15 ms·

Encryption, Privacy Are Larger Issues Than Fighting Terrorism

647 points by Osiris30 11y ago

jacquesm 11y ago
> No, David. If I were in the job now, I would have simply told the FBI to call Fort Meade, the headquarters of the National Security Agency, and NSA would have solved this problem for them. They're not as interested in solving the problem as they are in getting a legal precedent. That's quite the quote, especially given his history of employment. The weirdest thing about this whole cell-phone saga to me is that the perps are dead, did not appear to be part of some organized group and that very little could be done to them that hasn't been done already based on evidence found on the phone. Then there is the bit that a lot of the information that is on the phone is also already in the log files of the carriers. It's as if that phone somehow magically is going to yield an entirely new class of information that may not even exist in the first place. To me it has been evident from day one that this is not about this phone or the data that's on it but just about the legal precedent, getting it in black-and-white from the former head of counter terrorism is quite an indictment of his successors.
- ptaipale 11y ago
  > the perps are dead, did not appear to be part of some organized group A reasonable reason for inquiry here is to actually try to make sure if they were part of some organized group. "Appear not to be" is not quite enough. This is a valid reason to investigate even if they are dead. How did they get radicalized, etc. Not that it is a good enough reason to enforce breaking of encryption in the way proposed, but in a murder inquiry, privacy of the perps has to give way.
  - nickik 11y ago
    From other intel they know that he did not use his work phone much and saw no need to destroy it. He did destroy his private phone, so I think its quite clear that their is nothing on that phone. I think its reasonable for the FBI to want to access it, but lets not have any illusions, the change that their is any evidence on the phone is basically 0%.
  - ohyeshedid 11y ago
    If this was really about the privacy of the perps; an NSL would've been enough and we'd never know about it. This is about setting precedent, and as publicly as possible. If the feds get their way the entire idea of encryption is weakened, and not just for the lawful citizens. I suspect the reason for having this battle so publicly is propaganda based, just as it was with Zimmermann in the 90's.
    - dhimes 11y ago
      Since you brought up NSL.... The legality of the NSL (which does not require oversight- the FBI can self-sign them) hinges on the idea that the persons on whom the information is being gathered have/had "no reasonable expectation" of privacy of the information. That said, if these back doors were to be instituted, could the argument then be made that we now have "no reasonable expectation" of privacy of anything on our cell phones? Could this set a precedent of unholy proportions?
      - ohyeshedid 11y ago
        Absolutely, and as terrifying as that possibility is I personally think they didn't go the NSL route because Apple is big enough to finally prove or disprove the constitutionality of NSL's; even bring the process to mainstream attention. That's something the DOJ would never want to see happen, because then everyone can come out of the shadows and tell their story.
  - danieldk 11y ago
    A reasonable reason for inquiry here is to actually try to make sure if they were part of some organized group. "Appear not to be" is not quite enough. For a country that kills based on metadata[1], it seems quite far-fetched that they couldn't map out potentially interesting connections using just metadata. Also, it would be pretty dumb to put any revealing data on a work phone with iCloud backups enabled (which is just not accessible due to the FBI's mistakes). At any rate, this discussion is quite besides the point. Permitting this phone to be unlocked (or the hundred or so other phones mentioned) will open the floodgates for questionable regimes and a hunt for Apple's private key (more automation to handle requests will reduce security). [1] http://www.nybooks.com/daily/2014/05/10/we-kill-people-based-metadata/ http://www.nybooks.com/daily/2014/05/10/we-kill-people-based...
  - hammock 11y ago
    "Appear not to be" is often enough. The government is required to have probable cause to conduct a search.
  - EdHominem 11y ago
    > "Appear not to be" is not quite enough. It has to be, because there is no perfect. Everything is a numbers game between ever-more unlikely hypothetical evidence that might yield a valuable unknown, and the cost of collecting it. By such completist thinking, we should examine every image and video in the world because they might show up in the background of a birthday party video or vacation selfie, giving us another clue. Similarly, we should interview everyone in cities they've been known to be in... But in reality, unlike in a game or a movie, there is no 100% complete. The phone isn't one of a finite list of clues to examine whereby you will know everything you need to know. By fixating on the phone, or any few issues, you miss the larger point. There's very little likelihood of learning anything of value here, and are far richer leads elsewhere. This is just our security industry grandstanding for more money.
    - ptaipale 11y ago
      There is no perfect, but I think that by ordinary police standards in any developed country, not trying to investigate this kind of perp's phones would be too imperfect. It would be sloppy police work and any police officer deciding not to try to inspect the phone would be vulnerable to accusations of misconduct. That doesn't mean that I agree that Apple should be forced to break the encryption. It means the police really have a duty to investigate.
      - EdHominem 11y ago
        I'm not saying they shouldn't be interested... What if, instead of simply being locked, the phone was eaten by a pelican that flew out over the ocean and died. Gone. Should we dredge the ocean to find the phone? It's a duty to do so, right? The FBI have tried, and failed. How much more should they dredge before we stop harping on about this one piece of potential evidence? In this case they have the phone physically in hand so they feel blocked and powerless, but from a cost-benefit point of view it might as well be at the bottom of the ocean. Doesn't their duty compel them to investigate the most-likely to payout leads, not play political games over high-profile issues?
        11y ago
- monk_e_boy 11y ago
  No the weirdest thing is that Apple is standing up to the government. Isn't that just wrong? You, the people choose the government, so in effect Apple is standing up to the people of America and saying 'no'. If you the people didn't want the FBI to be bullish then choose a different government. It feels to me (an outsider) that it's the government that is out of control and is not accountable to the people.
  - thomasahle 11y ago
    Apple is in many countries, with governments who'd all like this kind of access. If you give FBI the tools, you also have to accept Russia, China and the whole gang having access to your phone.
    - monk_e_boy 11y ago
      Well that is up to Apple, they don't have to make one phone. They could make a US version and a rest of the world version.
      - thomasahle 11y ago
