6 ms·

The good: > Congress should not weaken this vital technology [encryption] because doing so works against the national interest. The bad: > Metadata may not c

by gred 10y ago

The good: > Congress should not weaken this vital technology [encryption] because doing so works against the national interest. The bad: > Metadata may not completely replace the loss of encrypted content, but metadata analysis could play a role in filling in the gap. The technology community leverages this information every day to improve services and target advertisements. There appears to be an opportunity for law enforcement to better leverage this information in criminal investigations. The ugly: > Although much of the debate has focused on requiring third party companies to decrypt information for the government, an alternative approach might involve compelling decryption by the individual consumers of these products. On a case-by-case basis, with proper court process, requiring an individual to provide a passcode or thumbprint to unlock a device could assist law enforcement in obtaining critical evidence without undermining the security or privacy of the broader population. > With respect to the Fifth Amendment, is there a substantive or legal difference between unlocking a device with a passcode and unlocking the device with a biometric identifier? Is entering a passcode a “testimonial act,” as some courts have held? Is a fingerprint different in any way? > Are there other circumstances that would enable the government to compel production of a passcode without undermining the Fifth Amendment?

UnoriginalGuy 10y ago
How is that "ugly?" - Case by case basis (i.e. not a giant dragnet). - Proper court process (i.e. warrants). - Likely not done in complete secret and with normal regularity oversight. That's the gold standard to me, not the ugly. I WANT courts to issue warrants against individuals based on a real concrete criminal case.
- tuna-piano 10y ago
  Exactly. If you think the government should be able to gain access to your house, filing cabinet, etc- with a warrant, why not your phone as well? The issue with the Snowden revelations and similiar programs is that there is no warrant or court process.
  - tanderson92 10y ago
    The only way to enforce a requirement that the government should be able to access your device / encrypted message / computer, is to require that software be written to follow government-mandated protocols which will allow the access and decryption. IMO, that's clearly a 1st amendment violation.
    - amckinlay 10y ago
      You mean like https://en.wikipedia.org/wiki/Communications_Assistance_for_Law_Enforcement_Act https://en.wikipedia.org/wiki/Communications_Assistance_for_... ?
    - angli 10y ago
      It's possible that you'll design a safe that the government cannot get into without destroying the contents. We say that the government can do their best to get into that safe if they have a warrant. There is no requirement that they be able to access the content (building the safe is not illegal), but there is a procedure that lets them try under appropriate conditions. What the parent posters have been talking about is a permission structure like that where law enforcement can try their best. Doesn't force anyone to write software in a particular way.
      - tanderson92 10y ago
        How do you enforce this: > On a case-by-case basis, with proper court process, requiring an individual to provide a passcode or thumbprint to unlock a device could assist law enforcement in obtaining critical evidence without undermining the security or privacy of the broader population. I can write a piece of messaging software which writes one of the following two in a log, without exception: (1) hash of /dev/urandom (2) message history with passphrase encryption If the government comes to me and asks for my passphrase and I say "I don't have one", how can they prove that I have a passphrase and am in contempt of any lawful order? The only actual way to enforce this is to make it illegal to write software which does (1). My point is: the reason the quoted parts in the top-level post are ugly is because search warrants should already be sufficient, unless you want to crack down on the ability of citizens to do the above.
- wyager 10y ago
