4 ms·

It is amazing what a corner encryption has pinned law enforcement into (after the USG of course pinned everyone into a corner by spying on what amounts to nearl

by codyb 11y ago

It is amazing what a corner encryption has pinned law enforcement into (after the USG of course pinned everyone into a corner by spying on what amounts to nearly the entire globes communications). There are no workable solutions which allow the government to serve a warrant and receive information without compromising the systems of millions of other subscribers to the same networks in some fashion (or reducing faith and trust in those networks). And the physical port, while an interesting concept, would essentially mean if LEOs jumped the gun by a few days, there warrant would be a bust because there'd be no information of use on the phone and the person obviously wouldn't use that physical device again. I've never had an issue with warranted communication retrieval. I certainly have an issue with the bulk collection of data on hundreds of millions of Americans at all times (as we all should, this is the sort of stuff you can blackmail politicians with, and when you can blackmail politicians you can control the future of the country, so it's something we need to prevent to maintain the integrity of our democracy). What tradeoffs should be made? Where should the lines in the sand be drawn? And what solutions exist or can be imagined which allow LEOs acting on good faith and reasonable suspicion to monitor the activities of those worthy of monitoring without compromising the very nature of our nations foundation?

pdkl95 11y ago
> There are no workable solutions What utter nonsense. Law enforcement absolutely has a solution: they use the traditional methods of investigation that have always worked. Wiretapping is a somewhat recent development, historically speaking, and it obviously isn't the only method of investigation. The only reason you see law enforcement getting annoyed at encryption is that they really liked how easy wiretapping (and the modern equivalents) made their job, and the power it gave them in the form of "parallel construction". > What tradeoffs should be made? A big problem with the rhetoric about rights and security having an inversely proportional relationship is the assumption that by giving up rights would actually result in better security. This is at best unproven, and often results in a loss of security.
- ecdavis 11y ago
  Playing devil's advocate here, but instantaneous long-distance communication is also a very recent development, historically speaking. Traditional investigation methods relied on tracking people's movements, who they associated with and so forth. Digital communication has almost completely removed the requirement for non-digital criminal relationships. As we saw with the DPR hired-killer case, two people can collaborate to perform a crime with zero non-digital connections. How do you use traditional methods in a world where criminals can just go about their daily lives, pausing occasionally to send a message to someone who could be a co-conspirator or could just be their mother? I don't think subverting encryption is necessarily the answer, but to say that law enforcement just wants to do things the easy way is to ignore the emergence of a very real problem that they face.
  - rm_-rf_slash 11y ago
    The government has admitted that it is impossible to reliably extract one party's communication without either watching all the time, or having the ability to do so, and I don't think it's for a lack of creativity. In a way we were spoiled by wiretapping because now we have set the expectation for hard, recorded evidence to be the standard, because facts can't lie. Thing is, this new age is a bigger can of worms than encryption versus the government is always watching. It could be 10 years away, it could be 50, but a computer will someday be able to generate your voice, create a fake video of your actions, and the state could put you away for nothing - and everyone could believe it. Neither of you are wrong. Machines can be fooled by prior, and people can be fooled by machines.
Lawtonfogle 11y ago
>I've never had an issue with warranted communication retrieval. Even when they are then used to carry out unjust punishments?
coldpie 11y ago
The thing is, encryption is all-or-nothing. You either have quality encryption, or you do not. The only trade-off to discuss here is whether we want to allow secure digital communication, or if all communication must be effectively in plaintext. I think the choice is fairly obvious, as without effective encryption we will basically kill any digital economy. But I do understand where the opposition is coming from.
pjc50 11y ago
"Amendment IV The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no warrants shall issue, but upon probable cause, supported by oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized." If we define a computer system and its contents as "papers", which seems reasonable, then the extra port approach matches this very well. You give the device a warrant signed by the public key of the judge, and it gives up its secrets. And takes a copy of the warrant.
- codyb 11y ago
  This is absolutely true and I agree, I think it'd be a great approach to the issue at hand. Of course someone below bought up the issue of someone just using a soldering iron to alter the physical port to be unusable. Or, what if, even, I just dropped my phone enough? Now there's a warrant for me, even if I'm not guilty, would I face criminal charges for obstructing an investigation even though it could have been an accidental mishap? If you deliberately burn papers relevant to an investigation that's one thing, what if your papers get caught in the rain? has anyone been in trouble for that? I'm not as educated on the subject as I could be, I most certainly admit.
  - pjc50 11y ago
    "Port" could imply something like a JTAG port internal to the device which is very hard to selectively disable. Or a one-shot system involving antifuses in the processor.
- okasdkqwewqqwe 11y ago
  I mean that's all fine and dandy but there's a couple problems. 1. The public key of the judge will be compromised. Not might, not won't. It will. End of story. This opens my device to a bunch of non-authorized individuals exfiltrating data without my knowledge. This is completely unreasonable at every level. To draw a parallel, this would like all locks in your house having a "police" keying. 2. Computers are not papers. Papers is a well defined term. 3. These ports would be taken advantage of by three-letter agencies without your knowledge and without a warrant. The only thing your approach allows is that the police officer won't snag your laptop so the office gets a new one. But really, that won't stop them from stealing your stuff so not even that works. The police cant even be trusted to not shoot an innocent person. What makes you think they can be trusted with a golden key? This approach completely undermines the entire reason we have encryption and AIDS the police in parallel construction. Not the other way around. Read on skipjack and the clipper chip. This kind of tech has been discussed and it DOES NOT work.
mindslight 11y ago
There are also no workable solutions that allow enforcement [sic] to read what you're thinking, even with a warrant. But sometimes the universe just doesn't work how they'd like, so their job isn't as easy as it could be. Boo hoo. This "debate" (actual: another attempt at forcing acceptance) is only occurring because people foolishly adopted webcrapps. The debate was settled long ago at a time when people thought in terms of owning their devices and data, before tech culture had been destroyed by advertising/propaganda. The result was a resounding "Hell No". It's been rekindled because these huge silos of irresponsibly stored data are an irresistible trove for control fetishists. And in a sense the public sector control fetishists are right - if the de jure government doesn't gain access to them, it's only a matter of time until the de facto government does - eg insurance pricing, background checks, extreme price discrimination. Let's hope the (de)centralization pendulum swings back hard this time, with Snowden having given it an extra push (Binney/Klein were pushing at the wrong time :/). We're due for another bubble pop sometime soon, and I hope that honest companies (aligned with user incentives) rise from the rubble. If our society is to have any long term future, the advancements of technology have to be distributed throughout it, not centrally controlled by a handful of entities.

