25 ms·
Senator asks FBI director to name the cryptographers who support backdoors
- jchw 9y agoRemember when they spent a million dollars to get data off a phone that provided them with no evidence? Yeah, I'm going to say we don't even need the list.
- jstarfish 9y agoTo be fair, while it looks ridiculous that so much effort is spent trying to break into phones in criminal cases, given how much of our lives are conducted through them they are sources ripe with intelligence-- i.e. we can hope to find out who a terrorist received support from, where a school shooter obtained their guns, etc. Sometimes it doesn't pan out, but such is the nature of criminal investigations.
- vuln 9y agoWhy would a terrorist destroy their personal devices yet leave their work phones intact? What kind of criminal would use a work device to commit any sort of crime? I'm sure the work iPhone was managed by a MDM. The US spent millions and even tried to force a company to write a backdoor. They tried to set a precedent, they knew there was nothing on the phone. It wasn't about the phone it was about using fear to get American citizens to sign over more rights.
- taneq 9y agoThey didn't spend a million dollars to get data off one phone. They spent a million dollars to try and set a precedent that would let them unlock and inspect any phone they wanted.
- davidw 9y agoCool - I was pretty sure it was going to be Wyden before even opening the article. I'm fairly happy with the job he's done as our senator in Oregon.
- trendia 9y agoIt's too bad the author didn't mention Wyden until the 5th paragraph. The author puts "Senator" in the title, when "Senator Wyden" would be just one more word.
- joemi 9y agoAlso, there was zero mention of what state the senator is from. Whatever happened to the standard "(D-OR)" after first mention of a senator in an article?
- aeorgnoieang 9y agoI almost thought it was a Republican senator given the lack of affiliation!
- Natsu 9y agoIt does seem like it's always Wyden though. Wish we had a few more like him.
- randcraw 9y agoSo how is the employment picture in Oregon? :-/ I suspect more than a few of us in ostrich country are considering joining you. It gets old, living where most voters can't be bothered to learn the issues before voting. Or after.
- davidw 9y agoPortland is becoming something of a tech hub, and you can work remotely elsewhere. I live in Bend, which is far more 'purple' than Portland is, but the weather is much more to my liking (more sun, less rain). Come check it out, I'd be happy to buy you a beer.
- redbeard0x0a 9y agoSomebody in the Senate with a brain?! This is awesome. I'm working to try and help get rid of Ted Cruz, we need good people running the company - we need more like Wyden - asking these kinds of questions!
- vvanders 9y agoOh yeah, Wyden is pretty awesome[1]. I wish he was my senator. He's got a pretty great record on tech related issues. [1] https://twitter.com/RonWyden/status/896012835448381441 https://twitter.com/RonWyden/status/896012835448381441
- benchaney 9y agoI have never met anyone who understands what cryptography is, and supports the FBI. As far as I can tell, the only reason they have any support at all is because they confuse people and muddy the waters. Edit: What I meant by "supports the FBI" is "supports the FBI on this issue". If you understand encryption and support the FBI in a general sense, but think they are wrong on this issue, then you aren't a counterpoint.
- dsacco 9y ago> I have never met anyone who understands what cryptography is, and supports the FBI. I understand cryptography and I broadly support the activities of the FBI. You have now “met” such a person. It’s fully possible to simultaneously support opposing concepts like end-to-end encryption for users and the organizational imperatives of the FBI. A nuanced perspective might consider that citizens and the FBI have separate prerogatives and competing incentives with respect to private encryption, and this is perfectly fine. A consequence of an organization optimized to reduce crime is its natural zeal for greater control over things that grant criminals freedom. Secure cryptography represents thermodynamically incontrovertible freedom of communication, which is intrinsically antagonistic to control. In the abstract, any organization striving to (in effect) reduce the rights of criminals will produce friction with the rights of citizens in general. But that doesn’t make the organization’s goals incoherent or evil, it means there must be a system of checks and balances. The ideal goal is one of compromise - we want to reduce net criminality, but we want to increase privacy. We have that compromise because open, end-to-end encryption (and private companies willing to implement it securely) is available to us. But the existence of arms race between parties does not indicate that one party’s overarching goals shouldn’t be supported. One party desires greater control, the other desires greater freedom. Both can coexist despite their competing incentives.
