Appeals Court Can Rule That DMCA's Anti-Circumvention Rules Are Unconstitutional

from the make-it-so dept

As you hopefully know, there are two main parts to the DMCA law that was passed in 1998. There's DMCA 512, which is what you hear about most of the time. That's the part that includes the rules for notice and takedown regimes for user uploaded content (among other things). It's got problems, but in its current form has also enabled many important services to exist. The other part, which is much more problematic, is DMCA 1201, which is the anti-circumvention rules -- or you could call it the "DRM" part of the law. This has no redeeming value whatsoever. Under 1201 basically any attempt to circumvent a "technological" protection measure, can be deemed infringing even if the underlying content is never infringed upon. This part of the law is not only not necessary, but it's drafted in a manner that has been regularly abused -- enabling everyone from printer manufacturers to garage door opener companies to argue that simple reverse engineering to create competition is "infringement."

In fact, everyone -- even the drafters of the DMCA -- knew that 1201 went too far and would lead to massive collateral damage. Rather than not passing such a bill, Congress came up with its "escape valve" which is the triennial review process, whereby every three years, the Librarian of Congress can magically declare which things are exempt from 1201. This has exempted a few classes of important use cases, but just the fact that (1) these uses need to be renewed every three years, and (2) that you have to ask for permission that can only be granted every 3 years for things that should be perfectly legal... is a problem.

Way back in 2016, EFF brought a case challenging the constitutionality of 1201 on behalf of computer security researcher/professor Matthew Green and hardware hacker Bunnie Huang, arguing that the DMCA 1201 liability suppressed their speech by stopping security research and beneficial hacking efforts. In 2019, a court dismissed much of the constitutional challenge, while allowing other parts of the case to move forward.

However, those constitutional questions are now on appeal and the EFF recently filed its opening brief. It's worth reading.

Appellants’ research and expression would be highly valuable to society. Their work would also be perfectly lawful but for one thing—it requires circumventing digital locks and teaching others how to do the same. In the name of protecting copyrights, a federal statute, Section 1201(a) of the Digital Millennium Copyright Act (DMCA), makes it a crime to engage in or even distribute information about such circumvention, even if the circumvention serves an otherwise lawful purpose. This statute subverts the traditional contours of copyright law to criminalize speech and bar people from using information they possess for education, journalism, and expression. That, in turn, puts Section 1201(a) on a collision course with the First Amendment—one it cannot and should not survive.

Some useful and worth reading amicus briefs have also been filed in the case. Copyright scholars Pam Samuelson and Rebecca Tushnet filed a fantastic brief:

In 1998, Congress made a momentous departure from traditional copyright law by enacting Section 1201 of the Digital Millennium Copyright Act (“DMCA”). Section 1201 created a new class of right—a right to control access to legitimately acquired copies of copyrighted works that had been transferred to lawful owners, as well as a new antitrafficking right specific to access controls. 17 U.S.C. § 1201(a). Both new rights—as well as the significant civil and criminal penalties for infringing those rights—apply well beyond the traditional contours of secondary liability for aiding infringement by others. Id. §§ 1203, 1204. Moreover, these new rights disregard and override traditional mechanisms within the Copyright Act that struck the balance between copyright protection and First Amendment interests.

The Tech Law & Policy clinic at Colorado Law highlighted how much damage 1201 and the triennial review process has done to accessibility, security, and right to repair:

The right to engage in fair use is protected by the First Amendment. The Supreme Court has concluded that fair use is one of copyright law’s essential “built-in First Amendment accommodations” and serves as a “traditional First Amendment safeguard.” The Supreme Court has conceptualized fair use as a safety valve that prevents copyright law from suppressing the exercise of First Amendment rights.

Section 1201 eliminates fair use’s capacity to serve as a First Amendment safeguard when copyrighted works are encumbered with TPMs. It does so by effectively prohibiting fair uses that require the circumvention of TPMs.

And then there's an amicus brief from documentary film makers talking about how damaging 1201 has been to their own expression:

The Digital Millennium Copyright Act prevents filmmakers from exercising their First Amendment right to make fair use by making it illegal to access content on DVDs and other digital content protected by encryption. Congress intended to create a “fail-safe” mechanism to preserve the public’s right to make fair use. But the open-ended rulemaking process it devised is unduly burdensome and has led to exemptions that leave filmmakers uncertain as to how they can make fair use safely. Amici urge this Court to issue a limiting construction that preserves their First Amendment right to make fair use. In addition, if this Court is inclined to order equitable relief in this appeal, this Court should preserve existing exemptions until a more constitutionally appropriate procedure is in place and more workable exemptions have gone into effect.

Filmmakers depend on the doctrine of fair use to make commentary, criticism, instruction, and report on current events by utilizing portions of digitized movies and other digitized content. Fair use in filmmaking has been called a paradigmatic fair use, and without it a massive range of expressive conduct would be impossible. But fair use is of little consequence if filmmakers cannot access the high-quality digital material they seek to use in the first place. Suppose a filmmaker wants to analyze how special effects in the Star Wars film franchise have evolved from 1977 to the present day, examining various clips from the past 45 years. The law is quite clear that fair use permits the use of film clips without permission or payment to the Star Wars rightsholders. To do this, however, the filmmaker will need to obtain high-quality footage, which is likely to be locked behind encryption and other technological protection measures (“TPMs”). That is a problem for filmmakers because Congress made it a crime to circumvent technologies that control access to copyrighted content when it enacted the Digital Millennium Copyright Act (“DMCA”) in 1998, now codified at Section 1201 of the copyright statute. The result is that, barring an exemption from the Librarian of Congress, filmmakers cannot access the digital content they need for fair use without a credible fear of civil and criminal liability.

