5 ms·

>any system that is designed to allow law enforcement agencies all across the country to expeditiously decrypt devices pursuant to court order will be enormousl

by natch 9y ago

>any system that is designed to allow law enforcement agencies all across the country to expeditiously decrypt devices pursuant to court order will be enormously complex, raising the likelihood of serious flaws in implementation. Generally I agree with the EFF but I always find this particular argument specious. If someone were to design such a system but without flaws in its implementation, would EFF be OK with that? I don't think so, because those agencies are rife with bad actors. A perfect system, in the hands of bad actors, is already a problem. The problem at the outset is with the context of use. Yes there are other problems that would follow on because the system would not be technically perfect, but even before that, the flawed context of giving these tools to bad actors should not be overlooked. Setting up such a system, perfect or not is a bad idea, period. Yes it will be imperfect but even if you buy into the mistaken idea that it can be made perfect, the context of use, in agencies with bad actors, is already broken even before the imperfections allow exploits by agency outsiders. No, we don't have to assume that the agencies are staffed with only good people. Not even for the sake of argument, and not even for the sake of a polite white paper from the EFF.

dalore 9y ago
One could argue that it's not a perfect system if it's susceptible to bad actors. A good system protects even when some of the good guys are bad guys.
pg_bot 9y ago
IMO the toothpaste is already out of the tube on this one. We already live in a world where strong encryption exists, and is accessible to the common developer. The DOJ does not get to live in the world that it wants to. I understand this will make their lives more difficult, however I do not care. Currently they are in the "anger and bargaining" stage of grief, I hope they realize that "going dark" isn't really that bad.
- josefresco 9y ago
  > I hope they realize that "going dark" isn't really that bad. I hope you know that, because I don't know a single person, expert or not who with confidence can claim "going dark" isn't going to be "that bad".
  - valuearb 9y ago
    Somehow the US survived in a world where everyone was dark 100% of the time for over 200 years. Maybe the FBI should just go back to relying on actual criminal research techniques and remember part of their job is protecting constitutional rights such as the right to privacy.
    - stevew20 9y ago
      Maybe they fired all the good investigators and hired data analysts, and are having serious buyers remorse!
    - josefresco 9y ago
      I knew my comment would be unpopular however I'm genuinely curious how you feel about law enforcements ability to wiretap, or perform surveillance suspects given a court order. This capability has existed in the period you referenced, and to me it would seem ... similar(?) to law enforcement being granted permission (by a court) now to surveil a suspect's digital devices. Why does the switch to digital change things? Similarly, If I lock my home/car/object, commit a crime - are you okay with law enforcement breaking into my property to gather evidence? I'm honestly asking, not trying to snark - please help me work through how encryption differs from other "analog" tools meant to ensure privacy.
      - valuearb 9y ago
        Think back even before technology. The police weren’t allowed to sneak on your property and search it, or hide on it to surreptitiously listen to your conversations, without a court order. This was to protect your privacy rights, as well as restrain over-reaching government agents. Now let’s assume 200 years ago all of your property was exposed so that any potentially dangerous people (robbers, horse thiefs, politicians) approaching your house could be easily seen. But this also means that federal agents coming to serve warrants could be seen with enough warning to allow you to destroy evidence, and anytime they’d try to surveil your house, you’d know they were there. Should it be illegal for your property to be so exposed? Should the government force property owners to plant shrubbery on approaches to their homes to make them easier to secretly surveil, and so surprise searches can be more successful? The difference between this and wiretapping is that wiretapping didn’t require you to change your property to allow it. The police merely tapped into existing infrastructure. I say “didn’t” because that stopped being true years ago. The feds were successful at forcing telecoms to alter their systems and equipment to make survellience easier, especially mass survellience. Now the FBI thinks that since they can force telecoms to put backdoors in their own equipment, they can also force companies to put backdoors in customers equipment. Let’s go back 200 years again where encryption was a