6 ms·

Panel seeks to fine tech companies for noncompliance with wiretap orders

81 points by gsibble 14y ago

benguild 14y ago
I find it funny that because technology began in the simplest, unencrypted, analog formats that now the government expects the ability to wiretap anything with ease.
- k2enemy 14y ago
  Not to mention the implicit idea that if something makes law enforcement's job easier, then it should be legally mandated.
  - toki5 14y ago
    That's a little disingenuous here -- "compliance" in this context means "able to comply." Currently, if a company is "unable to comply," that means they can't forward along whatever information is required by the warrant, and usually law enforcement backs off. The change here is that now they're starting to say "too bad, make it happen." Law enforcement doesn't have a hand in the tech stacks of private companies. This isn't "making their job easier" -- in a lot of cases it's making their job possible.
    - abecedarius 14y ago
      Their job is to catch criminals, not to snoop, maybe it's worth mentioning. These are necessarily linked only when the talk itself is the crime.
      - toki5 14y ago
        That's a fairly extreme and frankly unrealistic generalization. Warrants (of any form) exist because of the need to gather evidence in cases; the existence of evidence isn't always a crime in and of itself but is used to support a case that a crime has occurred (or is going to occur).
        betterunix 14y ago
        The police do not need the cooperation of tech companies to gather evidence. Yes, CALEA made it easier to gather evidence, but the police did a fine enough job beforehand. What you are ignoring is that this proposal, like CALEA, is really part of a very long chain of events that have led to ever greater police power. If you look at the history of law enforcement for the past 50 years, you see monotonic increases in the power of the police: the power to arrest people, the power to kill people (including the weapons the police carry), the power to conduct surveillance, the power to seize assets, etc. The reason we have the largest prison population on the planet is that we have ceded such vast power to the power to the police (and to prosecutors). Unfortunately, there are a lot of ring-wing, law-and-order types in this country who see nothing wrong with this picture: https://upload.wikimedia.org/wikipedia/commons/7/7c/San_Bernardino_police_swat_team.jpg https://upload.wikimedia.org/wikipedia/commons/7/7c/San_Bern...
        toki5 14y ago
        I'll reply to you and 'abecedarius in the same spot: The problem arises when critical evidence exists only in the infrastructure of some private company. If a case hinges on a fact that is proven only by information that is in the hands of, e.g., Verizon, then yes, law enforcement requires the cooperation of that tech company to gather evidence. >but the police did a fine enough job beforehand Beforehand? The police did a fine enough job gathering evidence before technology leapfrogged ahead of them? Sure, they did. Then they sought to adapt our laws to the advancements that we've made. You see power creep in law enforcement; I see power creep in everybody.
        betterunix 14y ago
        "If a case hinges on a fact that is proven only by information that is in the hands of, e.g., Verizon, then yes, law enforcement requires the cooperation of that tech company to gather evidence." ...and if the company lacks that evidence because the police took too long to ask for it, then the case falls apart. So what? Our justice system is not meant to minimize the number of false negatives, it is meant to minimize the number of false positives. "The police did a fine enough job gathering evidence before technology leapfrogged ahead of them?" Read the context; the police did a fine enough job of gathering wiretap evidence before CALEA. The phone had been around and in common use for decades before CALEA, and even in the years leading up to CALEA the police had gathered enormous amounts of evidence from wiretaps and pen registers. It was just harder, because prior to CALEA the police had to actually step away from their desks and install a machine to perform a wiretap -- how terribly inconvenient! "You see power creep in law enforcement; I see power creep in everybody." Only if you ignore the fact that the police are more powerful today than they were when our parents were growing up. You are not witnessing power creep, you are witnessing a possible minute change in the balance of power between people and the government. Instead of calling up a phone company and demanding a wiretap, the police might have to show up in a data center with a rack-mountable interception device, in the worst case.
    - cinquemb 14y ago
      "Law enforcement doesn't have a hand in the tech stacks of private companies." For good reason, because if a private company was busy bending over backwards for law enforcement through mounds of code that already works for their needs with their investor/own capital taking time away of providing/improving something useful to their target users, they wouldn't be in business for long.
      - rdtsc 14y ago
        Aha, bingo, that is why big companies love that. It kills the smaller, more agile competitors. Big monopolies will just pass this right through to the customers. As long as customers don't have an option to use a non-American carrier they have not choice.
  - jfoutz 14y ago
    I know, pulling over for flashing lights and sirens, what BS is that? Seriously though, it often makes sense to build in affordances for enforcement. We may not agree what laws exist, but if they're going to be enforced, they should be enforced uniformly and efficiently.
    - betterunix 14y ago
      No, we should not enforce laws efficiently, because that weakens the protection against tyranny. We want law enforcement agencies to have to jump through hoops so that tyrannical and oppressive laws are hard to enforce. The reason the US government is so inefficiently organized is to thwart the establishment of tyranny. Yes, it means that people who creep us out, who are "obviously" guilty, and whom we personally want to punish will continue to walk free. As H. L. Mencken famously said, "The trouble with fighting for human freedom is that one spends most of one's time defending scoundrels. For it is against scoundrels that oppressive laws are first aimed, and oppression must be stopped at the beginning if it is to be stopped at all."
      - toki5 14y ago
        Jumping through hoops -- a system of checks and balances -- is fine and good. When those checks and balances check out, so to speak, I want my law enforcement agencies able to do their job efficiently. This is a case of making that process -- the post-warrant process, after checks and balances have played out -- easier.
        betterunix 14y ago
