4 ms·

So let me get this straight: Breaking into other's computer systems to gain unauthorised access is only illegal/unethical for the little people - is that right?

sliverstorm 12y ago
So let me get this straight: enforcement should be bound by exactly the same rules as citizens - am I correct?
- coldtea 12y ago
  Yes, you are correct, and yes it should.
  - Loughla 12y ago
    So to commit any crime at all, I just need to be sure to close my doors and not allow law-enforcement in when they ask to enter. Correct? That is unbelievable naive, whatever your view on the current state of law-enforcement is. There are times when law-enforcement needs slightly more space to work than regular citizens; search warrants, for instance. The questions arise when we discuss where the line is for how much more space they need and when they need it. 99% of the time, I agree with you; law enforcement should have to operate under the same rules as everyone else. But, for that one percent, asking politely if any crimes are being committed on the premises is just not enough.
    - anon4 12y ago
      You're right but you don't want the executive branch to grant itself powers. You want the judiciary branch to give the executive branch an exceptional above-law right to do things in a specific situation that you don't want done to just any random person.
    - peterkelly 12y ago
      So let's consider how we might encode this notion into an authorisation protocol. A given computer system allows access to a set of individuals who, according to some criteria, have been granted authorisation (by some party) to have access that system. This lists consists, at minimum, of: 1) The owner of the system 2) Other users who have been granted access by the owner of the system 3) Law enforcement agencies from one or more jurisdictions If one were to implement this, then this would involve the software explicitly granting access to the law enforcement agencies in question. And if we assume this is desirable, then the next question to arise would be which agencies should be granted access. Now, this is where politics and international law come in. Australia, for example, would love to have access to government systems of Indonesia. Similarly, China for the US. And arguably all permutations of these, and every country in the world. And in many cases they likely already do. If you were to take the transitive closure of the desires and claims of all law enforcement agencies worldwide, then this would result in a situation where all such agencies have access to all system worldwide. If this is the case, then why even bother with exploits? It should be explicitly encoded in the default ACLs of all operating systems, perhaps using a regularly updated list obtained from a reliable source. Microsoft, Apple, and the Linux kernel developers could then embed this list, and the necessary update mechanisms, directly into the OS. This would ensure that all agencies have access to the systems they desire. The problem that comes here of course is that which agencies should be granted access to which systems. Should it be only those within the same country? Should it be those of allied countries as well? How do you determine whether country A should have access to systems in country B? I understand there are legitimate needs of law enforcement. But I also, by default, take the position that computer systems should be secure, and that everyone who's work touches on this should be focused on ensuring this. This is the difference between white hats (the "good guys") and black hats (the "bad guys"). Disclaimer: I'm a computer scientist, not a politician, intelligence analyst, or international law expert. My views have also been influenced by the overreach of the NSA and it's partner agencies.
      - adestefan 12y ago
        You just described CALEA.
      - mike_hearn 12y ago
    - coldtea 12y ago
      >So to commit any crime at all, I just need to be sure to close my doors and not allow law-enforcement in when they ask to enter. Correct? Unless they have proper and signed warrant. Which is like any other citizen, eg. me or you, having a permit to go into some place X. If we have to follow those rules (e.g about unauthorised access) then they should too. Breaking into computer systems (or houses) to find evidence is not playing by the same rules. Nor is getting that kind of power arbitrarily over everyone, as they do, without specifics about a target/case.
  - peterkelly 12y ago
    So which country's law should apply, in the case where a law enforcement agency from country A is breaking into systems owned and operated from within country B?
    - coldtea 12y ago
      They should not break into systems within country B. That's an act of war.
- peterkelly 12y ago
  Regarding computer security, yes. When we build software we have a responsibility to ensure that their use of this software - particularly for communication tools is secure. If there are instances where a piece of software is not secure, I believe (and I gather the general opinion in the industry is) that we should do what is necessary to fix those problems.
  - sliverstorm 12y ago
    As a member of the private sector working on software, yes. Make it as secure as you can and fix holes. But that isn't the FBI's job.
devindotcom 12y ago
Not exactly... it's kind of like asking whether peeping into someone else's home at night is only illegal for the little people. For you and me, it's stalking. For a police force that has presented probable cause, evidence, etc to a judge and been awarded a search warrant or wiretap, it's normal investigative technique.
- jnbiche 12y ago
  >Not exactly... it's kind of like asking whether peeping into someone else's home at night is only illegal for the little people. Well, if that's the analogy you want to use, then this is like police peeping in on the homes of thousands of people who have nothing to do with any crime, all in an effort to find a handful of criminals. There are many people who are OK with that state of affairs. I'm not.
- peterkelly 12y ago
  The problem I have with this technique specifically is that it takes advantage of software vulnerabilities that arguably should be reported to the vendor and fixed. If we accept that it's just fine for government agencies (and remember, it might not be a government in your own country) to find exploits, not report them in order to protect people who use that software, and keep those to themselves for their own benefit, then I have a problem with that. It leaves people at risk of being infiltrated not just by (some government agency) but by criminals e.g. looking for their credit card information. Put another way, let's suppose you find a vulnerability in Chrome. Do you: 1) Report it to Google, wait until a patch is available, and then discuss it publicly (aka responsible disclosure) 2) Keep it for yourself, or sell to a government agency (possibly that of a country not friendly to your own) to take advantage of The thing I really have a major beef with is that so many people think that option 2 is just fine. Software should be secure - everyone in the industry has a responsibility to protect users, not leave them vulnerable.
  - mike_hearn 12y ago
    I would agree, but then consider what happens after that - the FBI and similar in other countries have no other options left, and the path of least resistance for them is now to go to politicians and ask for Tor itself to be banned. Though I hate to say it, a system that (accidentally) allows police forces to deanonymise select individuals whilst other actors cannot do so, and even the police cannot do so in bulk all the time, is not a terrible tradeoff. Snowden has made similar remarks, I believe. Of course the supply of zero-days is presumably not infinite. As pointed out, if Tor had more manpower they'd maybe switch to Chrome which is much harder to exploit. So this situation whilst it may not seem ideal is perhaps the frying pan, and as endpoint security improves we may find ourselves in the fire. I recently proposed on tor-dev that individual relays be able to stop acting as introduction points for specific hidden services, with exactly this scenario in mind. They ignored me of course. They seem to feel invincible.

