8 ms·

Is the FBI dumb, evil, or just incompetent?

88 points by kevin_morrill 13y ago

LeoTolstoyJr 13y ago
Maybe I'm being naive, but what's preventing Google or Facebook from using their resources to launch a PR campaign against these requests from the FBI, or at the very least be a bit more outspoken about them?
- TsiCClawOfLight 13y ago
  the us government?
- sp332 13y ago
  Google already makes noise about it. They have a project to report on requests. https://www.google.com/transparencyreport/ https://www.google.com/transparencyreport/
- dragontamer 13y ago
  Because they are? http://news.cnet.com/8301-13578_3-57577958-38/google-fights-fbis-warrantless-data-requests-in-federal-court/ http://news.cnet.com/8301-13578_3-57577958-38/google-fights-...
- _pmf_ 13y ago
  > Maybe I'm being naive, but what's preventing Google or Facebook from using their resources to launch a PR campaign against these requests from the FBI The fact that they do not give a shit about you and your data (and why should they?). If you want your data to be encrypted, you have to do it at your end. PGP has shown exactly how much people really care about keeping their communication private if it requires even a minuscule amount of effort.
- skylan_q 13y ago
  Google and Facebook are now basically corporate interests/extended arms of the USG.
- AnthonyMouse 13y ago
  >Maybe I'm being naive, but what's preventing Google or Facebook from using their resources to launch a PR campaign against these requests from the FBI, or at the very least be a bit more outspoken about them? In theory, nothing. In practice, creating tension with the FBI and DoJ who may then decide to investigate or prosecute them for entirely unrelated things that would otherwise not have been investigated or prosecuted, etc. They have a choice between doing the Right Thing and doing the Easy Thing. We'll know what they choose soon enough.
- will_brown 13y ago
  Until recently the US Government was issuing tech companies National Security Letters (different from subpoenas, they do not require judicial approval) and the letters had built in gag orders. In other words if the recipient could not discuss what was being requested by the government, or even challenge the request in court without criminal penalties. Recently courts have reviewed this and given a partial lift on the built in gag orders. (see: http://en.wikipedia.org/wiki/National_security_letter http://en.wikipedia.org/wiki/National_security_letter)
- zeroexzeroone 13y ago
  Google used to have a very subtle way of telling you that an NSL was issued against you by asking you to "re-accept" their ToS. This may or may not be true, though.
- brown9-2 13y ago
  How do you expect these companies to operate in the US while defying US laws?
Cieplak 13y ago
Are there any video chat clients with end-to-end encryption? I was trying to do this by piping the output of my webcam to openssl and then to netcat, which sends the packets to a publicly addressable server (Amazon instance) that relays the encrypted packets to another computer behind a firewall, that decrypts the video stream and plays it in MPlayer. It works, but the latency is about 10 seconds. To reduce the latency, I could delta-encode the video stream, leverage the GPU somehow, but I'm not sure how to get the latency down to the 200ms required for seamless conversation. Also, it should be noted that there is little code behind this, mainly just unix utilities and pipes. PS: Also I could remove the Amazon piece and forge a direct P2P connection using NAT hole punching if the routers on both ends permit, but this is not always reliable and isn't a huge source of latency.
- stephen_g 13y ago
  Apparently FaceTime [1] and iMessage are end-to-end encrypted with unique session keys. Whether Apple has access to those keys is not known though (the key exchange isn't documented as far as I can tell). 1. http://www.zdnet.com/blog/apple/facetime-calls-are-encrypted-and-hipaa-compliant-when-using-proper-encryption/11166 http://www.zdnet.com/blog/apple/facetime-calls-are-encrypted...
  - venomsnake 13y ago
    Any communication that you don't set the keys/are able to track them should be considered unencrypted in my opinion.
- mtrimpe 13y ago
  Assuming TLS is still unbroken, RTMPS (Flash RTMP over TLS tunnel) offers the most accessible form of end-to-end encryption. To avoid intermediaries you'd have to run your own Flash server (e.g. Red5) though.
- vy8vWJlco 13y ago
  "Are there any video chat clients with end-to-end encryption?" Jitsi claims to. ( http://www.jitsi.org http://www.jitsi.org )
Jun8 13y ago
You don't need such a long argument to prove FBI's stunning incompetence, an example like failing to prevent the Boston bombing where they couldn't find their assess with two hands would suffice.
- skylan_q 13y ago
  They are dumb and evil. But in some ways they're also very bright. It's the most dangerous mix possible; To be effective at being incompetent.
- nathan_long 13y ago
  >> failing to prevent the Boston bombing OK, you're in charge of the FBI now. There are tens of thousands of public events today in tens of thousand of venues. Protect them all. Go.
  - tomjen3 13y ago
    No I am not. I can't protect them so I wouldn't try to become the leader of the FBI. I also can't do surgery but if I come in to have some work done on my hand and leave with a foot chopped of I am going to sue the doctor.
    - Chronic24 13y ago
      Exactly. The FBI was unable to perform their job properly. Then they ask the public for help. What, the bomber didn't leave behind any Facebook conversations to track? Boo hoo.
      - tomjen3 13y ago
        Exactly, the US has DHS, FBI, CIA and a dozen other agencies. Letting anything through should simply result in the leaders going to the electric chair.
        nathan_long 13y ago
ianstallings 13y ago
I'd say they're a little of all of those things and more. They are, after all, human. They get paranoid and worry, they make mistakes, they grasp for power when they can. It never works out like they want though, because they are human.
kenjackson 13y ago