        One would think that the police are already able to do their jobs efficiently, since we have the largest prison population on this planet. What this proposal is about is making it easier for the police to gather evidence, because as we all know, leaving their desks and actually working to catch criminals is just asking too much of them. It is precisely the same argument that was made for CALEA: demanding that the police actually go into the field and attach wiretapping equipment to phone lines is making it too hard to catch criminals, so we "must" make it possible to execute wiretap orders without even leaving their chair. The checks and balances are weakened every time we make the police "more efficient." Again, the point of making the government, police included, inefficient is to thwart those who would try to establish oppressive systems. Making the police more efficient makes it easier for unjust laws to be passed and enforced.
- rdtsc 14y ago
  They have 2 problems (and they somewhat conflict with each other). They _need_ strong, quality encryption to use it themselves. NSA advises and certifies on picking correct algorithms, with right sized keys on particular hardware, certified using this and that certificate (FIPS 140-2) and so on, when it comes to what government agencies should be using to keep their secrets safe. BUT at the same time they want everyone else to use something that is crack-able, traceable and easily controllable by them. Their wet dream is key escrow, something like "You can use your strong 2048 bit keys but please be kind enough first to send it to the NSA for escrow storage".
salem 14y ago
People will have a really tough time complying with this. CALEA requires that the subject of the intercept not be made aware of intercepts being made. If a target can check that the IP of his peer and is own is public, by a side channel for example, and a 3rd party IP is still used for 'nat/firewall traversal' that is known not to be needed, then the game is up. As usual, you'll only catch the clueless.
- peejaybee 14y ago
  I once set up a bridging firewall (using LEAF Bering) for a friend's business to control traffic invisibly (this wasn't for any nefarious purposes -- he really needed a firewall that didn't take up an IP number on his public network.) Configuring it was a pain in the ass (you couldn't telnet/ssh into it because it had no IP number) but it worked very well and didn't show up in pings, traceroutes, or much of anything else. You can do a lot at the frame layer.
D9u 14y ago
1984... "Freedom is Slavery!" "War is Peace!"
jchrisa 14y ago
The Coming War on General Purpose Computation http://craphound.com/?p=3817 http://craphound.com/?p=3817
rubbingalcohol 14y ago
So companies will have to build in "wiretap friendly" monitoring capabilities into their products in order to facilitate regulatory compliance? Is the government going to subsidize the cost of developing this stuff? Aside from how insidious the requirement seems from a privacy standpoint, it seems to place undue economic burden on businesses from a compliance standpoint.
deleted 14y ago
[deleted]
minimax 14y ago
People surprised by this probably ought to revisit the trap and trace requirements that the telcos have had in place for decades. http://en.wikipedia.org/wiki/Communications_Assistance_for_Law_Enforcement_Act http://en.wikipedia.org/wiki/Communications_Assistance_for_L...
- cube13 14y ago
  The legal framework was established in the 60's: http://www.aarclibrary.org/publib/church/reports/book3/html/ChurchB3_0147b.htm http://www.aarclibrary.org/publib/church/reports/book3/html/...
- HistoryInAction 14y ago
  Excellent point. Which is why once we're done with ECPA reform— en.wikipedia.org/wiki/Electronic_Communications_Privacy_Act — CALEA reform is next. These laws /must/ be updated for modern usage.
deepblueocean 14y ago
A good starting place to think about the CALEA system (besides, as other comments mention, looking at CALEA itself) is this paper from Matt Blaze and his students: http://www.crypto.com/blog/calea_weaknesses/ http://www.crypto.com/blog/calea_weaknesses/ Also interesting is Steve Bellovin et al.'s excellent report on security implications of extending CALEA to VoIP: https://www.cs.columbia.edu/~smb/papers/CALEAVOIPreport.pdf https://www.cs.columbia.edu/~smb/papers/CALEAVOIPreport.pdf Steve Bellovin is now the FTC's Chief Technologist and spends his days trying to bring technical sanity to the government in various ways.
dobbsbob 14y ago
You'd think we would learn our lessons about sabotaging our infrastructure and software to enable easy LE wiretap access after the Olympics spying scandal in Athens when somebody discovered this back door and used it to spy on the Prime Minister plus a hundred other dignitaries such as the US Ambassador. Wonder how this panel's decision will affect projects such as Textsecure and Redphone which were sadly sold to Twitter, and therefore under US jurisdiction to force backdoors into. Same goes for Phil Zimmerman's new service.
- rdtsc 14y ago
  > Wonder how this panel's decision will affect projects such as Textsecure and Redphone I say it is only a matter of time. The wheels are already turning in that direction. Just need a few terrorism/child porn high profile cases where someone on behalf of FBI will testify how they had to let the evil perpetrator go because encryption made it impossible to wiretap them -- and bam legislation will be out in no time. Remember many countries make cryptography illegal and even in US exporting string cryptographic software was the same legally as exporting the designs for bombs and rockets. And ban and/or arm twisting fines are just around the corner I suspect.
venomsnake 14y ago
And now I can write a simple greasemonkey script that can encrypt the text send to facebook chat and the other side decrypting it. We just need to be able to exchange keys by other channels - not hard at all. And on any device with root you can install driver that encrypts the mic signal. So instead of terrorists we will have technology literate terrorists.
eksith 14y ago
I can see why there's a demand for a P2P/distributed routing for voice/video services to get around this as they would require working with multiple ISPs at the least and at most involve some sort of end-to-end encryption. Wonder if it's possible to implement something like Tor for VoIP.
- jeffasinger 14y ago
  I think the hard part about doing Tor for VoIP would be latency. It would be pretty difficult to have a voice conversation with the sort of latency you'd get from bouncing a connection through a bunch of volunteer computers.
  - eksith 14y ago
    Good point. It may make more sense to initiate a connection via multiple routes (node discovery) and then direct-connect securely. Of course that won't prevent anyone eavesdropping of knowing where the call is going, just keep them from knowing what they were talking about.
revelation 14y ago
I like how fines will double each day if left unpaid. Within a few months, the fine will be much much higher than all money in existence.