        And if the FBI wanted to open a rest of the world version? Or another government wanted to open a US version?
        EdHominem 11y ago
        > Or another government wanted to open a US version? There's a good point. And who knows what limits they'd go to, to force Apple's hand? (Kidnapping, etc.) Apple is really only safe if they actually can't break their own encryption. Anything less makes them a target.
      - Piskvorrr 11y ago
        And then build that fence all along the border so that no world-version phones get in (see how well it worked for other illegal imports). Plus, you haven't solved the problem at all: you just say "okay, let's make only US phones vulnerable to foreign hacking." Should I enumerate why that's a bad thing?
- masklinn 11y ago
  And IIRC the phone in question is the perp's work phone, they also had personal phones which they destroyed, so the perps themselves knew phones could hold valuable data but saw no value in the the phone the FBI wants unlocked.
  - dopamean 11y ago
    I think the FBI already acknowledged very early on that they didn't expect to find anything useful on the phone for these very reasons.
    - richmarr 11y ago
      I imagine there's a Venn diagram of overlap between what a nutjob thinks is worth hiding and what would be of interest to law enforcement organisations. For example I doubt many of these extremists would both trying to hide information that could be used for psychological profiling of future attackers
      - jacquesm 11y ago
        The psychological profiling of future attackers has nothing to do with getting away with this push to access that particular phone. That's simply not even on the radar at this point, the FBI would be laughed out of any court they went to if they presented that as the reason why they want access. Their fig-leaf is that the phone may contain valuable information regarding this particular crime.
        richmarr 11y ago
        Criticising the example of psychological profiling doesn't address my actual point.
- dec0dedab0de 11y ago
  I think it's all an act to make people think apple phones are more secure than they actually are.
  - ethbro 11y ago
    From comments around the case, the government operates like any other black hat. Which is to say they absolutely have vulnerabilities that work against certain versions of iOS, but probably not others. And the NSA likely has more than a few zero days, simply because it's a far cheaper way for them to do their job than any alternatives. Just like with any piece of software, there is no "secret vulnerability that works all the time forever": it's discover, exploit, patch, repeat. (Which, incidentally, is also the argument against key escrow schemes. Whereas it would be discover, exploit all devices that implement the key escrow code, wait until the government develops a new patch, wait until all device manufacturers incorporate the patch... repeat.)
- steveax 11y ago
  It's worth listening to the audio to hear how surprised David is with this blunt charge. Clearly unexpected. Also: parallel construction (i.e.: the NSA doesn't want to reveal it has already done this)
ck2 11y ago
Other governments are definitely going to force manufacturers to make their phones unlockable or not for sale in their country. China, Russia, Saudia Arabia, all forced Blackberry to turn over their encryption keys long ago. US politicians should set an example and say we are NOT going to be like China and Russia and other repressive regimes and that when people's lives are literally on their phones, they have a reasonable right to privacy and protection from search and seizure, you know like in our constitution but ignored everyday.
- BBlarat 11y ago
  Well the winds have changed on that stance, at least in Europe. I've seen a couple of leading politicians say something in the line of: "If china can do it so can we" concerning the Chinese firewall and blocking "unwanted" content on the web, which is scary.
  - DanielBMarkham 11y ago
    If it happens, it'll become precedent, then all countries will want to do it. The next logical step is to outlaw phones and devices that are incapable of breaking into. Then they'll make it so you need a license to employ cryptography. It sounds crazy, but where we are right now would have sounded just as crazy 15 years ago.
    - mobiuscog 11y ago
      >Then they'll make it so you need a license to employ cryptography. You already need one to export certain goods / to certain countries.
      - FroshKiller 11y ago
        Big difference between "need" and "are required to have"!
    - masklinn 11y ago
      > The next logical step is to outlaw phones and devices that are incapable of breaking into. Then they'll make it so you need a license to employ cryptography. Welcome to the 90s: https://en.wikipedia.org/wiki/Export_of_cryptography_from_the_United_States#PC_era https://en.wikipedia.org/wiki/Export_of_cryptography_from_th... [0] > It sounds crazy, but where we are right now would have sounded just as crazy 15 years ago. Hardly. 15 years ago, the US were just barely past their encryption export ban, and we had yet to deal with the (still ongoing) fallout from it. [0] although back then the US only tried to backdoor or ban strong encryption for the international market, not for the domestic one, for simplicity reasons the domestic versions of exported products often used "export-grade" (shit) encryption
Gratsby 11y ago
>PRESIDENT BARACK OBAMA: If, technologically, it is possible to make an impenetrable device or system where the encryption is so strong that there's no key - there's no door at all - then how do we apprehend the child pornographer? How do we solve or disrupt a terrorist plot? It's so disappointing to me to hear a quote like that from the President.
- x5n1 11y ago
  What if the terrorist or pedo has things in his mind, that means all people's minds should be monitored at all times... Otherwise there is a chance that they might think thoughts to do evil things and then they might carry them out. I uhh want to emphasize that we should think of the uhh children.
- Jafit 11y ago
  Its fine though, because if you make something illegal then criminals won't use it.
  - mozumder 11y ago
    So, get rid of all laws?
  - Odin78 11y ago
    The thing is: if encryption is illegal and you encrypt your illegal material so law enforcement can't convict you for it, they can still convict you for using encryption.
    - Piskvorrr 11y ago
      Which is such a great idea, because proper encryption is undistinguishable from random data: so, if you have a drive, any drive, good luck convincing anyone that it does not contain any encrypted content, and that whatever is in the empty sectors is just garbage. Guilty until proven innocent.
      - 11y ago
shpx 11y ago
>We could put ankle bracelets on everybody so we'd know where everyone was all the time. How does everyone carrying phones not already make this the case?
- x5n1 11y ago
  It's a choice. Duh. Don't have a phone so they can't monitor you while you are not at home.
  - agd 11y ago
    How easy is it to be part of society without a phone? The way people communicate, organize, meet, is all via these devices. Yes, whether to have these devices is technically a choice, but when the social cost of choosing not to have one is so high, the choice is made for you.
    - mquander 11y ago
      For people on Hacker News? Easy as shit. You have employable skills and Internet access. Life will be strictly better than it was when you didn't have a smartphone fifteen years ago.
