10 ms·
Obama May Back FBI Plan to Expand Wiretap Laws
- moxie 13y agoIn the 2010 "aurora" attacks, it was Google's "lawful intercept" systems that were targeted by the attackers. Microsoft just recently revealed that it was the same in their case (http://www.cio.com/article/732122/_Aurora_Cyber_Attackers_Were_Really_Running_Counter_Intelligence http://www.cio.com/article/732122/_Aurora_Cyber_Attackers_We...). The original CALEA has had serious ramifications for security world-wide: telecommunications equipment manufactured for compliance with the US market gets shipped everywhere, enabling smooth surveillance for countries like Iran and Egypt. It also becomes a major vulnerability vector, the most public case being the Greek wiretapping affair (https://en.wikipedia.org/wiki/Greek_wiretapping_case_2004%E2%80%932005 https://en.wikipedia.org/wiki/Greek_wiretapping_case_2004%E2...). It's interesting that the government is floating this with a straight face at the same time that they're seriously debating a nominal "cyber security" bill.
- daniel-cussen 13y agoHacking is commutative. If I hack you and you've hacked John Doe, I've hacked John Doe as well with no additional effort. I can see the US government backing strong privacy laws and desisting from wiretapping in the future (not without trumpeting how noble it is for them to do so) if only to stop foreign hackers from easily spying on Americans.
- RKearney 13y agoI can't wait for end-to-end encryption to become more mainstream. What would happen if Apple or Samsung started selling cell phones that encrypted voice communications end-to-end and prevented any kind of intercepting? Would the government just ban them?
- nsxwolf 13y agoYes. Remember Clipper chip?
- tsotha 13y agoAnd remember how it failed? The only way the government is going to be able to snoop in on everyone's traffic is to make the use of cryptography illegal. I don't see how that can work, either, since it's sort of necessary for commercial transactions.
- deleted 13y ago[deleted]
- RKearney 13y agoWell the downside to iMessage is all of your messages are stored on Apples servers, waiting to be given to authorities at the drop of a warrant. When I said end-to-end encryption, I was thinking more along the lines of the middle man (Apple) not having the ability to decrypt your messages.
- moxie 13y agoWe're working on open source mobile end-to-end encryption at Open Whisper Systems: http://www.whispersystems.org http://www.whispersystems.org We'd love it if more interested folks got involved.
- andyjohnson0 13y agohttp://www.redactapp.com/ http://www.redactapp.com/ "Using encryption, ciphers and peer to peer messaging, Redact sends heavily encrypted messages from one phone to another without passing through any central servers. Messages you have sent or received can be redacted from both handsets at the touch of a button with no method of recovery."
- JshWright 13y agoWhere's the source?
- andyjohnson0 13y agoFor what? The application? The underlying OS? The vhdl for the CPU? What do you want to distrust first?
- Spooky23 13y agoObama is such a disappointment. At least Bush/Cheney punched you in the face and took your rights. This guy gives you some flowery speech and stabs you in the back. How are you going to regulate IM wiretapping? I wrote a simple IM app as a sophomore in 1997. Will that be a criminal act?
- deleted 13y ago[deleted]
- deleted 13y ago[deleted]
- deleted 13y ago[deleted]
- Spooky23 13y agoIt isnt about party a or b. I supported Obama when the message was hope and change. The actual delivery is realpolitik. I've worked in government, although not at the Federal level. Commissioners/directors/administrators don't control the message, the elected official does. The fact that the FBI Director isn't spending more time with his family is tacit administration approval of the "posturing". Read Profiles in Courage. Great leaders stand for their principles, even at personal cost. Yet here we are in 2013 and Guantanamo is still open.
- gwgarry 13y agoWe need to spy on the government as invasively as the government spies on us. We need to legalize that globally. Every waking minute of every leader's life needs to be monitored and reported to the people. People should be scared to lead because every little detail of their personal and professional life will become a matter of public record. They will have to essentially try their best to be Saints. That way no leader will ever have any real power to do anything. They will truly be public servant, nay slaves. You trespass on us, we trespass on you. It's only fair.
- shmerl 13y ago> since 2010 has pushed for a legal mandate requiring companies like Facebook and Google to build into their instant-messaging and other such systems a capacity to comply with wiretap orders. Their IM services aren't encrypted by default, at least with their default clients. Therefore nothing stops law enforcement from requesting the data with the court order. And presumably they already collect literally all open communication anyway. However anyone can of course use OTR, ZRTP and etc. with normal standalone clients through these same services. So they now want to request building backdoors into those protocols? Or they want to make encryption illegal? Or what is this really about?