sliverstorm 12y ago

So let me get this straight: enforcement should be bound by exactly the same rules as citizens - am I correct?

coldtea 12y ago
Yes, you are correct, and yes it should.
- Loughla 12y ago
  So to commit any crime at all, I just need to be sure to close my doors and not allow law-enforcement in when they ask to enter. Correct? That is unbelievable naive, whatever your view on the current state of law-enforcement is. There are times when law-enforcement needs slightly more space to work than regular citizens; search warrants, for instance. The questions arise when we discuss where the line is for how much more space they need and when they need it. 99% of the time, I agree with you; law enforcement should have to operate under the same rules as everyone else. But, for that one percent, asking politely if any crimes are being committed on the premises is just not enough.
  - anon4 12y ago
    You're right but you don't want the executive branch to grant itself powers. You want the judiciary branch to give the executive branch an exceptional above-law right to do things in a specific situation that you don't want done to just any random person.
  - peterkelly 12y ago
    So let's consider how we might encode this notion into an authorisation protocol. A given computer system allows access to a set of individuals who, according to some criteria, have been granted authorisation (by some party) to have access that system. This lists consists, at minimum, of: 1) The owner of the system 2) Other users who have been granted access by the owner of the system 3) Law enforcement agencies from one or more jurisdictions If one were to implement this, then this would involve the software explicitly granting access to the law enforcement agencies in question. And if we assume this is desirable, then the next question to arise would be which agencies should be granted access. Now, this is where politics and international law come in. Australia, for example, would love to have access to government systems of Indonesia. Similarly, China for the US. And arguably all permutations of these, and every country in the world. And in many cases they likely already do. If you were to take the transitive closure of the desires and claims of all law enforcement agencies worldwide, then this would result in a situation where all such agencies have access to all system worldwide. If this is the case, then why even bother with exploits? It should be explicitly encoded in the default ACLs of all operating systems, perhaps using a regularly updated list obtained from a reliable source. Microsoft, Apple, and the Linux kernel developers could then embed this list, and the necessary update mechanisms, directly into the OS. This would ensure that all agencies have access to the systems they desire. The problem that comes here of course is that which agencies should be granted access to which systems. Should it be only those within the same country? Should it be those of allied countries as well? How do you determine whether country A should have access to systems in country B? I understand there are legitimate needs of law enforcement. But I also, by default, take the position that computer systems should be secure, and that everyone who's work touches on this should be focused on ensuring this. This is the difference between white hats (the "good guys") and black hats (the "bad guys"). Disclaimer: I'm a computer scientist, not a politician, intelligence analyst, or international law expert. My views have also been influenced by the overreach of the NSA and it's partner agencies.
    - adestefan 12y ago
      You just described CALEA.
    - mike_hearn 12y ago
  - coldtea 12y ago
    >So to commit any crime at all, I just need to be sure to close my doors and not allow law-enforcement in when they ask to enter. Correct? Unless they have proper and signed warrant. Which is like any other citizen, eg. me or you, having a permit to go into some place X. If we have to follow those rules (e.g about unauthorised access) then they should too. Breaking into computer systems (or houses) to find evidence is not playing by the same rules. Nor is getting that kind of power arbitrarily over everyone, as they do, without specifics about a target/case.
- peterkelly 12y ago
  So which country's law should apply, in the case where a law enforcement agency from country A is breaking into systems owned and operated from within country B?
  - coldtea 12y ago
    They should not break into systems within country B. That's an act of war.
peterkelly 12y ago
Regarding computer security, yes. When we build software we have a responsibility to ensure that their use of this software - particularly for communication tools is secure. If there are instances where a piece of software is not secure, I believe (and I gather the general opinion in the industry is) that we should do what is necessary to fix those problems.
- sliverstorm 12y ago
  As a member of the private sector working on software, yes. Make it as secure as you can and fix holes. But that isn't the FBI's job.