- kqr 9y agoI think in this case a slippery slope counterargument is not obviously wrong. According to the UN, a person's correspondance is sacred and each and every one has a universal right not to have the privacy of their correspondance breached. Why are we now debating the privacy of encrypted correspondance from a baseline of no privacy for unencrypted correspondance? What says we will not continue to accept more and more, as long as it is only a small step from status quo?
- trendia 9y agoThe US won't be able to force these rules on foreign companies selling outside the US. e.g. Huawei, Samsung, and Sony are not going to backdoor their phones for customers in Asia / Europe. So, corporate / governmental customers in those countries are going to shy away from buying American phones... I can't see how this is a good thing for American companies.
- dmitrygr 9y agoBut they will be able to ban sales of phones that do not comply. For God's sake, they banned tiny circular magnets. Certainly they can ban particular models of phones. You're trying to use logic and reason as they apply to the government. The dirty secret is: they don't. Ever.
- zrth 9y agoNever read about "tiny circular magnets". What are you referring to?
- koenigdavidmj 9y agohttps://en.wikipedia.org/wiki/Neodymium_magnet_toys https://en.wikipedia.org/wiki/Neodymium_magnet_toys They were banned because if a child swallows two of them, then they'll pull toward each other, possibly ripping a hole in the intestine.
- jessaustin 9y agoWhereas a big magnet pill is the proper treatment for a cow that has eaten too much "hardware".
- cr0sh 9y agoMaybe as "toy sets" of magnets; it seems there's a ton of back and forth. That said, you can get spherical rare-earth magnets here: https://www.kjmagnetics.com/products.asp?cat=12 https://www.kjmagnetics.com/products.asp?cat=12 ...though a set of such won't be cheap, depending on the size of the magnets wanted.
- prophesi 9y agoHere's a link to the Senator's actual letter if you'd like to avoid the sensationalism: https://www.wyden.senate.gov/download/?id=B31DD6FF-98E8-490C-B491-7DE6C7559C71&download=1 https://www.wyden.senate.gov/download/?id=B31DD6FF-98E8-490C...
- karlshea 9y agoWhat part of the article was sensational? It was mostly background and direct quotes.
- prophesi 9y ago"Senator Demands FBI Director Explain His Encryption Backdoor Bullshit" is the main culprit. The article is just a rewording of the letter; even the background information is just the Senator's first few paragraphs.
- js8 9y ago"The problem, according to Wray, is that law enforcement is stymied by phone encryption, which is now widespread." Not American, but isn't criminality in the U.S. like at about lowest point in history? Is there some actual evidence that the lack of ability to do mass surveillance is somehow making criminal investigations less effective?
- anfedorov 9y agoSource?
- IncRnd 9y agoThe source is the first sentence in third paragraph of the article that you commented.
- anfedorov 9y agoLink? Curious how one would go about measuring, e.g., criminal insider trading facilitated by wide-spread e2e encryption.
- ch4s3 9y agoWhat evidence do you have to suggest the existence of this happening at any scale? The problem with large scale conspiracies is that they require a lot of people, and eventually someone slips up. This sort of crime is the bread and butter of the SEC, and they aren't making any claims about it increasing.
- deleted 9y ago[deleted]
- ch4s3 9y agoCrime rates are the lowest they've been since 1970 at least, [1] and murder rates are the lowest since WWII[2]. [1] http://www.nationalreview.com/corner/427758/careful-panic-violent-crime-and-gun-crime-are-both-dropping-charles-c-w-cooke http://www.nationalreview.com/corner/427758/careful-panic-vi... [2] https://www.factcheck.org/2016/07/dueling-claims-on-crime-trend/ https://www.factcheck.org/2016/07/dueling-claims-on-crime-tr...