I think people have the FBIs motivations misunderstood. And I don't mean in some evil conspiracy theory sort of way, but in one that is pretty consistent with their mission. Their main mission nowadays is to stop terrorism, etc... I I think that when they look at this rationally they believe are better served by being able to access these conversations. The article theorizes that people with data to hide will use encryption, or otherwise would be so stupid, that one can find them easily in any case. In the real world a lot of these cases are broken on a "lucky" break or two. Someone improperly or not using their encryption software once, for example. I think it seems foolish to accuse them of being dumb, evil, or incompetent. Given the stakes they deal with, and the amount of data they have to sift through, I think its very reasonable that they try to reduce the amount of work they need to do to find credible leads. And I'm sure they try to institute methods to minimize abuse, but I'm sure they are also aware that some abuse will happen. While some of this feels like it may cross the line, I think it's a line that a rationale organization, with their mission, should push against.
- nathan_long 13y ago
  Yes. Most of us here are privacy advocates, and I think society needs our voice. However, we're only one side of the coin. Imagine a world where every phone call, email, chat, forum post, etc is fully anonymous or indecipherable to law enforcement. And imagine your loved one has been abducted and law enforcement has no tools for finding those responsible. There are many kinds of dystopias. Big Brother is one. Rule by competing gangs is another. We're shooting for some compromise where both individuals and society's rights are balanced. It's hard.
  - betterunix 13y ago
    "Imagine a world where every phone call, email, chat, forum post, etc is fully anonymous or indecipherable to law enforcement. And imagine your loved one has been abducted and law enforcement has no tools for finding those responsible." So somehow, these abductors managed to leave no physical evidence at all and no witnesses? What does communication privacy have to do with that? There was once a time in this country when communications could be anonymous -- when law enforcement agencies did not have easy wiretapping access. We still managed to prosecute criminals then. Yes, sometimes criminals got away with their crimes, but that is what striking a balance is all about. The FBI is not trying to strike a balance with this proposal, they are trying to shift the balance in their favor.
fixxer 13y ago
I've read that quantum computing is picking up, so please correct me if I'm wrong... it IS still pretty hard to factor very large primes, right? This push to "stop terror" via reading the general public's email/chats/etc. seems more like Big Bro and less like a viable method to stop the next 9-11. Sure, the bros from Boston weren't exactly sophisticated, but I find it hard to believe nobody in Al Qaeda knows how to use PGP. Still, I'm voting for incompetent. If they want to know what kind of porno we all like, fine.
- kenjackson 13y ago
  it IS still pretty hard to factor very large primes, right Depends on what you mean by this... There are no practical systems which will do so. But the reason why quantum computing became interesting was because of Shor's work showing that they can factor large primes quickly (in theory).
  - nathan_long 13y ago
    >> There are no practical systems which will do so. ... that we know of. The intelligence community has secretly outpaced the rest of the world in computing, cryptography and cryptanalysis before.
    - hondje 13y ago
      Historically they are consistently about 10 years ahead of the curve per Bruce schneiers Applied Cryptography. I have no reason to not believe this to still be true
      - venomsnake 13y ago
        I do ... encryption back in the day was military stuff mostly. Nowadays it is everywhere and is much more mature field. And with the big internet companies siphoning the top talent I think they may have lost the edge a bit. Much more cheaper and practical approach is for them than to try to outpace and outspend everyone else combined is to stockpile on zero day exploits which can be used when needed.
charlesjshort 13y ago
What happens when the FBI becomes infected with people like Lerner who use their power to persecute political dissidents?
- nathan_long 13y ago
  This is the real danger of letting government become too powerful: individuals within it can abuse that power. If your political or religious views are or become unpopular, how much power to monitor, control and punish you do you want government organizations to have? How much oversight do you want for them?
- bediger4000 13y ago
  What do you mean "becomes"? J. Edgar Hoover actually did use his power to persecute political dissidents. I say this whole FBI backdoor/legal intercept thing reeks of trying to do that sort of thing again. I mean, it's pretty easy to monitor Quaker anti-war activists: they do everything publically and invite participation politely. No agency needs wiretap access to monitor them. So, who are they going to monitor with this?
siculars 13y ago
I say all of the above. There's basically one reason to work for law enforcement: Authority and its slutty sister, Power. People who are attracted to these things are susceptible to logic failures in pursuit of their interest in exerting Authority and Power.
- nathan_long 13y ago
  >> There's basically one reason to work for law enforcement: Authority and its slutty sister, Power. I'm against government surveillance, but your statement is way too broad. Only one reason? Really? You don't think anybody goes into law enforcement to protect others, curb violence, and generally do good for the world? I doubt you'd want your profession to be slandered so casually.
  - siculars 13y ago
    I said "basically one reason" because I thought it may engender pedantry. Ya, sure, people may get into law enforcement for ideologically pure reasons but I am of the opinion that with great power comes great responsibility and there are just not that many people who can resist the temptation of those two sisters. And as I said elsewhere, there are many ways to "generally do good for the world."
- andrewljohnson 13y ago
  Many people are drawn to law enforcement out of the desire to help others and do good for the world. Being an FBI agent is a very honorable and well-respected profession, especially outside of an internet forum. Your comment pisses on every person who ever went to school to study criminal law, many of whom did so for noble or at least neutral reasons.
  - zeroexzeroone 13y ago
    I wholeheartedly agree - I was born on American soil and always felt that the FBI's profession was very admirable. I have had family members deal with the FBI and most of their field agents are second to none when it comes to being good at their jobs.
riggins 13y ago
So the FBI would only be able to wiretap suspects who are either too dumb to use encryption — in which case they ought to be easy enough to catch without wiretaps I think the author under-estimates the difficultly of catching criminals.
