FBI Director Claims That The World's Most Knowledgeable Cybersecurity Experts Are Not 'Fair Minded' About Encryption Backdoors

from the oh-really? dept

Earlier this week, we noted that a huge list of companies, non-profits and cybersecurity experts had signed a letter to the White House about the stupidity and danger of trying to order backdoors into encryption (disclaimer: we signed the letter as well). While many in the press focused on the companies that had signed onto the letter (including Google, Apple, Cisco, Microsoft, Twitter and Facebook), as we noted, what was much more interesting was the long list of cybersecurity/encryption experts who signed onto the letter. Just in case you don't feel like searching it out, I'll post the entire list of those experts after this post.

It's a who's who of the brightest minds in encryption and cryptography. Whitfield Diffie invented public key cryptography. Phil Zimmermann created PGP. Ron Rivest is the "R" in "RSA." Peter Neumann has been working on these issues for decades before I was even born. And many more on the list are just as impressive.

So how do you think FBI director James Comey -- who has been leading the charge on backdooring encryption -- responded to these experts?

By calling them uninformed.

I wish I was joking.

A group of tech companies and some prominent folks wrote a letter to the President yesterday that I frankly found depressing. Because their letter contains no acknowledgment that there are societal costs to universal encryption. Look, I recognize the challenges facing our tech companies. Competitive challenges, regulatory challenges overseas, all kinds of challenges. I recognize the benefits of encryption, but I think fair-minded people also have to recognize the costs associated with that. And I read this letter and I think, “Either these folks don’t see what I see or they’re not fair-minded.” And either one of those things is depressing to me. So I’ve just got to continue to have the conversation.

First of all, it's kind of hilarious for the FBI director to be arguing that the people who signed that letter haven't done a cost-benefit analysis, since we've noted that the intelligence and law enforcement communities almost never do such an analysis. They always insist "more surveillance" must be better, without considering the costs involved.

And then there's this, showing that Comey still doesn't understand the letter at all:

We’ve got to have a conversation long before the logic of strong encryption takes us to that place. And smart people, reasonable people will disagree mightily. Technical people will say it’s too hard. My reaction to that is: Really? Too hard? Too hard for the people we have in this country to figure something out? I’m not that pessimistic. I think we ought to have a conversation.

Hey, Comey! No one is saying it's "too hard." They're saying it's IMPOSSIBLE to do this without weakening everyone's security. Impossible. It's not a "hard" problem, it's an impossible problem. Because if you weaken security to let the FBI in, by definition you are weakening the security to let others in as well. That's the point that was being made.

And this is important. For all of the ridiculous claims by Comey and others that we need to "have a conversation" on this, we do not. A conversation is counterproductive. All of these people can and should be working on systems to make us all more safe and secure. But if they have to keep explaining to ignorant folks like Comey why this is a bad idea, then they are taken away from making us safer. You can have a discussion over things that are hard. But there is no point in having a discussion over things that are impossible.

Filed Under: backdoors, cybersecurity, encryption, fbi, james comey, phil zimmermann, ron rivest, security, whitfield diffie

Pretty Much Anyone With Any Understanding Of Crypto Tells President Obama That Backdooring Crypto Is Monumentally Stupid

from the basic-understanding dept

Nearly 150 tech companies (including us via the Copia Institute), non-profits and computer security experts have all teamed up to send a letter to President Obama telling him to stop these stupid ideas about backdooring encryption that keeping coming out of his administration. The press headlines will note that big companies -- like Google, Apple, Cisco, Microsoft, Twitter and Facebook -- are signing the letter. But significantly more interesting is the signatures from a huge list of computer security experts, all putting their names down on paper to make it clear what a ridiculously bad idea it is to even think about backdooring encryption. Among those signing on are Phil Zimmermann (who lived through this sort of thing before), Whitfield Diffie (guy who invented public key cryptography), Brian Behlendorf, Ron Rivest, Peter Neumann, Gene Spafford, Bruce Schneier, Matt Blaze, Richard Clarke (long-time counterterrorism guy in the White House), Hal Abelson and many, many more. Basically a who's who of people who actually know what they're talking about.

We urge you to reject any proposal that U.S. companies deliberately weaken the security of their products. We request that the White House instead focus on developing policies that will promote rather than undermine the wide adoption of strong encryption technology. Such policies will in turn help to promote and protect cybersecurity, economic growth, and human rights, both here and abroad.