by codyb 11y ago

pdkl95 11y ago

> There are no workable solutions What utter nonsense. Law enforcement absolutely has a solution: they use the traditional methods of investigation that have always worked. Wiretapping is a somewhat recent development, historically speaking, and it obviously isn't the only method of investigation. The only reason you see law enforcement getting annoyed at encryption is that they really liked how easy wiretapping (and the modern equivalents) made their job, and the power it gave them in the form of "parallel construction". > What tradeoffs should be made? A big problem with the rhetoric about rights and security having an inversely proportional relationship is the assumption that by giving up rights would actually result in better security. This is at best unproven, and often results in a loss of security.

ecdavis 11y ago
Playing devil's advocate here, but instantaneous long-distance communication is also a very recent development, historically speaking. Traditional investigation methods relied on tracking people's movements, who they associated with and so forth. Digital communication has almost completely removed the requirement for non-digital criminal relationships. As we saw with the DPR hired-killer case, two people can collaborate to perform a crime with zero non-digital connections. How do you use traditional methods in a world where criminals can just go about their daily lives, pausing occasionally to send a message to someone who could be a co-conspirator or could just be their mother? I don't think subverting encryption is necessarily the answer, but to say that law enforcement just wants to do things the easy way is to ignore the emergence of a very real problem that they face.
- rm_-rf_slash 11y ago
  The government has admitted that it is impossible to reliably extract one party's communication without either watching all the time, or having the ability to do so, and I don't think it's for a lack of creativity. In a way we were spoiled by wiretapping because now we have set the expectation for hard, recorded evidence to be the standard, because facts can't lie. Thing is, this new age is a bigger can of worms than encryption versus the government is always watching. It could be 10 years away, it could be 50, but a computer will someday be able to generate your voice, create a fake video of your actions, and the state could put you away for nothing - and everyone could believe it. Neither of you are wrong. Machines can be fooled by prior, and people can be fooled by machines.