81 points by gsibble 14y ago

I find it funny that because technology began in the simplest, unencrypted, analog formats that now the government expects the ability to wiretap anything with ease.

k2enemy 14y ago
Not to mention the implicit idea that if something makes law enforcement's job easier, then it should be legally mandated.
- toki5 14y ago
  That's a little disingenuous here -- "compliance" in this context means "able to comply." Currently, if a company is "unable to comply," that means they can't forward along whatever information is required by the warrant, and usually law enforcement backs off. The change here is that now they're starting to say "too bad, make it happen." Law enforcement doesn't have a hand in the tech stacks of private companies. This isn't "making their job easier" -- in a lot of cases it's making their job possible.
  - abecedarius 14y ago
    Their job is to catch criminals, not to snoop, maybe it's worth mentioning. These are necessarily linked only when the talk itself is the crime.
    - toki5 14y ago
      That's a fairly extreme and frankly unrealistic generalization. Warrants (of any form) exist because of the need to gather evidence in cases; the existence of evidence isn't always a crime in and of itself but is used to support a case that a crime has occurred (or is going to occur).
      - betterunix 14y ago
        The police do not need the cooperation of tech companies to gather evidence. Yes, CALEA made it easier to gather evidence, but the police did a fine enough job beforehand. What you are ignoring is that this proposal, like CALEA, is really part of a very long chain of events that have led to ever greater police power. If you look at the history of law enforcement for the past 50 years, you see monotonic increases in the power of the police: the power to arrest people, the power to kill people (including the weapons the police carry), the power to conduct surveillance, the power to seize assets, etc. The reason we have the largest prison population on the planet is that we have ceded such vast power to the power to the police (and to prosecutors). Unfortunately, there are a lot of ring-wing, law-and-order types in this country who see nothing wrong with this picture: https://upload.wikimedia.org/wikipedia/commons/7/7c/San_Bernardino_police_swat_team.jpg https://upload.wikimedia.org/wikipedia/commons/7/7c/San_Bern...
        toki5 14y ago
        I'll reply to you and 'abecedarius in the same spot: The problem arises when critical evidence exists only in the infrastructure of some private company. If a case hinges on a fact that is proven only by information that is in the hands of, e.g., Verizon, then yes, law enforcement requires the cooperation of that tech company to gather evidence. >but the police did a fine enough job beforehand Beforehand? The police did a fine enough job gathering evidence before technology leapfrogged ahead of them? Sure, they did. Then they sought to adapt our laws to the advancements that we've made. You see power creep in law enforcement; I see power creep in everybody.
        betterunix 14y ago
        "If a case hinges on a fact that is proven only by information that is in the hands of, e.g., Verizon, then yes, law enforcement requires the cooperation of that tech company to gather evidence." ...and if the company lacks that evidence because the police took too long to ask for it, then the case falls apart. So what? Our justice system is not meant to minimize the number of false negatives, it is meant to minimize the number of false positives. "The police did a fine enough job gathering evidence before technology leapfrogged ahead of them?" Read the context; the police did a fine enough job of gathering wiretap evidence before CALEA. The phone had been around and in common use for decades before CALEA, and even in the years leading up to CALEA the police had gathered enormous amounts of evidence from wiretaps and pen registers. It was just harder, because prior to CALEA the police had to actually step away from their desks and install a machine to perform a wiretap -- how terribly inconvenient! "You see power creep in law enforcement; I see power creep in everybody." Only if you ignore the fact that the police are more powerful today than they were when our parents were growing up. You are not witnessing power creep, you are witnessing a possible minute change in the balance of power between people and the government. Instead of calling up a phone company and demanding a wiretap, the police might have to show up in a data center with a rack-mountable interception device, in the worst case.