Strong encryption is the cornerstone of the modern information economy’s security. Encryption protects billions of people every day against countless threats—be they street criminals trying to steal our phones and laptops, computer criminals trying to defraud us, corporate spies trying to obtain our companies’ most valuable trade secrets, repressive governments trying to stifle dissent, or foreign intelligence agencies trying to compromise our and our allies’ most sensitive national security secrets.

Encryption thereby protects us from innumerable criminal and national security threats. This protection would be undermined by the mandatory insertion of any new vulnerabilities into encrypted devices and services. Whether you call them “front doors” or “back doors”, introducing intentional vulnerabilities into secure products for the government’s use will make those products less secure against other attackers. Every computer security expert that has spoken publicly on this issue agrees on this point, including the government’s own experts.

There's much more in the full letter which I highly recommend reading. It very nicely summarizes why this is a completely insane idea, and highlights why anyone raising it should be immediately told to move on to some other project instead:

The Administration faces a critical choice: will it adopt policies that foster a global digital ecosystem that is more secure, or less? That choice may well define the future of the Internet in the 21st century. When faced with a similar choice at the end of the last century, during the so-called “Crypto Wars”, U.S. policymakers weighed many of the same concerns and arguments that have been raised in the current debate, and correctly concluded that the serious costs of undermining encryption technology outweighed the purported benefits. So too did the President’s Review Group on Intelligence and Communications Technologies, who unanimously recommended in their December 2013 report that the US Government should “(1) fully support and not undermine efforts to create encryption standards; (2) not in any way subvert, undermine, weaken, or make vulnerable generally available commercial software; and (3) increase the use of encryption and urge US companies to do so, in order to better protect data in transit, at rest, in the cloud, and in other storage.”

The Washington Post quotes another surprising signatory: Paul Rosenzweig, the former Deputy Assistant Secretary for Policy at Homeland Security. If that name sounds familiar, it's because we've quoted his defense of the NSA, once arguing that "too much transparency defeats the very purpose of democracy." If even he is arguing against backdooring encryption, you know it's an idea that should be killed off. In his case, it's because he recognizes the simple reality that seems to have eluded the FBI director:

The signatories include policy experts who normally side with national-security hawks. Paul Rosenzweig, a former Bush administration senior policy official at the Department of Homeland Security, said: “If I actually thought there was a way to build a U.S.-government-only backdoor, then I might be persuaded. But that’s just not reality.”

That's just not reality. And neither should be any policy effort that involves pushing for more backdoors in encryption. It's bad economic policy. It's bad security policy. It's bad crypto policy. It's bad privacy policy. It's just bad policy all around.

And the world would be much better off if all of these security experts and companies could focus on better protecting us from harm, rather than having to join in ridiculous debates about what a bunch of clueless bureaucrats think might be some sort of mythical magic unicorn encryption breaker.

Filed Under: 4th amendment, backdoors, bruce schneier, crypto, encryption, paul rosenzweig, phil zimmermann, privacy, richard clarke, ron rivest, security, vulnerabilitities, whitfield diffie
Companies: apple, cisco, facebook, google, microsoft, twitter

Insanity Rules In East Texas: Jury Finds Newegg Infringes On Ridiculous Encryption Patent

from the why-trolls-love-east-texas dept

There's a reason why patent trolls love east Texas -- and big part of that is that the juries there have a long history of favoring patent holders, no matter how ridiculous or how trollish. That was on display last night, when the jury in Marshall, Texas sided with patent troll Erich Spangenberg and his TQP shell company over Newegg. As we've been describing, Newegg brought out the big guns to prove pretty damn thoroughly that this guy Mike Jones and his encryption patent were both not new at the time the patent was granted and, more importantly, totally unrelated to the encryption that Newegg and other ecommerce providers rely on. Having Whit Diffie (who invented public key cryptography) and Ron Rivest (who basically made it practical in real life) present on your behalf, showing that they did everything prior to Jones' patent, while further showing that what Newegg was doing relied on their work, not Jones', should have ended the case.

