12 ms·

I agree with the EFF.. but: They write At the same time, according to the OIG report, the chief of the FBI’s Remote Operations Unit (the FBI’s elite hacking te

I agree with the EFF.. but: They write At the same time, according to the OIG report, the chief of the FBI’s Remote Operations Unit (the FBI’s elite hacking team, called ROU) knows “that one of the vendors that he worked closely with was almost 90 percent of the way toward a solution that the vendor had been working on for many months.” 90% finished with no definitive end in sight? That doesnt sound like a solution.. then the EFF concludes: March 1, 2016: Comey testifies... The OIG report concluded that Director Comey didn’t know that his testimony was false at the time he gave it. But it was false, and technical staff in FBI’s own ROU knew it was false. No it was not false. It was completely true at the time. 90% is not a solution. Comey does not have a time machine to see when/if the exploit would be completed. March 16, 2016: An outside vendor for the FBI completes its work on an exploit for the model in question. Now they have an exploit.. and what does the FBI do? They drop the their alternative approach involving the courts and apple. Making weak, clearly disingenuous (or worse, technically clueless if they really believe 90% is the same as 100%) arguments do not help the EFF. This will be the first part that their opponents latch on to and attack.

tedunangst 9y ago
After you're 90% done, you only have the other 90% to finish. Easy, peasy.
- celticninja 9y ago
  The first 90% takes 90% of the project time the last 10% takes the other 90% of the time.
  - SketchySeaBeast 9y ago
    We have a project manager who asks "are you done, or done done?" The two are very different.
    - hinkley 9y ago
      When I was young and impressionable it was done done. My last contracting gig the project manager (who was honestly too good for the customer and noped out after about 14 months and told me countless times “you can’t fix stupid”) started saying done done done. And still people would say, when asked if they were done done done, “yes, but...” At some point the developer is done with a task even if the task isn’t done with them. And they will make any rationalization necessary to take partial credit for completion.
tlb 9y ago
"90% complete" can mean a very wide range of things. If it means having bypassed 9 out of 10 security layers, there's no guarantee it'll ever work. If it means that the system works in the lab and they're adding UI and documentation, then it's reasonable to be confident. I've heard situations both worse and better described as "90% complete". I would guess that coming from a company selling security solutions to law enforcement, it'd be more like the latter (ie, it basically works and needs polishing).
- mannykannot 9y ago
  On the other hand, as the immediate goal was to decrypt one specific device and it was regarded as urgent, I would guess that the former is more likely. Your alternative scenario would amount to what would have been possibly the first time ever a software product was completed before it was released.
- deleted 9y ago
  [deleted]
- tedunangst 9y ago
  In the case of developing an exploit, one might reasonably claim that getting 0xdeadbeef in %rip is 90% done. A lot of researchers would stop at that point, because it's sufficient to demonstrate that it's exploitable. Some years ago, before various mitigations, you'd just have to polish up the payload and then you'd be 100%. But today, there might be a fair bit of work turning a demo crasher into a weaponized exploit.
V2hLe0ThslzRaV2 9y ago
The FBI's chief of its elite hacking unit has a clear conflict of interest in stating what the status of hacking into the phone related to the San Bernadino shooting -- and unless the OIG confirmed the vendor's status at that point forensically, verbal statements to me are meaningless. Saying that the vendor was "90 percent of the way toward a solution" could mean anything; for example, they had the hack, but were testing it to see if would work for all iPhone models.
- rgbrenner 9y ago
  The vendor the FBI contracted with to develop the exploit says they demonstrated it on March 20th. The FBI says they demonstrated on March 20th. In fact, they postponed a court hearing to attend the demonstration, and the following day informed the court. This is also 3 weeks after Comey's testimony to congress. If you're going to throw out a conspiracy theory, you should have something to back it up.
  - V2hLe0ThslzRaV2 9y ago
    My statements purely state that the FBI is very aware of how to take actions and make statements that are true, but misleading. What is the issue is that the OIG took statements that were clearly meaningless -- but assigned meaning to them. In fact, if you read the report, which includes these statements, "In the (FBI elite hacking unit) Chief’s view, the fact that he was not asked for help sooner was not a mistake in judgment or communication breakdown on CEAU’s part, but rather the result of a long-standing policy that the ROU Chief understood created a “line in the sand ”against using national security tools in criminal cases." -- which if true, given the events were a known terrorist attack, would have made the events a national security matter.
    - deleted 9y ago
      [deleted]
  - hinkley 9y ago
    Imagine you’re the attorney for the other side and you asked the agent under oath if they were tainted by information they were sworn not to reveal. For some of these agencies I would almost expect them to, let’s say embellish or fabricate, under oath to protect highly classified information. Does that not make them a tainted witness if they have to speak in half truths under oath? The only way to get an absolutely fair trial would be if all of the information were declassified, or the judge, jury, and lawyers had security clearance. And who without a high clearance could judge what is pertinent to the case? I think we have always known that justice and secrets clash, which is why we have (had) watchdog groups as a compromise.
jacquesm 9y ago
I find it impressive that they would even know they are '90% done'. Usually that's a good indication the person speaking has no clue about how long it will take to get it completed but they feel they have done a lot of work already. And then they hit a snag or some unforeseen obstacle and suddenly that 90% is unrealistically optimistic.
OldSchoolJohnny 9y ago
We know that as developers, but many wouldn't understand this.
- ozim 9y ago
  I expect EFF to be rather technical organisation.
valuearb 9y ago
It's also unclear whether the ROU chief even was able to tell Comey what he knew. I also agree with the EFF, but I think they should focus on the real problem, which is the FBI's cavalier insistence than creating encryption backdoors can ever be save.
kolpa 9y ago
> Making weak, clearly disingenuous (or worse, technically clueless if they really believe 90% is the same as 100%) arguments do not help the EFF. Sadly, this has been the EFF's Mo in recent years. They have an ongoing series of blog posts where they try to make hay out of some patent or copyright court ruling that they deeply misinterpret.
- DataWorker 9y ago
  Lawyers doing what lawyers do. Blame the state of our legal system, or society. Trial in the court of public opinion is accepted by society, consequences be damned.
  - ericd 9y ago
    I imagine that this kind of thing has some consequences for them specifically, though, given that they're funded by donations. I'm certainly less likely to keep donating if I think they're being dishonest and sensationalizing their work.
    - jstarfish 9y ago
      I agree with your sentiment (their SESTA coverage was a bit ridiculous) but that's exactly what opposing interests are doing. It's not a fair fight by nature. Why hold the only defender in the arena to a higher set of standards?
  - rayiner 9y ago
    Lawyers talk to decision makers (judges or juries) who hear both sides of the story. Lawyers are charged with presenting the best possible version of their client's story, because it is the job of the decision maker (not the lawyer) to weigh the facts, judge credibility, and reach a conclusion. The situation is a bit different where an organization like the EFF is talking directly to the public.
- tedunangst 9y ago
  Nevertheless people gobble it up. They are the advocates we deserve, not the advocates we need.
jedimastert 9y ago
> Making weak, clearly disingenuous (or worse, technically clueless if they really believe 90% is the same as 100%) arguments do not help the EFF. This will be the first part that their opponents latch on to and attack. I feel the same way about marijuana supporters.
- ataturk 9y ago
  After reading about what John Perry Barlow was up to before he died, I'm not sure EFF has our back at all. More like controlled opposition.
rayiner 9y ago
Also: consider how likely it is that some engineer in ROU would tell the director of the FBI they were 90% of the way to a solution. The FBI has 33,000 employees, more than Facebook. How many 90% solutions exist at Facebook that Zuckerberg does not know about?