    - nickik 11y ago
      Dont be so dramatic. You can have a phone and leave it at home if your gone do something where you don't want to get tracket. Thats just the most simple option. Its not a binary choice.
      - devishard 11y ago
        I don't want to be tracked when I go to work (or ever), but I have to bring my cell phone to work because I need it to do my job. So, yes it's a "choice": I can have my privacy or I can have my job.
        ambicapter 11y ago
kiba 11y ago
Sometime I wonder if the FBI and other security agencies lost perspectives or they know something that we don't. Time and time again, their argumentation are not particularly persuasive. I don't doubt the existence of terrorists, but it seems that they are more boogeymen rather than an actual threats. And when it came down to it, the power of terrorists is to inspire fear, rather than kill people. They can change us because we felt the need to change.
- JustSomeNobody 11y ago
  Politicians need to appear strong. For some reason, especially in the U.S., "leaders" have to appear strong. When there's no war going on, they have to start one. Terrorism is easy. There's really nobody to fight, but you get to fight them anyway. Politicians LOVE this. Law enforcement loves it too. They get to trot it out as an excuse to lengthen their leashes.
- rorykoehler 11y ago
  Standard power play. There always needs to be an enemy to fight against to keep the population inline. After the Soviet Union collapsed it left a vacuum so we had to invent terrorism as the new threat. IMO anyone who is scared of a couple of inbred bible/koran thumping terrorists isn't fit to lead a country.
emodendroket 11y ago
It seems clear to me that if all the money we spent on fighting terrorism since 9/11 were instead spent on, say, reducing traffic fatalities, it would have saved a lot more people.
- wiz21 11y ago
  That's so clear and so mathematically obvious, +100 karma point for you ! That's basic risk analysis
  - emodendroket 11y ago
    I mean, it's "clear and obvious" to me, but since it's a major issue every campaign season and the risks presented by our old and crumbling infrastructure, global warming, and other menaces that don't make gruesome cell phone videos is not most people don't seem to have noticed.
    - wiz21 11y ago
      100% agree... My old age tells me that politics are a necessary evil...
  - summerdown2 11y ago
    Except that the comparison isn't: 320,000 people dead due to traffic fatalities over 10 years. vs 350 people dead in terrorism over 10 years It's: 320,000 people dead due to traffic fatalities over 10 years causing little political fallout. vs 350 people dead in terrorism over 10 years plus a lot of political fallout for each event. Bluntly, to shift the risk argument we'd either need to take politicans out of the decision making and give it to some independent fact-based body, or get the media and people in general far more riled up about car crashes.
    - emodendroket 11y ago
      It seems to me that you are simply reiterating the original argument.
jccc 11y ago
Before you comment, please consider whether you'd prefer to vent your frustration in online message boards with like-minded people, or spend that potential energy in other ways: "What you can do about it: -- You can contact the Obama White House online to comment on strong encryption. https://www.whitehouse.gov/webform/share-your-thoughts-onstrong-encryption https://www.whitehouse.gov/webform/share-your-thoughts-onstr... -- You can contact your state Senators and Representatives via the contact information supplied by ContactingTheCongress.org. http://www.contactingthecongress.org/ http://www.contactingthecongress.org/ -- You can specifically contact Senators Richard Burr (R-NC) and Dianne Feinstein (D-CA) to express concerns about their bill intended to force companies to weaken or work around encryption under court orders. http://www.contactingthecongress.org/cgi-bin/newseek.cgi?site=ctc2011&state=nc http://www.contactingthecongress.org/cgi-bin/newseek.cgi?sit... http://www.contactingthecongress.org/cgi-bin/newseek.cgi?site=ctc2011&state=ca http://www.contactingthecongress.org/cgi-bin/newseek.cgi?sit... http://appleinsider.com/articles/16/03/09/proposed-senate-bill-penalizing-resistance-to-decryption-requests-nears-completion-could-be-introduced-next-week http://appleinsider.com/articles/16/03/09/proposed-senate-bi... Express yourself with the honesty and clarity that the government's charm offensive is lacking." http://appleinsider.com/articles/16/03/14/take-a-stand-against-the-obama-fbi-anti-encryption-charm-offensive http://appleinsider.com/articles/16/03/14/take-a-stand-again...
- adam12 11y ago
  I feel like that White House petition is a honeypot.
  - ccvannorman 11y ago
    This thread is a honeypot. Also buying any iPhone made after 2015.
    - headgasket 11y ago
      are you being sarcastic? otherwise can you elaborate?
- callcallcall 11y ago
deleted 11y ago
[deleted]
xrorre 11y ago
The Apple situation annoys me because it's no longer about the web. It's about breaking crypto on a device which is vendor-locked. The same thing as breaking homegrown crypto, or DVD crypto; easy and trivial. The fact that Apple doesn't use ephemeral keys and can't simply throw away the key in the event of an incident is worrisome enough. Real crypto needs to be more compartmented than that. A bank is not secure because of the massive door - it's safe because it would take a thief weeks to empty every safety deposit box. It's also made even safer when the key is (more or less) thrown away for periods of time and nobody can get it. Even with manual over-ride. Literally somebody could be dying inside the safe and nobody could save them. In properly implemented crypto nobody should hear you scream.
- nickik 11y ago
  The hole concept of end to end encryption works far better if the ends are actually secure. We use end to end encryption to protect our communucation one the move and our endpoint are protected with secure hardware. Weakening end point security is certantly not as bad as going after tls (for example) but its still a vital piece of our trust chain. And the smartphone will grow in importance as an authentification factor and that makes it even more vital.
JustSomeNobody 11y ago
Edit: Posted to wrong article. My apologies.
- deleted 11y ago
  [deleted]
- rntz 11y ago
  Wrong article. You probably meant to reply to https://news.ycombinator.com/item?id=11288841 https://news.ycombinator.com/item?id=11288841
  - JustSomeNobody 11y ago
    Yes, my apologies. Too many tabs open.
sugarfactory 11y ago
I think Apple and all other tech companies that support it move as the FBI (or whoever controls the FBI) expected or wanted. What was revealed a few years ago was the fact that big tech companies betrayed people's trust. So quite naturally they should attempt to regain that trust. Because if majority of people stop trusting tech companies and start using end-to-end encryption, use of encryption stops working as a signifier that indicates a higher likelihood that the user's doing something wrong. Thus it's crucial to keep ordinary people away from using encryption. In order to achieve this, it's important to make people trust big tech companies again. In my opinion, this is what the writer of the plot of the dispute between the FBI and Apple thinks.
themartorana 11y ago