But, apparently TQP's lawyers' technique of attacking Diffie's credibility somehow worked. The jury said both that the patent was valid and that Newegg infringed -- and they awarded TQP $2.3 million -- a little less than half of what TQP wanted, but still a lot more than TQP settled with many other companies (including those with much bigger ecommerce operations than Newegg). In other words, yet another travesty of justice from a jury in east Texas. Newegg will appeal, as it did in its last big patent troll lawsuit (which was much bigger), against Soverain Software. Again, Newegg had lost in East Texas, but prevailed big time on appeal. Hopefully history repeats itself.

Joe Mullin's coverage (linked above) has a bunch of little tidbits about how everyone responded to the verdict, but I think Diffie's response is the most honest. Asked how he was feeling:

"Distressed," he said. "I was hoping to be rid of this business."

Yeah, he's not the only one. The sheer ridiculousness of a jury simply not believing the very people who created the very building blocks of modern encryption, and instead buying the story of someone who did nothing special either with the concept behind his patent or with that patent once it existed, is just distressing. It shows how arbitrary jury trials can be, especially when you have jurors who simply don't understand the technology or the history at play. Blech. I think I may have to go buy an anti-patent troll t-shirt from Newegg.

Filed Under: cryptography, east texas, erich spangenberg, marshall texas, patents, whitfield diffie
Companies: ip nav, newegg, tqp

Newegg Brings Out Whit Diffie, Ron Rivest & Ray Ozzie To Debunk Patent Troll's Claim; Troll Attacks Diffie's Credibility

from the cue-laughter-now dept

Last week, we mentioned Newegg, a company that has publicly declared it won't settle with patent trolls, fighting in court against the world's most litigious patent troll, Erich Spangenberg. If you'd bet that's a recipe for some courtroom drama, it appears you would have won that bet. Joe Mullin continues his excellent reporting from East Texas, and talks about Newegg breaking out some heavyweights in support of its argument that some guy named Mike Jones didn't actually invent the cryptography that made e-commerce possible. Among those appearing on behalf of Newegg were three names that I hope all of you already recognize: Whitfield Diffie, Ron Rivest and Ray Ozzie. If not, look them up, but suffice it to say Newegg has credibility on their side.

They also had Alan Eldredge, a guy who worked on the original Lotus Notes to talk about how they implemented everything in Jones' patent (using Ron Rivest's RC4) before Jones filed for it. The interesting tidbit there is that Eldredge wasn't your typical expert witness hired by one of the parties in the case:

Eldridge wasn't paid, as expert witnesses were—he came down to testify against the Jones patent out of a feeling of "civic responsibility," he said. He didn't know who the defendants in this case were until he was told. "I hadn't even heard of New Age until Saturday," said Eldridge at one point, as laughs were stifled in the courtroom.

From the sound of it, Diffie oozed credibility on the stand, as he should, and Mullin believed the jury was eating it up (for more details on the specifics of the testimony, read Mullin's full article linked above):

Diffie's testimony went on some time, but he seemed to have the jury in the palm of his hand. A few jurors laughed at his jokes and smiled, and the more serious ones were certainly focused on his testimony. After about two hours, Albright passed the witness.

Spangenberg's lawyer, Marc Fenster, apparently decided the way to respond to this incredibly credible witness (the dude invented public key cryptography!) was to... attack his credibility. First, he attacked his credentials. Diffie never completed a master's degree, nor has he held a full time academic position -- which, of course, doesn't even remotely matter for anything, but Fenster tried to use it to make him seem like a charlatan, leading up to a claim that Diffie didn't actually invent public key cryptography. But, of course, that's not actually true. This story is well known in cryptography circles and you can find variations of it online. The UK's equivalent of the NSA, GCHQ, more or less figured out much of the same thing, but kept the whole thing secret. Fenster referred to James Ellis of GCHQ, who had conceived a similar idea, but wasn't able to do the math. The math was done later at a time much closer to Diffie's efforts (the exact timing here is somewhat in dispute). However, as many people have pointed out, none of that much matters, because the folks at GCHQ did absolutely nothing with this, and from all accounts, they didn't even think it was anything important or special.

And, more importantly, none of that actually takes away from the stuff that matters here: all the important work happened long before Mike Jones got his patent, and Spangenberg's company TQP's claim that Jones' work enabled e-commerce still looks like complete bunk. Even if GCHQ had figured out public key cryptography before Diffie, it doesn't change the fact that his version is the one that made it well known, RSA's implementation made it work, and that's actually what made secure e-commerce possible, not anything from TQP's patent.