tedunangst 9y ago

After you're 90% done, you only have the other 90% to finish. Easy, peasy.

celticninja 9y ago
The first 90% takes 90% of the project time the last 10% takes the other 90% of the time.
- SketchySeaBeast 9y ago
  We have a project manager who asks "are you done, or done done?" The two are very different.
  - hinkley 9y ago
    When I was young and impressionable it was done done. My last contracting gig the project manager (who was honestly too good for the customer and noped out after about 14 months and told me countless times “you can’t fix stupid”) started saying done done done. And still people would say, when asked if they were done done done, “yes, but...” At some point the developer is done with a task even if the task isn’t done with them. And they will make any rationalization necessary to take partial credit for completion.

tlb 9y ago

"90% complete" can mean a very wide range of things. If it means having bypassed 9 out of 10 security layers, there's no guarantee it'll ever work. If it means that the system works in the lab and they're adding UI and documentation, then it's reasonable to be confident. I've heard situations both worse and better described as "90% complete". I would guess that coming from a company selling security solutions to law enforcement, it'd be more like the latter (ie, it basically works and needs polishing).

mannykannot 9y ago
On the other hand, as the immediate goal was to decrypt one specific device and it was regarded as urgent, I would guess that the former is more likely. Your alternative scenario would amount to what would have been possibly the first time ever a software product was completed before it was released.
deleted 9y ago
[deleted]
tedunangst 9y ago
In the case of developing an exploit, one might reasonably claim that getting 0xdeadbeef in %rip is 90% done. A lot of researchers would stop at that point, because it's sufficient to demonstrate that it's exploitable. Some years ago, before various mitigations, you'd just have to polish up the payload and then you'd be 100%. But today, there might be a fair bit of work turning a demo crasher into a weaponized exploit.

