23 ms·

Obama administration quietly explored ways to bypass smartphone encryption

194 points by apawloski 11y ago

tempodox 11y ago
Nixon was a babe in the woods compared to Obama.
- tertius 11y ago
  You mean the Nixon Administration...
- tsotha 11y ago
  Yes and no. Nixon did a lot of things Obama wouldn't get away with. But the technology for the sort of dragnet snooping government agencies can do today wasn't available.
alyandon 11y ago
Cry me a river. The widespread adoption of encryption wouldn't have been such a pressing issue if spy agencies like the NSA hadn't been abusing their powers by conducting mass surveillance on law abiding citizens.
- irishcoffee 11y ago
  You do realize that all government agencies, especially those under the DoD, serve at the pleasure of the POTUS, right? Obama has had close to two full terms to tell NSA what he wants done and how he wants it done. He could shut the whole joint down tomorrow. He has not. He is very aware of exactly how NSA operates, and he has not changed a damn thing. Blame NSA, or whoever, all you want. They serve at the pleasure of their customer.
  - alyandon 11y ago
    This type of wholesale spying on law abiding citizens goes back 15+ years. I blame Obama, Bush, Congress, et al for not showing a backbone and ending these programs. Edit: I'm in an exceedingly grumpy mood today. :-/
    - late2part 11y ago
      Grumpy moods seem to be going around :-) I want to revisit the earlier point in your context. You say that it goes back 15 years. You are right. Each of these parties is jointly and severally liable for it. Obama is currently liable. I think it's just and right to criticize him for failure to act. His lack of fortitude is not excused by the lack of fortitude of others.
    - cheald 11y ago
      15? It's arguable that the government's institutional abuse of power to spy on law-abiding citizens began in earnest with J. Edgar Hoover, who began his tenure as the head of the FBI in 1924.
  - Retric 11y ago
    The president can't arbitrarily shut things down or have much direct control. Congress both controls the purse strings and requires money to be spent. At best, POTUS can generally enforce the law, but NSA actually has authority to do mass surveillance from Bush era laws. That said, Obama is clearly in favor of surveillance.
    - mattmanser 11y ago
      You do have to wonder what exaggerated lies they're told to believe that such surveillance is even necessary. I say lies, because if there were any real threats so many more terrorist attacks would happen than actually do. The other theory I've seen is that people in power are used to having their life scrutinized publicly, so personally don't really care about privacy, so are the worst people to making decisions about such things.
      - Retric 11y ago
        I think it's more of an incentive problem, after a disaster like say Hurricane Katrina it's really hard to stand up and publicly say everything is working just fine. Ideally, you want to be able to say well "where it not for the other guy we would have implemented my solution!" Which creates huge pressure based on how bad things look vs. how they actually are.
    - rhino369 11y ago
      The President can't change the laws or the budget. But an order like: "stop warrentless spying," is exactly the sort of order the President can give. Just like he ordered the military to let homosexuals join. Unless the Bush era laws says the NSA MUST spy (and they don't), he is pretty much clear to order them not to spy.
      - deleted 11y ago
        [deleted]
  - feld 11y ago
    Why do you people keep repeating these blatant lies? The POTUS does not have direct power to do these kinds of things. It's the whole lot of politicians that are ignorant and corrupt.
    - fein 11y ago
      This has been an odd dynamic through my entire lifetime. The president has never been the one pulling the strings, and I'm not sure why everyone blindly blames the person in that position. There are people whose names the general public has never seen that have a great amount of influence in our legislative process.
      - danso 11y ago
        I dunno, the whole concept of a "commander-in-chief" -- Chief Executive of a country, "The Buck Stops Here" -- is an odd dynamic. While we have the 3 branches of government, one of them is physically and institutionally commandeered by one human being, subject to the limitations and weaknesses shared by the 300 million human beings he oversees. The checks and balances system is nice, preventing a situation in which a depressed or cranky president launches a war "just because"...But there are a lot of other less direct ways that his personal state of being could drastically affect the entire country. What if the senator who is a leading advocate for surveillance reform personally insulted the president's family? Sure, the senator's a jerk, and the president would never admit to basing his decision to ignore the senator on such a personal slight. But if such personal hostility resulted in the president putting the senator much lower on his priority list...such that he never gets around to giving the issue the proper amount of attention...The impact on the country is virtually the same as if the president's reaction had been, "Fk that d-bag and everything he stands for" This is just a long way of saying, yeah, kind of crazy how so much of what affects us as a society is in the hands of one human being, and it's unfair to blame him for not being able to control everything. And yet, he is the one who signed up to have those powers...criticizing him is not just a reflexive tendency to scapegoat, but the current "user-friendly interface" we have with our bureaucracy.
      - 1024core 11y ago
        When Bush was in charge, everyone was quick to blame him. But now that Obama is in charge, suddenly it is "president has never been the one pulling strings .. why is everyone blaming him?"
  - dragonwriter 11y ago