This isn't just an issue for big companies. This is about fundamental fair use rights of the public -- which Congress tossed away decades ago, and tried to pave over by insisting the Librarian of Congress could swoop in every 3 years and stop the most egregious attacks on free speech. But that's not how the 1st Amendment works.

Hopefully the court agrees.

Filed Under: 1201, bunnie huang, copyright, dmca 1201, matthew green, security research

Software Legend Ray Ozzie Thinks He Can Safely Backdoor Encryption; He's Very Wrong

from the and-dangerous dept

There have been ongoing debates for a while now about the stupidity of backdooring encryption, with plenty of experts explaining why there's no feasible way to do it without causing all sorts of serious consequences (some more unintended than others). Without getting too deep into the weeds, the basic issue is that cryptography is freaking difficult and if something goes wrong, you're in a lot of trouble very fast. And it's very, very easy for something to go wrong. Adding in a backdoor to encryption is, effectively, making something go wrong... on purpose. In doing so, however, you're introducing a whole host of other opportunities for many, many things to go wrong, blowing up the whole scheme and putting everyone's information at risk. So, if you're going to show up with a "plan" to backdoor encryption, you better have a pretty convincing argument for how you avoid that issue (because the reality is you can't).

For at least a year (probably more) the one name that has kept coming up over and over as one of the few techies who insists that the common wisdom on backdooring encryption is wrong... is Ray Ozzie. Everyone notes that he's Microsoft's former Chief Software Architect and CTO, but some of us remember him from way before that when he created Lotus Notes and Groove Networks (which was supposed to be the nirvana of collaboration software). In recent months his name has popped up here and there, often by FBI/DOJ folks seeking to backdoor encryption, as having some possible ways forward.

And, recently, Wired did a big story on his backdoor idea, where he plays right into the FBI's "nerd harder" trope, by saying exactly what the FBI wants to hear, and which nearly every actual security expert says is wrong:

Ozzie, trim and vigorous at 62, acknowledged off the bat that he was dealing with a polarizing issue. The cryptographic and civil liberties community argued that solving the problem was virtually impossible, which “kind of bothers me,” he said. “In engineering if you think hard enough, you can come up with a solution.” He believed he had one.

This, of course, is the same sort of thing that James Comey, Christopher Wray and Rod Rosenstein have all suggested in the past few years: "you techies are smart, if you just nerd harder, you'll solve the problem." Ozzie, tragically, is giving them ammo. But he's not delivering the actual goods.

The Wired story details his plan which is not particularly unique. It takes concepts that others have proposed (and which have been shown to not be particularly secure) and puts a fresh coat of paint on them. Basically, the vendor of a device has a private key that it needs to keep secret, and under some "very special circumstances" it can send an employee into the dark chamber to do the requisite dance, retrieve the code, and give it to law enforcement. That's been suggested many times, and it's been explained many times why that opens up all sorts of dangerous scenarios that could put everyone at risk. The one piece that does seem different is that Ozzie wants a sort of limitation on the possible damage his system does if it goes wrong (in one particular way), which is that under his system if the backdoor is used, it can only be used on one phone and then it disables that phone forever:

Ozzie designed other features meant to ­reassure skeptics. Clear works on only one device at a time: Obtaining one phone’s PIN would not give the authorities the means to crack anyone else’s phone. Also, when a phone is unlocked with Clear, a special chip inside the phone blows itself up, freezing the contents of the phone thereafter. This prevents any tampering with the contents of the phone. Clear can’t be used for ongoing surveillance, Ozzie told the Columbia group, because once it is employed, the phone would no longer be able to be used.

So, let's be clear. That piece isn't what's useful in "reassuring skeptics." That piece is the only thing that really appears to be that unique about Ozzie's plan. And it hasn't done much to reassure skeptics. As the report notes, when Ozzie laid this out at a special meeting of super smart folks in the field, it didn't take long for one to spot a hole:

The most dramatic comment came from computer science professor and cryptographer Eran Tromer. With the flair of Hercule Poirot revealing the murderer, he announced that he’d discovered a weakness. He spun a wild scenario involving a stolen phone, a second hacked phone, and a bank robbery. Ozzie conceded that Tromer found a flaw, but not one that couldn’t be fixed.

"Not one that couldn't be fixed." But it took this guy just hearing about the system to find the flaw. There are more flaws. And they're going to be catastrophic. Because that's how cryptogrpahy works. Columbia computer science professor and all around computer security genius Steve Bellovin (who was also at that meeting) highlights how Tromer's flaw-spotting shows why Ozzie's plan is a fantasy with dangerous consequences:

Ozzie presented his proposal at a meeting at Columbia—I was there—to a diverse group. Levy wrote that Ozzie felt that he had "taken another baby step in what is now a two-years-and-counting quest" and that "he'd started to change the debate about how best to balance privacy and law enforcement access". I don't agree. In fact, I think that one can draw the opposite conclusion.