V2hLe0ThslzRaV2 9y ago

The FBI's chief of its elite hacking unit has a clear conflict of interest in stating what the status of hacking into the phone related to the San Bernadino shooting -- and unless the OIG confirmed the vendor's status at that point forensically, verbal statements to me are meaningless. Saying that the vendor was "90 percent of the way toward a solution" could mean anything; for example, they had the hack, but were testing it to see if would work for all iPhone models.

rgbrenner 9y ago
The vendor the FBI contracted with to develop the exploit says they demonstrated it on March 20th. The FBI says they demonstrated on March 20th. In fact, they postponed a court hearing to attend the demonstration, and the following day informed the court. This is also 3 weeks after Comey's testimony to congress. If you're going to throw out a conspiracy theory, you should have something to back it up.
- V2hLe0ThslzRaV2 9y ago
  My statements purely state that the FBI is very aware of how to take actions and make statements that are true, but misleading. What is the issue is that the OIG took statements that were clearly meaningless -- but assigned meaning to them. In fact, if you read the report, which includes these statements, "In the (FBI elite hacking unit) Chief’s view, the fact that he was not asked for help sooner was not a mistake in judgment or communication breakdown on CEAU’s part, but rather the result of a long-standing policy that the ROU Chief understood created a “line in the sand ”against using national security tools in criminal cases." -- which if true, given the events were a known terrorist attack, would have made the events a national security matter.
  - deleted 9y ago
    [deleted]
- hinkley 9y ago
  Imagine you’re the attorney for the other side and you asked the agent under oath if they were tainted by information they were sworn not to reveal. For some of these agencies I would almost expect them to, let’s say embellish or fabricate, under oath to protect highly classified information. Does that not make them a tainted witness if they have to speak in half truths under oath? The only way to get an absolutely fair trial would be if all of the information were declassified, or the judge, jury, and lawyers had security clearance. And who without a high clearance could judge what is pertinent to the case? I think we have always known that justice and secrets clash, which is why we have (had) watchdog groups as a compromise.

jacquesm 9y ago

I find it impressive that they would even know they are '90% done'. Usually that's a good indication the person speaking has no clue about how long it will take to get it completed but they feel they have done a lot of work already. And then they hit a snag or some unforeseen obstacle and suddenly that 90% is unrealistically optimistic.

OldSchoolJohnny 9y ago

We know that as developers, but many wouldn't understand this.

ozim 9y ago
I expect EFF to be rather technical organisation.

valuearb 9y ago

It's also unclear whether the ROU chief even was able to tell Comey what he knew. I also agree with the EFF, but I think they should focus on the real problem, which is the FBI's cavalier insistence than creating encryption backdoors can ever be save.

kolpa 9y ago

> Making weak, clearly disingenuous (or worse, technically clueless if they really believe 90% is the same as 100%) arguments do not help the EFF. Sadly, this has been the EFF's Mo in recent years. They have an ongoing series of blog posts where they try to make hay out of some patent or copyright court ruling that they deeply misinterpret.

DataWorker 9y ago
Lawyers doing what lawyers do. Blame the state of our legal system, or society. Trial in the court of public opinion is accepted by society, consequences be damned.
- ericd 9y ago
  I imagine that this kind of thing has some consequences for them specifically, though, given that they're funded by donations. I'm certainly less likely to keep donating if I think they're being dishonest and sensationalizing their work.
  - jstarfish 9y ago
    I agree with your sentiment (their SESTA coverage was a bit ridiculous) but that's exactly what opposing interests are doing. It's not a fair fight by nature. Why hold the only defender in the arena to a higher set of standards?
- rayiner 9y ago
  Lawyers talk to decision makers (judges or juries) who hear both sides of the story. Lawyers are charged with presenting the best possible version of their client's story, because it is the job of the decision maker (not the lawyer) to weigh the facts, judge credibility, and reach a conclusion. The situation is a bit different where an organization like the EFF is talking directly to the public.
tedunangst 9y ago
Nevertheless people gobble it up. They are the advocates we deserve, not the advocates we need.

jedimastert 9y ago

> Making weak, clearly disingenuous (or worse, technically clueless if they really believe 90% is the same as 100%) arguments do not help the EFF. This will be the first part that their opponents latch on to and attack. I feel the same way about marijuana supporters.

ataturk 9y ago
After reading about what John Perry Barlow was up to before he died, I'm not sure EFF has our back at all. More like controlled opposition.

rayiner 9y ago

Also: consider how likely it is that some engineer in ROU would tell the director of the FBI they were 90% of the way to a solution. The FBI has 33,000 employees, more than Facebook. How many 90% solutions exist at Facebook that Zuckerberg does not know about?