8 ms·
Tech firms “can and must” put backdoors in encryption, AG Barr says
- typenil 7y agoWe can have a little test - let's put backdoors on all of law enforcement's encryption usage and see how long it stays safe. I really don't know if people like Barr are arguing in good faith. But then I try to assume incompetence first and malice second.
- cr0sh 7y agoIf you know anything about Barr's long background, you'll know he is not "arguing in good faith".
- cmurf 7y agoExcept we have actual history to look at in Barr's case, Iran-Contra. I absolutely consider this malice first and incompetence second. That malice is classism, people are not equal, some people are inherently better people, and they have more money. Everything is a product. And wealthy people can buy more of that product than others. This is an attempt to make sure ordinary people cannot have privacy, cannot be protected from either each other, other governments or this government, but wealthy people will continue to be able to buy that protection one way or another. It's a feudalist's proposition. You do not understand the motives without understanding the underlying ideologies. Not everyone can be a lord over their own data - it's a fact. Your data, peasant, is not your data! It belongs to your lord. And who the lord is case by case, it could be the government, it could be a particular corporation or a trade group of them.
- geggam 7y agoNot sure why this is downvoted. After spending several decades on earth you start to see how govts are designed to protect the wealthy
- coldcode 7y agoLets put backdoors in politician's communications first that anyone can hack. If it goes well then we will support it.
- lonelappde 7y agoThis already happened. NSA/Booz Allen had a back door and Snowden exploited it. The Embassy had a back door and Manning exploited it.
- helen___keller 7y ago>He also accused tech firms of "dogmatic" posturing, saying lawful backdoor access "can be and must be" done, adding, "We are confident that there are technical solutions that will allow lawful access to encrypted data and communications by law enforcement, without materially weakening the security provided by encryption." This reminds me of the classic article about trisectors https://web.mst.edu/~lmhall/WhatToDoWhenTrisectorComes.pdf https://web.mst.edu/~lmhall/WhatToDoWhenTrisectorComes.pdf
- pwinnski 7y ago"We are confident that there are technical solutions that will allow squaring circles without materially making them not circles." Or drying water, or any number of other impossibilities.
- lonelappde 7y agoWWE is a squared circle. Ice is dry water.
- deleted 7y ago[deleted]
- joelx 7y agohttps://joelx.com/facebook-fined-while-murderers-go-free/15106/ https://joelx.com/facebook-fined-while-murderers-go-free/151...
- Topgamer7 7y agoI challenge him to describe what an encryption backdoor actually is. Its like putting a hidden switch behind a brick in a wall. The brick looks the same, but if you take the time to knock on every brick, you'll eventually find the button. Every moderately powerful nations will have someone out there knocking on the bricks.
- teunispeters 7y agoDitto larger and more organized criminal organizations.
- HeWhoLurksLate 7y agoI'm going to add that toddlers [teenagers / lone wolves] will also try knocking on bricks if they see their parents [governments] doing so successfully.
- coolspot 7y agoProbably something like this: https://blog.cryptographyengineering.com/2018/04/26/a-few-thoughts-on-ray-ozzies-clear-proposal/ https://blog.cryptographyengineering.com/2018/04/26/a-few-th... I believe this is how Australia is going to have their backdoors.
- crispyporkbites 7y agoThat's a nice analogy, but it's still an analogy. It's easy for someone to come along and modify the analogy to fit their purpose e.g. "we'll have someone watch the wall of bricks so no one can knock on them!" We simply can't let people legislate on issues they fundamentally don't understand. And understanding a backdoor is actually not that difficult - a smart, motivated person could literally learn the theory of this with some practical examples in a few hours of study.
- all_blue_chucks 7y agoIt takes a prohibitively long time to knock on 2^256 bricks. The real risks aren't from the crypto; they're from the humans who have access to the back door. Can they be trusted? Can they be compromised? That's not to mention the business damage this would cause. The US is trying to block Huawei products due to back doors. Other countries will block US products if the US government starts requiring back doors.
- ceautery 7y agoShockingly, comments are disabled on the AP video of him saying this: https://www.youtube.com/watch?v=c-QQwv1U2aY https://www.youtube.com/watch?v=c-QQwv1U2aY
- sokoloff 7y ago> The FBI ended up in possession of the shooter's iPhone during the investigation but was unable to unlock the device, as the attacker had been killed and therefore could not be compelled to share his PIN. Is it not the case that he couldn't be legally compelled to share his PIN even if he were alive?