- reeses 13y ago
  Agreed. The dumb ones will work out of 'the game' quickly enough and are quickly replaced. The bigger problem is not 'catching' them, but prosecuting them effectively. This requires prioritization of limited resources based on severity of offense, availability of sufficient evidence, and difficulty of prosecution. The last is ugly because it's almost directly economic, in that the ability to afford legal counsel creates some level of inequality.
ancarda 13y ago
Why would the FBI be interested in social networks? I don't think criminals and terrorists communicate using Facebook.
- mtgx 13y ago
  Which makes you wonder why they are interested in it, anyway, doesn't it?
- brown9-2 13y ago
  Not true.
  - ancarda 13y ago
    Can you cite any sources? I just find it implausible that anything other than petty crime would be discussed over social networks.
    - josefresco 13y ago
      http://www.cbc.ca/news/technology/story/2012/01/10/tech-terrorist-social-media.html http://www.cbc.ca/news/technology/story/2012/01/10/tech-terr... http://www.cnn.com/2013/04/27/world/rivers-social-media-terror http://www.cnn.com/2013/04/27/world/rivers-social-media-terr...
- nitrogen 13y ago
  It's probably for the network itself, not just the communications.
bediger4000 13y ago
I vote a little dumb, a little evil (you know, the banality kind) and pretty incompetent. Anecdotal, but the FBI's first web site was hosted by a NASA machine. I think the FBI was traditionally an IBM shop, and mainframes and the web didn't work well together at first. In more verifiable evidence of incompetence, there's the Virtual Case File epic fail (http://www.washingtonpost.com/wp-dyn/content/article/2006/08/17/AR2006081701485.html http://www.washingtonpost.com/wp-dyn/content/article/2006/08... just one of many articles about it) followed by a minor debacle in Sentinel (http://www.pcmag.com/article2/0,2817,2407922,00.asp http://www.pcmag.com/article2/0,2817,2407922,00.asp)
- lostlogin 13y ago
  This has happened on a vastly smaller scale at a few places I have worked. Another flaw seems to be that none technical people ask for something to appear in the new system when they have no idea. The system is built, exactly as requested, and it sucks. Having a competent software engineer on staff who understands the field is vastly more handy than a fat wad of cash paid to outsource. I'm sure there is a good middle road, but companies I have worked for haven't found it.
ireadqrcodes 13y ago
i guess they don't care about anything else as long as they can do their job
- reeses 13y ago
  We obviously need a test-driven government framework. :-)
nolite 13y ago
d) all of the above?
- reeses 13y ago
  Do FBI contradict myself? Very well then FBI contradict myself, (FBI am large, FBI contain multitudes.)
HarryHirsch 13y ago
The last line is the most important: if there is a backdoor (that is the Lawful Interception interface) there is no guarantee that it won't be used by unauthorized third parties. Anyone could have predicted that something like the Google hack was going to happen. I also seem to remember that there was a similar incident involving the cellphone network in Greece.
- betterunix 13y ago
  I would say that the most important issue is that an already over-powered law enforcement agency is asking for even more power. The recent journalist surveillance scandal should give a clue about the dangers of law enforcement surveillance. This proposal by the FBI will make that sort of surveillance easier. They are trying to grab more power to gather evidence against people, and by extension more power to arrest people. We already have the largest prison population in the world. There is no pressing need to expand it.
- rpgmaker 13y ago
  On top of this, the FBI doesn't have a "going dark" problem. For more on this please read Trevor Timm (an activist for the EFF and Executive Director of the Freedom of the Press Foundation) on the topic here: http://dprogram.net/2013/04/17/going-dark-whats-so-wrong-with-the-governments-plan-to-tap-our-internet/ http://dprogram.net/2013/04/17/going-dark-whats-so-wrong-wit... "Trevor Timm: Well, yeah. They’ve been complaining about this “Going Dark” problem for years now and we’ve never really seen any actual evidence that this actually exists. The FBI or the DOJ has to report the number of times they run into encryption when they ask for surveillance. Every year they have to report back how many times they ultimately couldn’t get the information they sought; the number is always 0—for the last 11 years." He shared this on twitter a while ago: https://twitter.com/trevortimm/status/331985318620327936 https://twitter.com/trevortimm/status/331985318620327936
venomsnake 13y ago
Think like a sysadmin in a big corporation. Assume that there are devices (the BYOD trend) that you have no root to/ no way to monitor them. It will drive you crazy if you have a mild case of ODC(and in IT it comes with the profession) no matter what the real risk is. Now you are in FBI shoes. With the devices so closely integrated into the cloud we are already close to the "day every iDevice was wiped irreversibly and huge part of the world stopped". Let's not make it closer.
paullth 13y ago
Cant the companies that would be affected just split off the operational side of the business to be outside of US jurisdiction, you know like some do to avoid paying tax (not to grossly over-simplify the issues...)? You know facebook could still exist as a US corporation encompassing the intellectual side of the company but create and icelandic company that actually deploys the servers and processes the data. Or something.
lawnchair_larry 13y ago