popular way to assure the privacy of important messages and papers. Let’s assume public/private key encryption was discovered, and companies spring up where they create unbreakable private/public combos for citizens to use to encrypt their messages and letters. The companies agree to protect their customers by never recording the private keys they generate for them. Federal agents are outraged, and demand the companies record citizens private keys and store them permanently so whenever a court ruled federal agents could have them those agents could read any citizens private papers and letters. And that the citizens aren’t allowed to know when their keys have been compromised. Can you imagine the theft, blackmail and other possibilities? That’s exactly what the FBI wants now.
_jal 9y ago
Any system with "exceptional"/whatever they want to call it this week access mechanisms inherently reduces the security of the system, even your hypothetical flawless system. This is because attackers rationally go for the weakest link, which becomes whatever policy mechanisms gate access to the panty-sniffer mechanism. We've seen a constant stream of stories of folks with access to surveillance mechanisms abusing them. Guards being creepy with cameras, NSA analysts stalking lovers, cops stalking lots of people. And that's just what leaks out to the press. Any sensible analysis of this sort of thing has to include the inevitability of abuse. If it doesn't include mechanisms for detecting, punishing and alerting the victim, then the priorities are made quite clear, and are a giant middle finger to the notion of personal autonomy for anyone without special legal status. Enjoy your freedom responsibly, citizen-unit. Or else.
Brockenstein 9y ago
Well there's a few ways to look at this. One diplomatically. The EFF doesn't want to overtly suggest that law enforcement are scumbags and thugs who abuse any system and can't ever be trusted. All sorts of people would rally together to defend poor law enforcement and that fight isn't productive. Two, there is no perfect system. There can be no perfect system. For starters we wouldn't know what perfection looks like if we saw it. Between the flaws in people, tools, technology, etc a perfect system is impossible. There will always be flaws, even if the flaws are largely people using a pretty good system. hence the argument about flawed systems. It's a pretty safe argument to make because it aligns with what happens in the real world. >If someone were to design such a system but without flaws in its implementation, would EFF be OK with that? Call us up when that outcome ever occurs. I'm predicting sometime after the 5th of Never.
- natch 9y ago
  You're right, but I'm not sure you read what I said. >Two, there is no perfect system. Yeah you are agreeing with me here. I was debating whether to spell out that what I had in mind was the technical and mathematical parts of the system, but even that is impossible to get perfect. Adding in people, it is still impossible. Not more impossible. Still impossible. But we need to stop talking about how the technical part will be flawed. Yes it will be. But that's not the worst problem. The people part is the worst problem. Talking about the technical flaws is the wrong argument to make. Naive people will just think "well, let's have our smart nerds work hard on it, and they will figure it out" and therefore the argument makes no headway. And naive people elect congress people. And presidents. Who appoint judges. Etc. What the EFF needs imho is an argument that even the naive masses will understand. Not one that is vulnerable to bullshit talking points like "well if we can go to the moon, we can do this." On the being diplomatic point, yes probably that's the case. I just think they could choose more of a realistic stance somewhere between the position of this paper, which is fairy tales pretending everything is OK as long as it's inside the US borders, and the rather extreme opposite position that you articulated with "law enforcement are scumbags and thugs..." They could easily describe the more nuanced middle ground reality which if seen clearly, should be devastating to the whole idea. Even the US president is not trustworthy, for starters.
mgleason_3 9y ago
Take a moment, lay back, look up at the stars and imagine all the ways it could go wrong if agencies could decrypt everything. The possibilities are endless... 1) External - The NSA so grandly showed that even the most important secrets kept by the most guarded and well-funded agency can be stolen. Imagine if Russian or Chinese hackers gain control of it... 2) Internal - Is there a government agency that hasn't had a bribery scandal? 3) Government overreach - Imagine these tools are in place and a president decides to target adversaries... 4) Petty - You're break up with a police-person goes poorly and they decide to get even...
- natch 9y ago
  Yep, great list. This kind of thing is what I wish the EFF would get out there.

