saying in a phone call that iPhone encryption was “another gift from God.”.

Devastating.


It's a shame the Vance-Bratton loop doesn't seem to be interested in hearing from other law enforcement representatives about whether the government should be forcing companies out of the encryption business or a locked-up phone should be treated as an investigative brick wall.

Here's PoliceOne's editor-in-chief, Doug Wyllie, pointing out what's wrong with the FBI's efforts -- and every assertion made by other law enforcement officials who believe private companies should be forced to destroy the protective efforts they've built into their devices.

The Associated Press said in its report, “The dispute places Apple, one of the world’s most respected companies, on the side of protecting the digital privacy of an accused Islamic terrorist.”

Well, no. Apple is protecting its product for the hundreds of millions who possess Apple iOS devices, and it is protecting its own corporate interests. The company’s market position could be jeopardized by taking away one of the elements to its product that is most appealing to consumers (privacy and encryption) and thereby put the shareholders in financial jeopardy. As CEO, it is Cook’s responsibility to resist that.

Furthermore, the FBI may be using terrorism as leverage to secure Apple's assistance, but its insistence that key info is held on a dead suspect's phone suggests it's reading too much into things it can't actually see, as well as short-circuiting its own investigative processes.

The fact is that the probability that a terrorist would keep sensitive information about his plot/plans on his government-issued mobile phone is pretty preposterous. In the unlikely event that there is information relevant to the investigation on that device, the possibility exists that it resides elsewhere as well, such as with mobile carrier network records, or another person’s phone who spoke or exchanged messages with Farook. Consequently, the FBI should:

Vigorously pursue all of the other avenues of investigation.

Work to develop better decryption capabilities for future investigations.

Withdraw its petition to the court to force a private company to damage its products.

This is coming from the editor of a site that's so much of a law enforcement echo chamber that you're not even allowed to see comments unless you can prove you're a law enforcement officer or official.


When another closed, pro-law enforcement loop can see both the forest and the trees, it clearly exposes Vance's efforts here as little more than grandstanding. What Vance and Bratton want -- along with James Comey -- is for every impediment to investigations to be removed, either by courts or by legislators. Because they've chosen to focus on encryption, they're ignoring scalable fences while wringing their hands over the padlock on the gate.

And, once more it must be pointed out that the FBI and other law enforcement agencies solved plenty of crimes before smartphones -- much less smartphone encryption -- became the norm. They claim everything that used to reside in file cabinets and bedroom drawers now resides in encrypted devices. While many people's "lives" are contained in their phones, their lives encompass far more than their Companion Rectangles™. They still have computers and laptops that aren't encrypted, third party social media services/email providers, as well as friends, relatives and co-conspirators who may be able to offer more insight or access. But all people like Vance see is iNcriminating Device 5S standing between them and justice, even when multiple paths around it still exist.

Filed Under: crime, cyrus vance, encryption, going dark, law enforcement, new york city, nyc, nypd

NY State Legislator Proposes Ban On Sale Of Encrypted Smartphones

from the never-too-late-to-give-a-bad-idea-another-shot dept

It appears someone's listening to local crackpot New York District Attorney Cyrus Vance's demands that encryption be outlawed to make law enforcement easier. His "white paper" didn't have the guts to make this demand, instead couching it in language stating he would be completely unopposed to a legislative ban on encryption, but that he wasn't going to be the bad guy asking for it.

A month later, as the mockery of his encryption white paper died down, Vance decided he would be the bad guy and openly stated that if Apple wasn't going to give him what he wanted, it could be forced to do so by the government. Lo and behold, New York Senator Assemblyman Matthew Titone has answered Vance's call for action. In what is likely the nation's first proposed ban on encryption, Titone's introduced bill forbids the sale of smartphones that can't be cracked by their manufacturers. (h/t Nate Cardozo)

ANY SMARTPHONE THAT IS MANUFACTURED ON OR AFTER JANUARY FIRST, TWO THOUSAND SIXTEEN, AND SOLD OR LEASED IN NEW YORK, SHALL BE CAPABLE OF BEING DECRYPTED AND UNLOCKED BY ITS MANUFACTURER OR ITS OPERATING SYSTEM PROVIDER.

THE SALE OR LEASE IN NEW YORK OF A SMARTPHONE MANUFACTURED ON OR AFTER JANUARY FIRST, TWO THOUSAND SIXTEEN THAT IS NOT CAPABLE OF BEING DECRYPTED AND UNLOCKED BY ITS MANUFACTURER OR ITS OPERATING SYSTEM PROVIDER SHALL SUBJECT THE SELLER OR LESSOR TO A CIVIL PENALTY OF TWO THOUSAND FIVE HUNDRED DOLLARS FOR EACH SMARTPHONE SOLD OR LEASED IF IT IS DEMONSTRATED THAT THE SELLER OR LESSOR OF THE SMARTPHONE KNEW AT THE TIME OF THE SALE OR LEASE THAT THE SMARTPHONE WAS NOT CAPABLE OF BEING DECRYPTED AND UNLOCKED BY ITS MANUFACTURER OR ITS OPERATING SYSTEM PROVIDER.

This isn't Titone's first attempt at this legislation, something that can be gleaned by the fact that the proposed legislation still contains wording suggesting January 1, 2016 is still somewhere off in the future. This bill made its debut last year, roughly nine months after Apple announced its plan to offer encryption by default.

The proposed legislation was introduced in the Committee on Consumer Affairs and Protection [wft?] on June 8th, 2015. Nothing happened then, but a new legislative session is upon us and Titone re-submitted his bill to the same committee last week.