- PopeDotNinja 7y agoNo one can force your to share information. Let's say your PIN code is 1324, and you suffer from stress induced transposia (just made that up). Every time you are asked to say or share your PIN code, you get stresses & use 1234, even though you meant to use 1324. There's no way make you say the correct PIN code. In a more realistic example, what are you going to do to someone who simply forgot their PIN code?
- lm28469 7y ago>what are you going to do to someone who simply forgot their PIN code? Put them in jail indefinitely, apparently. https://arstechnica.com/tech-policy/2017/03/man-jailed-indefinitely-for-refusing-to-decrypt-hard-drives-loses-appeal/ https://arstechnica.com/tech-policy/2017/03/man-jailed-indef...
- jtuente 7y ago> In deciding against Rawls, the court of appeals found that the constitutional rights against being compelled to testify against oneself were not being breached. That's because the appeals court, like the police, agreed that the presence of XXXXXXXXXX on his drives was a "foregone conclusion." The Fifth Amendment, at its most basic level, protects suspects from being forced to disclose incriminating evidence. In this instance, however, the authorities said they already know there's XXXXXXXXXX on the drives, so Rawls' constitutional rights aren't compromised. > ""Forensic examination also disclosed that Doe [Rawls] had downloaded thousands of files known by their "hash" values to be XXXXXXXXXX. The files, however, were not on the Mac Pro, but instead had been stored on the encrypted external hard drives. Accordingly, the files themselves could not be accessed."" A good guess can figure out what I've redacted.
- OrderlyTiamat 7y agoDoes mr Barr not understand that criminals will simply use free non-backdoored software instead? Of course he does. It's hard not to read this as another attemt to listen in on the conversation of regular citizens instead.
- iamnotacrook 7y agoYou could say that about criminalizing TOR. If you knew that by using TOR you were going to get swatted at 3am you'd probably stop using it. Same goes for encryption. The second any law is passed google/apple are going to pull apps; whatsapp etc are going to remove e2e (or alter it so the UI is the same but it can be snooped on) and criminals are going to have to figure out how to use PGP or whatever.
- loeg 7y agoIn this scenario, Amazon, Facebook, and Microsoft will immediately fold as they can no longer securely sell products to customers. If e2e crypto is banned, the entire ecommerce market is fucked.
- victorNicollet 7y agoThis isn't a ban on end-to-end crypto. A company would still be able to use end-to-end crypto, as long as they control one end, which is already the case in ecommerce.
- yibg 7y agoSeems like a failure of the tech community that most people don’t understand the ramifications of backdoors. People can also point to the example of China where there are indeed government backdoors and things are fine (from the government can get access but others can’t point of view). Clearly we don’t want to be like China in this regard but it does give an example of a “working” backdoor setup.
- cr0sh 7y ago
- DaniloDias 7y agoHow many law enforcement chiefs have to watch their credibility die on this hill?
- ptah 7y agodoes he want to turn american companies into what he accuses huawei of being
- ETHisso2017 7y agoThis plus the CLOUD Act would essentially do that
- heisenbit 7y agoMr. Barr is working for a President who's son in law was discussing to establish an encrypted and covert back-channel through the Russian embassy. He himself is accused of suppression and obfuscation of critical information that should have gone to Congress ages ago. He has less than zero standing in this area.
- cr0sh 7y agoPlus the question of that server in the Trump tower that was communicating with another server in Russia - that went silent when it was found out. ...and then that fire in the Trump tower - I wonder what went up in that besides some oligarch's possessions...? This whole damn thing is rotten, it stinks, and I for one am getting sick of it.
- t0mbstone 7y agoBut the Mueller report didn't find conclude that Trump colluded with the Russians. And their reasoning? Because they aren't allowed to indict a sitting president. If that's not the most bass-ackwards thing and proof of corruption I've ever heard of. "We held a giant investigation, but didn't conclude the party in question was guilty because we literally aren't allowed to"
- AnimalMuppet 7y agoWell... what's supposed to happen is impeachment. So what Mueller did, essentially, is hand the ball to Congress. "You're going to have to do it." And, arguably, that was the proper thing to do.
- cannonedhamster 7y agoThe Mueller report wasn't looking for collusion. That's literally the President changing the narrative. The Mueller report was looking into election tampering by a foreign power and it find that the Trump organization had numerous people that broke tons of established laws footing the course of running the campaign, including the President who incited action by a foreign power against a political opponent. How Republicans aren't running screaming from a guy who brags about committing literal treason I don't know. He's not even in line with traditional Republican values, he's not Christian, doesn't hate lgbtq people, has no problem with wasting government money, and hurts cheap labor by trying to close the border. His only real stated goal has been weakening the U.S government. A foreign power couldn't ask for a better mole inside the government.