  - cinquemb 14y ago
    "Law enforcement doesn't have a hand in the tech stacks of private companies." For good reason, because if a private company was busy bending over backwards for law enforcement through mounds of code that already works for their needs with their investor/own capital taking time away of providing/improving something useful to their target users, they wouldn't be in business for long.
    - rdtsc 14y ago
      Aha, bingo, that is why big companies love that. It kills the smaller, more agile competitors. Big monopolies will just pass this right through to the customers. As long as customers don't have an option to use a non-American carrier they have not choice.
- jfoutz 14y ago
  I know, pulling over for flashing lights and sirens, what BS is that? Seriously though, it often makes sense to build in affordances for enforcement. We may not agree what laws exist, but if they're going to be enforced, they should be enforced uniformly and efficiently.
  - betterunix 14y ago
    No, we should not enforce laws efficiently, because that weakens the protection against tyranny. We want law enforcement agencies to have to jump through hoops so that tyrannical and oppressive laws are hard to enforce. The reason the US government is so inefficiently organized is to thwart the establishment of tyranny. Yes, it means that people who creep us out, who are "obviously" guilty, and whom we personally want to punish will continue to walk free. As H. L. Mencken famously said, "The trouble with fighting for human freedom is that one spends most of one's time defending scoundrels. For it is against scoundrels that oppressive laws are first aimed, and oppression must be stopped at the beginning if it is to be stopped at all."
    - toki5 14y ago
      Jumping through hoops -- a system of checks and balances -- is fine and good. When those checks and balances check out, so to speak, I want my law enforcement agencies able to do their job efficiently. This is a case of making that process -- the post-warrant process, after checks and balances have played out -- easier.
      - betterunix 14y ago
        One would think that the police are already able to do their jobs efficiently, since we have the largest prison population on this planet. What this proposal is about is making it easier for the police to gather evidence, because as we all know, leaving their desks and actually working to catch criminals is just asking too much of them. It is precisely the same argument that was made for CALEA: demanding that the police actually go into the field and attach wiretapping equipment to phone lines is making it too hard to catch criminals, so we "must" make it possible to execute wiretap orders without even leaving their chair. The checks and balances are weakened every time we make the police "more efficient." Again, the point of making the government, police included, inefficient is to thwart those who would try to establish oppressive systems. Making the police more efficient makes it easier for unjust laws to be passed and enforced.
rdtsc 14y ago
They have 2 problems (and they somewhat conflict with each other). They _need_ strong, quality encryption to use it themselves. NSA advises and certifies on picking correct algorithms, with right sized keys on particular hardware, certified using this and that certificate (FIPS 140-2) and so on, when it comes to what government agencies should be using to keep their secrets safe. BUT at the same time they want everyone else to use something that is crack-able, traceable and easily controllable by them. Their wet dream is key escrow, something like "You can use your strong 2048 bit keys but please be kind enough first to send it to the NSA for escrow storage".

salem 14y ago

People will have a really tough time complying with this. CALEA requires that the subject of the intercept not be made aware of intercepts being made. If a target can check that the IP of his peer and is own is public, by a side channel for example, and a 3rd party IP is still used for 'nat/firewall traversal' that is known not to be needed, then the game is up. As usual, you'll only catch the clueless.

peejaybee 14y ago
I once set up a bridging firewall (using LEAF Bering) for a friend's business to control traffic invisibly (this wasn't for any nefarious purposes -- he really needed a firewall that didn't take up an IP number on his public network.) Configuring it was a pain in the ass (you couldn't telnet/ssh into it because it had no IP number) but it worked very well and didn't show up in pings, traceroutes, or much of anything else. You can do a lot at the frame layer.