At the meeting, Eran Tromer found a flaw in Ozzie's scheme: under certain circumstances, an attacker can get an arbitrary phone unlocked. That in itself is interesting, but to me the important thing is that a flaw was found. Ozzie has been presenting his scheme for quite some time. I first heard it last May, at a meeting with several brand-name cryptographers in the audience. No one spotted the flaw. At the January meeting, though, Eran squinted at it and looked at it sideways—and in real-time he found a problem that everyone else had missed. Are there other problems lurking? I wouldn't be even slightly surprised. As I keep saying, cryptographic protocols are hard.

Bellovin also points out -- as others have before -- that there's a wider problem here: how other countries will use whatever stupid example the US sets for much more nefarious purposes:

If the United States adopts this scheme, other countries, including specifically Russia and China, are sure to follow. Would they consent to a scheme that relied on the cooperation of an American company, and with keys stored in the U.S.? Almost certainly not. Now: would the U.S. be content with phones unlockable only with the consent and cooperation of Russian or Chinese companies? I can't see that, either. Maybe there's a solution, maybe not—but the proposal is silent on the issue.

And we're just getting started on how many experts are weighing in on just how wrong Ozzie is. Errata Security's Rob Graham pulls no punches pointing out that:

He's only solving the part we already know how to solve. He's deliberately ignoring the stuff we don't know how to solve. We know how to make backdoors, we just don't know how to secure them.

Specifically, Ozzie's plan relies on the idea that companies can keep their master private key safe. To support that this is possible, Ozzie (as the FBI has in the past) points to the fact that companies like Apple already keep their signing keys secret. And that's true. But that assumes incorrectly that signing keys and decryption keys are the same thing and can be treated similarly. They're not and they cannot be. The security protocols around signing keys are intense, but part of that intensity is built around the idea that you almost never have to use a signing key.

A decryption key is a different story altogether, especially with the FBI blathering on about thousands of phones it wants to dig its digital hands into. And, as Graham notes, you quickly run into a scaling issue, and with that scale, you ruin any chance of keeping that key secure.

Yes, Apple has a vault where they've successfully protected important keys. No, it doesn't mean this vault scales. The more people and the more often you have to touch the vault, the less secure it becomes. We are talking thousands of requests per day from 100,000 different law enforcement agencies around the world. We are unlikely to protect this against incompetence and mistakes. We are definitely unable to secure this against deliberate attack.

And, even worse, when that happened, we wouldn't even know.

If Ozzie's master key were stolen, nothing would happen. Nobody would know, and evildoers would be able to freely decrypt phones. Ozzie claims his scheme can work because SSL works -- but then his scheme includes none of the many protections necessary to make SSL work.

What I'm trying to show here is that in a lab, it all looks nice and pretty, but when attacked at scale, things break down -- quickly. We have so much experience with failure at scale that we can judge Ozzie's scheme as woefully incomplete. It's not even up to the standard of SSL, and we have a long list of SSL problems.

And so Ozzie's scheme relies on an impossibility. That you could protect a decryption key that has to be used frequently, the same way that a signing key is currently protected. And that doesn't work. And when it fails, everyone is seriously fucked.

Graham's article also notes that Ozzis is -- in true nerd harder fashion -- focusing on this as a technological problem, ignoring all the human reasons why such a system will fail and such a key won't be protected.

It focuses on the mathematical model but ignores the human element. We already know how to solve the mathematical problem in a hundred different ways. The part we don't know how to secure is the human element.

How do we know the law enforcement person is who they say they are? How do we know the "trusted Apple employee" can't be bribed? How can the law enforcement agent communicate securely with the Apple employee?

You think these things are theoretical, but they aren't.

Cryptography expert (and professor at Johns Hopkins), Matt Green did a fairly thorough tweetstorm debunking of Ozzie's plan as well. He also points out, as Graham does, the disaster scenario of what happens when (not if) the key gets out. But, an even bigger point that Green makes is that Ozzie's plan relies on a special chip in every device... and assumes that we'll design that chip to work perfectly and never get broken. And that's ridiculous:

Green and Graham also both point to the example of GrayKey, the recently reported on tool that law enforcement has been using to crack into all supposedly encrypted iPhones. Already, someone has hacked into the company behind GrayKey and leaked some of the code.

Put it all together and:

Suddenly the fawning over Ozzie's plan doesn't look so good any more, does it? And, again, these are the problems that everyone who has dug into why backdoors are a bad idea have pointed out before:

Green expanded some of his tweets into a blog post as well, which is also worth reading. In it, he also points out that even if we acknowledge the difference between signing keys and decryption keys, companies aren't even that good at keeping signing keys safe (and those are almost certainly going to be more protected that decryption keys since they need to be access much less frequently):

Moreover, signing keys leak all the time. The phenomenon is so common that journalists have given it a name: it’s called “Stuxnet-style code signing”. The name derives from the fact that the Stuxnet malware — the nation-state malware used to sabotage Iran’s nuclear program — was authenticated with valid code signing keys, many of which were (presumably) stolen from various software vendors. This practice hasn’t remained with nation states, unfortunately, and has now become common in retail malware.

