NSA's Stealing Keys To Mobile Phone Encryption Shows Why Mandatory Backdoors To Encryption Is A Horrible Idea

from the let's-end-this-now dept

Over the last few months, ever since both Apple and Google announced plans to encrypt data on iOS and Android devices by default, there's been a ridiculous amount of hand-wringing from the law enforcement community about requiring backdoors, golden keys and magic fairy dust that will allow law enforcement to decrypt the information on your phone... or children will die, even though they actually won't.

And, of course, yesterday, the Intercept had its big story about how the NSA (with an assist from GCHQ) hacked its way to get access to the encryption keys used on SIM cards on basically all the mobile phones out there, giving those intelligence agencies easy (warrant-free!) access to conversations that most people thought had at least some encryption. These two stories may not seem to be directly connected (we're talking about different kinds of encryption for different things), but in writing about the SIM card story, Julian Sanchez at Cato makes a really good point about why the Gemalto hack underscores why backdoors are a horrendously bad idea: they create a central point of attack to undermine all the security that people rely on.

Finally, this is one more demonstration that proposals to require telecommunications providers and device manufacturers to build law enforcement backdoors in their products are a terrible, terrible idea. As security experts have rightly insisted all along, requiring companies to keep a repository of keys to unlock those backdoors makes the key repository itself a prime target for the most sophisticated attackers—like NSA and GCHQ. It would be both arrogant and foolhardy in the extreme to suppose that only “good” attackers will be successful in these efforts. 

It would be nice to see that the revelation of the NSA undermining one use of encryption led people to realize the stupidity of undermining other forms of encryption, but somehow, it seems likely that our law enforcement community won't quite comprehend that message.

Filed Under: gchq, mandatory backdoors, mobile encryption, nsa, phone sims, repository, surveillance, target
Companies: apple, gemalto, google

US Gov't Appears To Have Misled The Supreme Court About How The NSA Spied On Americans

from the whoa dept

We've written a few times now about the fact that US Solicitor General Donald Verrilli pretty clearly made false statements to the Supreme Court in a key case concerning NSA warrantless wiretapping. The case, Clapper v. Amnesty International, mainly focused on who had standing to challenge warrantless wiretaps performed by the NSA. The government argued that since there was no evidence that Amnesty International was spied on, it had no standing. The false statement involved the claim that the government would have to inform defendants in cases where warrantless wiretaps were used that that's how the info was gathered. Except the government didn't do that.

It turns out that might not have been the only misrepresentation from Verrilli -- and this next one may be even bigger, involving misleading the Supreme Court on a loophole that allowed the NSA to spy on tens of thousands of Americans.

As was noted earlier this year, upon realizing what happened, Verrilli was apparently furious, and the DOJ has now changed its policy to match with what Verrilli said -- they now will notify defendants, but it's clear that they never did so before.

But Senators Mark Udall, Ron Wyden and Martin Heinrich have sent Verrilli a letter urging him to "set the record straight" with the Supreme Court... but not just on that issue of disclosing. Rather they highlight somewhere else they think he did not paint the correct picture:

In Clapper v. Amnesty, the majority opinion characterizes as “highly speculative” the plaintiffs’ fear that “the Government will decide to target the communications of non-U.S. persons with whom they communicate,” and states that the “respondents’ theory necessarily rests on their assertion that the Government will target other individuals – namely their foreign contacts.” These and other statements in the opinion indicate the Court’s view that the only way the plaintiffs’ communications could be intercepted under the FAA is if those communications are to or from a foreign intelligence target.

Yet with the disclosure and declassification in recent months of relevant documents regarding Section 702, the role of ‘about’ collection under the FAA is now public, although not widely understood. In addition to authorizing the collection of communications to and from foreign, overseas targets, the FISA Amendments Act also has been secretly interpreted to authorize the collection of communications that are merely about a targeted overseas foreigner.

This form of collection allows the government – through the “upstream” collection under Section 702 – to collect any communication whose content includes an identifier, such as an email address, associated with an overseas foreigner who may be a foreign intelligence target. But according to the FISA Court’s October 2011 opinion, the ‘about’ collection likely results in the acquisition of “tens of thousands” of wholly domestic communications every year. In other words, tens of thousands of emails between law-abiding Americans are likely being collected – even though these Americans are not actually communicating directly with a foreign intelligence or terrorism target. As FAA collection was intended to target persons “reasonably believed to be located outside the United States,” and targeting procedures were intended to “prevent the intentional acquisition of any communication as to which the sender and all intended recipients are known at the time of acquisition to be located in the United States,” the FISA Court in its October 2011 opinion called this expanded FAA collection a circumvention of the “spirit” of the law and a “cause of concern for the Court.”

Just to hammer this point home, they're saying that despite everyone, including the Supreme Court, clearly reading the law to say that Section 702 of the FAA is supposed to be limited to surveillance on foreign targets, it actually also allows surveillance on communications about foreign targets -- and that likely includes tons of communications of Americans. And these communications were believed not to be available under this program, including by the Supreme Court.