    > You do realize that all government agencies, especially those under the DoD, serve at the pleasure of the POTUS, right? This is false. Government agencies largely are creations of statute law, and their existence is governed by Congress. The heads of agencies (and top-ranking subordinate officers to a certain level) often serve at the pleasure of the President, but the agencies themselves do not exist at his pleasure. In most cases where the agencies that are not created by statute are subordinate to those that are, those subordinate agencies still do not exist at the discretion of the President, they exist under the statutory authority of some officer of the statutorily-created agency to which they report. (That officer may serve at the pleasure of the President, so the President could fire them for not acting as he wishes with respect to the subordinate agency, but the agency itself does not exist at the discretion of the President.) There are exceptions -- subordinate organizations not created by statute within the Executive Office of the President, for instance -- but generally federal government agencies do not exist at the discretion of the President. Heck, even doing this through a back-door approach by refusing to spend Congressionally-appropriated funds in order to kill a program has been ruled unconstitutional; Train v. City of New York, 420 U.S. 35 (1975).
    - abecedarius 11y ago
      There are exceptions -- subordinate organizations not created by statute within the Executive Office of the President, for instance I don't know what the legal status is now, but the NSA's origin sounds kind of like that: https://en.wikipedia.org/wiki/National_Security_Agency#World_War_II_and_its_aftermath https://en.wikipedia.org/wiki/National_Security_Agency#World... "The agency was formally established by Truman in a memorandum of October 24, 1952, that revised National Security Council Intelligence Directive (NSCID) 9.[28] Since President Truman's memo was a classified document,[28] the existence of the NSA was not known to the public at that time." Here is that memo, according to the NSA: https://www.nsa.gov/public_info/_files/truman/truman_memo.pdf https://www.nsa.gov/public_info/_files/truman/truman_memo.pd... It seems odd to me in talking about the "Director of the NSA" instead of the agency itself, but what do I know.
      - dragonwriter 11y ago
  - knowaveragejoe 11y ago
    Setting aside the fact that the POTUS can't actually do that, when you think about the fact that information is what makes governing possible in the first place, it makes complete sense that they would explore this sort of thing. Given an vague(and ultimately impossible) mission of "stopping all terrorist attacks", it makes sense that the NSA would be exploring what they have been, and that TPTB would be wholly supportive of it.
  - jellicle 11y ago
    It's probably not correct that Obama could close down the entire NSA tomorrow. However, he has essentially complete control over what it does. If he wanted to direct it to do, for example, only military intelligence activities directed solely at warfighting intelligence, he could. This Executive Order: http://www.archives.gov/federal-register/codification/executive-order/12333.html http://www.archives.gov/federal-register/codification/execut... can be changed at any time and to whatever the President desires it to be. He could change it this afternoon if he liked.
  - tootie 11y ago
    State and local police and prosecutors don't work for the federal government at all. Any avenue for mass surveillance is also an avenue for legitimate law enforcement investigation.
- gress 11y ago
  Yes it would. Cybercriminals are even more of a threat than spy agencies to most individuals. [edit: in case it is unclear, I am saying that cybercrime is as strong reason for individuals to use ubiquitous encryption as government snooping not that it is a justification for government snooping]
  - late2part 11y ago
    Really? You think cybercriminals do more damage than unbridled governments?
    - jayess 11y ago
      Yes. Cyber criminals put people in internment camps for thought crimes all the time.
      - GFK_of_xmaspast 11y ago
        Bitlocker is not an 'internment camp.'
    - dogma1138 11y ago
      Direct perceivable damage? Is there even a question? Did the NSA over stepped it's bounds sure, but did anyone actually got directly hurt? Well not really. The NSA is only as "bad" as the rest of the government, it's not a rogue agency that whisks people in the middle of the night to re-education camps, if the US ever becomes such state then encryption isn't going to help you. This isn't an argument against encryption, or in favor of the NSA violating the privacy of US citizens (I am not a US citizen and I do not expect the NSA to care for my privacy) it's just an argument that people should put things in perspective. East Germany didn't became a police state because of the Stasi, they've created the Stasi to enforce it. The US wasn't turned into a police state because of McCarthy-nism, it wouldn't turn into one because of the NSA even if they continue to violate the rights of US citizens unless there will be a major major political shift across all branches of the US government and it's population.
imgabe 11y ago
They looked into whether it could be done and then decided that doing it was not worth the controversy it would generate. This seems like a good thing, I'm not sure why WaPo went with such a sinister sounding headline. More accurate would be "Obama administration rejects several proposals to bypass smartphone encryption".
- tertius 11y ago
  After sending an RFP. I think that's the point.
  - imgabe 11y ago
    As I read it, it was to access encrypted information on a suspect after a warrant or court order has been issued. If you have something in a locked room and the police have a warrant to search it, they can cut the lock off and search it, that's perfectly legal. The trick with encryption is to find a way to do that without rendering every other lock in existence worthless, and I think that's what they're looking for.
    - JoeAltmaier 11y ago
      Maybe some three-key encryption, with the third key escrowed for judicial purposes.
      - jonlucc 11y ago
        The escrow there would make me very nervous, as it becomes a very juicy target.
        noir_lord 11y ago
        Give it to the Office of Personnel Management, they are charged with holding some of the most sensitive information the US Government has.
      - JupiterMoon 11y ago
venomsnake 11y ago