I'm one of the hard-headed privacy freaks usually sharpening my pitchfork when there is an outrage against civil liberties. I'm that guy. I once had a job that involved investigations of criminal activity (not law enforcement or government related, just a company protecting its own users and employees). In this case, I had identified, with certainty, one individual that was engaging in significant fraud. He appeared to have several accounts, and it was appearing highly likely that he had a few accomplices. During the investigation, I was fully willing to violate everyone's privacy to find everyone in the fraud network. This included data that was already submitted voluntarily, private communications, as well as embedding tracking objects and invisible flash objects to retrieve IP addresses of users surfing behind proxies (this used to be an effective way to unmask users). I didn't have a second thought about it. Why would I? I didn't care what the legitimate users were doing, wasn't going to stalk them, wasn't going to pay any attention to their personal affairs. But, to weed out this problem effectively, I needed to sweep everything. I'm trustworthy, just doing my job, and I certainly trust myself enough to disregard or ignore information that wasn't pertinent. After being entrenched in the investigation, I had a fairly exhaustive list of the bad actors. Initially this was just basic hard data, (such as correlating IP addresses), but then there was kind of a "sixth sense" that I also started relying on, where I couldn't articulate the signal, but some behavioral cues just felt like they were related. You know, "gut instinct". So I ended up digging into those accounts, and confirmation bias took over. I did find many more bad actors, but I was thoroughly convinced that a few cases were also related, which ended up being suspended, and it turned out that they were actually unrelated and legitimate. That's when I started to reflect a bit. I didn't go through with the most blatant of the proposed violations, although at the time I was willing to initially. I now realized how egregious that was, and noticed how easily I fell into that mindset. If asked, I think the words "If you've got nothing to hide, you've got nothing to fear" could have naturally rolled off my tongue (though, this certainly would have alerted me to the errors of my thought process). So I concluded a few things: - Most of the time, these blatant, sweeping violations, are most likely not malicious and probably do have good intentions. I very much understand what frame of mind most of those people are in. It's not an opaque three letter agency, it's made up of regular individuals with tunnel vision on their legitimate objectives (stopping crime). - When you look at criminals day in and day out, and are on a mission, everybody starts to look like a criminal. - The "working backwards" approach - finding signatures of bad activity, and applying it to other data, then "confirming" the new matches, is a well-understood statistical fallacy, aptly named, the prosecutor's fallacy[1]. If you spot it in court, your defense attorney can try and point it out to the jury - and good luck explaining it to your "peers" who probably play the same lotto numbers because theirs is "due eventually". But let's face it - your life is already ruined by then. You're on all the watch lists, your vehicles are bugged, you've got huge legal bills and no job, and maybe if you're extremely unlucky, you're even in Guantanamo. Everything prior had little or no judicial oversight, no way to defend yourself, and is from a system that is invariably full of investigators who are not self-aware enough to always catch themselves doing this, especially when the cost of missing an actual threat is extremely high. And for bonus points: The interface that a coworker created to do some of the data mining (let's call it the "lawful intercept interface") had an SQL injection bug in the logic that parsed login history. It wouldn't have been difficult to discover and exploit without even knowing this interface existed, due to the error a user would see on login if they had certain bad characters in the affected field. I found it roughly a year later and reported it to the CTO in a message from his own account, after using the bug to take his auth cookie out of the DB (we were friends, so I knew he would be a good sport). tl;dr It's mostly good intentioned individuals with tunnel vision, who are very misguided, and who don't understand the side effects and costs of what they propose. [1] http://en.wikipedia.org/wiki/Prosecutor%27s_fallacy http://en.wikipedia.org/wiki/Prosecutor%27s_fallacy
vy8vWJlco 13y ago
Most of these debates seem to start from the idea of a yes or no ballot to formalize a panopticon and I think that only makes it more likely that society will go there (I mean: please, somebody, think of the children). IMHO, the idea that law enforcement should have either all or no access to online data is a false dichotomy. Wiretapping capability is less relevant than ever IMHO, in a time with more privately-owned cameras and personal communication devices than ever; it is more likely than ever that criminals will leave physical evidence of physical crimes, and so there is less reason than ever to invade people's privacy or criminalize thoughts and suspicion/conspiracy/planning of physical crimes when the damage comes from the follow-through, not the imagination. Violent crime has been declining In Canada and the US for decades. This idea of urgency simply doesn't fit those facts. The Internet is basically a bunch of random thoughts. In a sense, people are having public conversations, but in another people are simply thinking out loud; the more we hold to criminalizing thoughts, the more we create problems by that process and criminalize freedom of thought. I'm for warrants, and against vigilante justice, but I also really think we need to dissect this idea that only law enforcement should have, or even already has, the tools to address all dangerous situations. IMHO, the less individuals rely on institutions the better, since it is well known that power corrupts. So far Canada and the US have had pretty good luck and the public has had some success holding institutions accountable for abuses of power, but I don't get the impression that influence is as strong as it needs to be, going forward (and I don't know how to fix it while continuing to empower institutions that quite predictably stray from their mandates rather than close shop). IMHO, Institutions pose an unnecessary risk as they continue to grow and claw for more power - in this case, pushing for more surveillance capabilities. I would rather be responsible for myself, without the help of institutions, wherever possible. As we create new potentials, and empower people to help themselves, I think the role of institutions should decrease. Take the recent article on the French police offloading missing person searches on Facebook for example. ( http://www.itworld.com/networking/357720/french-police-end-missing-persons-searches-suggest-using-facebook-instead http://www.itworld.com/networking/357720/french-police-end-m... ) As much as I don't like Facebook, I think that's the right tool for that job, and I would like to see more work to empower individuals in that sense. It's a wonderful thing to be not needed because you actually solved a problem. I, for one, would love to not need to rely on (and pay for) the police or government because I was safe and had a voice of my own.
X4 13y ago
I believe that the CIA is much much worse than the FBI.

