5 ms·

> Attorney General William Barr said in a speech last month that encrypted messaging services allow "criminals to operate with impunity." The cost of encryption

by pdkl95 7y ago

> Attorney General William Barr said in a speech last month that encrypted messaging services allow "criminals to operate with impunity." The cost of encryption is “ultimately measured in a mounting number of victims — men, women and children who are the victims of crimes, crimes that could have been prevented if law enforcement had been given lawful access to encrypted evidence," This disgraceful, emotionally manipulative statement is an obvious lie. Police/FBI/etc have have access to far more information about criminals than any point in history. The average person (criminals included) leaves behind an incredible amount of "digital exhaust". They should be able to build a complete pattern-of-life easily with 3rd party data (e.g. ad tracking), various side channels, and the massive amount of metadata[1] recorded every time criminals used their phone. Of course, using all of that data to find a criminal requires actual detective work specific to each case. Encryption (especially on a phone examined after a crime) isn't preventing law enforcement from investigating crimes; it is, however, harder to automate. This anti-encryption argument is really about automated mass surveillance, not finding specific criminals. [1] "We kill people based on metadata" https://www.youtube.com/watch?v=UdQiz0Vavmc https://www.youtube.com/watch?v=UdQiz0Vavmc

bredren 7y ago
It isn’t just detective work, it is personnel with the skills to identify and pursue likely evidence. Digital forensics is way outside typical leo training and believe it or not you can make a lot more money in the private sector with IT training. Local, state and federal case loads get backlogged behind, leaving the highest priority cases to get staffed.
- pdkl95 7y ago
  > Digital forensics is way outside typical leo training That's the problem: attempting to prevent important new technology (actually-secure encryption) from being used is not a substitute for updated training that provides "typical leo" with digital forensics skills that are increasingly needed. Susan Landau's 2016 testimony before the House Judiciary Committee regarding Apple's encryption on the San Bernardino shooter's iphone: >> "Instead of embracing the communications and device security we so badly need for securing US public and private data, law enforcement continues to press hard to undermine security in the misguided desire to preserve simple, but outdated, investigative techniques." >> "We need 21st century techniques to secure the data that 21st century enemies—organized crime and nation-state attackers—seek to steal and exploit. Twentieth century approaches that provide law enforcement with the ability to investigate but also simplify exploitations and attacks are not in our national security interest. Instead of laws and regulation that weaken our protections, we should enable law enforcement to develop 21st century capabilities for conducting investigations." >> "Developing such capabilities will involve deep changed for the Bureau, which remains agent-based, not technology-based."
  - wool_gather 7y ago
    While this is easy to agree to broadly, what exactly does she intend that these "technology-based 21st century capabilities" are? If she's talking about something like PRISM, are we going to be any happier with that solution?
    - class4behavior 7y ago
      That would contradict with her overall disagreement on backdoors in encryption systems. I think, she was referring to classic investigative measures using modern tools and infrastructure.
- weberc2 7y ago
  What stops LEO from contracting with a digital forensic company or consultancy?
  - chii 7y ago
    Cost and scalability. LEA and agencies cannot use these resources enmass, and yet they want the results of such.
  - bredren 7y ago
    They do this at the federal level a lot and there is a lot of money in it.
  - deleted 7y ago
    [deleted]
  - dillonmckay 7y ago
    Thompson Reuters provides ICE with information for immigration enforcement.
- soulofmischief 7y ago
  I wonder if this would be true if the War on Drugs did not exist. Or if the CIA hadn't played a large role in spreading crack cocaine throughout Los Angeles to fund a proxy war with Iran, leading to a massive criminal element and subsequent rapid militarization of police and refocusing of FBI, CIA and police resources towards non-violent, victimless crimes.
sorokod 7y ago
> It isn’t just detective work, it is personnel with the skills to identify and pursue likely evidence. I think that at this point of the 21st century, this is 100 % detective work.
MuffinFlavored 7y ago
> it is, however, harder to automate If Apple does not give you the tools to decrypt messages on their phones, doesn't that make it "impossible" to automate, where automate is defined as any version of "decrypting the data on the phone"?
- s17n 7y ago
  I believe the point that OP is making is that the encrypted data on our phones is data historically would never have been available to law enforcement, as it simply wouldn't have existed. Then as now law enforcement can investigate but the investigative process is impossible to automate. On the other hand giving the government access to all the data that we now store about ourselves would enable automated forms of law enforcement that, in the past, were just not possible (this is what we're seeing in China).
- johnnyapol 7y ago
  One thing to keep in mind is that really only two things Apple can do. The first is to release a modified and signed version of iOS to LE agencies that has any timeouts removed to allow them to try to bruteforce the passcode locks. If a user uses a significantly long password instead of a passcode, this becomes way less effective. The second thing is to log iMessage data on the server-side (since it has to be decrypted at some point). This would allow them to produce it, but would miss any apps installed on the phone used for alternative communication. I don't like to see this so much as Apple refusing but there really isn't a way for Apple to enable easy full access without a backdoor, which is an unrealistic expectation.
  - ryukafalz 7y ago
    >The second thing is to log iMessage data on the server-side (since it has to be decrypted at some point). iMessage is end-to-end encrypted, so that's also not an option. Apple would have to inject a key they controlled into a user's list of device keys. (Which they can do, and the UI doesn't notify users if it were to happen.)
    - 7y ago
fortran77 7y ago
This guy's (now deceased) sister drove him to the location. So she was in on it, too. (Why she's not included as a perpetrator in discussions about this event is odd.) I'm sure he left evidence that goes well beyond his own phone if he was planning and plotting with others. They should have no trouble piecing this together with or without his phone.
- arcticfox 7y ago
  Uh, the sister that was shot? What leads you to believe she was in on it?
- rdtsc 7y ago
  I think it is more appropriate to refer to them as his brother https://www.out.com/news/2019/8/08/dayton-shooters-slain-brother-was-reportedly-trans-man https://www.out.com/news/2019/8/08/dayton-shooters-slain-bro...
  - Kye 7y ago
    I see this a lot. People who are known to be trans in the wider LGBTQ+ community die, then their family deadnames them to the press, and people come out of the woodworks to defend the family and the press while ignoring the wishes of the person who died. Sometimes, like in this case, it's complicated because they're only out to a few people. I would still rather err on the side of what close friends say rather than family. The family probably had no idea. They rarely do until someone's ready to come out to everyone.
    - skybrian 7y ago
      I have no knowledge here, but it seems like you're saying that journalists should out people who aren't out to their families? Doing that without having clear evidence of the person's intent seems it might be an invasion of privacy?
      - Kye 7y ago
        I'm saying it's complicated. Sometimes there is no clear right way.
otakucode 7y ago
And it's crystal clear and obvious in this case that it doesn't matter. The man shot a bunch of people, and was subsequently killed to stop his slaughter. There is no doubt to his guilt. There is no case to build. While the public may wish to know more about the shooters motives, that's not something the public or any law enforcement agency needs to keep people safe.
- cronix 7y ago
  Yes, there was lots on his Twitter feed and other social accounts before they shut them down immediately after discovering he was an Antifa supporter, praised the attempted bombing of the ICE facility last month, and talked about supporting Warren/Sanders a lot. There's more than enough evidence out there, just a lot has been hidden because he doesn't fit their Alt-Right narrative they keep pressing. You don't need his phone. https://www.snopes.com/fact-check/dayton-shooter-warren/ https://www.snopes.com/fact-check/dayton-shooter-warren/
- skybrian 7y ago
  This seems over-confident. Other people might have been involved. If so, there could be a case to build. Hard to say without investigating?
dymk 7y ago
Maybe they can’t build a profile via ad tracking, because ad tracking isn’t as invasive/doesn’t collect data which can be tied back to a specific name.
jeffdavis 7y ago
Well, everyone is talking about how excited they are to violate the 2nd Amendment. Might as well violate the 4th, too, and maybe the 1st and 5th while we are at it. All in the name of safety.
- thephyber 7y ago
  I would argue that all of the Amendments have always been subservient to “national security” (whatever that means in any age), for better or worse. Also, I have yet to hear anyone argue that we should “violate” the 2A, but I have heard lots of 1A discussion about how we could frame laws or discuss whether 2A is worth keeping in its current state.