- betterunix 13y agoThe 2010 proposal included key escrow or some form of a back door. They seem to have dropped that from this latest proposal, probably because they did not want to revive the same old fight.
- mpyne 13y agoAccording to the article, at this point they've given up on the idea of disabling end-to-end encryption or holding keys in escrow, due to the concern that hackers could use the same backdoors. From what I can tell, the proposal is that a judge would be order to order a technically-feasible wiretap, and be able to fine the company for not complying. The problem is that "technically feasible" would be up to the judge, so the company would need to be able to explain via their lawyers why a given wiretap could not actually be implemented.
- jacoblyles 13y agoMeanwhile, it's likely that the US government records every domestic phone call: http://www.guardian.co.uk/commentisfree/2013/may/04/telephone-calls-recorded-fbi-boston http://www.guardian.co.uk/commentisfree/2013/may/04/telephon...
- HistoryInAction 13y agoYep. Again under the CALEA law. What's going on here is that the FBI wants to expand CALEA to the online world, for both VoIP and IM. We can talk about this at the next PolitiHacks meetup if you want.
- malandrew 13y agoThe irony of this is that it will most certainly have opposite affect as the FBI wants. Means to secure communications end-to-end will just be built into browsers and other clients that much faster. Eventually more and more companies will be severely limited in what information they can even with respect to information between any two end users. Most information will end up being limited to information the user chooses to share with the company hosting the service, such as preferences, publicly published information and queries to the service. Right now encryption typically requires a user to seek out special software with encryption features, but my bet is that encryption will move down the stack to the operating system and browser in a way that not only encrypts private information on the device, but that guarantees encryption end-to-end between users over any service. Full disk encryption is already becoming more common. HTTPS and SSL are becoming the norm. I'm looking forward to what fruit future research in homomorphic encryption bears.
- bad_user 13y agoUnless encryption itself becomes illegal.
- HistoryInAction 13y agoWe're tracking this and will be fighting it. Support groups like EFF and Center for Democracy and Technology (CDT), the latter of which I consult for. The gist is that the FBI push is a trial balloon—aka the changes proposed aren't expected to be introduced as legislation for many months. That said, if we push back hard through folks who agree with us in DC, like EFF and CDT, it may prevent the bad CALEA changes from ever getting introduced in the first place.
- mtowle 13y agoI apologize for the cynicism, but can you point to an example wherein pushing back accomplished more than mere delayment and/or change of form?
- HistoryInAction 13y agoNo, cynicism is warranted and expected. There were the crypto fights of the '90s, where the government tried classifying it as weaponry subject to export regulations, caused the open sourcing of PGP rather than subject it to the regs. That's probably the best example of an actual game-change that we drove through our pushback against the national security apparatus. It's taken 10 years, but we've been striking some solid blows against the National Security Letter regime, with the ACLU and EFF working with folks like Nicholas Merrill of Calyx. But that's just trying to claw back from a godawful status quo post-PATRIOT Act. SOPA isn't valid because we know that the MPAA/RIAA will keep trying to slip their policies through; we haven't hit a major realignment point yet on IP issues. But it opens up the possibility of a win, as long as our activist groups don't oversimplify, as a solid minority of HN pointed out with the recent CISPA debate. But c'mon, we of all people know that rates of change are what matter, not the current state of things. Groups like EFF and CDT act as a force. The force at any given point can be and often is overmatched by content or national security. It's one of the reasons why I'm arguing that we can't just ignore the political world anymore. We need to more actively support these groups, offline as well as online. They are our best defenses to continue to be able to grow the pie, and yet the old money of content or the government contract money of national security continues to make more sustained, ongoing arguments in their favor to our detriment.
- venomsnake 13y ago"The more you tighten your grip, Tarkin, the more star systems will slip through your fingers." Same is with communications. We will have easier time in the short run, but a few years down the road we will face MSRB terrorists and criminals - that have learned to be ghosts due to the selection pressure. We don't want them to become smart and imaginative.