"You know, we could, at the far extreme to make the FBI's job easier, put ankle bracelets on everybody so that we'd know where everybody was all the time. That's a ridiculous example, but my point is encryption and privacy are larger issues than fighting terrorism." Ok so replace "ankle bracelets" with "GPS/cell triangulated device" and it's a ridiculous example because what, things that are already real aren't really "examples"?
clarkmoody 11y ago
The larger issue, by far, is whether we are a free people. From the article: CLARKE: No, the point I'm trying to make is there are limits. And what this is is a case where the federal government, using a 1789 law, is trying to compel speech. And courts have ruled in the past, appropriately, that the government cannot compel speech. What the FBI and the Justice Department are trying to do is to make code writers at Apple - to make them write code that they do not want to write that will make their systems less secure. If the FBI gets its way in this case, forcing Apple employees to perform a service for the government, then it sets the precedent for the government to compel anyone to do anything the government wants. When you are forced to work for someone against your will, this is called slavery. Of course the FBI used a terrorist attack to try and get what it's always wanted, and it will abuse the unlock power in the future if it gets it now, but judges could easily cite this case as a defense for the government to compel other action from the people. Clarke makes it sound like there is court precedent against this compulsion, but that would be overturned if the FBI wins. Indeed, encryption and privacy are very important, but our very liberty is more important.
- pgwhalen 11y ago
  This is way overblown. Yes, the government should not be able compel Apple to build back doors, but this isn't some kind of new precedent about compulsion. There are plenty of industries where the cost of doing business includes creating something to satisfy a regulatory requirement.
  - jaycroft 11y ago
    I believe that it is indeed a new precident about compulsion. If say, I want to make airplane parts I need to satisfy regulatory requirements. I know those requirements in advance, and can decide if I want to be a parts manufacturer or not. Lets say I instead decide to make drone parts for hobbyists because there's less regulation. Should the government be able to compel me to obtain an AS9100 cert so that they can bolt some of my hobby parts on a DHS operated drone? I would call that slavery. The FBI is attempting to compel Apple to do work that they never anticipated in order to comply with laws that do not yet exist.
username3 11y ago
Gun rights are larger issues than fighting mass shootings.
ccvannorman 11y ago
I am surprised that a search for "math" only turned up one result in this thread, about car accidents vs terrorist victims. Isn't it true that encryption legislation or policy is sort of irrelevant next to the very clear math that says encryption will always be ahead of decryption? Even in a (hopefully avoidable) dystopia where encryption is illegal, would that really stop technology companies from continuing to do what they've always done? John Oliver has a great segment[1] where he notes that the majority of cheap, available encryption applications aren't even US-based, and so it becomes nigh-impossible for our (or any) government to stop any pedestrian from encrypting. [1] https://www.youtube.com/watch?v=zsjZ2r9Ygzw https://www.youtube.com/watch?v=zsjZ2r9Ygzw
- h0w412d 11y ago
  Yep. Cory Doctorow has talked about this: how the universe "makes it easy" to secure communications because mathematically, it's really easy to encrypt (verify that a number is prime) and really difficult to decrypt through hacking (factor a huge prime number). And because of that, outlawing encryption is really outlawing math, which is ridiculous. Math is a universal API everyone has access to simply by existing. You can't outlaw math.
  - nickpsecurity 11y ago
    Do you have a link to that? Because I know a guy who really needs to counterpoint it. High-security engineer, Clive Robinson, always said security is about physics if you look at it down to the hardware. The physics try to connect things in ways you didn't see coming. That allows unauthorized communications. The physics also try to corrupt the operation of your chips. That compromises computational security mechanisms. Even encryption algorithms had tons of problems when they were implemented to the point that it takes pro's with years of experience to implement them with any assurance. Those are often broken later. So, if Doctorow said that, he couldn't be further from the truth. The universe seems to do everything it can to make security difficult via physics itself. Throw in economics and biology (evolving malicious attackers) to top the argument off.
    - 11y ago
kordless 11y ago
Encryption and privacy are what make this reality work. You think you are you. I think I am me. This reality's ability to keep those separate is a privacy feature. From a Buddhist's perspective our understanding (Dharma) is that we are, on some level, all the same entity. One of the early sutras put it this way: > "Discrimination is consciousness. Nondiscrimination is wisdom. Clinging to consciousness will bring disgrace but clinging to wisdom will bring purity. Disgrace leads to birth and death but purity leads to Nirvana." Encryption gives the means by which we can enable privacy between ourselves, or what we think of as self. If we enable complete privacy from all others, we drop into a self-world. If we disable privacy, and join all the others disabling privacy, we drop into an isolated type of Nirvana, with the implication everything becomes quite boring. I have compared this in the past to the observed push and pull of public and private cloud business models. One solution may come via virtual realities where we can arrive at consensus in a fair and measured way without centralized control. It is my belief that immutable data structures backed by encryption, such as a blockchain, are the path out of this mess. Here's Alan Watts talking about this: https://www.youtube.com/watch?v=lBOcFwUzIIQ https://www.youtube.com/watch?v=lBOcFwUzIIQ
exabrial 11y ago
"You dont need a gun" "You don't need encryption" It's not the bill of needs. I was born with these rights. This is the danger of eroding the constitution, the arguments can be used against whatever issue you want. If we want it changed, do it the right way and pass an amendment. But please, protect the integrity of the most important document we have.
bicknergseng 11y ago
I just had a thought: what happens if Apple complies with the order (say they lose the legal battle or something), but individual employees refuse to build the software? I think the verdict is out on whether or not Apple, a corporation, can be compelled to do this, but what if they can't find anyone to do it? Just thinking it _should_ be much harder to compel individuals to do something like this than it is to compel a corporation.
- JoeAltmaier 11y ago
  Ha! Folks will line up to do the job. I've refused to violate federal regulations (re wireless devices, bands and transmission rules) as a contractor and had the regular employees jump right in and volunteer for the job. At a Midwest manufacturer in a liberal (college) town.
  - bicknergseng 11y ago
    Not actually interested in if people are willing to do ethically questionable engineering work; I'm interested in whether or not the government can compel them to do so.