88 points by kevin_morrill 13y ago

Maybe I'm being naive, but what's preventing Google or Facebook from using their resources to launch a PR campaign against these requests from the FBI, or at the very least be a bit more outspoken about them?

TsiCClawOfLight 13y ago
the us government?
sp332 13y ago
Google already makes noise about it. They have a project to report on requests. https://www.google.com/transparencyreport/ https://www.google.com/transparencyreport/
dragontamer 13y ago
Because they are? http://news.cnet.com/8301-13578_3-57577958-38/google-fights-fbis-warrantless-data-requests-in-federal-court/ http://news.cnet.com/8301-13578_3-57577958-38/google-fights-...
_pmf_ 13y ago
> Maybe I'm being naive, but what's preventing Google or Facebook from using their resources to launch a PR campaign against these requests from the FBI The fact that they do not give a shit about you and your data (and why should they?). If you want your data to be encrypted, you have to do it at your end. PGP has shown exactly how much people really care about keeping their communication private if it requires even a minuscule amount of effort.
skylan_q 13y ago
Google and Facebook are now basically corporate interests/extended arms of the USG.
AnthonyMouse 13y ago
>Maybe I'm being naive, but what's preventing Google or Facebook from using their resources to launch a PR campaign against these requests from the FBI, or at the very least be a bit more outspoken about them? In theory, nothing. In practice, creating tension with the FBI and DoJ who may then decide to investigate or prosecute them for entirely unrelated things that would otherwise not have been investigated or prosecuted, etc. They have a choice between doing the Right Thing and doing the Easy Thing. We'll know what they choose soon enough.
will_brown 13y ago
Until recently the US Government was issuing tech companies National Security Letters (different from subpoenas, they do not require judicial approval) and the letters had built in gag orders. In other words if the recipient could not discuss what was being requested by the government, or even challenge the request in court without criminal penalties. Recently courts have reviewed this and given a partial lift on the built in gag orders. (see: http://en.wikipedia.org/wiki/National_security_letter http://en.wikipedia.org/wiki/National_security_letter)
zeroexzeroone 13y ago
Google used to have a very subtle way of telling you that an NSL was issued against you by asking you to "re-accept" their ToS. This may or may not be true, though.
brown9-2 13y ago
How do you expect these companies to operate in the US while defying US laws?

Cieplak 13y ago

Are there any video chat clients with end-to-end encryption? I was trying to do this by piping the output of my webcam to openssl and then to netcat, which sends the packets to a publicly addressable server (Amazon instance) that relays the encrypted packets to another computer behind a firewall, that decrypts the video stream and plays it in MPlayer. It works, but the latency is about 10 seconds. To reduce the latency, I could delta-encode the video stream, leverage the GPU somehow, but I'm not sure how to get the latency down to the 200ms required for seamless conversation. Also, it should be noted that there is little code behind this, mainly just unix utilities and pipes. PS: Also I could remove the Amazon piece and forge a direct P2P connection using NAT hole punching if the routers on both ends permit, but this is not always reliable and isn't a huge source of latency.

stephen_g 13y ago
Apparently FaceTime [1] and iMessage are end-to-end encrypted with unique session keys. Whether Apple has access to those keys is not known though (the key exchange isn't documented as far as I can tell). 1. http://www.zdnet.com/blog/apple/facetime-calls-are-encrypted-and-hipaa-compliant-when-using-proper-encryption/11166 http://www.zdnet.com/blog/apple/facetime-calls-are-encrypted...
- venomsnake 13y ago
  Any communication that you don't set the keys/are able to track them should be considered unencrypted in my opinion.
mtrimpe 13y ago
Assuming TLS is still unbroken, RTMPS (Flash RTMP over TLS tunnel) offers the most accessible form of end-to-end encryption. To avoid intermediaries you'd have to run your own Flash server (e.g. Red5) though.
vy8vWJlco 13y ago
"Are there any video chat clients with end-to-end encryption?" Jitsi claims to. ( http://www.jitsi.org http://www.jitsi.org )

Jun8 13y ago

You don't need such a long argument to prove FBI's stunning incompetence, an example like failing to prevent the Boston bombing where they couldn't find their assess with two hands would suffice.

skylan_q 13y ago
They are dumb and evil. But in some ways they're also very bright. It's the most dangerous mix possible; To be effective at being incompetent.
nathan_long 13y ago
>> failing to prevent the Boston bombing OK, you're in charge of the FBI now. There are tens of thousands of public events today in tens of thousand of venues. Protect them all. Go.
- tomjen3 13y ago
  No I am not. I can't protect them so I wouldn't try to become the leader of the FBI. I also can't do surgery but if I come in to have some work done on my hand and leave with a foot chopped of I am going to sue the doctor.
  - Chronic24 13y ago
    Exactly. The FBI was unable to perform their job properly. Then they ask the public for help. What, the bomber didn't leave behind any Facebook conversations to track? Boo hoo.
    - tomjen3 13y ago
      Exactly, the US has DHS, FBI, CIA and a dozen other agencies. Letting anything through should simply result in the leaders going to the electric chair.
      - nathan_long 13y ago

ianstallings 13y ago

I'd say they're a little of all of those things and more. They are, after all, human. They get paranoid and worry, they make mistakes, they grasp for power when they can. It never works out like they want though, because they are human.

