5 ms·

The way this works is that in addition to the more colorful clients, you absolutely need to make sure that you have a sufficient number of clients among law enf

The way this works is that in addition to the more colorful clients, you absolutely need to make sure that you have a sufficient number of clients among law enforcement and security services in countries with a decent(-ish) track record regarding human rights. This way, your products and services are not obviously illegal. You can even tell your employees that your products and services are saving lives because it's actually true. This strategy mostly works because the major operating system suppliers refuse to implement requested lawful intercept solutions for their consumer products. Instead, we end up with companies that try to fill the gaps, making a business of exploiting security flaws. It's possible for the OS vendors to completely dry this swamp, by offering competing services to law enforcement using the interfaces they already have (automated software updates, for example). The reputable clients would migrate rather quickly. These companies would be left with just the shady clients, making it much more difficult to justify their continued existence.

itronitron 3y ago
>> by offering competing services That is a slippery slope though, because the OS vendors could offer Law Enforcement everything today, and there will be a special request made for a little something extra tomorrow.
judiisis 3y ago
Well Google and apple already have a lawful intercepting solution,they just don't have full zero day backdoor
abwizz 3y ago
idk seems to me that what you wish for is already here. os-vendors are predominiantly us-american and the rest of the world has to get their lawful interception on the free market, no?
luch 3y ago
Enabling lawful interceptions would only dry half the swamp, the other half being clandestine intelligence operations on foreign targets. No way any reputable OS vendor would agree to enable, for example, Dutch intelligence services spying on Russian citizens living in the UK.
kmeisthax 3y ago
The OS vendors refuse to implement lawful intercept capability because there is no such thing as a lawful intercept capability. There is only intercept capability for any purpose because ROM bootloaders and secure enclaves cannot vet the lawfulness of a request to subvert their owners. You can make a phone relatively secure against people trying to break into it, but only if it has unique access keys for the owner. If you give any government a second key for intercept capabilities, that key will be a single point of failure for the entire system. Eventually it will leak and your phone password will be effectively useless. I don't even need to invent a scenario for this: you can buy the TSA master keys off Amazon right now. The only reason why it's not a huge problem is that TSA locks are a special thing you buy and use solely for airline luggage that is already in TSA custody anyway. If you use TSA locks on anything else, however, you're just asking for it to be stolen because the locks don't actually provide any security. The shady clients will get their hands on any intercept key provided by law enforcement, because it's legally unreasonable for Apple or Google to only provide intercept capability to some of the countries they operate in. e.g. if you give the US and UK a decryption key you also have to give it to Saudi Arabia[0]. Hell, in some countries the shady and legit clients are part of the same government - e.g. you can't give the key to just the FBI but not the NSA or CIA. [0] The Saudis have one very big lever they can use to force the west to do what it wants: gas prices.
- trogdor 3y ago
  >The Saudis have one very big lever they can use to force the west to do what it wants: gas prices. The United States gets most of its petroleum from Canada. Saudi Arabia accounts for only 7% of U.S. petroleum and crude oil imports. Source: https://www.eia.gov/energyexplained/oil-and-petroleum-products/imports-and-exports.php https://www.eia.gov/energyexplained/oil-and-petroleum-produc...
  - nannal 3y ago
    Gas and oil are fungible. Anyone dropping supply affects the entire market. You need to look at total global production percent.
  - nojvek 3y ago
GoblinSlayer 3y ago
I propose that government can sell CIAndroid phones with competitive advantages like low price or "reduce taxes by 10%" app.

itronitron 3y ago

>> by offering competing services That is a slippery slope though, because the OS vendors could offer Law Enforcement everything today, and there will be a special request made for a little something extra tomorrow.

judiisis 3y ago

Well Google and apple already have a lawful intercepting solution,they just don't have full zero day backdoor

abwizz 3y ago

idk seems to me that what you wish for is already here. os-vendors are predominiantly us-american and the rest of the world has to get their lawful interception on the free market, no?

luch 3y ago

Enabling lawful interceptions would only dry half the swamp, the other half being clandestine intelligence operations on foreign targets. No way any reputable OS vendor would agree to enable, for example, Dutch intelligence services spying on Russian citizens living in the UK.

kmeisthax 3y ago

The OS vendors refuse to implement lawful intercept capability because there is no such thing as a lawful intercept capability. There is only intercept capability for any purpose because ROM bootloaders and secure enclaves cannot vet the lawfulness of a request to subvert their owners. You can make a phone relatively secure against people trying to break into it, but only if it has unique access keys for the owner. If you give any government a second key for intercept capabilities, that key will be a single point of failure for the entire system. Eventually it will leak and your phone password will be effectively useless. I don't even need to invent a scenario for this: you can buy the TSA master keys off Amazon right now. The only reason why it's not a huge problem is that TSA locks are a special thing you buy and use solely for airline luggage that is already in TSA custody anyway. If you use TSA locks on anything else, however, you're just asking for it to be stolen because the locks don't actually provide any security. The shady clients will get their hands on any intercept key provided by law enforcement, because it's legally unreasonable for Apple or Google to only provide intercept capability to some of the countries they operate in. e.g. if you give the US and UK a decryption key you also have to give it to Saudi Arabia[0]. Hell, in some countries the shady and legit clients are part of the same government - e.g. you can't give the key to just the FBI but not the NSA or CIA. [0] The Saudis have one very big lever they can use to force the west to do what it wants: gas prices.

trogdor 3y ago
>The Saudis have one very big lever they can use to force the west to do what it wants: gas prices. The United States gets most of its petroleum from Canada. Saudi Arabia accounts for only 7% of U.S. petroleum and crude oil imports. Source: https://www.eia.gov/energyexplained/oil-and-petroleum-products/imports-and-exports.php https://www.eia.gov/energyexplained/oil-and-petroleum-produc...
- nannal 3y ago
  Gas and oil are fungible. Anyone dropping supply affects the entire market. You need to look at total global production percent.
- nojvek 3y ago

GoblinSlayer 3y ago

I propose that government can sell CIAndroid phones with competitive advantages like low price or "reduce taxes by 10%" app.