5 ms·

FBI director: Unbreakable encryption is a “huge, huge problem”

23 points by hvo 9y ago

cvwright 9y ago
Well, to be fair, it is a huge problem for the director of the FBI. His job is to investigate potential crimes by gathering lots of evidence and doing lots of analysis. The popularity of encryption is making it increasingly difficult for him to gather the evidence that he needs. The problem (for him) is that encryption is a tremendous help to everyone else, and we don't (yet?) have a way to protect our data from criminals and from overzealous or corrupt cops, without also deterring legitimate investigations.
- gozur88 9y ago
  The FBI still has a pretty extensive toolset when they need it. No amount of encryption is going to save you from a listening device planted in the area of your super secret phone calls.
  - freedomben 9y ago
    True, but (at least for now) planting a listening device requires significant effort and a warrant. Chances are they will have to be pretty interested in you before going through that kind of effort/expense. Storing and sifting mountains of data and metadata from everybody, and mining it and mapping it, just waiting for somebody to do something wrong is just too tempting to resist. That said tho, I tend to believe that most encryption is crackable due to mistakes made during implementation, or mistakes made by the user. In a cryptanalysis class I took my mind was blown by how easy it an be to decode cipher text using simple statistical analysis, especially if some of the plaintext is known.
- bhhaskin 9y ago
  We also need to protect our data from the government and mega corporations.
- freedomben 9y ago
  Haha, very true, and good perspective. Although if I had more confidence that the FBI isn't being misused as a weapon by politicians members of leadership with their own agenda (cough Comey cough), I might be more willing to permit them visibility.
- BLKNSLVR 9y ago
  Semantics, but it's a "huge, huge problem" for the director of the FBI for reasons of politics - having to essentially lie about it in public. The director doesn't do investigations, evidence gathering, or analysis. The other situation in which it's a "huge, huge problem" is when there is communication they'd like to access that is encrypted. What we don't know, among many other things, is: 1) How often do they come up against encrypted comms? 2) Can "traditional" work yield results that would make the encrypted comms less vital to the investigation? 3) What's the scale of the crime they're investigating when encrypted comms are encountered? 4) Are they investigating after a crime has already been committed? If so, then the damage is already done. (Yes, reconstruction of the lead-up may be useful) Breaking encryption is not going to be a silver bullet, but trying to sell it as such is their "huge, huge problem".
jstarfish 9y ago
For better or worse, so much of our lives are conducted through and recorded by our phones and computers that they are now highly valuable black boxes for post-incident criminal investigations. It's a shame that encryption makes it harder for them to jack into the accused's consciousness and simply download some assortment of digital artifacts out of context that can be used to build a narrative against them. Used to be you had to go out and hunt for evidence, but modern investigators prefer to sit back and fish for evidence once it comes to them. Plus there's the value of things like your contacts list...for OC cases, it's a helpful collection of nodes and edges for their graph. They also lose the ability to see what extracurricular proclivities you've been up to. Anything licentious you've ever (or have ever) done will be used to gain leverage over other potential witnesses or simply demonize you in court. God help you if you're embezzling money while carrying on an affair, or you're a furry simply accused of a sex crime. Our digital lives betray the fifth amendment. Even if you won't testify against yourself, the contents of your phone/computer will tell everything...unless it's encrypted. It's the last defense against self-incrimination that we have in this era.
wybiral 9y ago
This just in: FBI is annoyed by how easy it is for criminals to use paper shredders, wear hats around cameras, and whisper in rooms with microphones. But that doesn't mean these things should be stopped.
spiraldancing 9y ago
Devil's Advocate — in the entire history of US law, if police can convince a judge that they have a good enough reason, judge can give the cops permission to break into your house, your bedroom, your diary, your safety deposit box, the safe you buried in your shed ... a judge always had the choice to decide whether or not cops get to invade your privacy. For the first time, ever, strong encryption changes that paradigm. Personally, I'm still in favor of it, but it really is a very fundamental game-changer.
- sasaf5 9y ago
  "a judge always had the choice to decide whether or not cops get to invade your privacy." Judges could not, and cannot, force anyone to reveal information, which is different from providing access to physical places and objects. Strong encryption just gives leverage for what you can store in the domain of your own mind, by allowing you to unlock lots of physical data with some small piece of memorized information. Essentially, little has changed, except perhaps the ever increasing hunger of the state to control people's lives.
  - sjg007 9y ago
    They can hold you in contempt for not providing decryption keys. That would suck if you legitimately forgot your password..
    - dllthomas 9y ago
      Has it been tested whether they can hold you in contempt if you consistently claim to have forgotten the password? In the (ongoing?) case I am aware of the person in question first explicitly refused.
- oconnore 9y ago
  I think it's just changed. They can't read your diary or your photo albums anymore, but they can see purchase history down to the second, they can (in theory) track your location in real time and cross reference it against others, they have full financials, social media, etc. It's still the case that dumb criminals without good opsec will get caught and prosecuted, and it's no news that criminals that have good opsec are hard to catch.
gersh 9y ago
You need to weight the law enforcement need for encryption against the security threat of hackers stealing your data. Hackers including foreign state-sponsored hackers appear to be a major threat. People need the tools to protect their data.
burntrelish1273 9y ago
If chainsaws were used in a mass killing, should we ban chainsaws? Or how about scissors? Saying police and government agencies "need" to have master keys to every building, network and endpoint is insane. This is the fascist Clipper chip redux. The potential for abuse is beyond the pale for an open society. As such an open society must accept some edge-case vulnerabilities (ie criminals using crypto) in order to avoid becoming a censored, totalitarian fiefdom where dissent is crushed by the wide powers of intelligence services that have a panopticon into everyone's lives, 1984-style.
tj-teej 9y ago
The inability to read minds, is a "huge, huge problem"