kenjackson 13y ago

I think people have the FBIs motivations misunderstood. And I don't mean in some evil conspiracy theory sort of way, but in one that is pretty consistent with their mission. Their main mission nowadays is to stop terrorism, etc... I I think that when they look at this rationally they believe are better served by being able to access these conversations. The article theorizes that people with data to hide will use encryption, or otherwise would be so stupid, that one can find them easily in any case. In the real world a lot of these cases are broken on a "lucky" break or two. Someone improperly or not using their encryption software once, for example. I think it seems foolish to accuse them of being dumb, evil, or incompetent. Given the stakes they deal with, and the amount of data they have to sift through, I think its very reasonable that they try to reduce the amount of work they need to do to find credible leads. And I'm sure they try to institute methods to minimize abuse, but I'm sure they are also aware that some abuse will happen. While some of this feels like it may cross the line, I think it's a line that a rationale organization, with their mission, should push against.

nathan_long 13y ago
Yes. Most of us here are privacy advocates, and I think society needs our voice. However, we're only one side of the coin. Imagine a world where every phone call, email, chat, forum post, etc is fully anonymous or indecipherable to law enforcement. And imagine your loved one has been abducted and law enforcement has no tools for finding those responsible. There are many kinds of dystopias. Big Brother is one. Rule by competing gangs is another. We're shooting for some compromise where both individuals and society's rights are balanced. It's hard.
- betterunix 13y ago
  "Imagine a world where every phone call, email, chat, forum post, etc is fully anonymous or indecipherable to law enforcement. And imagine your loved one has been abducted and law enforcement has no tools for finding those responsible." So somehow, these abductors managed to leave no physical evidence at all and no witnesses? What does communication privacy have to do with that? There was once a time in this country when communications could be anonymous -- when law enforcement agencies did not have easy wiretapping access. We still managed to prosecute criminals then. Yes, sometimes criminals got away with their crimes, but that is what striking a balance is all about. The FBI is not trying to strike a balance with this proposal, they are trying to shift the balance in their favor.

fixxer 13y ago

I've read that quantum computing is picking up, so please correct me if I'm wrong... it IS still pretty hard to factor very large primes, right? This push to "stop terror" via reading the general public's email/chats/etc. seems more like Big Bro and less like a viable method to stop the next 9-11. Sure, the bros from Boston weren't exactly sophisticated, but I find it hard to believe nobody in Al Qaeda knows how to use PGP. Still, I'm voting for incompetent. If they want to know what kind of porno we all like, fine.

kenjackson 13y ago
it IS still pretty hard to factor very large primes, right Depends on what you mean by this... There are no practical systems which will do so. But the reason why quantum computing became interesting was because of Shor's work showing that they can factor large primes quickly (in theory).
- nathan_long 13y ago
  >> There are no practical systems which will do so. ... that we know of. The intelligence community has secretly outpaced the rest of the world in computing, cryptography and cryptanalysis before.
  - hondje 13y ago
    Historically they are consistently about 10 years ahead of the curve per Bruce schneiers Applied Cryptography. I have no reason to not believe this to still be true
    - venomsnake 13y ago
      I do ... encryption back in the day was military stuff mostly. Nowadays it is everywhere and is much more mature field. And with the big internet companies siphoning the top talent I think they may have lost the edge a bit. Much more cheaper and practical approach is for them than to try to outpace and outspend everyone else combined is to stockpile on zero day exploits which can be used when needed.

charlesjshort 13y ago

What happens when the FBI becomes infected with people like Lerner who use their power to persecute political dissidents?

nathan_long 13y ago
This is the real danger of letting government become too powerful: individuals within it can abuse that power. If your political or religious views are or become unpopular, how much power to monitor, control and punish you do you want government organizations to have? How much oversight do you want for them?
bediger4000 13y ago
What do you mean "becomes"? J. Edgar Hoover actually did use his power to persecute political dissidents. I say this whole FBI backdoor/legal intercept thing reeks of trying to do that sort of thing again. I mean, it's pretty easy to monitor Quaker anti-war activists: they do everything publically and invite participation politely. No agency needs wiretap access to monitor them. So, who are they going to monitor with this?

siculars 13y ago

I say all of the above. There's basically one reason to work for law enforcement: Authority and its slutty sister, Power. People who are attracted to these things are susceptible to logic failures in pursuit of their interest in exerting Authority and Power.

nathan_long 13y ago
>> There's basically one reason to work for law enforcement: Authority and its slutty sister, Power. I'm against government surveillance, but your statement is way too broad. Only one reason? Really? You don't think anybody goes into law enforcement to protect others, curb violence, and generally do good for the world? I doubt you'd want your profession to be slandered so casually.
- siculars 13y ago
  I said "basically one reason" because I thought it may engender pedantry. Ya, sure, people may get into law enforcement for ideologically pure reasons but I am of the opinion that with great power comes great responsibility and there are just not that many people who can resist the temptation of those two sisters. And as I said elsewhere, there are many ways to "generally do good for the world."
andrewljohnson 13y ago
Many people are drawn to law enforcement out of the desire to help others and do good for the world. Being an FBI agent is a very honorable and well-respected profession, especially outside of an internet forum. Your comment pisses on every person who ever went to school to study criminal law, many of whom did so for noble or at least neutral reasons.
- zeroexzeroone 13y ago
  I wholeheartedly agree - I was born on American soil and always felt that the FBI's profession was very admirable. I have had family members deal with the FBI and most of their field agents are second to none when it comes to being good at their jobs.