> The first potential solution called for providers to add a physical, encrypted port to their devices. Companies would maintain a separate set of keys to unlock devices, using that port only if law enforcement had physical access to a device and obtained a court order to compel the company’s assistance. Soldering gun and that port is a toast. > The second approach would exploit companies’ automatic software updates. Under a court order, the company could insert spyware onto targeted customers’ phones or tablets — essentially hacking the device. However, the memo warned, this could “call into question the trustworthiness of established software update channels” and might lead some users to opt out of updates, which would eventually leave their devices less secure. It could be done even today. And I would not be surprised if we haven't already some FISA mandated app updates. > A third idea described splitting up encryption keys, a possibility floated by National Security Agency director Michael S. Rogers earlier this year. That would require companies to create a way to unlock encrypted content, but divide the key into several pieces — to be combined only under court order. Exactly how this would work remains unclear, but the memo warned that such a system would be “complex to implement and maintain.” So straight backdoor. While workable for apple, not really suitable for android. And we have the golden key as the mother lode of all cyber criminal activity in the world. > Under the final approach, which officials called a “forced backup,” companies under court order would be required to upload data stored on an encrypted device to an unencrypted location. Adava Decrypta or any other magical spell? If companies hold any way to decrypt the content, then it is not encrypted. if they don't, what is expected from them is magic.
- calgoo 11y ago
  "Soldering gun and that port is a toast." Even better, make it so that if that port is used, it fries the internal memory :)
mtgx 11y ago
"Guys, relax - we don't want golden keys! We only want malicious software updates, physical backdoors, forced backups and...umm split-golden keys."
jlgaddis 11y ago
The sentence > “[T]hese challenges mean that inaccessible encryption will always be available to malicious actors" can be easily replaced with > “[T]hese challenges mean that inaccessible encryption will always be available to everyone” and still retain the same meaning.
- Lawtonfogle 11y ago
  To a corrupt government, there is no significant difference between those two anyways.
uniformlyrandom 11y ago
> ... splitting up encryption keys, a possibility floated by National Security Agency director Michael S. Rogers earlier this year. That would require companies to create a way to unlock encrypted content, but divide the key into several pieces — to be combined only under court order. Exactly how this would work remains unclear, but the memo warned that such a system would be “complex to implement and maintain.” Actually, this is called a 'lawful escrow', and it is implemented in many enterprise PKI systems specifically to comply with court orders. So I guess they decided to throw in one sane option, to offset three other fairly insane ones.
uniformlyrandom 11y ago
> ... splitting up encryption keys, a possibility floated by National Security Agency director Michael S. Rogers earlier this year. That would require companies to create a way to unlock encrypted content, but divide the key into several pieces — to be combined only under court order. Exactly how this would work remains unclear, but the memo warned that such a system would be “complex to implement and maintain.” Actually, this is called a 'lawful escrow', and it is implemented in many enterprise PKI systems specifically to comply with court orders. So I guess they decided to throw in one sane option, to offset three other fairly insane ones.
codyb 11y ago
It is amazing what a corner encryption has pinned law enforcement into (after the USG of course pinned everyone into a corner by spying on what amounts to nearly the entire globes communications). There are no workable solutions which allow the government to serve a warrant and receive information without compromising the systems of millions of other subscribers to the same networks in some fashion (or reducing faith and trust in those networks). And the physical port, while an interesting concept, would essentially mean if LEOs jumped the gun by a few days, there warrant would be a bust because there'd be no information of use on the phone and the person obviously wouldn't use that physical device again. I've never had an issue with warranted communication retrieval. I certainly have an issue with the bulk collection of data on hundreds of millions of Americans at all times (as we all should, this is the sort of stuff you can blackmail politicians with, and when you can blackmail politicians you can control the future of the country, so it's something we need to prevent to maintain the integrity of our democracy). What tradeoffs should be made? Where should the lines in the sand be drawn? And what solutions exist or can be imagined which allow LEOs acting on good faith and reasonable suspicion to monitor the activities of those worthy of monitoring without compromising the very nature of our nations foundation?
- pdkl95 11y ago
  > There are no workable solutions What utter nonsense. Law enforcement absolutely has a solution: they use the traditional methods of investigation that have always worked. Wiretapping is a somewhat recent development, historically speaking, and it obviously isn't the only method of investigation. The only reason you see law enforcement getting annoyed at encryption is that they really liked how easy wiretapping (and the modern equivalents) made their job, and the power it gave them in the form of "parallel construction". > What tradeoffs should be made? A big problem with the rhetoric about rights and security having an inversely proportional relationship is the assumption that by giving up rights would actually result in better security. This is at best unproven, and often results in a loss of security.
  - ecdavis 11y ago
    Playing devil's advocate here, but instantaneous long-distance communication is also a very recent development, historically speaking. Traditional investigation methods relied on tracking people's movements, who they associated with and so forth. Digital communication has almost completely removed the requirement for non-digital criminal relationships. As we saw with the DPR hired-killer case, two people can collaborate to perform a crime with zero non-digital connections. How do you use traditional methods in a world where criminals can just go about their daily lives, pausing occasionally to send a message to someone who could be a co-conspirator or could just be their mother? I don't think subverting encryption is necessarily the answer, but to say that law enforcement just wants to do things the easy way is to ignore the emergence of a very real problem that they face.
phkahler 11y ago