647 points by Osiris30 11y ago

> No, David. If I were in the job now, I would have simply told the FBI to call Fort Meade, the headquarters of the National Security Agency, and NSA would have solved this problem for them. They're not as interested in solving the problem as they are in getting a legal precedent. That's quite the quote, especially given his history of employment. The weirdest thing about this whole cell-phone saga to me is that the perps are dead, did not appear to be part of some organized group and that very little could be done to them that hasn't been done already based on evidence found on the phone. Then there is the bit that a lot of the information that is on the phone is also already in the log files of the carriers. It's as if that phone somehow magically is going to yield an entirely new class of information that may not even exist in the first place. To me it has been evident from day one that this is not about this phone or the data that's on it but just about the legal precedent, getting it in black-and-white from the former head of counter terrorism is quite an indictment of his successors.

ptaipale 11y ago
> the perps are dead, did not appear to be part of some organized group A reasonable reason for inquiry here is to actually try to make sure if they were part of some organized group. "Appear not to be" is not quite enough. This is a valid reason to investigate even if they are dead. How did they get radicalized, etc. Not that it is a good enough reason to enforce breaking of encryption in the way proposed, but in a murder inquiry, privacy of the perps has to give way.
- nickik 11y ago
  From other intel they know that he did not use his work phone much and saw no need to destroy it. He did destroy his private phone, so I think its quite clear that their is nothing on that phone. I think its reasonable for the FBI to want to access it, but lets not have any illusions, the change that their is any evidence on the phone is basically 0%.
- ohyeshedid 11y ago
  If this was really about the privacy of the perps; an NSL would've been enough and we'd never know about it. This is about setting precedent, and as publicly as possible. If the feds get their way the entire idea of encryption is weakened, and not just for the lawful citizens. I suspect the reason for having this battle so publicly is propaganda based, just as it was with Zimmermann in the 90's.
  - dhimes 11y ago
    Since you brought up NSL.... The legality of the NSL (which does not require oversight- the FBI can self-sign them) hinges on the idea that the persons on whom the information is being gathered have/had "no reasonable expectation" of privacy of the information. That said, if these back doors were to be instituted, could the argument then be made that we now have "no reasonable expectation" of privacy of anything on our cell phones? Could this set a precedent of unholy proportions?
    - ohyeshedid 11y ago
      Absolutely, and as terrifying as that possibility is I personally think they didn't go the NSL route because Apple is big enough to finally prove or disprove the constitutionality of NSL's; even bring the process to mainstream attention. That's something the DOJ would never want to see happen, because then everyone can come out of the shadows and tell their story.
- danieldk 11y ago
  A reasonable reason for inquiry here is to actually try to make sure if they were part of some organized group. "Appear not to be" is not quite enough. For a country that kills based on metadata[1], it seems quite far-fetched that they couldn't map out potentially interesting connections using just metadata. Also, it would be pretty dumb to put any revealing data on a work phone with iCloud backups enabled (which is just not accessible due to the FBI's mistakes). At any rate, this discussion is quite besides the point. Permitting this phone to be unlocked (or the hundred or so other phones mentioned) will open the floodgates for questionable regimes and a hunt for Apple's private key (more automation to handle requests will reduce security). [1] http://www.nybooks.com/daily/2014/05/10/we-kill-people-based-metadata/ http://www.nybooks.com/daily/2014/05/10/we-kill-people-based...
- hammock 11y ago
  "Appear not to be" is often enough. The government is required to have probable cause to conduct a search.
- EdHominem 11y ago
  > "Appear not to be" is not quite enough. It has to be, because there is no perfect. Everything is a numbers game between ever-more unlikely hypothetical evidence that might yield a valuable unknown, and the cost of collecting it. By such completist thinking, we should examine every image and video in the world because they might show up in the background of a birthday party video or vacation selfie, giving us another clue. Similarly, we should interview everyone in cities they've been known to be in... But in reality, unlike in a game or a movie, there is no 100% complete. The phone isn't one of a finite list of clues to examine whereby you will know everything you need to know. By fixating on the phone, or any few issues, you miss the larger point. There's very little likelihood of learning anything of value here, and are far richer leads elsewhere. This is just our security industry grandstanding for more money.
  - ptaipale 11y ago
    There is no perfect, but I think that by ordinary police standards in any developed country, not trying to investigate this kind of perp's phones would be too imperfect. It would be sloppy police work and any police officer deciding not to try to inspect the phone would be vulnerable to accusations of misconduct. That doesn't mean that I agree that Apple should be forced to break the encryption. It means the police really have a duty to investigate.
    - EdHominem 11y ago
      I'm not saying they shouldn't be interested... What if, instead of simply being locked, the phone was eaten by a pelican that flew out over the ocean and died. Gone. Should we dredge the ocean to find the phone? It's a duty to do so, right? The FBI have tried, and failed. How much more should they dredge before we stop harping on about this one piece of potential evidence? In this case they have the phone physically in hand so they feel blocked and powerless, but from a cost-benefit point of view it might as well be at the bottom of the ocean. Doesn't their duty compel them to investigate the most-likely to payout leads, not play political games over high-profile issues?
      - 11y ago
monk_e_boy 11y ago
No the weirdest thing is that Apple is standing up to the government. Isn't that just wrong? You, the people choose the government, so in effect Apple is standing up to the people of America and saying 'no'. If you the people didn't want the FBI to be bullish then choose a different government. It feels to me (an outsider) that it's the government that is out of control and is not accountable to the people.
- thomasahle 11y ago
  Apple is in many countries, with governments who'd all like this kind of access. If you give FBI the tools, you also have to accept Russia, China and the whole gang having access to your phone.
  - monk_e_boy 11y ago
    Well that is up to Apple, they don't have to make one phone. They could make a US version and a rest of the world version.
    - thomasahle 11y ago
      And if the FBI wanted to open a rest of the world version? Or another government wanted to open a US version?
      - EdHominem 11y ago
        > Or another government wanted to open a US version? There's a good point. And who knows what limits they'd go to, to force Apple's hand? (Kidnapping, etc.) Apple is really only safe if they actually can't break their own encryption. Anything less makes them a target.
    - Piskvorrr 11y ago
      And then build that fence all along the border so that no world-version phones get in (see how well it worked for other illegal imports). Plus, you haven't solved the problem at all: you just say "okay, let's make only US phones vulnerable to foreign hacking." Should I enumerate why that's a bad thing?
masklinn 11y ago
And IIRC the phone in question is the perp's work phone, they also had personal phones which they destroyed, so the perps themselves knew phones could hold valuable data but saw no value in the the phone the FBI wants unlocked.
- dopamean 11y ago
  I think the FBI already acknowledged very early on that they didn't expect to find anything useful on the phone for these very reasons.
  - richmarr 11y ago
    I imagine there's a Venn diagram of overlap between what a nutjob thinks is worth hiding and what would be of interest to law enforcement organisations. For example I doubt many of these extremists would both trying to hide information that could be used for psychological profiling of future attackers
    - jacquesm 11y ago
      The psychological profiling of future attackers has nothing to do with getting away with this push to access that particular phone. That's simply not even on the radar at this point, the FBI would be laughed out of any court they went to if they presented that as the reason why they want access. Their fig-leaf is that the phone may contain valuable information regarding this particular crime.
      - richmarr 11y ago
        Criticising the example of psychological profiling doesn't address my actual point.
dec0dedab0de 11y ago
I think it's all an act to make people think apple phones are more secure than they actually are.
- ethbro 11y ago
  From comments around the case, the government operates like any other black hat. Which is to say they absolutely have vulnerabilities that work against certain versions of iOS, but probably not others. And the NSA likely has more than a few zero days, simply because it's a far cheaper way for them to do their job than any alternatives. Just like with any piece of software, there is no "secret vulnerability that works all the time forever": it's discover, exploit, patch, repeat. (Which, incidentally, is also the argument against key escrow schemes. Whereas it would be discover, exploit all devices that implement the key escrow code, wait until the government develops a new patch, wait until all device manufacturers incorporate the patch... repeat.)
steveax 11y ago
It's worth listening to the audio to hear how surprised David is with this blunt charge. Clearly unexpected. Also: parallel construction (i.e.: the NSA doesn't want to reveal it has already done this)