And he also digs deeper into the point he made in his tweetstorm about how on the processor side, not even Apple has been able to keep its secure chip from being broken -- yet Ozzie's plan is based almost entirely on the idea that such an unbreakable chip would be available:

The richest and most sophisticated phone manufacturer in the entire world tried to build a processor that achieved goals similar to those Ozzie requires. And as of April 2018, after five years of trying, they have been unable to achieve this goal — a goal that is critical to the security of the Ozzie proposal as I understand it.

Now obviously the lack of a secure processor today doesn’t mean such a processor will never exist. However, let me propose a general rule: if your proposal fundamentally relies on a secure lock that nobody can ever break, then it’s on you to show me how to build that lock.

Update: We should add that the criticisms raised here are not new either. Back in February we wrote about a whitepaper by Riana Pfefferkorn making basically all of these same points that the folks quoted above are making. In other words, it's a bit bizarre that Wired wrote this article as if Ozzie is doing something new and noteworthy.

So that's a bunch of experts highlighting why Ozzie's plan is silly. But, from the policy side it's awful too. Because having Ozzie going around and spouting this debunked nonsense, but with his pedigree, simply gives the "going dark" and "responsible encryption" pundits something to grasp onto to claim they were right all along, even though they weren't. They've said for years that the techies just need to nerd harder, and they will canonize Ray Ozzie as the proof that they were right... even though they're not and his plan doesn't solve any of the really hard problems.

And, as we noted much earlier in this post, cryptography is one of those areas where the hard problems really fucking matter. And if Ozzie's plan doesn't even touch on most of the big ones, it's no plan at all. It's a Potemkin Village that law enforcement types will parade around for the next couple of years insisting that backdoors can be made safely, even though Ozzie's plan is not safe at all. I am sure that Ray Ozzie means well -- and I've got tremendous respect for him and have for years. But what he's doing here is actively harmful -- even if his plan is never implemented. Giving the James Comeys and Chris Wrays of the worlds some facade they can cling to to say that this can be done is only going to create many more problems.

Filed Under: encryption, encryption is hard, going dark, key escrow, matthew green, nerd harder, ray ozzie, responsible encryption, rob graham, security, steven bellovin

The Cyber World Is Falling Apart And The DOJ Is Calling For Weakened Encryption

from the better-for-cops,-worse-for-everyone-else dept

It seemed like the (mostly) one-man War on Encryption had reached a ceasefire agreement when "Going Dark" theorist James Comey was unceremoniously ejected from office for failing to pledge allegiance to the new king president. But it had barely had time to be relegated to the "Tired" heap before Deputy Attorney General Rod Rosenstein resurrected it.

Rosenstein has been going from cybersecurity conference to cybersecurity conference raising arguments for encryption before dismissing them entirely. His remarks have opened with the generally awful state of cybersecurity at both the public and private levels. He says encryption is important, especially when there are so many active security threats. Then he undermines his own arguments by calling for "responsible encryption" -- a euphemism for weakened encryption that provides law enforcement access to locked devices and communications on secured platforms.

Considering recent events, this isn't the direction the DOJ should be pushing. Russian hackers used a popular antivirus software to liberate NSA exploits from a contractor's computer. Equifax exposed the data of millions of US citizens who never asked to be tracked by the service in the first place. Yahoo just admitted everyone who ever signed up for its email service was affected by a years-old security breach. Ransomware based on NSA malware wreaked havoc all over the world. These are all issues Rosenstein has touched on during his remarks. But they're swiftly forgotten by the Deputy Attorney General when his focus shifts to what he personally -- representing US law enforcement -- can't access because of encryption.

DAG Rosenstein needs to pay more attention to the first half of his anti-encryption stump speeches, as Matthew Green points out at Slate:

[A]ny technology that allows U.S. agencies to lawfully access data will present an irresistible target for hackers and foreign intelligence services. The idea that such data will remain safe is laughable in a world where foreign intelligence services have openly leveraged cyberweapons against corporate and political targets. In his speech, Rosenstein claims that the “master keys” needed to enable his proposal can be kept safe, but his arguments are contradicted by recent history. For example, in 2011 hackers managed to steal the master keys for RSA’s SecurID authentication product—and then used those keys to break into a slew of defense contractors. If we can’t secure the keys that protect top-secret documents, it’s hard to believe we’ll do better for your text messages.

Rosenstein is steering everyone towards his new term "responsible encryption" but there's nothing responsible about creating a set of encryption keys for lawful access. It may not necessarily be a backdoor -- a term Rosenstein is trying hard to distance himself from -- but it is a hole that wouldn't otherwise exist. And if keys are created and stored by manufacturers and platform providers, the chance malicious hackers can find them will always remain above 0%.

Filed Under: cybersecurity, encryption, going dark, hacks, matthew green, rod rosenstein, security

EFF Asks Court To Block The DOJ From Prosecuting Researcher For DMCA Violations

from the jumping-ahead-of-the-threat dept

A few more wrinkles have appeared in the EFF's attempted legal destruction of the DMCA's anti-circumvention clause. Back in July, the EFF -- along with researchers Bunny Huang and Matthew Green -- sued the government, challenging the constitutionality of Section 1201 of the DMCA. As it stands now, researchers are restricted by the limitations built into the anti-circumvention clause. The Library of Congress can grant exceptions, but these are only temporary, lasting three years and generally vanishing at the end of that term.