- jkn 13y agoMost contributors here seem to wish for widespread end-to-end encryption, to make wiretaps a thing of the past. I'm a bit surprised at this apparent consensus... What is the estimated number of people who have been significantly wronged by abusive wiretapping, and how does it compare to the number of criminals arrested and crimes averted by wiretapping? I'm asking this in the context of Western democracies. I understand that the situation is different in authoritarian countries. I have my doubts on the wisdom of this specific plan from the FBI, but security implications seem only a peripheral concern for the majority of people complaining. It rather seems that people don't want to compromise on privacy and I don't get it. Generally speaking, don't we want wiretaps to be possible?
- vy8vWJlco 13y agoI do not consider pre-emptive interception capabilities to be a public or government responsibility. Warranted interception can be helpful, but at this moment, I am concerned more by the cyber war/terrorism rhetoric and its effect on my democracy (Canada, in my case) than I am by any threat of violence (we just passed a bill called S-7 that allows for 3-day holding without charge, and 12 month conditional probation without charge, RE: "terrorism"). We usually follow the US example, so I watch these subjects with interest, and have been amazed at the choice to walk people out of their own homes in Boston, at gunpoint, "for their own protection." I'd rather take my chances and protect myself against terrorism. (A person's home used to be his "castle.") Yes, privacy (and encryption, for example) empowers bad people - but it empowers the good ones too. Two wrongs don't make a right; I prefer to keep my freedom and strength than live in frightened "safety." So: encryption it is, even though it costs. I wish governments and concerned citizens could see how they are creating the very walls that alienate and anger. (FWIW, Canada had a bill called C-30 on the table last year with similar interception obligations and fines, and even though the government could have just passed it, because Canada is currently a political dictatorship, a huge number of Canadian's stood up and figuratively shouted in unison: NO. All it takes is saying I'm not afraid: I'm not afraid of terrorism, I'm not afraid of guns, I'm not afraid of other people's freedoms; no, I won't give away any more of my dignity. In fact, I want it back.)
- drucken 13y ago1. "Wiretapping" is the wrong conceptual model for what is proposed and implemented in modern systems. "Vacuuming" might be a better term. 2. This is a power grab, not merely an attempt to maintain equivalent present powers. As people live increasingly more of their lives on or impacted by virtual systems, the power to monitor and abuse whole societies becomes significantly larger. If you have any doubts about this, imagine it is the North Korean government with the technology. 3. Private communication, the minimum of freedom of expression and closest to thought, of any kind is never a hindrance to prevent crime or its investigation. A crime and everything leading to its implementation (and after) has many consequences in the world. It is these effects that are critical and required for crime prevention and prosecution. If there was a technology to monitor everyone's thoughts at the same time, would you use it as part of the criminal system? 4. The costs are orders of magnitude larger to setup, grow and maintain such monitoring systems indefinitely instead of targeting crime prevention and investigation. That's your taxpayer money being spent. 5. If after all the above, the inevitable result is still for governments to have the potential ability to access all communication anywhere between anyone at any time, then to reclaim individuals' rights, they too have a powerful incentive to seek and create systems that achieve the opposite, including encryption. This will occur regardless of law, and the deeper the loss or perception of loss of private rights, the more widespread it will occur. In short, "Those who desire to give up freedom in order to gain security will not have, nor do they deserve, either one."
- cpursley 13y agoOf course he will. Bureaucrats only have one objective: Increase their political influence/power. Anyone who goes to the polls thinking otherwise is naive.
- mparr4 13y agoThe amount of the fine is interesting: "starting at $25,000 a day". Despite official's assurances at a number of points that this new policy wouldn't target smaller startups--and the article implying that this policy would mostly impact "companies like Facebook and Google"--it's hard to imagine $25,000 even registering with a Facebook or a Google. Perhaps the small start-up need not worry about this new policy change, but it sounds like the medium start-up might. Fines "starting" at $25,000/day. Where do they go from there?
- frogpelt 13y agoThat's about $10 Million a year. And, like you said, that's where it starts. Look at the fines that they are imposing on companies that don't comply with Affordable Care Act. Some will incur fines upwards of a $1 Million/day. I think even Facebook and Google would feel $365 Million a year in fines.
- mparr4 13y agoI do see a fundamental difference between the two regulations, at least on a moral basis. One compels you to provide health insurance to your employees, the other requires you participate in a wiretapping program in the name of "national security". Not to say anything about the outrageous cost of healthcare in this country...
- LekkoscPiwa 13y ago<sarcasm><cynism>Yeah, he can do it. And if you don't like it then you are obviously a racist.</cynism></sarcasm>