ck2 11y ago

Other governments are definitely going to force manufacturers to make their phones unlockable or not for sale in their country. China, Russia, Saudia Arabia, all forced Blackberry to turn over their encryption keys long ago. US politicians should set an example and say we are NOT going to be like China and Russia and other repressive regimes and that when people's lives are literally on their phones, they have a reasonable right to privacy and protection from search and seizure, you know like in our constitution but ignored everyday.

BBlarat 11y ago
Well the winds have changed on that stance, at least in Europe. I've seen a couple of leading politicians say something in the line of: "If china can do it so can we" concerning the Chinese firewall and blocking "unwanted" content on the web, which is scary.
- DanielBMarkham 11y ago
  If it happens, it'll become precedent, then all countries will want to do it. The next logical step is to outlaw phones and devices that are incapable of breaking into. Then they'll make it so you need a license to employ cryptography. It sounds crazy, but where we are right now would have sounded just as crazy 15 years ago.
  - mobiuscog 11y ago
    >Then they'll make it so you need a license to employ cryptography. You already need one to export certain goods / to certain countries.
    - FroshKiller 11y ago
      Big difference between "need" and "are required to have"!
  - masklinn 11y ago
    > The next logical step is to outlaw phones and devices that are incapable of breaking into. Then they'll make it so you need a license to employ cryptography. Welcome to the 90s: https://en.wikipedia.org/wiki/Export_of_cryptography_from_the_United_States#PC_era https://en.wikipedia.org/wiki/Export_of_cryptography_from_th... [0] > It sounds crazy, but where we are right now would have sounded just as crazy 15 years ago. Hardly. 15 years ago, the US were just barely past their encryption export ban, and we had yet to deal with the (still ongoing) fallout from it. [0] although back then the US only tried to backdoor or ban strong encryption for the international market, not for the domestic one, for simplicity reasons the domestic versions of exported products often used "export-grade" (shit) encryption

Gratsby 11y ago

>PRESIDENT BARACK OBAMA: If, technologically, it is possible to make an impenetrable device or system where the encryption is so strong that there's no key - there's no door at all - then how do we apprehend the child pornographer? How do we solve or disrupt a terrorist plot? It's so disappointing to me to hear a quote like that from the President.

x5n1 11y ago
What if the terrorist or pedo has things in his mind, that means all people's minds should be monitored at all times... Otherwise there is a chance that they might think thoughts to do evil things and then they might carry them out. I uhh want to emphasize that we should think of the uhh children.
Jafit 11y ago
Its fine though, because if you make something illegal then criminals won't use it.
- mozumder 11y ago
  So, get rid of all laws?
- Odin78 11y ago
  The thing is: if encryption is illegal and you encrypt your illegal material so law enforcement can't convict you for it, they can still convict you for using encryption.
  - Piskvorrr 11y ago
    Which is such a great idea, because proper encryption is undistinguishable from random data: so, if you have a drive, any drive, good luck convincing anyone that it does not contain any encrypted content, and that whatever is in the empty sectors is just garbage. Guilty until proven innocent.
    - 11y ago

shpx 11y ago

>We could put ankle bracelets on everybody so we'd know where everyone was all the time. How does everyone carrying phones not already make this the case?

x5n1 11y ago
It's a choice. Duh. Don't have a phone so they can't monitor you while you are not at home.
- agd 11y ago
  How easy is it to be part of society without a phone? The way people communicate, organize, meet, is all via these devices. Yes, whether to have these devices is technically a choice, but when the social cost of choosing not to have one is so high, the choice is made for you.
  - mquander 11y ago
    For people on Hacker News? Easy as shit. You have employable skills and Internet access. Life will be strictly better than it was when you didn't have a smartphone fifteen years ago.
  - nickik 11y ago
    Dont be so dramatic. You can have a phone and leave it at home if your gone do something where you don't want to get tracket. Thats just the most simple option. Its not a binary choice.
    - devishard 11y ago
      I don't want to be tracked when I go to work (or ever), but I have to bring my cell phone to work because I need it to do my job. So, yes it's a "choice": I can have my privacy or I can have my job.
      - ambicapter 11y ago

kiba 11y ago

Sometime I wonder if the FBI and other security agencies lost perspectives or they know something that we don't. Time and time again, their argumentation are not particularly persuasive. I don't doubt the existence of terrorists, but it seems that they are more boogeymen rather than an actual threats. And when it came down to it, the power of terrorists is to inspire fear, rather than kill people. They can change us because we felt the need to change.