devindotcom 12y ago

Not exactly... it's kind of like asking whether peeping into someone else's home at night is only illegal for the little people. For you and me, it's stalking. For a police force that has presented probable cause, evidence, etc to a judge and been awarded a search warrant or wiretap, it's normal investigative technique.

jnbiche 12y ago
>Not exactly... it's kind of like asking whether peeping into someone else's home at night is only illegal for the little people. Well, if that's the analogy you want to use, then this is like police peeping in on the homes of thousands of people who have nothing to do with any crime, all in an effort to find a handful of criminals. There are many people who are OK with that state of affairs. I'm not.
peterkelly 12y ago
The problem I have with this technique specifically is that it takes advantage of software vulnerabilities that arguably should be reported to the vendor and fixed. If we accept that it's just fine for government agencies (and remember, it might not be a government in your own country) to find exploits, not report them in order to protect people who use that software, and keep those to themselves for their own benefit, then I have a problem with that. It leaves people at risk of being infiltrated not just by (some government agency) but by criminals e.g. looking for their credit card information. Put another way, let's suppose you find a vulnerability in Chrome. Do you: 1) Report it to Google, wait until a patch is available, and then discuss it publicly (aka responsible disclosure) 2) Keep it for yourself, or sell to a government agency (possibly that of a country not friendly to your own) to take advantage of The thing I really have a major beef with is that so many people think that option 2 is just fine. Software should be secure - everyone in the industry has a responsibility to protect users, not leave them vulnerable.
- mike_hearn 12y ago
  I would agree, but then consider what happens after that - the FBI and similar in other countries have no other options left, and the path of least resistance for them is now to go to politicians and ask for Tor itself to be banned. Though I hate to say it, a system that (accidentally) allows police forces to deanonymise select individuals whilst other actors cannot do so, and even the police cannot do so in bulk all the time, is not a terrible tradeoff. Snowden has made similar remarks, I believe. Of course the supply of zero-days is presumably not infinite. As pointed out, if Tor had more manpower they'd maybe switch to Chrome which is much harder to exploit. So this situation whilst it may not seem ideal is perhaps the frying pan, and as endpoint security improves we may find ourselves in the fire. I recently proposed on tor-dev that individual relays be able to stop acting as introduction points for specific hidden services, with exactly this scenario in mind. They ignored me of course. They seem to feel invincible.