- dx87 7y agoIt'd be nice is encryption fell under the 2nd amendment. It's been classified as a munition before, and with the creation of USCYBERCOM, the govt has a vested interest in ensuring that it's citizens have experience using encryption software.
- the_watcher 7y agoThat's an interesting argument, but only the most extreme interpretation of the 2nd Amendment argues that it covers _all_ munitions. And I'm having trouble finding a contemporary example of someone making this claim. On top of that, we now have years of SCOTUS jurisprudence that "arms" are absolutely subject to _some_ regulations, with the debate focusing on what "some" actually means.
- homonculus1 7y ago>And I'm having trouble finding a contemporary example of someone making this claim. Maybe you were looking for someone notable, but I'll make it for you right now.
- jessaustin 7y agoYou're certainly more notable than homonculus2!
- Coffeewine 7y agoJust out of curiosity, does that extend to things like chemical or biological weapons? I suppose such an interpretation would have the side effect of making literally any hazardous substance legal to possess.
- homonculus1 7y agoThe definition of "arms" can reasonably be limited to conventional arms, i.e. the weapon is controlled by a human and its damage can be targeted. Weapons of mass destruction and contagion are not compatible with the purposes of self-defense, defense of the nation, and protecting society against tyranny.
- cmurf 7y agoClearly the antitrust investigation is really about strong arming big tech into putting in backdoors. Republican administrations for decades have been weak on competition law, they have little problem with mergers and conglomeration, and have no concerns for consumer protection, or a belief in a broad privacy right. And that's because they believe those things are adequately addressed by consumers making informed choices, because consumers have all available information. I'd bet all the tea in China that they drop the antitrust investigation in exchange for backdoors. If these companies continue to base their businesses in large part on services, they will need a trusted cryptographic method for protecting customer information. If these companies regress into being strictly product and advertising businesses, what is the loss of value? And what kinds of businesses fill the void? And will those businesses even be based in the U.S. if the legal regime mandates backdoors for all businesses? Besides, on what basis does DOJ require only big tech provide a backdoor?
- jessaustin 7y agoSpeaking of China, maybe Huawei could get out of the doghouse by giving DoJ some backdoor?
- tehjoker 7y agoWe don't need to make arguments like "I trust the state, but what about criminals?". All US administrations have exhibited strong evidence of criminality and work to suppress dissent and oppress minorities. The current administration makes AG Barr's machinations exceptionally clear as they employ an ever more viscous kidnapping force and (incompetently) attempt to start wars around the world. If you want to be able to resist these assholes (e.g. having anti-war or anti-ICE meetings that aren't snooped on, enable whistleblowers, etc), you need secure communications. Don't give them a backdoor.
- mLuby 7y agoA "viscous kidnapping force" is an especially sticky problem. ^__^;
- benj111 7y agoI hate it when the kidnappers are thick.
- stcredzero 7y agoThey're viscously coupled to data. This is what enables them to slip through the cracks: https://giphy.com/gifs/film-terminator-2-X9o7FpxErqKje https://giphy.com/gifs/film-terminator-2-X9o7FpxErqKje
- tehjoker 7y agoOne day I will learn to spell. T_T
- hirundo 7y agoEven if the state is completely trustworthy, has zero potential criminals in its ranks and always acts with good intentions, it's not enough. There is repeated proof, ad nauseum, that governments are incapable of consistently protecting their data from hackers. So if a state has access to backdoors it's a matter of when, not if, that access will be captured by criminals and enemy states. I work in a small company where I honestly believe everyone is trustworthy. Still it is a good thing that our users' passwords are hashed and none of our staff can decode them. It's a tragic example of motivated reasoning that the head of the Department of Justice doesn't get that.
- octosphere 7y agoYeah but what's to stop a bad actor simply switching to a provably secure cryptographic system or app? Don't forget there's an arms race going on, where bad actors consistently try to outpace law enforcement by switching to provably secure and private systems. Take for example when 3DES[0] was discovered as insecure and all the criminals switched to AES[1]. And don't forget the old adage: If you outlaw encryption, then only outlaws will use encryption [0] https://en.wikipedia.org/wiki/Triple_DES https://en.wikipedia.org/wiki/Triple_DES [1] https://en.wikipedia.org/wiki/Advanced_Encryption_Standard https://en.wikipedia.org/wiki/Advanced_Encryption_Standard
- bdamm 7y ago> then only outlaws will use encryption Which makes them easy to find in a dragnet unless they're also using stenography.