riggins 13y ago

So the FBI would only be able to wiretap suspects who are either too dumb to use encryption — in which case they ought to be easy enough to catch without wiretaps I think the author under-estimates the difficultly of catching criminals.

reeses 13y ago
Agreed. The dumb ones will work out of 'the game' quickly enough and are quickly replaced. The bigger problem is not 'catching' them, but prosecuting them effectively. This requires prioritization of limited resources based on severity of offense, availability of sufficient evidence, and difficulty of prosecution. The last is ugly because it's almost directly economic, in that the ability to afford legal counsel creates some level of inequality.

ancarda 13y ago

Why would the FBI be interested in social networks? I don't think criminals and terrorists communicate using Facebook.

mtgx 13y ago
Which makes you wonder why they are interested in it, anyway, doesn't it?
brown9-2 13y ago
Not true.
- ancarda 13y ago
  Can you cite any sources? I just find it implausible that anything other than petty crime would be discussed over social networks.
  - josefresco 13y ago
    http://www.cbc.ca/news/technology/story/2012/01/10/tech-terrorist-social-media.html http://www.cbc.ca/news/technology/story/2012/01/10/tech-terr... http://www.cnn.com/2013/04/27/world/rivers-social-media-terror http://www.cnn.com/2013/04/27/world/rivers-social-media-terr...
nitrogen 13y ago
It's probably for the network itself, not just the communications.

bediger4000 13y ago

I vote a little dumb, a little evil (you know, the banality kind) and pretty incompetent. Anecdotal, but the FBI's first web site was hosted by a NASA machine. I think the FBI was traditionally an IBM shop, and mainframes and the web didn't work well together at first. In more verifiable evidence of incompetence, there's the Virtual Case File epic fail (http://www.washingtonpost.com/wp-dyn/content/article/2006/08/17/AR2006081701485.html http://www.washingtonpost.com/wp-dyn/content/article/2006/08... just one of many articles about it) followed by a minor debacle in Sentinel (http://www.pcmag.com/article2/0,2817,2407922,00.asp http://www.pcmag.com/article2/0,2817,2407922,00.asp)

lostlogin 13y ago
This has happened on a vastly smaller scale at a few places I have worked. Another flaw seems to be that none technical people ask for something to appear in the new system when they have no idea. The system is built, exactly as requested, and it sucks. Having a competent software engineer on staff who understands the field is vastly more handy than a fat wad of cash paid to outsource. I'm sure there is a good middle road, but companies I have worked for haven't found it.

ireadqrcodes 13y ago

i guess they don't care about anything else as long as they can do their job

reeses 13y ago
We obviously need a test-driven government framework. :-)

nolite 13y ago

d) all of the above?

reeses 13y ago
Do FBI contradict myself? Very well then FBI contradict myself, (FBI am large, FBI contain multitudes.)

HarryHirsch 13y ago

The last line is the most important: if there is a backdoor (that is the Lawful Interception interface) there is no guarantee that it won't be used by unauthorized third parties. Anyone could have predicted that something like the Google hack was going to happen. I also seem to remember that there was a similar incident involving the cellphone network in Greece.

betterunix 13y ago
I would say that the most important issue is that an already over-powered law enforcement agency is asking for even more power. The recent journalist surveillance scandal should give a clue about the dangers of law enforcement surveillance. This proposal by the FBI will make that sort of surveillance easier. They are trying to grab more power to gather evidence against people, and by extension more power to arrest people. We already have the largest prison population in the world. There is no pressing need to expand it.
rpgmaker 13y ago
On top of this, the FBI doesn't have a "going dark" problem. For more on this please read Trevor Timm (an activist for the EFF and Executive Director of the Freedom of the Press Foundation) on the topic here: http://dprogram.net/2013/04/17/going-dark-whats-so-wrong-with-the-governments-plan-to-tap-our-internet/ http://dprogram.net/2013/04/17/going-dark-whats-so-wrong-wit... "Trevor Timm: Well, yeah. They’ve been complaining about this “Going Dark” problem for years now and we’ve never really seen any actual evidence that this actually exists. The FBI or the DOJ has to report the number of times they run into encryption when they ask for surveillance. Every year they have to report back how many times they ultimately couldn’t get the information they sought; the number is always 0—for the last 11 years." He shared this on twitter a while ago: https://twitter.com/trevortimm/status/331985318620327936 https://twitter.com/trevortimm/status/331985318620327936

venomsnake 13y ago

Think like a sysadmin in a big corporation. Assume that there are devices (the BYOD trend) that you have no root to/ no way to monitor them. It will drive you crazy if you have a mild case of ODC(and in IT it comes with the profession) no matter what the real risk is. Now you are in FBI shoes. With the devices so closely integrated into the cloud we are already close to the "day every iDevice was wiped irreversibly and huge part of the world stopped". Let's not make it closer.

paullth 13y ago

Cant the companies that would be affected just split off the operational side of the business to be outside of US jurisdiction, you know like some do to avoid paying tax (not to grossly over-simplify the issues...)? You know facebook could still exist as a US corporation encompassing the intellectual side of the company but create and icelandic company that actually deploys the servers and processes the data. Or something.