- natch 9y agoCompletely apart from the possibility, more like a fact, that the back door will be breached by non-law-enforcement black hats, there's another serious matter here. Anyone who thinks that a solution to this might be possible should be prepared to give a good answer the following question: How does your system protect the rights of people subject to these searches in cases where law enforcement is evil? Hint: it doesn't. And that's not a mere trivial inconvenience. It's a fatal flaw that can corrupt economies, bring down governments, wreak havoc on lives, destroy cultures, corrode societies, and crush freedom. There's a reason Thomas Jefferson said "the price of freedom is eternal vigilance." I don't want to live in a place like today's Venezuela, Syria, China, North Korea... we should value our rights and our freedoms.
- cat199 9y ago> Syria 'Eternal vigilance' in the face of a significant portion of population hoping to forcibly enact sharia law on the rest of the likely takes the form of a ideologically moderate strongman... An inconvenient fact that USians like to avoid discussing in order to continue simplemindedly branding people as 'evil'.. .. But only if we just fund more rebels, they will certainly magically embrace 1700's style western free market capitalism because the west is great!
- ZephyrP 9y agoI've always imagined the hope is for a country like Singapore, not North Korea (which is still scary).
- mschuster91 9y ago> How does your system protect the rights of people subject to these searches in cases where law enforcement is evil? And especially: when law enforcement becomes evil or goes rogue. For example, in 1936 in the Netherlands a census had established a list of all people - including their religious affiliation. When the Nazis marched in a couple years later, they had a perfectly validated source of Jews to deport (per https://de.wikipedia.org/wiki/Judenkartei#Niederlande https://de.wikipedia.org/wiki/Judenkartei#Niederlande). While I do not believe that data about religion will be used as a round-them-up-and-kill-them list ever again, there are other things which we allow various forms of law enforcements or secret services to access or to do which may be OK under our current governments but may very well be used against us in the future. There's a reason why undocumented people have been afraid to register or interact with the government - what Trump and his cronies did basically confirmed all their decade-long suspicions.
- maxxxxx 9y agoHas anyone ever brought forward a concrete proposal how this could be implemented?
- sova 9y agoA widespread public backdoor that affects all devices so law enforcement and anyone with the backdoor key can get in? Yeah, they are all over the place. I suspect a lot of stuff the NSA pumps out already has excellent backdoors. I think the only real way a government could encourage its citizenry to use CLEARNET (unencrypted comms) for everything would be to offer some sort of benefits if everything you did was easily observable by law enforcement. Again, the backdoor idea is flaunting arrogance in the face of the Right to Privacy and Unreasonable Search and Seizure, and I think the Senators have a lot of emotional issues to work through before they start commanding the tech sector to do anything. Nobody supports a backdoor, backdoors in software are not good, end up falling into the wrong hands, and have historically never prevented a single catastrophe -- I'd be happy if law enforcement revealed a time when they cracked encryption to find some sort of juicy plot, but alas, I have yet to read a single instance of the sort. If you add a backdoor to our software systems, you're effectively adding a spy camera into every device that uses that chip, and you are not in control of who has the key, despite your best efforts. "Don't worry, only I know the combination to my suitcase, it's quite alright if it exchanges 70000 hands" ... said nobody ever. Law Enforcement and Legislation need to target this realm with a completely different approach, otherwise we leave the back door to the castle completely unguarded and defenseless.
- deleted 9y ago[deleted]
- cvwright 9y agoWe have some preliminary thoughts: https://twitter.com/hackermath/status/956617943768481792 https://twitter.com/hackermath/status/956617943768481792
- sathackr 9y agoIf silicon valley can just nerd a little harder and make it happen, then surely the FBI can just try a little harder and eliminate all crime, and then the problem goes away.
- debt 9y ago"Wray’s speech undoubtedly spurred frustration in Silicon Valley" It's an absolutely ridiculous notion that everyone in the Valley is pro-privacy. It's the exact opposite. Many of the security higher-ups in the Valley are complicit and working very closely with law enforcement to figure out a solution. These companies are trying to figure out how to balance risk; the risk of providing a secret way to open up someone's phone to the government while keeping it hidden from everyone and the PR fallout of knowingly providing backdoors to supposedly secure personal electronic devices. It's got nothing to do with some high-and-mighty goal that every person is entitled to privacy(of course the constitution would disagree but that's irrelevant). This is a hilarious facade. If they need access to the phone data, they will get it. On top of all that, the San Bernardino case illustrated that there is a market for private security companies to circumvent most security protections anyway.