JustSomeNobody 11y ago
Politicians need to appear strong. For some reason, especially in the U.S., "leaders" have to appear strong. When there's no war going on, they have to start one. Terrorism is easy. There's really nobody to fight, but you get to fight them anyway. Politicians LOVE this. Law enforcement loves it too. They get to trot it out as an excuse to lengthen their leashes.
rorykoehler 11y ago
Standard power play. There always needs to be an enemy to fight against to keep the population inline. After the Soviet Union collapsed it left a vacuum so we had to invent terrorism as the new threat. IMO anyone who is scared of a couple of inbred bible/koran thumping terrorists isn't fit to lead a country.

emodendroket 11y ago

It seems clear to me that if all the money we spent on fighting terrorism since 9/11 were instead spent on, say, reducing traffic fatalities, it would have saved a lot more people.

wiz21 11y ago
That's so clear and so mathematically obvious, +100 karma point for you ! That's basic risk analysis
- emodendroket 11y ago
  I mean, it's "clear and obvious" to me, but since it's a major issue every campaign season and the risks presented by our old and crumbling infrastructure, global warming, and other menaces that don't make gruesome cell phone videos is not most people don't seem to have noticed.
  - wiz21 11y ago
    100% agree... My old age tells me that politics are a necessary evil...
- summerdown2 11y ago
  Except that the comparison isn't: 320,000 people dead due to traffic fatalities over 10 years. vs 350 people dead in terrorism over 10 years It's: 320,000 people dead due to traffic fatalities over 10 years causing little political fallout. vs 350 people dead in terrorism over 10 years plus a lot of political fallout for each event. Bluntly, to shift the risk argument we'd either need to take politicans out of the decision making and give it to some independent fact-based body, or get the media and people in general far more riled up about car crashes.
  - emodendroket 11y ago
    It seems to me that you are simply reiterating the original argument.

jccc 11y ago

Before you comment, please consider whether you'd prefer to vent your frustration in online message boards with like-minded people, or spend that potential energy in other ways: "What you can do about it: -- You can contact the Obama White House online to comment on strong encryption. https://www.whitehouse.gov/webform/share-your-thoughts-onstrong-encryption https://www.whitehouse.gov/webform/share-your-thoughts-onstr... -- You can contact your state Senators and Representatives via the contact information supplied by ContactingTheCongress.org. http://www.contactingthecongress.org/ http://www.contactingthecongress.org/ -- You can specifically contact Senators Richard Burr (R-NC) and Dianne Feinstein (D-CA) to express concerns about their bill intended to force companies to weaken or work around encryption under court orders. http://www.contactingthecongress.org/cgi-bin/newseek.cgi?site=ctc2011&state=nc http://www.contactingthecongress.org/cgi-bin/newseek.cgi?sit... http://www.contactingthecongress.org/cgi-bin/newseek.cgi?site=ctc2011&state=ca http://www.contactingthecongress.org/cgi-bin/newseek.cgi?sit... http://appleinsider.com/articles/16/03/09/proposed-senate-bill-penalizing-resistance-to-decryption-requests-nears-completion-could-be-introduced-next-week http://appleinsider.com/articles/16/03/09/proposed-senate-bi... Express yourself with the honesty and clarity that the government's charm offensive is lacking." http://appleinsider.com/articles/16/03/14/take-a-stand-against-the-obama-fbi-anti-encryption-charm-offensive http://appleinsider.com/articles/16/03/14/take-a-stand-again...

adam12 11y ago
I feel like that White House petition is a honeypot.
- ccvannorman 11y ago
  This thread is a honeypot. Also buying any iPhone made after 2015.
  - headgasket 11y ago
    are you being sarcastic? otherwise can you elaborate?
callcallcall 11y ago

deleted 11y ago

[deleted]

xrorre 11y ago

The Apple situation annoys me because it's no longer about the web. It's about breaking crypto on a device which is vendor-locked. The same thing as breaking homegrown crypto, or DVD crypto; easy and trivial. The fact that Apple doesn't use ephemeral keys and can't simply throw away the key in the event of an incident is worrisome enough. Real crypto needs to be more compartmented than that. A bank is not secure because of the massive door - it's safe because it would take a thief weeks to empty every safety deposit box. It's also made even safer when the key is (more or less) thrown away for periods of time and nobody can get it. Even with manual over-ride. Literally somebody could be dying inside the safe and nobody could save them. In properly implemented crypto nobody should hear you scream.

nickik 11y ago
The hole concept of end to end encryption works far better if the ends are actually secure. We use end to end encryption to protect our communucation one the move and our endpoint are protected with secure hardware. Weakening end point security is certantly not as bad as going after tls (for example) but its still a vital piece of our trust chain. And the smartphone will grow in importance as an authentification factor and that makes it even more vital.