  Because they're claiming that they have the right to extract information that (allegedly, not even certainly) exists inside the defendant's head, i.e. to force a testimony. There's a very obvious difference between saying "We're allowed to look inside your documents and records" and "We're allowed to force you to give up any fact we claim you know on pain of contempt charges". Even worse is the fact that people might not actually remember encryption keys (it's happened to me several times), which would mean you could be kept in jail indefinitely for forgetting the password to some trivial volume. I know I've used Truecrypt to keep copies of business receipts and subsequently forgotten the password years later; imagine if the government had erroneously accused me of having illegal materials in that encrypted volume.
  - Eridrus 10y ago
    Many countries already have these laws on the books, so you can see how it plays out in the rest of the world. In the case of your phone it's pretty unlikely you will not know the code.
- nabla9 10y ago
  Describe metadata analysis without giant dragnet. The beef in the metadata analysis comes with mass surveillance. Getting warrant to see where suspect sends emails is not in question. There is little analysis needed there.
  - reitanqild 10y ago
    Very much can be done on a case-by-case basis: Get proper warrant, ask telecom provider to provide call logs for customer under investigation. Analyse. Ask for call records for other customers that seems to be interesting based on initial study (if necessary after getting extended warrant.) None of this needs a constant omnipresent dragnet ir secret courts interpreting secret laws in secret ways. I'd go so far as to say it is dangerous to spread the idea that this is necessary.
    - idlewords 10y ago
      Your comment implies a vast private-sector dragnet, obtainable by subpoena.
      - cryptarch 10y ago
        You mean Google/Gmail and Facebook? That ought to do for at least 90% of all cases.
      - reitanqild 10y ago
        No it means detailed phone bills.
- gred 10y ago
  I see where you're coming from, but a few observations: - The judicial branch is wading through this question now (sometimes allowing compulsion, often not); it's not a question for Congress to answer, as appealing as it might be to them to help us redefine our Constitutional rights. - We're in the analogy danger zone, but would you say that your phone is more like a safe or more like an extension of your mind? What do you think your answer will be 10 years from now? 20 years from now? - Dragnet vs. compelled disclosure is a false dichotomy. The NSA and friends will continue their collection of data + metadata at scale, regardless of the outcome here.
  - peterwwillis 10y ago
    > The judicial branch is wading through this question now (sometimes allowing compulsion, often not); it's not a question for Congress to answer, as appealing as it might be to them to help us redefine our Constitutional rights. IANAL, but from what I recall, the entire point of the legislative branch is to create, remove, and re-define constitutional rights. The judicial affirms what they are, and the executive violates them. (Sorry, is that too on-the-nose?)
    - dgoldstein0 10y ago
      This is pretty close, but I would phrase it as the legislative branch gets to write the "fine print" of constitutional rights. Often the constitution is vague enough that the legislature has a large amount of creative license; sometimes though particular rights are given by the constitution or an amendment, in which case changing it in a large way, or removing it, requires another amendment - or else such attempted changes may be struck down by judicial challenge.
      - ethbro 10y ago
        The full US process could be summed as: The Constitution defines some rights and laws. Congress is empowered to grant additional rights and make additional laws. Congress also implements and defines rights and laws contained in the Constitution. If a citizen feels the Constitution has been violated by Congress, then the judicial system (headed by the Supreme Court) decides whether to invalidate the law(s) or not. If a majority of citizens wish to change the Constitution, then there is an amendment process.
- ekianjo 10y ago
  just to remind you SWAT was supposed to be case by case. Now they send it by default to destroy your door.
  - GordonS 10y ago
    I think you have a point here - all too often there is a creeping escalation of the use of such powers.
- FellowTraveler 10y ago
  Perhaps you are unfamiliar with the 5th Amendment to the U.S. Constitution.
- ekianjo 10y ago
  > That's the gold standard to me, not the ugly. I WANT courts to issue warrants against individuals based on a real concrete criminal case. Then you are not aware of the state of things. Most courts now issue warrants without fact checking, simply based on police reporting info from dubious informers. That's not how it's supposed to work yet they are doing little more than just stamping requests for warrants now.