- mxuribe 9y agoThat is an awesome letter!
- shmerl 9y agoAre there any that do, besides potential proponents of police state?
- wyldfire 9y agoThe simplest answer is to ask Congress to put aside a budget for a Congressional encrypted communications channel with key escrow or some other great backdoor idea. Then, the executive can do an RFP, get it implemented and then we just wait until presumed-private-congressional communications are revealed.
- cantrevealname 9y agoWouldn't it be better if we adopt the position that unbreakable crypto is a basic human right? Every time we hear about government demands for backdoors, we technies, cryptographers, thought-leaders, and journalists respond that backdoors are a security risk and can't be implemented safely. I feel this invites endless counter-arguments and new proposals by the authoritarian parts of government. We've been playing this game forever -- as far back as the Clipper Chip in early 1990s -- and it never seems to end. Maybe we should take the high road: the time has come that unbreakable crypto is to be considered a basic human right; the same as free speech, freedom of thought, or freedom of religion. In this digital age, a lot of those other rights can't be guaranteed without strong crypto. Whenever any mention of backdooring, weakening, disabling, preventing encrypted communication comes up, our reply should be, "no, you can't do that because crypto is a human right, the same as free speech, and is necessary to protect other fundamental rights".
- soup10 9y agoNobody besides a few elite security people even knows how legit crypto products really are. It's all a rumor mill for us lay programmers. Crypto is cool and all but human right? Not sure what that has to do with anything. Crypto is a tool for the good guys and the bad guys, it's not some absolutist concept.
- deleted 9y ago[deleted]
- murftown 9y ago> but human right? Not sure what that has to do with anything. If the government is pressuring organizations into backdooring their crypto, wouldn't it be relevant whether using effective crypto is considered a human right? Not sure why you think it's so out in left field.
- mi100hael 9y agoI get where you're coming from, but I think that argument needs some work. Currently, none of those rights you mention that are enumerated in the Bill of Rights are guaranteed through absolute means, they are preserved via checks & balances among branches of the government. And even if they were more absolute, there would still be asterisks as things stand today: - You have freedom of speech/thought unless it was the motivation behind a criminal action, in which case you're additionally punished for a hate crime - You have freedom to keep & bear arms except not in some states if your Sheriff doesn't like you - You have the right to privacy unless there is probable cause to believe you're involved in criminal activity, in which case the court can issue a search warrant - etc. etc. Even if you tried to argue that "crypto is a basic right," that wouldn't change anyone's mind who is arguing that there should be an asterisk if you're under criminal investigation.
- aeorgnoieang 9y ago> During his January 9th speech at the International Conference on Cyber Security in New York, Wray called the prevalence of encryption an “urgent public safety issue” and said it had prevented law enforcement from accessing some 7,800 devices in the last fiscal year. [Emphasis is mine.]
- yodon 9y agoRon Wyden (D) Oregon is the senator who asked the FBI to name any cryptographers that support backdoors. He’s by far the most tech savvy and encryption savvy member of the house or Senate.
- tatersolid 9y agoNo, he’s not. I like him, but there are in fact more “tech savvy” Congress critters. Four members of the House have computer science degrees (at least they were House members back in 2016): Democrat Ted Lieu of California and Republicans Will Hurd of Texas; Bill Johnson of Ohio; and Steve Scalise of Louisiana.
- jlgaddis 9y agoWhy do we never hear from them when this subject comes up?
- tatersolid 9y agoUmm... we do, in fact, hear from them. Example, first of many search engine hits: https://www.google.com/amp/s/techcrunch.com/2016/04/28/a-whatsapp-chat-with-crypto-loving-congressman-ted-lieu/amp/ https://www.google.com/amp/s/techcrunch.com/2016/04/28/a-wha...
