3 ms·

One thing I don't understand is, why are E2EE messages on Whats App impervious to a subpoena? Take this example: let's say I had evidence of a crime, but I put

by rcme 4y ago

One thing I don't understand is, why are E2EE messages on Whats App impervious to a subpoena? Take this example: let's say I had evidence of a crime, but I put it in a safe with an unknown-to-me code, locked it, and put the safe in my basement. I could see the DOJ compelling me to get the safe opened if possible. In the case of Whats App, the E2EE is merely a promise to users from Meta. Nothing is stopping Meta from deploying an updated app version that phones home message contents. What can Meta not be compelled to release such an update?

sroussey 4y ago
Because their terms says otherwise. Always good to watch those when they change.
seanhunter 4y ago
Not a lawyer, but that's not how subpoenas work in my understanding. A subpoena is a legal writ compelling the production of evidence or testimony.[1] If Meta had access already, the data they have could therefore be subject to a subpoena. They already are responsive to subpoenas for information from facebook for example[2]. However a subpoena can't compell them to change their app to do something it doesn't currently do - it can only get them to provide evidence they have. [1] https://uk.practicallaw.thomsonreuters.com/2-501-7136?contextData=%28sc.Default%29&transitionType=Default https://uk.practicallaw.thomsonreuters.com/2-501-7136?contex... [2] https://www.zdnet.com/article/heres-what-facebook-sends-the-cops-in-response-to-a-subpoena/ https://www.zdnet.com/article/heres-what-facebook-sends-the-...
kevincox 4y ago
> Nothing is stopping Meta from deploying an updated app version that phones home message contents. IIUC there isn't a known case where the government has forced something like this. It is technically possible but legally some people claim that this is "forced speech" or other things so that it can't be compelled.
- mdek 4y ago
  well, the government has definitely tried [1] [1] https://en.wikipedia.org/wiki/FBI%E2%80%93Apple_encryption_dispute https://en.wikipedia.org/wiki/FBI%E2%80%93Apple_encryption_d...
from 4y ago
The government tried to compel Apple this way (not through a subpoena but an ancient law called the All Writs Act) in the San Bernardino shooting case but they were able to unlock the phone through other means so the case just ended up going away. It probably depends on whether Whatsapp can argue it's unreasonable, the government has other investigative techniques available, etc.
bityard 4y ago
For your average criminal case, I don't believe companies can be compelled by investigators to "pwn" a user's service in this way. But there are two things to note: All of the US three-letter agencies have been lobbying VERY hard for warrantless surveillance of social networks and backdoors into E2EE apps, using CSAM as a justification and claiming that all of their existing evidence-gathering channels are "going dark" due to rising use of encryption. So far they haven't succeeded, but I feel that it is only a matter of time before they get the bulk of what they are asking for. Either due to a series of small "wins" stretched out over many years, or there will be a high-profile case where a child is abducted and murdered and the agencies will finally get their big win from congress by rushing in front of congress and TV cameras and shouting, "we could have prevented this with unfettered access to the criminal's phone!" (And I'll only give that about a 15% chance of actually being factually true.) Second, there is absolutely nothing preventing the government from secretly compelling any US person or company to produce evidence via practically any means for a case via a National Security Letter if they can even tangentially frame the suspect as a terrorist.

by rcme 4y ago

sroussey 4y ago

Because their terms says otherwise. Always good to watch those when they change.

seanhunter 4y ago

Not a lawyer, but that's not how subpoenas work in my understanding. A subpoena is a legal writ compelling the production of evidence or testimony.[1] If Meta had access already, the data they have could therefore be subject to a subpoena. They already are responsive to subpoenas for information from facebook for example[2]. However a subpoena can't compell them to change their app to do something it doesn't currently do - it can only get them to provide evidence they have. [1] https://uk.practicallaw.thomsonreuters.com/2-501-7136?contextData=%28sc.Default%29&transitionType=Default https://uk.practicallaw.thomsonreuters.com/2-501-7136?contex... [2] https://www.zdnet.com/article/heres-what-facebook-sends-the-cops-in-response-to-a-subpoena/ https://www.zdnet.com/article/heres-what-facebook-sends-the-...

kevincox 4y ago

> Nothing is stopping Meta from deploying an updated app version that phones home message contents. IIUC there isn't a known case where the government has forced something like this. It is technically possible but legally some people claim that this is "forced speech" or other things so that it can't be compelled.

mdek 4y ago
well, the government has definitely tried [1] [1] https://en.wikipedia.org/wiki/FBI%E2%80%93Apple_encryption_dispute https://en.wikipedia.org/wiki/FBI%E2%80%93Apple_encryption_d...

from 4y ago

The government tried to compel Apple this way (not through a subpoena but an ancient law called the All Writs Act) in the San Bernardino shooting case but they were able to unlock the phone through other means so the case just ended up going away. It probably depends on whether Whatsapp can argue it's unreasonable, the government has other investigative techniques available, etc.

bityard 4y ago

For your average criminal case, I don't believe companies can be compelled by investigators to "pwn" a user's service in this way. But there are two things to note: All of the US three-letter agencies have been lobbying VERY hard for warrantless surveillance of social networks and backdoors into E2EE apps, using CSAM as a justification and claiming that all of their existing evidence-gathering channels are "going dark" due to rising use of encryption. So far they haven't succeeded, but I feel that it is only a matter of time before they get the bulk of what they are asking for. Either due to a series of small "wins" stretched out over many years, or there will be a high-profile case where a child is abducted and murdered and the agencies will finally get their big win from congress by rushing in front of congress and TV cameras and shouting, "we could have prevented this with unfettered access to the criminal's phone!" (And I'll only give that about a 15% chance of actually being factually true.) Second, there is absolutely nothing preventing the government from secretly compelling any US person or company to produce evidence via practically any means for a case via a National Security Letter if they can even tangentially frame the suspect as a terrorist.