Projects and research efforts continue to be thwarted by this provision, opening up those who circumvent DRM and other protective measures to the possibility of prosecution. And their options when facing charges are severely limited. There is no "fair use" exception to Section 1201 of the DMCA -- something the EFF would like to see changed.

The threat of prosecution may be mostly existential, but it's still far from nonexistent. This is why the EFF has requested a preliminary injunction that would prevent the DOJ from trying to put its client in jail.

The Electronic Frontier Foundation (EFF) asked a court Thursday for an order that would prevent the government from prosecuting its client, security researcher Matthew Green, for publishing a book about making computer systems more secure.

[...]

But publishing the book, tentatively entitled Practical Cryptographic Engineering, could land Green in jail under an onerous and unconstitutional provision of copyright law. To identify security vulnerabilities in a device he has purchased, Green must work directly with copyrighted computer code, bypassing control measures meant to prevent the code from being accessed.

The injunction request [PDF] points out that -- in addition to the anti-circumvention clause being a form a prior restraint -- Green will be performing the sort of actions the DOJ has prosecuted people for in the past.

A rigorous and effective audit of a computer system’s security requires that Dr. Green analyze the software controlling the system. Often, secure computer systems prevent access to their software code through technological protection measures (“TPMs”) such as encryption, username/password combinations, or physical memory restrictions preventing a user from accessing certain stored information. An adversary seeking to extract information about the software code or about the system’s user, or to install their own malicious software, would seek to bypass these measures in order to maximize their ability to locate and exploit vulnerabilities.

To identify security flaws, Dr. Green must do the same; indeed, finding and reporting on the vulnerability of these access controls is a critical part of auditing the security of the system. If he does not bypass access controls in a computer system, Dr. Green’s research is significantly limited. While he may be able to discover some vulnerabilities, he cannot determine with confidence whether devices are secure against an adversary willing to circumvent access controls.

The DOJ has already responded (sort of) to some of the claims raised in the EFF's injunction request. Its motion to dismiss [PDF] -- filed the same day as the EFF's injunction request -- claims the EFF and Matthew Green have no standing to challenge Section 1201 of the DMCA. Not only that, but they cannot provide any evidence prosecution is likely if Green continues with his research work.

Plaintiffs’ claims should be dismissed in their entirety. As an initial matter, Plaintiffs lack standing to raise their First Amendment claims on a pre-enforcement basis because the assertions in their Complaint fail to establish a credible threat of prosecution, under the DMCA’s criminal enforcement provision, for engaging in constitutionally-protected activity. None of the Plaintiffs claims to have been threatened with criminal prosecution. Plaintiffs’ conclusory assertion that others have been prosecuted under the DMCA in the past, for unidentified reasons, is insufficient to establish that Plaintiffs face a credible threat, as is their assertion that third parties might bring suit against them under a separate civil private right of action. Moreover, Plaintiffs fail plausibly to assert that the acts of circumvention and trafficking that they wish to undertake qualify as speech or expressive conduct that is entitled to First Amendment protection but prohibited by the DMCA.

The DOJ's arguments roughly align with the assertions made in its motion to dismiss in a lawsuit brought by security researchers and the ACLU against the much-hated CFAA. Once again, the DOJ recognizes that Green's book may be covered by the First Amendment, but actions taken during its compilation may not be.

In both cases, though, the statutes lend themselves to punishing security researchers for performing security research. While the DOJ may have no intention of prosecuting Green for his work, the anti-circumvention clause allows it to hold onto that option for as long as it wants to. The only way to guarantee this won't happen is to obtain an injunction, but chances are the court won't be as interested in staving off the theoretical as it will be in examining the First Amendment claims.

Filed Under: anti-circumvention, copyright, dmca, dmca 1201, doj, matthew green, research
Companies: eff

EFF Lawsuit Challenges DMCA's Digital Locks Provision As First Amendment Violation

from the well,-that's-interesting dept

Computer security professor Matthew Green and famed hardware hacker Bunnie Huang have teamed up with the EFF to sue the US government, challenging the constitutionality of Section 1201 of the DMCA, also known as the "anti-circumvention" clause. As we've discussed for many years, 1201 makes it against the law to "manufacture, import, offer to the public, provide, or otherwise traffic in any technology, product, service, device, component, or part thereof" that is designed to "circumvent" DRM or other "technological protection measures." There are all sorts of problems with this part of the law, including the fact that it doesn't matter why you have that tool or why you're circumventing the DRM. For example, it would still be considered infringement if you cracked DRM on a public domain work. That's... insane.

The only "safety valve" on this is the ridiculous triennial review process, whereby people can beg and plead with the Librarian of Congress to "exempt" certain scenarios from being covered by 1201. The process is something of a joke, and even if you get an exemption one time, it automatically expires after three years, and the Library of Congress might not renew it.

