Apple Engineers Contemplate Refusing To Write Code Demanded By Justice Department

from the well-this-could-get-interesting dept

In all the discussions about Apple v. the FBI, a few people occasionally ask what would happen if Apple's engineers just refused to write the code demanded (some also ask about writing the code, but purposely messing it up). And now it appears that at least some Apple engineers are thinking about just this scenario. According to the NY Times:

Apple employees are already discussing what they will do if ordered to help law enforcement authorities. Some say they may balk at the work, while others may even quit their high-paying jobs rather than undermine the security of the software they have already created, according to more than a half-dozen current and former Apple employees.

As the NY Times notes, these details certainly add some pretty hefty weight to the First Amendment arguments about "compelled speech" that Apple has made (and that the EFF doubled down on in its amicus brief). As for what then would happen... that's up to the court, but it's likely that the court would find Apple in contempt and/or start fining it. But that still leaves open the question of how does it comply if not a single engineer is willing to help out.

This particular legal dispute gets more interesting day by day...

Filed Under: all writs act, code, doj, engineers, ios, privacy, refuse, security
Companies: apple

Pissed Off Google Security Guys Issue FU To NSA, Announce Data Center Traffic Now Encrypted

from the keep-at-it dept

So far, one of the biggest stories of the Snowden NSA leaks, by far, is the revelation that the NSA was infiltrating the private data links between Google and Yahoo data centers (and, it seems likely, other companies as well). Google had clearly suspected this, as it had been reported earlier that they were scrambling to encrypt those data links. As you may recall, the original Washington Post article also noted that two Google engineers who were shown the NSA's slides "exploded in profanity" and anger at the NSA.

It would appear that this sentiment is pretty common across Google's security team, and they're displaying their anger on Google Plus -- but also announcing that all that data is now encrypted. When the news first broke, security engineer Brandon Downey expressed reasonable anger about the news:

Fuck these guys.

I've spent the last ten years of my life trying to keep Google's users safe and secure from the many diverse threats Google faces.

[...] But after spending all that time helping in my tiny way to protect Google -- one of the greatest things to arise from the internet -- seeing this, well, it's just a little like coming home from War with Sauron, destroying the One Ring, only to discover the NSA is on the front porch of the Shire chopping down the Party Tree and outsourcing all the hobbit farmers with half-orcs and whips.

On Tuesday, the Washington Post revealed a few more slides showing more details of the NSA's infiltration of private data links between data centers. In response to that, another security engineer, Mike Hearn, announced that all the traffic shown in those slides is now encrypted, along with his own "fuck you" to the NSA and GCHQ:

I now join him in issuing a giant Fuck You to the people who made these slides. I am not American, I am a Brit, but it's no different - GCHQ turns out to be even worse than the NSA.

We designed this system to keep criminals out. There's no ambiguity here. The warrant system with skeptical judges, paths for appeal, and rules of evidence was built from centuries of hard won experience. When it works, it represents as good a balance as we've got between the need to restrain the state and the need to keep crime in check. Bypassing that system is illegal for a good reason.

Unfortunately we live in a world where all too often, laws are for the little people. Nobody at GCHQ or the NSA will ever stand before a judge and answer for this industrial-scale subversion of the judicial process. In the absence of working law enforcement, we therefore do what internet engineers have always done - build more secure software. The traffic shown in the slides below is now all encrypted and the work the NSA/GCHQ staff did on understanding it, ruined.

Of course, some people might reasonably question the idea that Google is "little people" here. And, while it's good to see Google staffers furious about this, it remains to be seen if Google will actually do more about this. A lawsuit against the US government for hacking into its network seems called for. And, potentially against Level 3 as well, given that it appears Level 3 provided much of the dark fiber Google was using -- and the company gave a giant "if the government comes to us, we can't talk about it" response, that hinted strongly towards "the government came to us and had us tap Google's private links."

Hopefully, we'll start to see that employee anger over this turn into much more: including better privacy tools for users and using Google's political pull to fight the NSA in DC as well.

Filed Under: datacenters, encryption, engineers, nsa, nsa surveillance, security
Companies: google, level 3

The US Government Has Betrayed The Internet; It's Time To Fix That Now

from the no-more-messing-around dept

With the latest shocking revelations concerning the NSA's ability to break encryption, Bruce Schneier has made an excellent point. In pursuit of trying to find a few needles, the US government has basically betrayed the core of the internet -- and it's time for engineers to fix it. Now. Basically what's come out today is that the NSA has purposely been massively weakening internet security for its own good on the ridiculous belief that only it would find and use these vulnerabilities.