The Senators ask Verrilli if he clearly informed the Supreme Court of this at any point, and if not, suggest that he correct the record.

We believe that a formal notification to the Supreme Court of the government’s misrepresentations in the case — both relating to its notice policy and relating to its practice of ‘about’ collection under Section 702 of the FISA Amendments Act — would be an important step in correcting the public record and would be in the interests of the public as well as of the Administration and the Supreme Court.

This seems rather important -- and a point that not many reporters have covered (which also might explain why the Senators are raising it, and noting that the revelation "is not widely understood.") This is a way of alerting people to the simple fact that the NSA has interpreted Section 702 to mean it can collect any communication deemed to be "about" a target, even if the communication is not from or to that target.

Filed Under: donald verrilli, faa, fisa, fisa amendments act, james clapper, mark udall, martin heinrich, nsa, ron wyden, section 702, solicitor general, supreme court, target
Companies: amnesty international

The NSA's Favorite Weasel Word To Pretend It's Claiming It Doesn't Spy On Americans

from the target-target-target dept

Well, well. In the aftermath of the revelations that the NSA is getting records of every phone call from Verizon, followed up by the news that most of the biggest tech companies are supposedly giving direct access to the NSA, the intelligence community is responding the same way it always does: with weasel words. First up, you can see Director of National Intelligence James Clapper's statement about the spying, which we'll be discussing again in a bit.

But, a bunch of folks have been reasonably pointing out that Clapper appears to have lied to Congress. Of course, it's not like this wasn't easily called. Two years ago, we wrote about Clapper's answers to Senators Wyden and Udall, which we pointed out was a ridiculous answer that was clearly sidestepping the real questions. However, looking over that letter again now, and having become a bit more familiar with the weasel words the NSA likes to use, it's easy to look at Clapper's statement and explain why he can "stand by it" while the clear implication of it was the opposite of what he meant.

You asked whether communications of Americans have been collected… Section 702 of the FAA [FISA Amendments Act] explicitly prohibits the intentional targeting of persons reasonably believed to be located in the United States or United States persons located abroad. The Intelligence Community has put in place a variety of procedures, which have been approved by the FISA Court as required by law, to ensure that only persons reasonably believed to be located outside the United States are targeted and to prevent the intentional acquisition of any communications as to which the sender and all intended recipients are known to be located in the United States. Guidelines are also required by law to ensure compliance with other limitations on FAA collection, including the requirement that a U.S. person may not be intentionally targeted under section 702. If it is discovered that a target has entered the U.S. or is a U.S. person, he or she is promptly detargeted and reports are made as appropriate to the Department of Justice (DOJ), the Office of the Director of National Intelligence (ODNI) and the FISA Court. Moreover, when communications from persons located in the United States are collected because they are communicating with a lawful target, the privacy and civil liberty rights of U.S. persons are protected through the careful implementation of the procedures required under the FAA to ’minimize the acquisition and retention, and prohibit the dissemination“ of information about U.S. persons.’”

Most people would read this to be him saying that they do not spy on Americans. And that's obviously what he's trying to imply. But that's not what he's actually saying. He's using the NSA's favorite weasel word: "target." Now, most people assume that means one of the people on the call must be outside the US. But, you could -- if you were devious intelligence official trying to mislead Congress and the American public (hypothetically) -- interpret the word "target" to mean "if we, in general are 'targeting' foreign threats, no matter what they might be like, and this information we're collecting might help in that process, then we can snarf up this data."

In other words, most people think that "target" would mean one of the people on the phone. But, the NSA means "this overall investigation is about targeting foreign threats, so we can take whatever data we want because the goal is to stop foreign threats with it -- and therefore our mandate not to spy on Americans doesn't apply."

So, it shouldn't be particularly surprising to see that the administration's "response" to this is to highlight, yet again, that this only "targets" non-US persons:

Information collected through a U.S. government surveillance program that taps into the servers of internet companies targets only non-U.S. persons living outside the United States, a senior administration official said on Thursday.

The U.S. law that allows the collection of data under this program does not allow the targeting of any U.S. citizen or of any person located in the United States, the official said, speaking on condition of anonymity.

Right, but whether or not they're "targeting" a person, is separate from whether or not they're spying on the data of Americans. As long as it's all part of a process that "targets" non-US persons, they can claim that they're playing by the rules.

Given that, however, I don't see how Clapper can reasonably standby the following statements:

Wyden: Does the NSA collect any type of data at all on millions or hundreds of millions of Americans?

Clapper: No sir.

Wyden: It does not?

Clapper: Not wittingly. There are cases where they could, inadvertently perhaps, collect—but not wittingly.

Clapper is insisting that he didn't lie in his comments, but he then pretends that he was only talking about email:

What I said was, the NSA does not voyeuristically pore through U.S. citizens' e-mails. I stand by that.

Except, that's not what he was asked, nor was it what he said. He was specifically asked if the NSA collects any type of data at all, and he said no. Up above, he was using weasel words, but here it looks like he was flat out lying directly to Congress. Usually, Congress doesn't like that.

Filed Under: james clapper, nsa, spying, surveillance, target, weasel words