The lawsuit, filed by EFF and some excellent lawyers from Wilson Sonsini, points out that the Supreme Court has long stated that fair use is the "safety valve" that stops copyright law from violating the First Amendment in regulating speech. But fair use isn't an allowable defense under 1201, leading to a question of whether or not 1201 itself violates the First Amendment:

Enacted in 1998, these provisions broadly restrict the public’s ability to access, speak about, and use copyrighted materials, without the traditional safeguards—such as the fair use doctrine—that are necessary to protect free speech and allow copyright law to coexist with the First Amendment. The threat of enforcement of these provisions chills protected and noninfringing speech that relies on copyrighted works, including independent technical research into computer security systems and the discussion of that research, and accessing copyrighted works in order to shift the content to a different format, space, or time. The triennial rulemaking process by which the public may seek exemptions pursuant to 17 U.S.C. § 1201(a)(1)(C) does not alleviate these problems. To the contrary, the rulemaking is itself an unconstitutional speech-licensing regime.

The complaint highlights how both Green and Huang have been scared away from working on various projects that have nothing to do with copyright-covered content, but both of which involve circumventing technological protection measures. In Green's case, it's about his security research, finding computer security problems in various devices. For Huang it's his work on a NeTVCR, an advancement on the NeTV device he created in the past. For it to work, however, he needs to get around HDCP and that, of course, would violate 1201. This presents a problem:

To the extent that the purpose of Section 1201 is “to promote the progress of science and the useful arts,” see U.S. Const. Art I, Sec. 8, cl. 8, its restrictions are not narrowly tailored to this purpose. Rather, they sweep up a vast amount of protected speech. This includes the speech that Green, Huang, Alphamax, and users of NeTVCR would undertake, but for the fear or criminal and other penalties. It also includes the many forms of speech that have been the subjects of exemption requests, and many additional forms of speech that have not yet been the subject of an exemption request. The means chosen in Section 1201 specifically targets the communicative impact of uses of copyrighted works and speech about the circumvention of TPMs that restrict such works.

Separately, as noted in the quote above, the case argues that the triennial review process itself violates the First Amendment.

The rulemaking contemplated by Section 1201(a)(1) is a licensing regime that lacks the safeguards the First Amendment requires. The combined ban and exemption process grants excessive power to a government official to make discretionary case-by-case decisions absent sufficient controlling standards.

Section 1201 does not provide for timely review of requests for permission to speak. Applicants must wait up to three years for an opportunity to participate in the triennial rulemaking, and the Rulemaking Defendants have no deadlines governing when they must issue a rule granting or denying exemption requests.

As Huang notes in his blog post about the case, this is a really big issue. It's both about free speech and what it means to "own" something.

Before Section 1201, the ownership of ideas was tempered by constitutional protections. Under this law, we had the right to tinker with gadgets that we bought, we had the right to record TV shows on our VCRs, and we had the right to remix songs. Section 1201 built an extra barrier around copyrightable works, restricting our prior ability to explore and create. In order to repair a gadget, we may have to decrypt its firmware; in order to remix a video, we may have to strip HDCP. Whereas we once readily expressed feelings and new ideas through remixes and hardware modifications, now we must first pause and ask: does this violate Section 1201? Especially now that cryptography pervades every aspect of modern life, every creative spark is likewise dampened by the chill of Section 1201.

The act of creation is no longer spontaneous.

Our recent generation of Makers, hackers, and entrepreneurs have developed under the shadow of Section 1201. Like the parable of the frog in the well, their creativity has been confined to a small patch, not realizing how big and blue the sky could be if they could step outside that well. Nascent 1201-free ecosystems outside the US are leading indicators of how far behind the next generation of Americans will be if we keep with the status quo.

Our children deserve better.

The argument here is compelling. 1201 has all sorts of problems, but no one has tested this First Amendment argument before. Unfortunately, our courts have been incredibly (and unfortunately) reluctant to seriously consider constitutional challenges to copyright law. The cases that have made it up through the court system have ended unfortunately badly -- cases like the Eldred case challenging copyright term extension, for example. I hope that this one turns out differently, and it may become a case to watch. Again, the arguments are quite compelling to me, but I'm unfortunately skeptical that the judicial system will agree. I hope I'm wrong.

Filed Under: 1201, anti-circumvention, bunnie huang, dmca, dmca 1201, fair use, first amendment, free speech, hacking, matthew green, research, security research, triennial review
Companies: eff

Flaw Discovered In Apple iMessage Encryption, Reminding Us That Compelled Backdoors Are Idiotic

from the encryption-is-hard dept

One of the points that seems to be widely misunderstood by people who don't spend much time in computer security worlds, is that building secure encryption systems is really hard and almost everything has some sort of vulnerability somewhere. This is why it's a constant struggle by security researchers, cryptographers and security engineers to continually poke holes in encryption, and try to fix up and patch systems. It's also why the demand for backdoors is idiotic, because they probably already exist in some format. But purposely building in certain kinds of backdoors that can't be closed by law almost certainly blasts open much larger holes for those with nefarious intent to get in.

Case in point: over the weekend, computer science professor Matthew Green and some other researchers announced that they'd discovered a serious hole in the encryption used for Apple's iMessage platform, allowing a sophisticated hacker to access encrypted messages and pictures. And, Green, who has been vocal about the ridiculousness of the DOJ's request against Apple, notes how this is yet more evidence that the DOJ's request is a bad idea:

“Even Apple, with all their skills — and they have terrific cryptographers — wasn’t able to quite get this right,” said Green, whose team of graduate students will publish a paper describing the attack as soon as Apple issues a patch. “So it scares me that we’re having this conversation about adding back doors to encryption when we can’t even get basic encryption right.”