I've said this before. They can already get a warrant and visit a suspect. Make them unlock their phone or go to jail for obstruction or some such (legal question, how compulsory can this get?). The problem is that they want to snoop in secrecy without tipping off a suspect. It's undesirable when going after networks of people, but going in the front door seems completely feasible today.
- JupiterMoon 11y ago
  Failure to provide decryption keys is I think not currently covered by the 5th in USA. In the UK the punishment for failure to decrypt a device when the police ask is pretty much the punishment for whatever they accuse one of having on the device...
  - aianus 11y ago
    > failure to decrypt a device What if you don't have the key? Do they need to prove that you're able and refusing to decrypt the device or are you presumed guilty until you prove you can't? What about one-time pads where you could make up whatever key you wanted and it would be valid?
    - JupiterMoon 11y ago
      I think (and I am not lawyer and not your lawyer) that the onus is on you to prove that you don't have the encryption key (anymore) or have access to it. I don't know what case law exists on this.
    - yarrel 11y ago
      I believe people were emailing encrypted messages to the minister who proposed this and destroying the keys to demonstrate the problem with this. However on the whole it is the same as being asked to open a safe. If you don't remember the combination...
  - JupiterMoon 11y ago
    To the downvoters. I don't like these things either -- but just downvoting them on HN won't change things.... Vote in your national elections with civil liberties in mind instead.
devit 11y ago
Why do they need that? All they need is for a policeman to physically seize a device while it is unlocked. Or even while it is locked with encryption keys stored in memory, and some custom tech to read the RAM from a running device. I'd wager that people with sufficient physical security to prevent this are very rare, and it works against any sort of device that doesn't have a dead man's switch.
- da_chicken 11y ago
  > Or even while it is locked with encryption keys stored in memory, and some custom tech to read the RAM from a running device. Isn't that exactly what "exploring ways to bypass smartphone encryption" means?
manishsharan 11y ago
You can blame this administration or the other one for pervasive snooping. The sad truth is that we are prisoners of our fear. Remember when Obama tried to shutdown Gitmo ?
ixtli 11y ago
As an American citizen I don't have an issue with gov't funded development of attacks on encryption so long as they don't pass laws that give them an advantage like, as an example, requiring companies to back door their own software. Edit for clarity: I realize that they do this. I'm trying to say that such abuses of power aside, I have a hard time finding it scary or surprising that they, or anyone else want to break encryption.
izzydata 11y ago
They say they don't want to sound like they are asking for a backdoor, but they are basically asking for a backdoor. Then they mention that if they start adding spyware to peoples phones through service providers software update channels that people will not find them trustworthy. Well, no shit.
whoopdedo 11y ago
From another leaked memo (or maybe the same memo): Although “the legislative environment is very hostile today, it could turn in the event of a terrorist attack or criminal event where strong encryption can be shown to have hindered law enforcement.” There is value, he said, in “keeping our options open for such a situation.” In other words, he was hoping for a terrorist attack that could be used as a flag to push anti-encryption legislation. https://www.washingtonpost.com/world/national-security/tech-trade-agencies-push-to-disavow-law-requiring-decryption-of-phones/2015/09/16/1fca5f72-5adf-11e5-b38e-06883aacba64_story.html?postshare=9031442410909976 https://www.washingtonpost.com/world/national-security/tech-...
- sehugg 11y ago
  I wouldn't go that far. This is ODNI's General Counsel saying that they would prefer to defer public attacks -- er, debate -- on any specific plan until a crisis occurs, at which point opposition will be muted. They can then take advantage of the climate to go full court press with whatever strategy has been preselected. Whether "preparing to leverage" is worse than "hoping" is up for debate.
  - pdeuchler 11y ago
    That's a rather pedantic difference. What you're essentially saying is they just used weasel words that gives them an out instead of just blatantly saying what they mean.
- happyscrappy 11y ago
  If there is a successful attack politicians will be questioned about why they did not do more, no conspiracy needed. Is it dangerous to have encryption keys stored? Of course, but the danger is mostly that they will be stolen not used by the government, although that is still a risk but smaller.
  - mentat 11y ago
    I'm curious how / why you trust the government, which is made up of people with various agendas.
pnut 11y ago
Well duh, surveillance is core to US National Security. Obviously it comes with some thorny opportunities for abuse, but in the scope of national defense, it would be malpractice not to develop every capability possible. Your enemies won't hold back, and let's remember that we are more or less already in an asymmetrical information war with both state and non-state actors inside US borders.
TJPe 11y ago
The POTUS is not the only responsible party, but is definitely among the supports for wide spread mass surveillance. A person could argue that he is not responsible if the government operated in the nature it's suppose to under the constitution, but with executive orders (among other things) that is not the case.
snarfy 11y ago
I'm still waiting for XKeyScore to be generally accessible by any script kiddie. When it is they'll realize how utterly stupid it is for such a system to exist.
sehugg 11y ago
“Rather than sparking more discussion, government-proposed technical approaches would almost certainly be perceived as proposals to introduce ‘backdoors’ or vulnerabilities in technology products and services and increase tensions rather [than] build cooperation,” ... but we welcome a robust debate!
sukaka 11y ago
I see what Obama's saying. In my experience, research on bypass methods may become the source of a new terrorist attack. Then a terrorist attack would be our making.
LinuxBender 11y ago
I do not see value in this discussion. Once your smart phone is powered on, it is not encrypted. All files can be pulled or pushed over the air by the carrier. Not all carriers will ask for a warrant. Click down if you want, but I was told to not ask for a warrant.