by pdkl95 7y ago

bredren 7y ago

It isn’t just detective work, it is personnel with the skills to identify and pursue likely evidence. Digital forensics is way outside typical leo training and believe it or not you can make a lot more money in the private sector with IT training. Local, state and federal case loads get backlogged behind, leaving the highest priority cases to get staffed.

pdkl95 7y ago
> Digital forensics is way outside typical leo training That's the problem: attempting to prevent important new technology (actually-secure encryption) from being used is not a substitute for updated training that provides "typical leo" with digital forensics skills that are increasingly needed. Susan Landau's 2016 testimony before the House Judiciary Committee regarding Apple's encryption on the San Bernardino shooter's iphone: >> "Instead of embracing the communications and device security we so badly need for securing US public and private data, law enforcement continues to press hard to undermine security in the misguided desire to preserve simple, but outdated, investigative techniques." >> "We need 21st century techniques to secure the data that 21st century enemies—organized crime and nation-state attackers—seek to steal and exploit. Twentieth century approaches that provide law enforcement with the ability to investigate but also simplify exploitations and attacks are not in our national security interest. Instead of laws and regulation that weaken our protections, we should enable law enforcement to develop 21st century capabilities for conducting investigations." >> "Developing such capabilities will involve deep changed for the Bureau, which remains agent-based, not technology-based."
- wool_gather 7y ago
  While this is easy to agree to broadly, what exactly does she intend that these "technology-based 21st century capabilities" are? If she's talking about something like PRISM, are we going to be any happier with that solution?
  - class4behavior 7y ago
    That would contradict with her overall disagreement on backdoors in encryption systems. I think, she was referring to classic investigative measures using modern tools and infrastructure.
weberc2 7y ago
What stops LEO from contracting with a digital forensic company or consultancy?
- chii 7y ago
  Cost and scalability. LEA and agencies cannot use these resources enmass, and yet they want the results of such.
- bredren 7y ago
  They do this at the federal level a lot and there is a lot of money in it.
- deleted 7y ago
  [deleted]
- dillonmckay 7y ago
  Thompson Reuters provides ICE with information for immigration enforcement.
soulofmischief 7y ago
I wonder if this would be true if the War on Drugs did not exist. Or if the CIA hadn't played a large role in spreading crack cocaine throughout Los Angeles to fund a proxy war with Iran, leading to a massive criminal element and subsequent rapid militarization of police and refocusing of FBI, CIA and police resources towards non-violent, victimless crimes.

sorokod 7y ago

> It isn’t just detective work, it is personnel with the skills to identify and pursue likely evidence. I think that at this point of the 21st century, this is 100 % detective work.