It's worth noting that the flaw that he and his team found would not have helped the FBI get what it wants off of Syed Farook's iPhone, but it's still a reminder of just how complex cryptography currently is, at a time when people are trying to keep everyone out. Offer up any potential backdoor, and you're almost certainly blasting major holes throughout the facade.

Apple is getting ready to push out a software update that will fix the flaw shortly. And this, alone, is yet another reason why the DOJ's case is so dangerous -- since the method it wants to use to get into Farook's phone is via its capabilities to push software updates. Patching software holes is a major reason to accept regular software updates, but the FBI is now trying to co-opt that process to install unsafe code. That, in turn, may prompt people to avoid software updates altogether, which in most cases will make them less safe.

Filed Under: complexity, cryptography, doj, encryption, fbi, imessage, matthew green, privacy
Companies: apple

Security Audit Of TrueCrypt Doesn't Find Any Backdoors -- But What Will Happen To TrueCrypt?

from the questions-still-left-to-be-answered dept

Over the past few years we've followed the saga of TrueCrypt. The popular and widely used full disk encryption system got some attention soon after the initial Snowden leaks when people started realizing that no one really knew who was behind TrueCrypt, and that the software had not been fully audited. Cryptographer Matthew Green decided to lead an effort to audit TrueCrypt. A year ago, the team released the first phase, finding a few small vulnerabilities, but no backdoors and nothing too serious. This week the full audit was completed and again finds no evidence of any backdoors planted in the code. Matthew Green's blog post on the report provides the key details, which notes a few small issues that should be fixed, but nothing too serious:

The TL;DR is that based on this audit, Truecrypt appears to be a relatively well-designed piece of crypto software. The NCC audit found no evidence of deliberate backdoors, or any severe design flaws that will make the software insecure in most instances.

That doesn't mean Truecrypt is perfect. The auditors did find a few glitches and some incautious programming -- leading to a couple of issues that could, in the right circumstances, cause Truecrypt to give less assurance than we'd like it to.

For example: the most significant issue in the Truecrypt report is a finding related to the Windows version of Truecrypt's random number generator (RNG), which is responsible for generating the keys that encrypt Truecrypt volumes. This is an important piece of code, since a predictable RNG can spell disaster for the security of everything else in the system.

However, as Green notes, the problem with the way its implemented in TrueCrypt would only be a problem in "extremely" rare circumstances that wouldn't impact most users. But it's still something that could be fixed.

But that's where the problem lies. As you may recall, in the midst of all of this, the still anonymous developers behind TrueCrypt suddenly announced that it wasn't secure and that all development had ceased. There have been some efforts to fork and rescue TrueCrypt, but that's come with some skepticism as people feared what might be hidden in the code (and also some concerns about the TrueCrypt license.

Hopefully this new audit puts at least some of those concerns to rest (though it's always good to be paranoid when building security software) and people do really put an effort developing an updated version of TrueCrypt. For what it's worth, I've seen a bunch of articles claiming the audit shows that TrueCrypt is safe. That's not quite true. It's just saying they didn't find anything -- which should be very re-assuring, but you can never say with 100% certainty that the code is safe. Either way, what's needed now is more development moving forward.

Filed Under: audit, backdoors, encryption, full disk encryption, matthew green, security, truecrypt

NSA's 'Apology' For Backdooring Crypto Standard Really A 'Sorry We Got Caught' Kind Of Apology

from the not-buying-it dept

Update: While the article in question claimed that Dr. Wertheimer was the Director of Research for the NSA, an email from the NSA alerts us that Wertheimer left the NSA before writing the article.

As you may recall, one of the big Snowden revelations was the fact that the NSA "took control" over a key security standard allowing backdoors to be inserted (or, at least, a weakness that made it easy to crack). It didn't take long for people to realize that the standard in question was Dual_EC_DRBG, or the Dual Elliptic Curve Deterministic Random Bit Generator. It also came out that the NSA had given RSA $10 million to push this compromised random bit generator as the default. That said, as we noted, many had already suspected something was up and had refused to use Dual_EC_DRBG. In fact, all the way back in 2007, there was a widespread discussion about the possibility of the NSA putting a backdoor in Dual_EC_DRBG, which is why so few actually trusted it.

Still, to have the details come out in public was a pretty big deal, so it also seemed like a fairly big deal to see that the Director of Research at the NSA, Dr. Michael Wertheimer (also former Assistant Deputy Director and CTO in the Office of the Director of National Intelligence), had apparently written something of an apology in the latest Notices of the American Mathematical Society. In a piece entitled, "The Mathematics Community and the NSA," Wertheimer sort of apologizes, admitting that mistakes were made. After admitting that concerns were raised by Microsoft researchers in 2007, and again with the Snowden documents (though without saying why they were raised the second time), here's Wertheimer's "apology."