Lawtonfogle 11y ago

>I've never had an issue with warranted communication retrieval. Even when they are then used to carry out unjust punishments?

coldpie 11y ago

The thing is, encryption is all-or-nothing. You either have quality encryption, or you do not. The only trade-off to discuss here is whether we want to allow secure digital communication, or if all communication must be effectively in plaintext. I think the choice is fairly obvious, as without effective encryption we will basically kill any digital economy. But I do understand where the opposition is coming from.

pjc50 11y ago

"Amendment IV The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no warrants shall issue, but upon probable cause, supported by oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized." If we define a computer system and its contents as "papers", which seems reasonable, then the extra port approach matches this very well. You give the device a warrant signed by the public key of the judge, and it gives up its secrets. And takes a copy of the warrant.

codyb 11y ago
This is absolutely true and I agree, I think it'd be a great approach to the issue at hand. Of course someone below bought up the issue of someone just using a soldering iron to alter the physical port to be unusable. Or, what if, even, I just dropped my phone enough? Now there's a warrant for me, even if I'm not guilty, would I face criminal charges for obstructing an investigation even though it could have been an accidental mishap? If you deliberately burn papers relevant to an investigation that's one thing, what if your papers get caught in the rain? has anyone been in trouble for that? I'm not as educated on the subject as I could be, I most certainly admit.
- pjc50 11y ago
  "Port" could imply something like a JTAG port internal to the device which is very hard to selectively disable. Or a one-shot system involving antifuses in the processor.
okasdkqwewqqwe 11y ago
I mean that's all fine and dandy but there's a couple problems. 1. The public key of the judge will be compromised. Not might, not won't. It will. End of story. This opens my device to a bunch of non-authorized individuals exfiltrating data without my knowledge. This is completely unreasonable at every level. To draw a parallel, this would like all locks in your house having a "police" keying. 2. Computers are not papers. Papers is a well defined term. 3. These ports would be taken advantage of by three-letter agencies without your knowledge and without a warrant. The only thing your approach allows is that the police officer won't snag your laptop so the office gets a new one. But really, that won't stop them from stealing your stuff so not even that works. The police cant even be trusted to not shoot an innocent person. What makes you think they can be trusted with a golden key? This approach completely undermines the entire reason we have encryption and AIDS the police in parallel construction. Not the other way around. Read on skipjack and the clipper chip. This kind of tech has been discussed and it DOES NOT work.

mindslight 11y ago

There are also no workable solutions that allow enforcement [sic] to read what you're thinking, even with a warrant. But sometimes the universe just doesn't work how they'd like, so their job isn't as easy as it could be. Boo hoo. This "debate" (actual: another attempt at forcing acceptance) is only occurring because people foolishly adopted webcrapps. The debate was settled long ago at a time when people thought in terms of owning their devices and data, before tech culture had been destroyed by advertising/propaganda. The result was a resounding "Hell No". It's been rekindled because these huge silos of irresponsibly stored data are an irresistible trove for control fetishists. And in a sense the public sector control fetishists are right - if the de jure government doesn't gain access to them, it's only a matter of time until the de facto government does - eg insurance pricing, background checks, extreme price discrimination. Let's hope the (de)centralization pendulum swings back hard this time, with Snowden having given it an extra push (Binney/Klein were pushing at the wrong time :/). We're due for another bubble pop sometime soon, and I hope that honest companies (aligned with user incentives) rise from the rubble. If our society is to have any long term future, the advancements of technology have to be distributed throughout it, not centrally controlled by a handful of entities.