- snuxoll 7y agoSteganography, not stenography.
- lukifer 7y agoWhich is exactly what would happen. Low-effort E2E encryption (Signal, iMessage) primarily benefits lawful users; but bad actors are sufficiently motivated to invest the effort in getting around encryption restrictions by disguising communications as legitimate data.
- lonelappde 7y agoYou conflate unlawful with bad. Everyone is unlawful.
- checktheorder 7y agoThe bureaucrats and politicians who espouse the same opinions as Barr all live in a very old-school world. They believe that encryption is a product solely "built" by companies with Wall Street headquarters open 9-4 M-F. They think that stopping these companies from "building" their encryption is a matter of talking about it with a director of the company in question over 18 holes, or failing that, sending a strongly-worded letter to the legal department of the company in question. Barr&co. do not live in the real world.
- matthewmacleod 7y agoThis was briefly confusing, as AG Barr is the soft drinks company which manufactures Irn Bru in Scotland, and I was surprised to see they had an opinion. But I'm interested in what the constructive path forward is on the rather more important issue of ubiquitous encryption. I think most people generally accept that well-regulated wiretapping (and other forms of interception of communication) are a useful and important law enforcement tool. Easy-to-use, commodity encryption makes this tool mostly useless. But obviously any "back door" would be immediately leaked/abused, and more to the point would just be circumvented by anybody who really did still want privacy. You can't shut the stable door etc. We do sometimes choose to outlaw useful and entirely legitimate technology because of the potential for abuse. Is there a reasonable argument for doing so with mass-market encryption? In reality, it seems that the public benefit of having encryption in place is so overwhelming that this is a total non-starter. Or is it simply the case that we now have to accept that this tool is no longer one which can be used? I think we'd have to accept that ubiquitous encryption is here to stay and stop trying to fight it.
- skybrian 7y agoNote that a lot can be learned from "metadata" (keeping track of who is talking to who) and it's also hard to prevent without adding a lot of inefficiency via something like onion routing. So that would be the logical place for some kind of law enforcement compromise while still encrypting the messages themselves.
- the_watcher 7y ago> as AG Barr is the soft drinks company which manufactures Irn Bru in Scotland, and I was surprised to see they had an opinion. An irreverent marketer could generate a ton of earned media out of this.
- helen___keller 7y agoI don't agree that encryption should be illegal, but also I don't think it's feasible to try and make it illegal without going all the way with our own version of the great firewall
- abecedarius 7y ago
- linsomniac 7y agoIs this the same Bill Barr who blacked out entire pages of the Muller Report? Why is transparency so important for the citizens but so prized by the politicians?
- jschwartzi 7y agoAll animals are equal, but some animals are more equal than others.
- jakelazaroff 7y ago> The cost of encryption, he said, is measured in "victims" who might have been saved from crime if law enforcement had been able to lawfully intercept communications earlier. The cost of backdoors is measured in hospitals paralyzed by ransomware, personal information stolen by hackers, government secrets obtained by hostile nations. Not to mention the threat of pervasive surveillance by our own government, which has long shown it's willing to intrude on our privacy as much as it possibly can, laws be damned.
- coolspot 7y agoLook, same applies for example to 2nd amendment. But people find it plausible and vote for more gun control.
- altmind 7y agoits shocking how the constitutional privacy rights are being stripped step by step.
- ThrustVectoring 7y agoI'm honestly more concerned about the free speech protections being stripped from writers of computer programs.
- Ididntdothis 7y agoAre there any papers that make concrete proposals how such a thing could work?
- solarkraft 7y agoA stable genius.
- tomphoolery 7y ago> The existence of encryption means "converting the Internet and communications into a law-free zone" that criminals will happily take advantage of to do more crimes, Barr added, likening it to a neighborhood that local cops have abandoned. This is such an asinine comparison. It's not like the cops have access to every locked door of every house in their jurisdiction. You don't need to build a special "cop door" into your house so they can come in whenever they want to, and you don't need to make an extra copy to give to the precinct. Why should my "internet house" be any different?
- thorwasdfasdf 7y agoEven if the gov required backdoors. It's not going to stop the highly invested terrorists. If someone was to go through all the trouble of plotting another 911, I think they'd have more then enough money to create a secure messaging site of their own. All it takes is one little web site with a really strong encryption algorithm. It's pretty trivial to create your own messaging platform and not too hard to add a large enough encryption to it.
- LinuxBender 7y agoIt's even easier to just have preshared phrases that have unique meaning. "Your rental car payment is due." "OK, I will pay it on Wednesday at 10am. Stop nagging me." I would imagine that if enough people knew everything had lawful intercept, then they would just obfuscate their communications.