lawnchair_larry 13y ago

I'm one of the hard-headed privacy freaks usually sharpening my pitchfork when there is an outrage against civil liberties. I'm that guy. I once had a job that involved investigations of criminal activity (not law enforcement or government related, just a company protecting its own users and employees). In this case, I had identified, with certainty, one individual that was engaging in significant fraud. He appeared to have several accounts, and it was appearing highly likely that he had a few accomplices. During the investigation, I was fully willing to violate everyone's privacy to find everyone in the fraud network. This included data that was already submitted voluntarily, private communications, as well as embedding tracking objects and invisible flash objects to retrieve IP addresses of users surfing behind proxies (this used to be an effective way to unmask users). I didn't have a second thought about it. Why would I? I didn't care what the legitimate users were doing, wasn't going to stalk them, wasn't going to pay any attention to their personal affairs. But, to weed out this problem effectively, I needed to sweep everything. I'm trustworthy, just doing my job, and I certainly trust myself enough to disregard or ignore information that wasn't pertinent. After being entrenched in the investigation, I had a fairly exhaustive list of the bad actors. Initially this was just basic hard data, (such as correlating IP addresses), but then there was kind of a "sixth sense" that I also started relying on, where I couldn't articulate the signal, but some behavioral cues just felt like they were related. You know, "gut instinct". So I ended up digging into those accounts, and confirmation bias took over. I did find many more bad actors, but I was thoroughly convinced that a few cases were also related, which ended up being suspended, and it turned out that they were actually unrelated and legitimate. That's when I started to reflect a bit. I didn't go through with the most blatant of the proposed violations, although at the time I was willing to initially. I now realized how egregious that was, and noticed how easily I fell into that mindset. If asked, I think the words "If you've got nothing to hide, you've got nothing to fear" could have naturally rolled off my tongue (though, this certainly would have alerted me to the errors of my thought process). So I concluded a few things: - Most of the time, these blatant, sweeping violations, are most likely not malicious and probably do have good intentions. I very much understand what frame of mind most of those people are in. It's not an opaque three letter agency, it's made up of regular individuals with tunnel vision on their legitimate objectives (stopping crime). - When you look at criminals day in and day out, and are on a mission, everybody starts to look like a criminal. - The "working backwards" approach - finding signatures of bad activity, and applying it to other data, then "confirming" the new matches, is a well-understood statistical fallacy, aptly named, the prosecutor's fallacy[1]. If you spot it in court, your defense attorney can try and point it out to the jury - and good luck explaining it to your "peers" who probably play the same lotto numbers because theirs is "due eventually". But let's face it - your life is already ruined by then. You're on all the watch lists, your vehicles are bugged, you've got huge legal bills and no job, and maybe if you're extremely unlucky, you're even in Guantanamo. Everything prior had little or no judicial oversight, no way to defend yourself, and is from a system that is invariably full of investigators who are not self-aware enough to always catch themselves doing this, especially when the cost of missing an actual threat is extremely high. And for bonus points: The interface that a coworker created to do some of the data mining (let's call it the "lawful intercept interface") had an SQL injection bug in the logic that parsed login history. It wouldn't have been difficult to discover and exploit without even knowing this interface existed, due to the error a user would see on login if they had certain bad characters in the affected field. I found it roughly a year later and reported it to the CTO in a message from his own account, after using the bug to take his auth cookie out of the DB (we were friends, so I knew he would be a good sport). tl;dr It's mostly good intentioned individuals with tunnel vision, who are very misguided, and who don't understand the side effects and costs of what they propose. [1] http://en.wikipedia.org/wiki/Prosecutor%27s_fallacy http://en.wikipedia.org/wiki/Prosecutor%27s_fallacy

vy8vWJlco 13y ago

Most of these debates seem to start from the idea of a yes or no ballot to formalize a panopticon and I think that only makes it more likely that society will go there (I mean: please, somebody, think of the children). IMHO, the idea that law enforcement should have either all or no access to online data is a false dichotomy. Wiretapping capability is less relevant than ever IMHO, in a time with more privately-owned cameras and personal communication devices than ever; it is more likely than ever that criminals will leave physical evidence of physical crimes, and so there is less reason than ever to invade people's privacy or criminalize thoughts and suspicion/conspiracy/planning of physical crimes when the damage comes from the follow-through, not the imagination. Violent crime has been declining In Canada and the US for decades. This idea of urgency simply doesn't fit those facts. The Internet is basically a bunch of random thoughts. In a sense, people are having public conversations, but in another people are simply thinking out loud; the more we hold to criminalizing thoughts, the more we create problems by that process and criminalize freedom of thought. I'm for warrants, and against vigilante justice, but I also really think we need to dissect this idea that only law enforcement should have, or even already has, the tools to address all dangerous situations. IMHO, the less individuals rely on institutions the better, since it is well known that power corrupts. So far Canada and the US have had pretty good luck and the public has had some success holding institutions accountable for abuses of power, but I don't get the impression that influence is as strong as it needs to be, going forward (and I don't know how to fix it while continuing to empower institutions that quite predictably stray from their mandates rather than close shop). IMHO, Institutions pose an unnecessary risk as they continue to grow and claw for more power - in this case, pushing for more surveillance capabilities. I would rather be responsible for myself, without the help of institutions, wherever possible. As we create new potentials, and empower people to help themselves, I think the role of institutions should decrease. Take the recent article on the French police offloading missing person searches on Facebook for example. ( http://www.itworld.com/networking/357720/french-police-end-missing-persons-searches-suggest-using-facebook-instead http://www.itworld.com/networking/357720/french-police-end-m... ) As much as I don't like Facebook, I think that's the right tool for that job, and I would like to see more work to empower individuals in that sense. It's a wonderful thing to be not needed because you actually solved a problem. I, for one, would love to not need to rely on (and pay for) the police or government because I was safe and had a voice of my own.

X4 13y ago

I believe that the CIA is much much worse than the FBI.