194 points by apawloski 11y ago

tempodox 11y ago

Nixon was a babe in the woods compared to Obama.

tertius 11y ago
You mean the Nixon Administration...
tsotha 11y ago
Yes and no. Nixon did a lot of things Obama wouldn't get away with. But the technology for the sort of dragnet snooping government agencies can do today wasn't available.

alyandon 11y ago

Cry me a river. The widespread adoption of encryption wouldn't have been such a pressing issue if spy agencies like the NSA hadn't been abusing their powers by conducting mass surveillance on law abiding citizens.

irishcoffee 11y ago
You do realize that all government agencies, especially those under the DoD, serve at the pleasure of the POTUS, right? Obama has had close to two full terms to tell NSA what he wants done and how he wants it done. He could shut the whole joint down tomorrow. He has not. He is very aware of exactly how NSA operates, and he has not changed a damn thing. Blame NSA, or whoever, all you want. They serve at the pleasure of their customer.
- alyandon 11y ago
  This type of wholesale spying on law abiding citizens goes back 15+ years. I blame Obama, Bush, Congress, et al for not showing a backbone and ending these programs. Edit: I'm in an exceedingly grumpy mood today. :-/
  - late2part 11y ago
    Grumpy moods seem to be going around :-) I want to revisit the earlier point in your context. You say that it goes back 15 years. You are right. Each of these parties is jointly and severally liable for it. Obama is currently liable. I think it's just and right to criticize him for failure to act. His lack of fortitude is not excused by the lack of fortitude of others.
  - cheald 11y ago
    15? It's arguable that the government's institutional abuse of power to spy on law-abiding citizens began in earnest with J. Edgar Hoover, who began his tenure as the head of the FBI in 1924.
- Retric 11y ago
  The president can't arbitrarily shut things down or have much direct control. Congress both controls the purse strings and requires money to be spent. At best, POTUS can generally enforce the law, but NSA actually has authority to do mass surveillance from Bush era laws. That said, Obama is clearly in favor of surveillance.
  - mattmanser 11y ago
    You do have to wonder what exaggerated lies they're told to believe that such surveillance is even necessary. I say lies, because if there were any real threats so many more terrorist attacks would happen than actually do. The other theory I've seen is that people in power are used to having their life scrutinized publicly, so personally don't really care about privacy, so are the worst people to making decisions about such things.
    - Retric 11y ago
      I think it's more of an incentive problem, after a disaster like say Hurricane Katrina it's really hard to stand up and publicly say everything is working just fine. Ideally, you want to be able to say well "where it not for the other guy we would have implemented my solution!" Which creates huge pressure based on how bad things look vs. how they actually are.
  - rhino369 11y ago
    The President can't change the laws or the budget. But an order like: "stop warrentless spying," is exactly the sort of order the President can give. Just like he ordered the military to let homosexuals join. Unless the Bush era laws says the NSA MUST spy (and they don't), he is pretty much clear to order them not to spy.
    - deleted 11y ago
      [deleted]
- feld 11y ago
  Why do you people keep repeating these blatant lies? The POTUS does not have direct power to do these kinds of things. It's the whole lot of politicians that are ignorant and corrupt.
  - fein 11y ago
    This has been an odd dynamic through my entire lifetime. The president has never been the one pulling the strings, and I'm not sure why everyone blindly blames the person in that position. There are people whose names the general public has never seen that have a great amount of influence in our legislative process.
    - danso 11y ago
      I dunno, the whole concept of a "commander-in-chief" -- Chief Executive of a country, "The Buck Stops Here" -- is an odd dynamic. While we have the 3 branches of government, one of them is physically and institutionally commandeered by one human being, subject to the limitations and weaknesses shared by the 300 million human beings he oversees. The checks and balances system is nice, preventing a situation in which a depressed or cranky president launches a war "just because"...But there are a lot of other less direct ways that his personal state of being could drastically affect the entire country. What if the senator who is a leading advocate for surveillance reform personally insulted the president's family? Sure, the senator's a jerk, and the president would never admit to basing his decision to ignore the senator on such a personal slight. But if such personal hostility resulted in the president putting the senator much lower on his priority list...such that he never gets around to giving the issue the proper amount of attention...The impact on the country is virtually the same as if the president's reaction had been, "Fk that d-bag and everything he stands for" This is just a long way of saying, yeah, kind of crazy how so much of what affects us as a society is in the hands of one human being, and it's unfair to blame him for not being able to control everything. And yet, he is the one who signed up to have those powers...criticizing him is not just a reflexive tendency to scapegoat, but the current "user-friendly interface" we have with our bureaucracy.