It appears that Newegg is so confident that it's going to win the case completely that it didn't even bother having its final witness take the stand. That witness was going to challenge the $5.1 million damages claim from Spangenberg. But that only comes into play if the jury finds for TQP. While it may be a bit risky, Newegg seems to be betting big that damages aren't even going to be in play here at all.

Filed Under: encryption, erich spangenberg, patents, ray ozzie, ron rivest, whitfield diffie
Companies: newegg, tqp

Newegg Battles World's Most Litigious Patent Troll Over Bogus Claims Of 'Inventing' E-Commerce Encryption

from the good-luck,-newegg dept

Joe Mullin is down in an East Texas court room, covering all the details of a key patent lawsuit, pitting the world's most litigious patent troll, Erich Spangenberg, against well-known electronics retailer, Newegg, a company that has vowed never to settle with patent trolls -- a strategy that has been quite successful so far. Spangenberg is infamous for his "sue first, license later" approach to patent trolling, but the details revealed during the lawsuit show how profitable it is. Spangenberg has sued a ton of companies over this very patent -- with nearly all of them settling for much less than it would cost to fight a patent suit in court (fighting is estimated to cost upwards of $1 to $2 million). Nearly all the settlements are for much less:

Target had a website; Target got sued by TQP. It got out of the case by paying $40,000.

Some paid less than that—but most paid more.

Dodge & Cox, a mutual fund, paid a bit more than $25,000. Pentagon Credit Union paid $65,000. QVC paid $75,000. MLB Advanced Media paid $85,000. PetSmart paid $150,000. PMC paid $400,000. Cigna paid $425,000. Bank of America paid $450,000. First National paid $450,000. Visa paid $500,000. Amazon, Newegg's much larger competitor, paid $500,000. UPS paid $525,000.

IBM paid $750,000. Allianz Insurance paid $950,000. Microsoft paid $1,000,000.

All in all, Spangenberg has squeezed $45.37 million out of licenses for this one patent, which almost certainly does not actually cover the encryption used in online shopping, as Spangenberg claims. Oh yeah: Spangenberg's deal with the original inventor of the patent? The inventor gets 2.5% of the money, plus $350/hour for consulting. End result? He's made $588,000, while Spangenberg keeps the rest -- all on a patent he bought for about $750,000.

And, yes, the patent (which has since expired) is highly questionable in the first place. While Spangenberg's lawyers (representing his shell company called TQP) tried to claim that the inventor, Michael Jones, was some sort of visionary genius who predicted the world of e-commerce, there's no actual evidence to support this. Newegg (thankfully) has famed cryptography expert Whitfield Diffie on hand to call bullshit on the claims that Jones (a) invented anything special or (b) that his invention is even remotely in use on e-commerce sites today. Diffie, of course, is one of the inventors of public key cryptography, which happened prior to Jones' invention, and is what is actually used online.

Jurors got a short dose of the conventional historical record when Newegg lawyer Kent Baldauf gave them a preview of Diffie's testimony. "It's Dr. Diffie's invention that allows credit cards to be encrypted today," explained Kent Baldauf. "He's the one that figured out how you could send information to some remote server that you've never had any contact with before without these keys somehow being pre-set and pre-arranged in a closed system."

Baldauf also raised the basic themes of Newegg's defenses. The patent described symmetric cryptography—two hard-coded modems talking to each other. It wasn't that different in theory than the code books that have been exchanged since ancient times. It had nothing to do with public key cryptography that kept Internet data safe; Newegg therefore does not infringe, he argued.

To boot, to the extent Jones is an inventor at all, he isn't the first. The RC4 cipher was designed two years before Jones' patent filing and was combined with Lotus Notes by Ron Rivest of RSA Security.

Of course, with a patent jury trial in East Texas, you never now how things are going to turn out. But, this case is at least interesting in helping to open the books on how patent trolling works -- getting tons of companies to pay up on questionable patents by offering "settlement" rates below what a lawsuit would cost, even if the patent is totally bogus. And, kudos, once again, to Newegg for fighting this. It could have easily settled like all those other companies, but is fighting this one out on principle -- and in the hope that it will stop the next patent troll from doing the shakedown game.

Filed Under: e-commerce, encryption, erich spangenberg, michael jones, patents, whitfield diffie
Companies: newegg, tqp