MuffinFlavored 7y ago

> it is, however, harder to automate If Apple does not give you the tools to decrypt messages on their phones, doesn't that make it "impossible" to automate, where automate is defined as any version of "decrypting the data on the phone"?

s17n 7y ago
I believe the point that OP is making is that the encrypted data on our phones is data historically would never have been available to law enforcement, as it simply wouldn't have existed. Then as now law enforcement can investigate but the investigative process is impossible to automate. On the other hand giving the government access to all the data that we now store about ourselves would enable automated forms of law enforcement that, in the past, were just not possible (this is what we're seeing in China).
johnnyapol 7y ago
One thing to keep in mind is that really only two things Apple can do. The first is to release a modified and signed version of iOS to LE agencies that has any timeouts removed to allow them to try to bruteforce the passcode locks. If a user uses a significantly long password instead of a passcode, this becomes way less effective. The second thing is to log iMessage data on the server-side (since it has to be decrypted at some point). This would allow them to produce it, but would miss any apps installed on the phone used for alternative communication. I don't like to see this so much as Apple refusing but there really isn't a way for Apple to enable easy full access without a backdoor, which is an unrealistic expectation.
- ryukafalz 7y ago
  >The second thing is to log iMessage data on the server-side (since it has to be decrypted at some point). iMessage is end-to-end encrypted, so that's also not an option. Apple would have to inject a key they controlled into a user's list of device keys. (Which they can do, and the UI doesn't notify users if it were to happen.)
  - 7y ago

fortran77 7y ago

This guy's (now deceased) sister drove him to the location. So she was in on it, too. (Why she's not included as a perpetrator in discussions about this event is odd.) I'm sure he left evidence that goes well beyond his own phone if he was planning and plotting with others. They should have no trouble piecing this together with or without his phone.

arcticfox 7y ago
Uh, the sister that was shot? What leads you to believe she was in on it?
rdtsc 7y ago
I think it is more appropriate to refer to them as his brother https://www.out.com/news/2019/8/08/dayton-shooters-slain-brother-was-reportedly-trans-man https://www.out.com/news/2019/8/08/dayton-shooters-slain-bro...
- Kye 7y ago
  I see this a lot. People who are known to be trans in the wider LGBTQ+ community die, then their family deadnames them to the press, and people come out of the woodworks to defend the family and the press while ignoring the wishes of the person who died. Sometimes, like in this case, it's complicated because they're only out to a few people. I would still rather err on the side of what close friends say rather than family. The family probably had no idea. They rarely do until someone's ready to come out to everyone.
  - skybrian 7y ago
    I have no knowledge here, but it seems like you're saying that journalists should out people who aren't out to their families? Doing that without having clear evidence of the person's intent seems it might be an invasion of privacy?
    - Kye 7y ago
      I'm saying it's complicated. Sometimes there is no clear right way.

otakucode 7y ago

And it's crystal clear and obvious in this case that it doesn't matter. The man shot a bunch of people, and was subsequently killed to stop his slaughter. There is no doubt to his guilt. There is no case to build. While the public may wish to know more about the shooters motives, that's not something the public or any law enforcement agency needs to keep people safe.

cronix 7y ago
Yes, there was lots on his Twitter feed and other social accounts before they shut them down immediately after discovering he was an Antifa supporter, praised the attempted bombing of the ICE facility last month, and talked about supporting Warren/Sanders a lot. There's more than enough evidence out there, just a lot has been hidden because he doesn't fit their Alt-Right narrative they keep pressing. You don't need his phone. https://www.snopes.com/fact-check/dayton-shooter-warren/ https://www.snopes.com/fact-check/dayton-shooter-warren/
skybrian 7y ago
This seems over-confident. Other people might have been involved. If so, there could be a case to build. Hard to say without investigating?

dymk 7y ago

Maybe they can’t build a profile via ad tracking, because ad tracking isn’t as invasive/doesn’t collect data which can be tied back to a specific name.

jeffdavis 7y ago

Well, everyone is talking about how excited they are to violate the 2nd Amendment. Might as well violate the 4th, too, and maybe the 1st and 5th while we are at it. All in the name of safety.

thephyber 7y ago
I would argue that all of the Amendments have always been subservient to “national security” (whatever that means in any age), for better or worse. Also, I have yet to hear anyone argue that we should “violate” the 2A, but I have heard lots of 1A discussion about how we could frame laws or discuss whether 2A is worth keeping in its current state.