D9u 14y ago

1984... "Freedom is Slavery!" "War is Peace!"

jchrisa 14y ago

The Coming War on General Purpose Computation http://craphound.com/?p=3817 http://craphound.com/?p=3817

rubbingalcohol 14y ago

So companies will have to build in "wiretap friendly" monitoring capabilities into their products in order to facilitate regulatory compliance? Is the government going to subsidize the cost of developing this stuff? Aside from how insidious the requirement seems from a privacy standpoint, it seems to place undue economic burden on businesses from a compliance standpoint.

deleted 14y ago

[deleted]

minimax 14y ago

People surprised by this probably ought to revisit the trap and trace requirements that the telcos have had in place for decades. http://en.wikipedia.org/wiki/Communications_Assistance_for_Law_Enforcement_Act http://en.wikipedia.org/wiki/Communications_Assistance_for_L...

cube13 14y ago
The legal framework was established in the 60's: http://www.aarclibrary.org/publib/church/reports/book3/html/ChurchB3_0147b.htm http://www.aarclibrary.org/publib/church/reports/book3/html/...
HistoryInAction 14y ago
Excellent point. Which is why once we're done with ECPA reform— en.wikipedia.org/wiki/Electronic_Communications_Privacy_Act — CALEA reform is next. These laws /must/ be updated for modern usage.

deepblueocean 14y ago

A good starting place to think about the CALEA system (besides, as other comments mention, looking at CALEA itself) is this paper from Matt Blaze and his students: http://www.crypto.com/blog/calea_weaknesses/ http://www.crypto.com/blog/calea_weaknesses/ Also interesting is Steve Bellovin et al.'s excellent report on security implications of extending CALEA to VoIP: https://www.cs.columbia.edu/~smb/papers/CALEAVOIPreport.pdf https://www.cs.columbia.edu/~smb/papers/CALEAVOIPreport.pdf Steve Bellovin is now the FTC's Chief Technologist and spends his days trying to bring technical sanity to the government in various ways.

dobbsbob 14y ago

You'd think we would learn our lessons about sabotaging our infrastructure and software to enable easy LE wiretap access after the Olympics spying scandal in Athens when somebody discovered this back door and used it to spy on the Prime Minister plus a hundred other dignitaries such as the US Ambassador. Wonder how this panel's decision will affect projects such as Textsecure and Redphone which were sadly sold to Twitter, and therefore under US jurisdiction to force backdoors into. Same goes for Phil Zimmerman's new service.

rdtsc 14y ago
> Wonder how this panel's decision will affect projects such as Textsecure and Redphone I say it is only a matter of time. The wheels are already turning in that direction. Just need a few terrorism/child porn high profile cases where someone on behalf of FBI will testify how they had to let the evil perpetrator go because encryption made it impossible to wiretap them -- and bam legislation will be out in no time. Remember many countries make cryptography illegal and even in US exporting string cryptographic software was the same legally as exporting the designs for bombs and rockets. And ban and/or arm twisting fines are just around the corner I suspect.

venomsnake 14y ago

And now I can write a simple greasemonkey script that can encrypt the text send to facebook chat and the other side decrypting it. We just need to be able to exchange keys by other channels - not hard at all. And on any device with root you can install driver that encrypts the mic signal. So instead of terrorists we will have technology literate terrorists.

eksith 14y ago

I can see why there's a demand for a P2P/distributed routing for voice/video services to get around this as they would require working with multiple ISPs at the least and at most involve some sort of end-to-end encryption. Wonder if it's possible to implement something like Tor for VoIP.

jeffasinger 14y ago
I think the hard part about doing Tor for VoIP would be latency. It would be pretty difficult to have a voice conversation with the sort of latency you'd get from bouncing a connection through a bunch of volunteer computers.
- eksith 14y ago
  Good point. It may make more sense to initiate a connection via multiple routes (node discovery) and then direct-connect securely. Of course that won't prevent anyone eavesdropping of knowing where the call is going, just keep them from knowing what they were talking about.

revelation 14y ago

I like how fines will double each day if left unpaid. Within a few months, the fine will be much much higher than all money in existence.