    - 1024core 11y ago
      When Bush was in charge, everyone was quick to blame him. But now that Obama is in charge, suddenly it is "president has never been the one pulling strings .. why is everyone blaming him?"
- dragonwriter 11y ago
  > You do realize that all government agencies, especially those under the DoD, serve at the pleasure of the POTUS, right? This is false. Government agencies largely are creations of statute law, and their existence is governed by Congress. The heads of agencies (and top-ranking subordinate officers to a certain level) often serve at the pleasure of the President, but the agencies themselves do not exist at his pleasure. In most cases where the agencies that are not created by statute are subordinate to those that are, those subordinate agencies still do not exist at the discretion of the President, they exist under the statutory authority of some officer of the statutorily-created agency to which they report. (That officer may serve at the pleasure of the President, so the President could fire them for not acting as he wishes with respect to the subordinate agency, but the agency itself does not exist at the discretion of the President.) There are exceptions -- subordinate organizations not created by statute within the Executive Office of the President, for instance -- but generally federal government agencies do not exist at the discretion of the President. Heck, even doing this through a back-door approach by refusing to spend Congressionally-appropriated funds in order to kill a program has been ruled unconstitutional; Train v. City of New York, 420 U.S. 35 (1975).
  - abecedarius 11y ago
    There are exceptions -- subordinate organizations not created by statute within the Executive Office of the President, for instance I don't know what the legal status is now, but the NSA's origin sounds kind of like that: https://en.wikipedia.org/wiki/National_Security_Agency#World_War_II_and_its_aftermath https://en.wikipedia.org/wiki/National_Security_Agency#World... "The agency was formally established by Truman in a memorandum of October 24, 1952, that revised National Security Council Intelligence Directive (NSCID) 9.[28] Since President Truman's memo was a classified document,[28] the existence of the NSA was not known to the public at that time." Here is that memo, according to the NSA: https://www.nsa.gov/public_info/_files/truman/truman_memo.pdf https://www.nsa.gov/public_info/_files/truman/truman_memo.pd... It seems odd to me in talking about the "Director of the NSA" instead of the agency itself, but what do I know.
    - dragonwriter 11y ago
- knowaveragejoe 11y ago
  Setting aside the fact that the POTUS can't actually do that, when you think about the fact that information is what makes governing possible in the first place, it makes complete sense that they would explore this sort of thing. Given an vague(and ultimately impossible) mission of "stopping all terrorist attacks", it makes sense that the NSA would be exploring what they have been, and that TPTB would be wholly supportive of it.
- jellicle 11y ago
  It's probably not correct that Obama could close down the entire NSA tomorrow. However, he has essentially complete control over what it does. If he wanted to direct it to do, for example, only military intelligence activities directed solely at warfighting intelligence, he could. This Executive Order: http://www.archives.gov/federal-register/codification/executive-order/12333.html http://www.archives.gov/federal-register/codification/execut... can be changed at any time and to whatever the President desires it to be. He could change it this afternoon if he liked.
- tootie 11y ago
  State and local police and prosecutors don't work for the federal government at all. Any avenue for mass surveillance is also an avenue for legitimate law enforcement investigation.
gress 11y ago
Yes it would. Cybercriminals are even more of a threat than spy agencies to most individuals. [edit: in case it is unclear, I am saying that cybercrime is as strong reason for individuals to use ubiquitous encryption as government snooping not that it is a justification for government snooping]
- late2part 11y ago
  Really? You think cybercriminals do more damage than unbridled governments?
  - jayess 11y ago
    Yes. Cyber criminals put people in internment camps for thought crimes all the time.
    - GFK_of_xmaspast 11y ago
      Bitlocker is not an 'internment camp.'
  - dogma1138 11y ago
    Direct perceivable damage? Is there even a question? Did the NSA over stepped it's bounds sure, but did anyone actually got directly hurt? Well not really. The NSA is only as "bad" as the rest of the government, it's not a rogue agency that whisks people in the middle of the night to re-education camps, if the US ever becomes such state then encryption isn't going to help you. This isn't an argument against encryption, or in favor of the NSA violating the privacy of US citizens (I am not a US citizen and I do not expect the NSA to care for my privacy) it's just an argument that people should put things in perspective. East Germany didn't became a police state because of the Stasi, they've created the Stasi to enforce it. The US wasn't turned into a police state because of McCarthy-nism, it wouldn't turn into one because of the NSA even if they continue to violate the rights of US citizens unless there will be a major major political shift across all branches of the US government and it's population.