- logfromblammo 7y agoAttorneys for the United States "can and must" build a criminal case starting from "reasonable suspicion", through "probable cause", all the way to "beyond reasonable doubt", without violating at any step the Constitutional protections put in place for the express purpose of limiting the government's power to reshape or destroy the society it purportedly serves. We say not to roll your own encryption, but it's one thing to build a lock that is easily picked, and quite another to build one that instantly and silently opens to a key held by a stranger, outside your supervision. Even if there weren't open source crypto projects out there, some managed on servers outside the US, just because I don't roll my own, doesn't mean I can't. I wrote a paper while in high school on the Clipper Chip, explaining why it was a bad idea. I have learned a lot since 1994, and these folks have apparently learned nothing. Backdoors are inherently flawed. DRM is inherently flawed. You can't create security by trusting an untrustworthy party, or by declaring the intended recipient to be the eavesdropper, or by redefining up to be down.
- wrs 7y agoJust keep repeating “you lost all the SF-86s, but you want us to trust you with everything in everyone’s phone?”
- lukifer 7y agoIf you need to explain to non-technical friends and family exactly why this is a terrible idea, CGP Grey offers an easily digestible 5-minute primer: https://www.youtube.com/watch?v=VPBH1eW28mo https://www.youtube.com/watch?v=VPBH1eW28mo Computers either have unbreakable locks, or no locks whatsoever. There's no stable middle ground.
- stronglikedan 7y ago> unbreakable locks Replace that with "locks that have yet to be broken", and I agree.
- motohagiography 7y agoIn the last crypto wars in the 90s and competent scientific explanations of the dilemma between trustworthy and backdoored didn't register with people who think in political terms either. The government side of this is rhetorically, "we can imprison and kill engineers until one of you delivers us a flying pig, whether you still say that's impossible is your call." Some engineer is going to figure out how to meet their requirements. Pigs themselves can't fly per se, but when you get to discussing how far, in what direction, for how long, under what power, and the consequences of doing nothing, even flying pigs become a solvable problem. A technologist will say, "that's horrible, unethical, and wrong, you just ran those pigs off a cliff." Everyone else looks at the politicians and the guys with the guns and says, "See? Flying pigs." They also probably push that technologist over the cliff as well. This is why they call politics the art of the possible. What Barr is saying is that he plans to make tech companies accountable for his problems in justice. This kind of irrational posturing is probably a bargaining gambit on other regulatory areas or just an empty signal to rank and file law enforcement that the whitehouse and AG are on their sides.
- AlphaGeekZulu 7y ago"[...]The cost of encryption, he said, is measured in "victims" who might have been saved from crime if law enforcement had been able to lawfully intercept communications earlier.[...]" Yes, one can measure the cost of encryption like this, just like you can measure the cost of lax gun controls or automobile traffic by their fatalities (= negative costs). But you also measure the cost of encryption and lax gun controls and automobile traffic by their benefits (positive costs). If the balance is sufficiently in the positive, the negative costs might get accepted. There is no logical point, to only reason from one side of the calculation. I never heard Barr say: "The cost of privacy is measured in 'victims' who might have been saved from crime if law enforcement had put an officer in every bedroom throughout the country." "The cost of lax gun controls is measured in dead pupils who might have been saved from death if legislation had passed stricter gun control laws."
- AlphaGeekZulu 7y agoEncryption doesn't kill people, people do?
- geggam 7y agoIf this happens companies will flee the country who does this. They have no choice.
- trentlott 7y agoThey do not need to hide the backdoor's existences though Just add a 'USGOV BACKDOOR' tab and password/encrypt it or whatever the fuck. It doesn't need to be a real control panel or anything other than trivial options (a grayed-out unchangeable toggle box that says 'Enable backdoor', for instance). I'm not the guy to provide you UI tips. Let users understand it's there without relying on security-through-obscurity. Disallow any temptation to use StO and ensure users are fully informed of the government's firm and fatherly hand. Yes, I know that the GUI/man page information are not 'the backdoor'. It is also not actually any functionality for the software you're using. It is function through abstracted symbols. Protest via abstracted symbolism - visible and immutable vulnerability.
- HeWhoLurksLate 7y agoI like this a lot. Great idea!
- thewileyone 7y agoThis and other backdoor "requirements" by US authorities is the basis of the Huawei hullabaloo ... cause Huawei wouldn't give them one, like Cisco and Ericsson has. "If you're not with us, you're against us."