4 ms·

Require PGP signed requests, and you should have more guarantee?

g_p 5y ago
The problem would be establishing a web of trust of which PGP keys are valid, who still is "law enforcement", and whether they're on gardening leave or have retired etc. There's too many (US) law enforcement bodies to make a centralised system work, as you'd need to get a certificate authority managing every individual officer's status for every one of these (small and large) agencies, and handle onboarding and offboarding. In other countries there are more formal structures for these request through verifiable channels, with standard operating procedures in place. The question is whether the companies are adopting a lowest common denominator model (a false but assumed valid US request can request any user's data) or not, as that might start to make it a more global concern, and get it on European data protection regulators' radars.
- technofiend 5y ago
  There is already a FedPKI and it's already the Department of Justice's job to track law enforcement, is it not?
  - SkittyDog 5y ago
    No, I don't believe it's the DoJ's job to track law enforcement. There is some Federal-level recordkeeping of crime statistics... training... intelligence sharing. Could you explain what you mean, or give some examples?
jandrese 5y ago
How do you verify the PGP key for a random LEO? The web of trust is a total failure for general use verification, it only solves the special ultra-paranoid use case. Key distribution has always been the weak point of PGP.
- ryukafalz 5y ago
  You would use something like WKD and not the web of trust. https://wiki.gnupg.org/WKD https://wiki.gnupg.org/WKD
- est31 5y ago
  Government institutions are some of the best places where centralized certificate handling/signing infrastructures shine.
  - jandrese 5y ago
    And yet it's basically impossible to get a government organization to sign emails except internally using MS Exchange's encrypted email support.
- EricE 5y ago
  DHS already has a portal LEOs use to collaborate - would be pretty easy to set up something at the federal level - if there was the will.

g_p 5y ago

The problem would be establishing a web of trust of which PGP keys are valid, who still is "law enforcement", and whether they're on gardening leave or have retired etc. There's too many (US) law enforcement bodies to make a centralised system work, as you'd need to get a certificate authority managing every individual officer's status for every one of these (small and large) agencies, and handle onboarding and offboarding. In other countries there are more formal structures for these request through verifiable channels, with standard operating procedures in place. The question is whether the companies are adopting a lowest common denominator model (a false but assumed valid US request can request any user's data) or not, as that might start to make it a more global concern, and get it on European data protection regulators' radars.

technofiend 5y ago
There is already a FedPKI and it's already the Department of Justice's job to track law enforcement, is it not?
- SkittyDog 5y ago
  No, I don't believe it's the DoJ's job to track law enforcement. There is some Federal-level recordkeeping of crime statistics... training... intelligence sharing. Could you explain what you mean, or give some examples?

jandrese 5y ago

How do you verify the PGP key for a random LEO? The web of trust is a total failure for general use verification, it only solves the special ultra-paranoid use case. Key distribution has always been the weak point of PGP.

ryukafalz 5y ago
You would use something like WKD and not the web of trust. https://wiki.gnupg.org/WKD https://wiki.gnupg.org/WKD
est31 5y ago
Government institutions are some of the best places where centralized certificate handling/signing infrastructures shine.
- jandrese 5y ago
  And yet it's basically impossible to get a government organization to sign emails except internally using MS Exchange's encrypted email support.
EricE 5y ago
DHS already has a portal LEOs use to collaborate - would be pretty easy to set up something at the federal level - if there was the will.