imgabe 11y ago

They looked into whether it could be done and then decided that doing it was not worth the controversy it would generate. This seems like a good thing, I'm not sure why WaPo went with such a sinister sounding headline. More accurate would be "Obama administration rejects several proposals to bypass smartphone encryption".

tertius 11y ago
After sending an RFP. I think that's the point.
- imgabe 11y ago
  As I read it, it was to access encrypted information on a suspect after a warrant or court order has been issued. If you have something in a locked room and the police have a warrant to search it, they can cut the lock off and search it, that's perfectly legal. The trick with encryption is to find a way to do that without rendering every other lock in existence worthless, and I think that's what they're looking for.
  - JoeAltmaier 11y ago
    Maybe some three-key encryption, with the third key escrowed for judicial purposes.
    - jonlucc 11y ago
      The escrow there would make me very nervous, as it becomes a very juicy target.
      - noir_lord 11y ago
        Give it to the Office of Personnel Management, they are charged with holding some of the most sensitive information the US Government has.
    - JupiterMoon 11y ago

venomsnake 11y ago

> The first potential solution called for providers to add a physical, encrypted port to their devices. Companies would maintain a separate set of keys to unlock devices, using that port only if law enforcement had physical access to a device and obtained a court order to compel the company’s assistance. Soldering gun and that port is a toast. > The second approach would exploit companies’ automatic software updates. Under a court order, the company could insert spyware onto targeted customers’ phones or tablets — essentially hacking the device. However, the memo warned, this could “call into question the trustworthiness of established software update channels” and might lead some users to opt out of updates, which would eventually leave their devices less secure. It could be done even today. And I would not be surprised if we haven't already some FISA mandated app updates. > A third idea described splitting up encryption keys, a possibility floated by National Security Agency director Michael S. Rogers earlier this year. That would require companies to create a way to unlock encrypted content, but divide the key into several pieces — to be combined only under court order. Exactly how this would work remains unclear, but the memo warned that such a system would be “complex to implement and maintain.” So straight backdoor. While workable for apple, not really suitable for android. And we have the golden key as the mother lode of all cyber criminal activity in the world. > Under the final approach, which officials called a “forced backup,” companies under court order would be required to upload data stored on an encrypted device to an unencrypted location. Adava Decrypta or any other magical spell? If companies hold any way to decrypt the content, then it is not encrypted. if they don't, what is expected from them is magic.

calgoo 11y ago
"Soldering gun and that port is a toast." Even better, make it so that if that port is used, it fries the internal memory :)

mtgx 11y ago

"Guys, relax - we don't want golden keys! We only want malicious software updates, physical backdoors, forced backups and...umm split-golden keys."

jlgaddis 11y ago

The sentence > “[T]hese challenges mean that inaccessible encryption will always be available to malicious actors" can be easily replaced with > “[T]hese challenges mean that inaccessible encryption will always be available to everyone” and still retain the same meaning.

Lawtonfogle 11y ago
To a corrupt government, there is no significant difference between those two anyways.

uniformlyrandom 11y ago

> ... splitting up encryption keys, a possibility floated by National Security Agency director Michael S. Rogers earlier this year. That would require companies to create a way to unlock encrypted content, but divide the key into several pieces — to be combined only under court order. Exactly how this would work remains unclear, but the memo warned that such a system would be “complex to implement and maintain.” Actually, this is called a 'lawful escrow', and it is implemented in many enterprise PKI systems specifically to comply with court orders. So I guess they decided to throw in one sane option, to offset three other fairly insane ones.

uniformlyrandom 11y ago

codyb 11y ago

It is amazing what a corner encryption has pinned law enforcement into (after the USG of course pinned everyone into a corner by spying on what amounts to nearly the entire globes communications). There are no workable solutions which allow the government to serve a warrant and receive information without compromising the systems of millions of other subscribers to the same networks in some fashion (or reducing faith and trust in those networks). And the physical port, while an interesting concept, would essentially mean if LEOs jumped the gun by a few days, there warrant would be a bust because there'd be no information of use on the phone and the person obviously wouldn't use that physical device again. I've never had an issue with warranted communication retrieval. I certainly have an issue with the bulk collection of data on hundreds of millions of Americans at all times (as we all should, this is the sort of stuff you can blackmail politicians with, and when you can blackmail politicians you can control the future of the country, so it's something we need to prevent to maintain the integrity of our democracy). What tradeoffs should be made? Where should the lines in the sand be drawn? And what solutions exist or can be imagined which allow LEOs acting on good faith and reasonable suspicion to monitor the activities of those worthy of monitoring without compromising the very nature of our nations foundation?

pdkl95 11y ago
> There are no workable solutions What utter nonsense. Law enforcement absolutely has a solution: they use the traditional methods of investigation that have always worked. Wiretapping is a somewhat recent development, historically speaking, and it obviously isn't the only method of investigation. The only reason you see law enforcement getting annoyed at encryption is that they really liked how easy wiretapping (and the modern equivalents) made their job, and the power it gave them in the form of "parallel construction". > What tradeoffs should be made? A big problem with the rhetoric about rights and security having an inversely proportional relationship is the assumption that by giving up rights would actually result in better security. This is at best unproven, and often results in a loss of security.
- ecdavis 11y ago
  Playing devil's advocate here, but instantaneous long-distance communication is also a very recent development, historically speaking. Traditional investigation methods relied on tracking people's movements, who they associated with and so forth. Digital communication has almost completely removed the requirement for non-digital criminal relationships. As we saw with the DPR hired-killer case, two people can collaborate to perform a crime with zero non-digital connections. How do you use traditional methods in a world where criminals can just go about their daily lives, pausing occasionally to send a message to someone who could be a co-conspirator or could just be their mother? I don't think subverting encryption is necessarily the answer, but to say that law enforcement just wants to do things the easy way is to ignore the emergence of a very real problem that they face.

phkahler 11y ago

I've said this before. They can already get a warrant and visit a suspect. Make them unlock their phone or go to jail for obstruction or some such (legal question, how compulsory can this get?). The problem is that they want to snoop in secrecy without tipping off a suspect. It's undesirable when going after networks of people, but going in the front door seems completely feasible today.