23 points by hvo 9y ago

Well, to be fair, it is a huge problem for the director of the FBI. His job is to investigate potential crimes by gathering lots of evidence and doing lots of analysis. The popularity of encryption is making it increasingly difficult for him to gather the evidence that he needs. The problem (for him) is that encryption is a tremendous help to everyone else, and we don't (yet?) have a way to protect our data from criminals and from overzealous or corrupt cops, without also deterring legitimate investigations.

gozur88 9y ago
The FBI still has a pretty extensive toolset when they need it. No amount of encryption is going to save you from a listening device planted in the area of your super secret phone calls.
- freedomben 9y ago
  True, but (at least for now) planting a listening device requires significant effort and a warrant. Chances are they will have to be pretty interested in you before going through that kind of effort/expense. Storing and sifting mountains of data and metadata from everybody, and mining it and mapping it, just waiting for somebody to do something wrong is just too tempting to resist. That said tho, I tend to believe that most encryption is crackable due to mistakes made during implementation, or mistakes made by the user. In a cryptanalysis class I took my mind was blown by how easy it an be to decode cipher text using simple statistical analysis, especially if some of the plaintext is known.
bhhaskin 9y ago
We also need to protect our data from the government and mega corporations.
freedomben 9y ago
Haha, very true, and good perspective. Although if I had more confidence that the FBI isn't being misused as a weapon by politicians members of leadership with their own agenda (cough Comey cough), I might be more willing to permit them visibility.
BLKNSLVR 9y ago
Semantics, but it's a "huge, huge problem" for the director of the FBI for reasons of politics - having to essentially lie about it in public. The director doesn't do investigations, evidence gathering, or analysis. The other situation in which it's a "huge, huge problem" is when there is communication they'd like to access that is encrypted. What we don't know, among many other things, is: 1) How often do they come up against encrypted comms? 2) Can "traditional" work yield results that would make the encrypted comms less vital to the investigation? 3) What's the scale of the crime they're investigating when encrypted comms are encountered? 4) Are they investigating after a crime has already been committed? If so, then the damage is already done. (Yes, reconstruction of the lead-up may be useful) Breaking encryption is not going to be a silver bullet, but trying to sell it as such is their "huge, huge problem".

jstarfish 9y ago

For better or worse, so much of our lives are conducted through and recorded by our phones and computers that they are now highly valuable black boxes for post-incident criminal investigations. It's a shame that encryption makes it harder for them to jack into the accused's consciousness and simply download some assortment of digital artifacts out of context that can be used to build a narrative against them. Used to be you had to go out and hunt for evidence, but modern investigators prefer to sit back and fish for evidence once it comes to them. Plus there's the value of things like your contacts list...for OC cases, it's a helpful collection of nodes and edges for their graph. They also lose the ability to see what extracurricular proclivities you've been up to. Anything licentious you've ever (or have ever) done will be used to gain leverage over other potential witnesses or simply demonize you in court. God help you if you're embezzling money while carrying on an affair, or you're a furry simply accused of a sex crime. Our digital lives betray the fifth amendment. Even if you won't testify against yourself, the contents of your phone/computer will tell everything...unless it's encrypted. It's the last defense against self-incrimination that we have in this era.

wybiral 9y ago

This just in: FBI is annoyed by how easy it is for criminals to use paper shredders, wear hats around cameras, and whisper in rooms with microphones. But that doesn't mean these things should be stopped.

spiraldancing 9y ago

Devil's Advocate — in the entire history of US law, if police can convince a judge that they have a good enough reason, judge can give the cops permission to break into your house, your bedroom, your diary, your safety deposit box, the safe you buried in your shed ... a judge always had the choice to decide whether or not cops get to invade your privacy. For the first time, ever, strong encryption changes that paradigm. Personally, I'm still in favor of it, but it really is a very fundamental game-changer.

sasaf5 9y ago
"a judge always had the choice to decide whether or not cops get to invade your privacy." Judges could not, and cannot, force anyone to reveal information, which is different from providing access to physical places and objects. Strong encryption just gives leverage for what you can store in the domain of your own mind, by allowing you to unlock lots of physical data with some small piece of memorized information. Essentially, little has changed, except perhaps the ever increasing hunger of the state to control people's lives.
- sjg007 9y ago
  They can hold you in contempt for not providing decryption keys. That would suck if you legitimately forgot your password..
  - dllthomas 9y ago
    Has it been tested whether they can hold you in contempt if you consistently claim to have forgotten the password? In the (ongoing?) case I am aware of the person in question first explicitly refused.
oconnore 9y ago
I think it's just changed. They can't read your diary or your photo albums anymore, but they can see purchase history down to the second, they can (in theory) track your location in real time and cross reference it against others, they have full financials, social media, etc. It's still the case that dumb criminals without good opsec will get caught and prosecuted, and it's no news that criminals that have good opsec are hard to catch.

gersh 9y ago

You need to weight the law enforcement need for encryption against the security threat of hackers stealing your data. Hackers including foreign state-sponsored hackers appear to be a major threat. People need the tools to protect their data.

burntrelish1273 9y ago

If chainsaws were used in a mass killing, should we ban chainsaws? Or how about scissors? Saying police and government agencies "need" to have master keys to every building, network and endpoint is insane. This is the fascist Clipper chip redux. The potential for abuse is beyond the pale for an open society. As such an open society must accept some edge-case vulnerabilities (ie criminals using crypto) in order to avoid becoming a censored, totalitarian fiefdom where dissent is crushed by the wide powers of intelligence services that have a panopticon into everyone's lives, 1984-style.

tj-teej 9y ago

The inability to read minds, is a "huge, huge problem"