by gred 10y ago

UnoriginalGuy 10y ago

How is that "ugly?" - Case by case basis (i.e. not a giant dragnet). - Proper court process (i.e. warrants). - Likely not done in complete secret and with normal regularity oversight. That's the gold standard to me, not the ugly. I WANT courts to issue warrants against individuals based on a real concrete criminal case.

tuna-piano 10y ago
Exactly. If you think the government should be able to gain access to your house, filing cabinet, etc- with a warrant, why not your phone as well? The issue with the Snowden revelations and similiar programs is that there is no warrant or court process.
- tanderson92 10y ago
  The only way to enforce a requirement that the government should be able to access your device / encrypted message / computer, is to require that software be written to follow government-mandated protocols which will allow the access and decryption. IMO, that's clearly a 1st amendment violation.
  - amckinlay 10y ago
    You mean like https://en.wikipedia.org/wiki/Communications_Assistance_for_Law_Enforcement_Act https://en.wikipedia.org/wiki/Communications_Assistance_for_... ?
  - angli 10y ago
    It's possible that you'll design a safe that the government cannot get into without destroying the contents. We say that the government can do their best to get into that safe if they have a warrant. There is no requirement that they be able to access the content (building the safe is not illegal), but there is a procedure that lets them try under appropriate conditions. What the parent posters have been talking about is a permission structure like that where law enforcement can try their best. Doesn't force anyone to write software in a particular way.
    - tanderson92 10y ago
      How do you enforce this: > On a case-by-case basis, with proper court process, requiring an individual to provide a passcode or thumbprint to unlock a device could assist law enforcement in obtaining critical evidence without undermining the security or privacy of the broader population. I can write a piece of messaging software which writes one of the following two in a log, without exception: (1) hash of /dev/urandom (2) message history with passphrase encryption If the government comes to me and asks for my passphrase and I say "I don't have one", how can they prove that I have a passphrase and am in contempt of any lawful order? The only actual way to enforce this is to make it illegal to write software which does (1). My point is: the reason the quoted parts in the top-level post are ugly is because search warrants should already be sufficient, unless you want to crack down on the ability of citizens to do the above.
wyager 10y ago
Because they're claiming that they have the right to extract information that (allegedly, not even certainly) exists inside the defendant's head, i.e. to force a testimony. There's a very obvious difference between saying "We're allowed to look inside your documents and records" and "We're allowed to force you to give up any fact we claim you know on pain of contempt charges". Even worse is the fact that people might not actually remember encryption keys (it's happened to me several times), which would mean you could be kept in jail indefinitely for forgetting the password to some trivial volume. I know I've used Truecrypt to keep copies of business receipts and subsequently forgotten the password years later; imagine if the government had erroneously accused me of having illegal materials in that encrypted volume.
- Eridrus 10y ago
  Many countries already have these laws on the books, so you can see how it plays out in the rest of the world. In the case of your phone it's pretty unlikely you will not know the code.
nabla9 10y ago
Describe metadata analysis without giant dragnet. The beef in the metadata analysis comes with mass surveillance. Getting warrant to see where suspect sends emails is not in question. There is little analysis needed there.
- reitanqild 10y ago
  Very much can be done on a case-by-case basis: Get proper warrant, ask telecom provider to provide call logs for customer under investigation. Analyse. Ask for call records for other customers that seems to be interesting based on initial study (if necessary after getting extended warrant.) None of this needs a constant omnipresent dragnet ir secret courts interpreting secret laws in secret ways. I'd go so far as to say it is dangerous to spread the idea that this is necessary.
  - idlewords 10y ago
    Your comment implies a vast private-sector dragnet, obtainable by subpoena.
    - cryptarch 10y ago
      You mean Google/Gmail and Facebook? That ought to do for at least 90% of all cases.
    - reitanqild 10y ago
      No it means detailed phone bills.
gred 10y ago
I see where you're coming from, but a few observations: - The judicial branch is wading through this question now (sometimes allowing compulsion, often not); it's not a question for Congress to answer, as appealing as it might be to them to help us redefine our Constitutional rights. - We're in the analogy danger zone, but would you say that your phone is more like a safe or more like an extension of your mind? What do you think your answer will be 10 years from now? 20 years from now? - Dragnet vs. compelled disclosure is a false dichotomy. The NSA and friends will continue their collection of data + metadata at scale, regardless of the outcome here.
- peterwwillis 10y ago
  > The judicial branch is wading through this question now (sometimes allowing compulsion, often not); it's not a question for Congress to answer, as appealing as it might be to them to help us redefine our Constitutional rights. IANAL, but from what I recall, the entire point of the legislative branch is to create, remove, and re-define constitutional rights. The judicial affirms what they are, and the executive violates them. (Sorry, is that too on-the-nose?)
  - dgoldstein0 10y ago
    This is pretty close, but I would phrase it as the legislative branch gets to write the "fine print" of constitutional rights. Often the constitution is vague enough that the legislature has a large amount of creative license; sometimes though particular rights are given by the constitution or an amendment, in which case changing it in a large way, or removing it, requires another amendment - or else such attempted changes may be struck down by judicial challenge.
    - ethbro 10y ago
      The full US process could be summed as: The Constitution defines some rights and laws. Congress is empowered to grant additional rights and make additional laws. Congress also implements and defines rights and laws contained in the Constitution. If a citizen feels the Constitution has been violated by Congress, then the judicial system (headed by the Supreme Court) decides whether to invalidate the law(s) or not. If a majority of citizens wish to change the Constitution, then there is an amendment process.
ekianjo 10y ago
just to remind you SWAT was supposed to be case by case. Now they send it by default to destroy your door.
- GordonS 10y ago
  I think you have a point here - all too often there is a creeping escalation of the use of such powers.
FellowTraveler 10y ago
Perhaps you are unfamiliar with the 5th Amendment to the U.S. Constitution.
ekianjo 10y ago
> That's the gold standard to me, not the ugly. I WANT courts to issue warrants against individuals based on a real concrete criminal case. Then you are not aware of the state of things. Most courts now issue warrants without fact checking, simply based on police reporting info from dubious informers. That's not how it's supposed to work yet they are doing little more than just stamping requests for warrants now.