JupiterMoon 11y ago
Failure to provide decryption keys is I think not currently covered by the 5th in USA. In the UK the punishment for failure to decrypt a device when the police ask is pretty much the punishment for whatever they accuse one of having on the device...
- aianus 11y ago
  > failure to decrypt a device What if you don't have the key? Do they need to prove that you're able and refusing to decrypt the device or are you presumed guilty until you prove you can't? What about one-time pads where you could make up whatever key you wanted and it would be valid?
  - JupiterMoon 11y ago
    I think (and I am not lawyer and not your lawyer) that the onus is on you to prove that you don't have the encryption key (anymore) or have access to it. I don't know what case law exists on this.
  - yarrel 11y ago
    I believe people were emailing encrypted messages to the minister who proposed this and destroying the keys to demonstrate the problem with this. However on the whole it is the same as being asked to open a safe. If you don't remember the combination...
- JupiterMoon 11y ago
  To the downvoters. I don't like these things either -- but just downvoting them on HN won't change things.... Vote in your national elections with civil liberties in mind instead.

devit 11y ago

Why do they need that? All they need is for a policeman to physically seize a device while it is unlocked. Or even while it is locked with encryption keys stored in memory, and some custom tech to read the RAM from a running device. I'd wager that people with sufficient physical security to prevent this are very rare, and it works against any sort of device that doesn't have a dead man's switch.

da_chicken 11y ago
> Or even while it is locked with encryption keys stored in memory, and some custom tech to read the RAM from a running device. Isn't that exactly what "exploring ways to bypass smartphone encryption" means?

manishsharan 11y ago

You can blame this administration or the other one for pervasive snooping. The sad truth is that we are prisoners of our fear. Remember when Obama tried to shutdown Gitmo ?

ixtli 11y ago

As an American citizen I don't have an issue with gov't funded development of attacks on encryption so long as they don't pass laws that give them an advantage like, as an example, requiring companies to back door their own software. Edit for clarity: I realize that they do this. I'm trying to say that such abuses of power aside, I have a hard time finding it scary or surprising that they, or anyone else want to break encryption.

izzydata 11y ago

They say they don't want to sound like they are asking for a backdoor, but they are basically asking for a backdoor. Then they mention that if they start adding spyware to peoples phones through service providers software update channels that people will not find them trustworthy. Well, no shit.

whoopdedo 11y ago

From another leaked memo (or maybe the same memo): Although “the legislative environment is very hostile today, it could turn in the event of a terrorist attack or criminal event where strong encryption can be shown to have hindered law enforcement.” There is value, he said, in “keeping our options open for such a situation.” In other words, he was hoping for a terrorist attack that could be used as a flag to push anti-encryption legislation. https://www.washingtonpost.com/world/national-security/tech-trade-agencies-push-to-disavow-law-requiring-decryption-of-phones/2015/09/16/1fca5f72-5adf-11e5-b38e-06883aacba64_story.html?postshare=9031442410909976 https://www.washingtonpost.com/world/national-security/tech-...

sehugg 11y ago
I wouldn't go that far. This is ODNI's General Counsel saying that they would prefer to defer public attacks -- er, debate -- on any specific plan until a crisis occurs, at which point opposition will be muted. They can then take advantage of the climate to go full court press with whatever strategy has been preselected. Whether "preparing to leverage" is worse than "hoping" is up for debate.
- pdeuchler 11y ago
  That's a rather pedantic difference. What you're essentially saying is they just used weasel words that gives them an out instead of just blatantly saying what they mean.
happyscrappy 11y ago
If there is a successful attack politicians will be questioned about why they did not do more, no conspiracy needed. Is it dangerous to have encryption keys stored? Of course, but the danger is mostly that they will be stolen not used by the government, although that is still a risk but smaller.
- mentat 11y ago
  I'm curious how / why you trust the government, which is made up of people with various agendas.

pnut 11y ago

Well duh, surveillance is core to US National Security. Obviously it comes with some thorny opportunities for abuse, but in the scope of national defense, it would be malpractice not to develop every capability possible. Your enemies won't hold back, and let's remember that we are more or less already in an asymmetrical information war with both state and non-state actors inside US borders.

TJPe 11y ago

The POTUS is not the only responsible party, but is definitely among the supports for wide spread mass surveillance. A person could argue that he is not responsible if the government operated in the nature it's suppose to under the constitution, but with executive orders (among other things) that is not the case.

snarfy 11y ago

I'm still waiting for XKeyScore to be generally accessible by any script kiddie. When it is they'll realize how utterly stupid it is for such a system to exist.

sehugg 11y ago

“Rather than sparking more discussion, government-proposed technical approaches would almost certainly be perceived as proposals to introduce ‘backdoors’ or vulnerabilities in technology products and services and increase tensions rather [than] build cooperation,” ... but we welcome a robust debate!

sukaka 11y ago

I see what Obama's saying. In my experience, research on bypass methods may become the source of a new terrorist attack. Then a terrorist attack would be our making.

LinuxBender 11y ago

I do not see value in this discussion. Once your smart phone is powered on, it is not encrypted. All files can be pulled or pushed over the air by the carrier. Not all carriers will ask for a warrant. Click down if you want, but I was told to not ask for a warrant.