There has been no fanfare accompanying this twice-submitted legislation, most likely due to it potentially toxic side effects. Even Titone's own Senate page -- where press releases seem to accompany all of his other sponsored bills -- has nothing to say about this one. Still, the bill has attracted two co-sponsors: Walter Mosley and Patricia Fahy.

Interestingly, or perhaps more accurately, infuriatingly, the bill would hold retailers responsible for manufacturers' actions. Apple Stores would apparently be unable to sell any smartphones and every service provider would have to eliminate any phones with default encryption from their lineups.

The wording isn't a ban on encryption, per se. But it does make the sale of encrypted phones illegal -- pretty much accomplishing the same thing without having to require backdoors or forbid manufacturers from offering default encryption in the other 49 states. That latter part is the loophole New York can't close, even if this stupid piece of legislation passes.

New York's sky-high tobacco taxes have turned New York City into a massive secondary market for cigarette cartons that fell off a truck/were purchased across state lines. This would basically do the same thing for smartphones, creating a market for phones purchased in other states but deployed in New York. The bill doesn't even attempt to address this loophole, laying pretty much all of the culpability at the feet of local resellers. Purchasers aren't forbidden from deploying their own encryption and secondhand phones containing built-in encryption can be bought and sold without fear of repercussion.

In all likelihood, Titone's bill will die another death on the cold hard assembly floor. The bill is bad in multiple ways, but not in any of the ways immediately appealing to undecided politicians. The spiel accompanying the bill attempts to press all of the right buttons ("There is no reason criminals should also benefit, and they will, as people will be defrauded or threatened, and terrorists will use these encrypted devices to plot their next attack over FaceTime..."), but informing the nation's largest phone manufacturers that their products can't be sold in New York isn't exactly the sort of message many legislators are willing to send

Filed Under: cyrus vance, encryption, going dark, matthew titone, mobile encryption, ny, patricia fahey, walter mosley
Companies: apple

Manhattan District Attorney Still Totally Ignorant About Encryption, Slams Tim Cook & Demands Legislation To Wipe Out Encryption

from the not-a-good-idea,-cyrus dept

Manhattan District Attorney Cyrus Vance really doesn't like encryption -- and really doesn't seem even remotely interested in the fact that he doesn't appear to understand even the basics of what he's talking about. Vance started whining about mobile phone encryption in January of this year, falsely claiming it meant these phones were "sealed off from law enforcement." Of course, that ignores the fact that only some information is encrypted, and plenty of other stuff is readily available. Over the summer, Vance kept up the campaign, with a ridiculous nearly fact free op-ed in the NY Times in which he blamed an unsolved murder in Evanston Illinois (note: ~800 miles from Manhattan) on encryption. As we noted at the time, the facts didn't match the reality. The phone in that case (from Samsung) didn't come with default local encryption turned on, and it's not at all clear the phone even had that much value in the investigation (and, remember, communications metadata was still readily available).

Vance then really went for the big score last month in releasing a white paper calling for a legislative ban on encryption. Of course, knowing how ridiculous that sounds, he tries to claim that he's not actually asking for a legislative ban... while actually asking for a legislative ban. But it's totally a ban. The specifics of his legislative proposal is that "designers and makers of operating systems not design or build them to be impregnable to lawful governmental searches."

This, of course, would do next to nothing in helping Vance, as those who wished to encrypt the contents of their phones could still install third party applications to do so. Furthermore, those who wished to communicate via encrypted end-to-end communications platforms could still do that as well. Oh, and also, in demanding that everyone design devices that have weak security, Vance would be intentionally putting most people at a higher degree of risk... all to solve a single unsolved murder in Evanston, which probably wouldn't have been solved even if that phone hadn't been encrypted.

Either way, Vance just doesn't want to let go. And with Tim Cook going on 60 Minutes and repeating his pretty straightforward (and knowledgeable) defense of encryption, Vance can't let the opportunity pass, without again attacking Apple and demanding legislation to make everyone less safe.

“Local law enforcement agencies rely on photos, videos, and messages stored on lawfully seized smartphones to hold perpetrators accountable, deliver justice for victims, and exonerate the innocent. Apple implemented full-disk encryption so that it could no longer comply with the judicial search warrants that make this work possible.

“iPhones are now the first consumer products in American history that are beyond the reach of lawful warrants. The result is crimes go unsolved and victims are left beyond the protection of law.‎

“Because Apple is unwilling to help solve this problem, the time for a national, legislative solution is now.”

Once again, almost none of that is true. Apple didn't implement that for the purpose of not complying with warrants, but to protect its customers from harm. You would think that someone who works in law enforcement would appreciate such preventative measures. As for relying on photos, videos and messages -- those are rarely stored exclusively on the device (hence the local encryption doesn't matter for law enforcement) and rarely the key issue in a case. If they were, Vance wouldn't have to point to a case nearly half the country away as his prime example.

Second, the idea that "iPhone are... beyond the reach of lawful warrants" is also total bullshit. This is just a small sliver of information on some iPhones if used in a specific way that are beyond the scope of a warrant. But there has always been information that is beyond the scope of a warrant -- such as the information in someone's brain.

You'd almost think that Vance is trying to purposely mislead people into thinking that they can plan crimes on their iPhones and the information won't be accessible. Gee, I wonder why he'd want to do that...

Finally, the idea that crimes are going unsolved because of this again remains to be proven, because almost every example given so far has been debunked, and they frequently look like law enforcement types blaming encryption for other failures.

Vance, like Senator Tom Cotton, really really dislike encryption and their statements against Tim Cook demonstrate a willingness to either expose their own ignorance publicly, or a willingness to flat out lie to the American public to serve their own political needs. Neither is a particularly good look for a government official.

Filed Under: cyrus vance, district attorney, encryption, manhattan, tim cook
Companies: apple