- yodon 9y ago> I like [Ron Wyden] but there are in fact more “tech savvy” Congress critters. Ron Wyden is all over the issues I care about, to the point where on the rare occasions we disagree I’m willing to believe he’s right because he does policy for a living and I’m just a guy with strong opinions (which is precisely why representational democracies were invented). The other four? I never hear them championing critical tech policy issues. Yes Ron is in the Senate and they are in the House, but Ron was in my feeds constantly long before he ran for the Senate (and I don’t even live in his district). Savvy doesn’t just mean a degree in my book. Savvy means able to cut through the noise and get to what matters. And since we are clearly in agreement over the importance of this stuff and just quibbling around the margins, I’ll mention adding Suzan DelBene (D) WA to your list of reps to follow if she’s not there already. I’m not sure what her degree is in but she’s a former Microsoft VP who is incredibly smart and deeply knowledgeable about tech issues (though I haven’t seen that emerge yet as a top legislative focus area for her the way it has for Ron Wyden).
- rkagerer 9y agoIf that list ever gets released I would really like to see a follow up post about it.
- JustSomeNobody 9y ago>Why can’t they break encryption in a good way while they’re at it? Thoughts like these always remind me of this[0]: >On two occasions I have been asked,'Pray, Mr. Babbage, if you put into the machine wrong figures, will the right answers come out?' I am not able rightly to apprehend the kind of confusion of ideas that could provoke such a question. [0] I know that wasn't a direct quote from Mr. Wray, but it is in keeping with his thoughts.
- gerdesj 9y agoJust after I read an article that a US Senator demonstrates that he understands the risks inherent in backdooring crypto, I read this: https://www.theregister.co.uk/2018/01/25/uk_prime_minister_encryption/ https://www.theregister.co.uk/2018/01/25/uk_prime_minister_e... "Here we go again... UK Prime Minister urges nerds to come up with magic crypto backdoors" I was rather hoping our PM had quietly dropped that nonsense a while back but it seems not. sigh
- fny 9y agoCryptography with backdoors means humans with knowledge of said backdoors in both industry and government. Even if it were theoretically possible, I have no faith in humans to protect this kind of information.
- YTGRK 9y agohttps://youtu.be/I2l8xkjTUh4 https://youtu.be/I2l8xkjTUh4
- DaniFong 9y agoALL OF THEM
- ilovetux 9y agoI keep hearing these arguments and after hundreds of hours of pub talks, the absolute best idea me and my friends have come up with (it's still a bad idea) is government issued crypto certificates. The idea goes that about the same time someone is issued a social security number they are also issued a cryptographic key pair. The cool thing is that your key pair can establish identity and in case your private key is compromised a new one could be issued easily. The government would have to maintain copies of everyone's private keys. The only way this would actually work in practice is if a number of new rights were established and a number of existing rights were updated. I don't want to enumerate what we came up with in discussions, but they are numerous. The only real benefit to all of this is that encryption would have a backdoor which is established before any encrypted communication actually takes place so the protocols could be made as secure as possible. This also means that the government would have to establish a monopoly on something that we can do with a single openssl command.
- csomar 9y agoTwo things: 1. That's a disaster waiting to happen. Lots of actors are targeting governments, not just hackers and criminals (other governments and people from inside the gov itself). 2. That doesn't stop terrorists from using secure encryption. What you are proposing gives government unlimited access to innocent citizens data while it does nothing about access to malicious parties. Sorry but this proposal makes no sense! At least the backdoor is a wolf in disguise for government intervention in citizens everyday life.
- ilovetux 9y agoI agree that its a disaster waiting to happen, so theres no need to apologize, I mention that it's a bad idea in the first paragraph. To be honest, I don't really know why I even posted it besides the fact that it's something me and my friends have been discussing on and off for about a year now because it keeps coming up in the news. The "bad guy" problem is an inherent problem and while me and my friends have come up with a few novel work-arounds none of them solves the problem completely. Another issue is that multi-layer encryption could disrupt the government's ability to execute a warrant. If this BAD IDEA were implemented then multi-layer encryption would need to be made illegal and that starts us down a very dangerous path. The only thing I think is a good idea is using a crypto key pair as a replacement for ssn but only if it's not really used for encryption.
- sharemywin 9y agoI'm sure the Chinese and Russian Governments could provide a list of willing companies that would be happy to offer those services to american companies and our government.