JustSomeNobody 11y ago

Edit: Posted to wrong article. My apologies.

deleted 11y ago
[deleted]
rntz 11y ago
Wrong article. You probably meant to reply to https://news.ycombinator.com/item?id=11288841 https://news.ycombinator.com/item?id=11288841
- JustSomeNobody 11y ago
  Yes, my apologies. Too many tabs open.

sugarfactory 11y ago

I think Apple and all other tech companies that support it move as the FBI (or whoever controls the FBI) expected or wanted. What was revealed a few years ago was the fact that big tech companies betrayed people's trust. So quite naturally they should attempt to regain that trust. Because if majority of people stop trusting tech companies and start using end-to-end encryption, use of encryption stops working as a signifier that indicates a higher likelihood that the user's doing something wrong. Thus it's crucial to keep ordinary people away from using encryption. In order to achieve this, it's important to make people trust big tech companies again. In my opinion, this is what the writer of the plot of the dispute between the FBI and Apple thinks.

themartorana 11y ago

"You know, we could, at the far extreme to make the FBI's job easier, put ankle bracelets on everybody so that we'd know where everybody was all the time. That's a ridiculous example, but my point is encryption and privacy are larger issues than fighting terrorism." Ok so replace "ankle bracelets" with "GPS/cell triangulated device" and it's a ridiculous example because what, things that are already real aren't really "examples"?

clarkmoody 11y ago

The larger issue, by far, is whether we are a free people. From the article: CLARKE: No, the point I'm trying to make is there are limits. And what this is is a case where the federal government, using a 1789 law, is trying to compel speech. And courts have ruled in the past, appropriately, that the government cannot compel speech. What the FBI and the Justice Department are trying to do is to make code writers at Apple - to make them write code that they do not want to write that will make their systems less secure. If the FBI gets its way in this case, forcing Apple employees to perform a service for the government, then it sets the precedent for the government to compel anyone to do anything the government wants. When you are forced to work for someone against your will, this is called slavery. Of course the FBI used a terrorist attack to try and get what it's always wanted, and it will abuse the unlock power in the future if it gets it now, but judges could easily cite this case as a defense for the government to compel other action from the people. Clarke makes it sound like there is court precedent against this compulsion, but that would be overturned if the FBI wins. Indeed, encryption and privacy are very important, but our very liberty is more important.

pgwhalen 11y ago
This is way overblown. Yes, the government should not be able compel Apple to build back doors, but this isn't some kind of new precedent about compulsion. There are plenty of industries where the cost of doing business includes creating something to satisfy a regulatory requirement.
- jaycroft 11y ago
  I believe that it is indeed a new precident about compulsion. If say, I want to make airplane parts I need to satisfy regulatory requirements. I know those requirements in advance, and can decide if I want to be a parts manufacturer or not. Lets say I instead decide to make drone parts for hobbyists because there's less regulation. Should the government be able to compel me to obtain an AS9100 cert so that they can bolt some of my hobby parts on a DHS operated drone? I would call that slavery. The FBI is attempting to compel Apple to do work that they never anticipated in order to comply with laws that do not yet exist.

username3 11y ago

Gun rights are larger issues than fighting mass shootings.

ccvannorman 11y ago

I am surprised that a search for "math" only turned up one result in this thread, about car accidents vs terrorist victims. Isn't it true that encryption legislation or policy is sort of irrelevant next to the very clear math that says encryption will always be ahead of decryption? Even in a (hopefully avoidable) dystopia where encryption is illegal, would that really stop technology companies from continuing to do what they've always done? John Oliver has a great segment[1] where he notes that the majority of cheap, available encryption applications aren't even US-based, and so it becomes nigh-impossible for our (or any) government to stop any pedestrian from encrypting. [1] https://www.youtube.com/watch?v=zsjZ2r9Ygzw https://www.youtube.com/watch?v=zsjZ2r9Ygzw

h0w412d 11y ago
Yep. Cory Doctorow has talked about this: how the universe "makes it easy" to secure communications because mathematically, it's really easy to encrypt (verify that a number is prime) and really difficult to decrypt through hacking (factor a huge prime number). And because of that, outlawing encryption is really outlawing math, which is ridiculous. Math is a universal API everyone has access to simply by existing. You can't outlaw math.
- nickpsecurity 11y ago
  Do you have a link to that? Because I know a guy who really needs to counterpoint it. High-security engineer, Clive Robinson, always said security is about physics if you look at it down to the hardware. The physics try to connect things in ways you didn't see coming. That allows unauthorized communications. The physics also try to corrupt the operation of your chips. That compromises computational security mechanisms. Even encryption algorithms had tons of problems when they were implemented to the point that it takes pro's with years of experience to implement them with any assurance. Those are often broken later. So, if Doctorow said that, he couldn't be further from the truth. The universe seems to do everything it can to make security difficult via physics itself. Throw in economics and biology (evolving malicious attackers) to top the argument off.
  - 11y ago

kordless 11y ago

Encryption and privacy are what make this reality work. You think you are you. I think I am me. This reality's ability to keep those separate is a privacy feature. From a Buddhist's perspective our understanding (Dharma) is that we are, on some level, all the same entity. One of the early sutras put it this way: > "Discrimination is consciousness. Nondiscrimination is wisdom. Clinging to consciousness will bring disgrace but clinging to wisdom will bring purity. Disgrace leads to birth and death but purity leads to Nirvana." Encryption gives the means by which we can enable privacy between ourselves, or what we think of as self. If we enable complete privacy from all others, we drop into a self-world. If we disable privacy, and join all the others disabling privacy, we drop into an isolated type of Nirvana, with the implication everything becomes quite boring. I have compared this in the past to the observed push and pull of public and private cloud business models. One solution may come via virtual realities where we can arrive at consensus in a fair and measured way without centralized control. It is my belief that immutable data structures backed by encryption, such as a blockchain, are the path out of this mess. Here's Alan Watts talking about this: https://www.youtube.com/watch?v=lBOcFwUzIIQ https://www.youtube.com/watch?v=lBOcFwUzIIQ

exabrial 11y ago

"You dont need a gun" "You don't need encryption" It's not the bill of needs. I was born with these rights. This is the danger of eroding the constitution, the arguments can be used against whatever issue you want. If we want it changed, do it the right way and pass an amendment. But please, protect the integrity of the most important document we have.

bicknergseng 11y ago

I just had a thought: what happens if Apple complies with the order (say they lose the legal battle or something), but individual employees refuse to build the software? I think the verdict is out on whether or not Apple, a corporation, can be compelled to do this, but what if they can't find anyone to do it? Just thinking it _should_ be much harder to compel individuals to do something like this than it is to compel a corporation.

JoeAltmaier 11y ago
Ha! Folks will line up to do the job. I've refused to violate federal regulations (re wireless devices, bands and transmission rules) as a contractor and had the regular employees jump right in and volunteer for the job. At a Midwest manufacturer in a liberal (college) town.
- bicknergseng 11y ago
  Not actually interested in if people are willing to do ethically questionable engineering work; I'm interested in whether or not the government can compel them to do so.