Schneier makes two important calls in his article. First, he calls on those who actually helped out in placing these backdoors into today's technologies to come out and reveal the details. Second, he says that the internet technology and security community needs to come together right now to rethink core internet infrastructure to build solutions that are done right, with real security in mind. Encryption is still viable and powerful, but it needs to be done correctly.

We need to figure out how to re-engineer the internet to prevent this kind of wholesale spying. We need new techniques to prevent communications intermediaries from leaking private information.

We can make surveillance expensive again. In particular, we need open protocols, open implementations, open systems – these will be harder for the NSA to subvert.

As we've written a few times now, a bunch of attempts have sprung up lately to build secure communications offerings, but this goes way beyond that. This is a problem going back to core internet infrastructure, and it needs to be rethought and re-implemented in an open way that can be reviewed by anyone and where it's much more difficult for the NSA to hide or to sneak in "covert" operatives whose roles are to subvert the security.

Of course, in the short run this is also going to give extra ammo to foreign governments who want greater control over the internet themselves (not always with good intentions). It's going to be important to resist that kind of control as well. Instead, the focus needs to be on rethinking this in a manner so that no party is in full control and can subvert the system.

Filed Under: encryption, engineers, internet, internet infrastructure, nsa, nsa surveillance, security

Brazen Scams By Engineers Uncovered

from the nice-work-if-you-can-get-it dept

Two separate stories of two different fairly amazing scams by engineers have come out recently. The first one is the more incredible one, and it involves a guy named William Grayson Hunter, who apparently secretly had two separate full time jobs at two different companies, but barely spent much time at either, instead "spending his days at bars, amusement parks and movie theaters," but sent in time cards, including some that billed for more than 24-hours a day. One of his two full-time employers, Aerospace Corp., just agreed to pay the government $2.5 million after it was investigating Hunter's work that was billed to the government at a premium. Of course, there's no punishment for Hunter, who died in 2010.

The other story is a bit more conventional. A network engineer at Verizon Wireless repeatedly used the company's warranty contracts with Cisco to order replacements parts that weren't needed, and then sold them off and kept the money -- which apparently added up to $4.5 million. Like Hunter above, Michael Baxter had interests outside of work:

[Baxter] spent the proceeds on jewelry, cars, international travel and multiple cosmetic surgeries for his girlfriend, prosecutors said.

Apparently, controls and audits on such things have gone out of style.

Filed Under: engineers, scams

Why You Don't Want Politicians Doing Your Engineering For You

from the not-a-good-thing dept

We frequently worry (or point out the negative consequences) of technologically illiterate politicians passing laws that impact technology. It goes beyond just laws, however, into other investigations. Frank Ahrens, at the Washington Post, highlights what happens when you have technologically illiterate politicians trying to investigate the Toyota acceleration problem, highlighting a troubling exchange between Toyota's boss, Akio Toyoda, and Eleanor Holmes Norton, the Congresswoman from DC:

Toyoda said that when his company gets a complaint about a mechanical problem, engineers set to work trying to duplicate the problem in their labs to find out what went wrong.

Norton said: "Your answer -- we'll wait to see if this is duplicated -- is very troublesome." Norton asked Toyoda why his company waited until a problem recurred to try to diagnose it, which is exactly what he was not saying.

Members of Congress are generally lawyers and politicians, not engineers. But they are launching investigations and creating policies that have a direct impact on the designers and builders of incredibly complex vehicles -- there are 20,000 parts in a modern car -- so there are some basics they should understand. Chief among them: The only way to credibly figure out why something fails is to attempt to duplicate the failure under observable conditions. This is the engineering method.

But, of course, understanding how engineering and technology works doesn't get you (re-)elected. Grandstanding does.

Filed Under: duplication, engineering, engineers, politicians
Companies: toyota

Suggestion: Engineers Go On A Patent Strike

from the nice-idea,-but... dept

Via Against Monopoly comes an opinion piece from the EE Times suggesting that engineers who recognize how harmful the patent system can be should go on a patent strike:

Stop filing patents. Refuse to sign employment contracts that give your employer sole title to your inventions. Don't participate in any due diligence efforts on patent portfolios.

Basically, his argument is that most engineers recognize how harmful the patent system is, but are pushed into patenting by lawyers and management, and the only way to get the message out is to stop assisting with anything having to do with patents.

It's a nice idea, and if a lot of folks really got involved it might get some attention, but I have a hard time believing it could actually be effective. While many people do recognize the problems with patents, an awful lot either don't care or don't know enough to care about it -- and they'll just keep patenting away. It's similar to calls to "boycott" RIAA music or similar such things. It sounds good, but it's effectively impossible to make such a process really work in practice.

Filed Under: engineers, patent strike, patents