With hindsight, NSA should have ceased supporting the Dual_EC_DRBG algorithm immediately after security researchers discovered the potential for a trapdoor. In truth, I can think of no better way to describe our failure to drop support for the Dual_EC_DRBG algorithm as anything other than regrettable. The costs to the Defense Department to deploy a new algorithm were not an adequate reason to sustain our support for a questionable algorithm. Indeed, we support NIST’s April 2014 decision to remove the algorithm. Furthermore, we realize that our advocacy for the Dual_EC_DRBG casts suspicion on the broader body of work NSA has done to promote secure standards. Indeed, some colleagues have extrapolated this single action to allege that NSA has a broader agenda to “undermine Internet encryption.” A fair reading of our track record speaks otherwise. Nevertheless, we understand that NSA must be much more transparent in its standards work and act according to that transparency. That effort can begin with the AMS now.

However, as security researcher/professor Matthew Green quickly shot back, this is a bullshit apology, because he's really only apologizing for not dropping the standard when they got caught red handed back in 2007.

The trouble is that on closer examination, the letter doesn't express regret for the inclusion of Dual EC DRBG in national standards. The transgression Dr. Wertheimer identifies is simply the fact that NSA continued to support the algorithm after major questions were raised. That's bizarre.

Green also takes on Wertheimer's weak attempt to still defend pushing the compromised Dual_EC_DRBG as ridiculous. Here were Wertheimer's arguments for why it was still okay:

• The Dual_EC_DRBG was one of four random number generators in the NIST standard; it is neither required nor the default.
• The NSA-generated elliptic curve points were necessary for accreditation of the Dual_EC_DRBG but only had to be implemented for actual use in certain DoD applications.
• The trapdoor concerns were openly studied by ANSI X9F1, NIST, and by the public in 2007.

But, again, those don't make much sense and actually make Wertheimer's non-apology that much worse. As Green notes, even though there were other random number generators, the now infamous RSA deal did lead some to use it since it was the "default" in a popular software library and because NIST had declared the standard safe, meaning that people trusted it. Green also goes into great detail describing how the second point is also incredibly misleading. It's worth reading his full explanation, but the short version is that despite some people fearing the NSA's plan would have a backdoor, the details and the possible "alternatives" to avoid that were completely hidden away and more or less dropped.

And that final point, well... really? Again, that's basically saying, "Well, people thought we might have put in a backdoor, but couldn't prove it, but there, you guys had your chance to debate it." Nevermind the fact that there actually was a backdoor and it wasn't confirmed until years later. And, as Green notes, many of the concerns were actually raised earlier and swept under the rug. Also, the standard was pushed and adopted by RSA as a default long before some of these concerns were raised as well.

This might all be academic, but keep this in mind: we now know that RSA Security began using the Dual EC DRBG random number generator in BSAFE -- as the default, I remind you -- in 2004. That's three years during which concerns were not openly studied by the public.

To state that the trapdoor concerns were 'openly' studied in 2007 is absolutely true. It's just completely irrelevant.

In other words, this isn't an apology. It's an apology that the NSA got caught (and didn't stop pushing things the first time it got caught), and then a weak defense of why they still went ahead with a compromised offering.

Wertheimer complains that this one instance has resulted in distrust from the mathematics and cryptography community. If so, his weak response isn't going to help very much.

Filed Under: apology, backdoor, cryptography, dual_ec_drbg, elliptic curve, encryption, matthew green, michael wertheimer, nist, nsa, random number generator, standards, surveillance

NSA Has Spurred Renewed Interest In Thorough Security Audits Of Popular 'Secure' Software

from the skepticism-is-a-good-thing dept

In yet another bit of fallout from the NSA surveillance efforts -- and, specifically, the NSA's covert takeover of security standards to insert vulnerabilities -- it appears that there's suddenly much more skepticism towards well-known security offerings. This is a good thing. There have already been some revelations concerning attempts to compromise Tor, and security researcher Matthew Green has now called for a thorough security audit of TrueCrypt, the (very) popular disk encryption tool. Green and some others have kicked off the project on the aptly named website IsTrueCryptAuditedYet.com.

As Green notes, he is not suggesting that TrueCrypt is not secure, or that it's been compromised, but that in this day and age, security software needs to be properly audited -- and, if anything, hopefully the results of such an audit will be either more secure software or more confidence that TrueCrypt really is secure.

Maybe nothing at all. Rest assured if I knew of a specific problem with Truecrypt, this post would have a very different title -- something with exclamation points and curse words and much wry humor. Let me be clear: I am not implying anything like this. Not even a little.

The 'problem' with Truecrypt is the same problem we have with any popular security software in the post-September-5 era: we don't know what to trust anymore. We have hard evidence that the NSA is tampering with encryption software and hardware, and common sense tells us that NSA is probably not alone. Truecrypt, as popular and widely trusted as it is, makes a fantastic target for subversion.

But quite frankly there are other things that worry me about Truecrypt. The biggest one is that nobody knows who wrote it. This skeeves me out. As Dan Kaminsky puts it, 'authorship is a better predictor of quality than openness'. I would feel better if I knew who the TrueCrypt authors were.

Now please don't take this the wrong way: anonymity is not a crime. It's possible the Truecrypt developers are magical security elves who are simply trying to protect their vital essence. More prosaically, perhaps they live in a country where privacy advocates aren't as revered as they are in the US. (I kid.)

Hopefully, the end result of this new found skepticism towards popular security products will lead to a world in which we really are more secure, rather than one in which the NSA just has people thinking they're more secure.

Filed Under: audits, matthew green, nsa, nsa surveillance, security, truecrypt