by natch 9y ago

dalore 9y ago

One could argue that it's not a perfect system if it's susceptible to bad actors. A good system protects even when some of the good guys are bad guys.

pg_bot 9y ago

IMO the toothpaste is already out of the tube on this one. We already live in a world where strong encryption exists, and is accessible to the common developer. The DOJ does not get to live in the world that it wants to. I understand this will make their lives more difficult, however I do not care. Currently they are in the "anger and bargaining" stage of grief, I hope they realize that "going dark" isn't really that bad.

josefresco 9y ago
> I hope they realize that "going dark" isn't really that bad. I hope you know that, because I don't know a single person, expert or not who with confidence can claim "going dark" isn't going to be "that bad".
- valuearb 9y ago
  Somehow the US survived in a world where everyone was dark 100% of the time for over 200 years. Maybe the FBI should just go back to relying on actual criminal research techniques and remember part of their job is protecting constitutional rights such as the right to privacy.
  - stevew20 9y ago
    Maybe they fired all the good investigators and hired data analysts, and are having serious buyers remorse!
  - josefresco 9y ago
    I knew my comment would be unpopular however I'm genuinely curious how you feel about law enforcements ability to wiretap, or perform surveillance suspects given a court order. This capability has existed in the period you referenced, and to me it would seem ... similar(?) to law enforcement being granted permission (by a court) now to surveil a suspect's digital devices. Why does the switch to digital change things? Similarly, If I lock my home/car/object, commit a crime - are you okay with law enforcement breaking into my property to gather evidence? I'm honestly asking, not trying to snark - please help me work through how encryption differs from other "analog" tools meant to ensure privacy.
    - valuearb 9y ago
      Think back even before technology. The police weren’t allowed to sneak on your property and search it, or hide on it to surreptitiously listen to your conversations, without a court order. This was to protect your privacy rights, as well as restrain over-reaching government agents. Now let’s assume 200 years ago all of your property was exposed so that any potentially dangerous people (robbers, horse thiefs, politicians) approaching your house could be easily seen. But this also means that federal agents coming to serve warrants could be seen with enough warning to allow you to destroy evidence, and anytime they’d try to surveil your house, you’d know they were there. Should it be illegal for your property to be so exposed? Should the government force property owners to plant shrubbery on approaches to their homes to make them easier to secretly surveil, and so surprise searches can be more successful? The difference between this and wiretapping is that wiretapping didn’t require you to change your property to allow it. The police merely tapped into existing infrastructure. I say “didn’t” because that stopped being true years ago. The feds were successful at forcing telecoms to alter their systems and equipment to make survellience easier, especially mass survellience. Now the FBI thinks that since they can force telecoms to put backdoors in their own equipment, they can also force companies to put backdoors in customers equipment. Let’s go back 200 years again where encryption was a popular way to assure the privacy of important messages and papers. Let’s assume public/private key encryption was discovered, and companies spring up where they create unbreakable private/public combos for citizens to use to encrypt their messages and letters. The companies agree to protect their customers by never recording the private keys they generate for them. Federal agents are outraged, and demand the companies record citizens private keys and store them permanently so whenever a court ruled federal agents could have them those agents could read any citizens private papers and letters. And that the citizens aren’t allowed to know when their keys have been compromised. Can you imagine the theft, blackmail and other possibilities? That’s exactly what the FBI wants now.

_jal 9y ago

Any system with "exceptional"/whatever they want to call it this week access mechanisms inherently reduces the security of the system, even your hypothetical flawless system. This is because attackers rationally go for the weakest link, which becomes whatever policy mechanisms gate access to the panty-sniffer mechanism. We've seen a constant stream of stories of folks with access to surveillance mechanisms abusing them. Guards being creepy with cameras, NSA analysts stalking lovers, cops stalking lots of people. And that's just what leaks out to the press. Any sensible analysis of this sort of thing has to include the inevitability of abuse. If it doesn't include mechanisms for detecting, punishing and alerting the victim, then the priorities are made quite clear, and are a giant middle finger to the notion of personal autonomy for anyone without special legal status. Enjoy your freedom responsibly, citizen-unit. Or else.

Brockenstein 9y ago

Well there's a few ways to look at this. One diplomatically. The EFF doesn't want to overtly suggest that law enforcement are scumbags and thugs who abuse any system and can't ever be trusted. All sorts of people would rally together to defend poor law enforcement and that fight isn't productive. Two, there is no perfect system. There can be no perfect system. For starters we wouldn't know what perfection looks like if we saw it. Between the flaws in people, tools, technology, etc a perfect system is impossible. There will always be flaws, even if the flaws are largely people using a pretty good system. hence the argument about flawed systems. It's a pretty safe argument to make because it aligns with what happens in the real world. >If someone were to design such a system but without flaws in its implementation, would EFF be OK with that? Call us up when that outcome ever occurs. I'm predicting sometime after the 5th of Never.

natch 9y ago
You're right, but I'm not sure you read what I said. >Two, there is no perfect system. Yeah you are agreeing with me here. I was debating whether to spell out that what I had in mind was the technical and mathematical parts of the system, but even that is impossible to get perfect. Adding in people, it is still impossible. Not more impossible. Still impossible. But we need to stop talking about how the technical part will be flawed. Yes it will be. But that's not the worst problem. The people part is the worst problem. Talking about the technical flaws is the wrong argument to make. Naive people will just think "well, let's have our smart nerds work hard on it, and they will figure it out" and therefore the argument makes no headway. And naive people elect congress people. And presidents. Who appoint judges. Etc. What the EFF needs imho is an argument that even the naive masses will understand. Not one that is vulnerable to bullshit talking points like "well if we can go to the moon, we can do this." On the being diplomatic point, yes probably that's the case. I just think they could choose more of a realistic stance somewhere between the position of this paper, which is fairy tales pretending everything is OK as long as it's inside the US borders, and the rather extreme opposite position that you articulated with "law enforcement are scumbags and thugs..." They could easily describe the more nuanced middle ground reality which if seen clearly, should be devastating to the whole idea. Even the US president is not trustworthy, for starters.

mgleason_3 9y ago

Take a moment, lay back, look up at the stars and imagine all the ways it could go wrong if agencies could decrypt everything. The possibilities are endless... 1) External - The NSA so grandly showed that even the most important secrets kept by the most guarded and well-funded agency can be stolen. Imagine if Russian or Chinese hackers gain control of it... 2) Internal - Is there a government agency that hasn't had a bribery scandal? 3) Government overreach - Imagine these tools are in place and a president decides to target adversaries... 4) Petty - You're break up with a police-person goes poorly and they decide to get even...

natch 9y ago
Yep, great list. This kind of thing is what I wish the EFF would get out there.