4 ms·

So let me get this straight: enforcement should be bound by exactly the same rules as citizens - am I correct?

by sliverstorm 12y ago

coldtea 12y ago
Yes, you are correct, and yes it should.
- Loughla 12y ago
  So to commit any crime at all, I just need to be sure to close my doors and not allow law-enforcement in when they ask to enter. Correct? That is unbelievable naive, whatever your view on the current state of law-enforcement is. There are times when law-enforcement needs slightly more space to work than regular citizens; search warrants, for instance. The questions arise when we discuss where the line is for how much more space they need and when they need it. 99% of the time, I agree with you; law enforcement should have to operate under the same rules as everyone else. But, for that one percent, asking politely if any crimes are being committed on the premises is just not enough.
  - anon4 12y ago
    You're right but you don't want the executive branch to grant itself powers. You want the judiciary branch to give the executive branch an exceptional above-law right to do things in a specific situation that you don't want done to just any random person.
  - peterkelly 12y ago
    So let's consider how we might encode this notion into an authorisation protocol. A given computer system allows access to a set of individuals who, according to some criteria, have been granted authorisation (by some party) to have access that system. This lists consists, at minimum, of: 1) The owner of the system 2) Other users who have been granted access by the owner of the system 3) Law enforcement agencies from one or more jurisdictions If one were to implement this, then this would involve the software explicitly granting access to the law enforcement agencies in question. And if we assume this is desirable, then the next question to arise would be which agencies should be granted access. Now, this is where politics and international law come in. Australia, for example, would love to have access to government systems of Indonesia. Similarly, China for the US. And arguably all permutations of these, and every country in the world. And in many cases they likely already do. If you were to take the transitive closure of the desires and claims of all law enforcement agencies worldwide, then this would result in a situation where all such agencies have access to all system worldwide. If this is the case, then why even bother with exploits? It should be explicitly encoded in the default ACLs of all operating systems, perhaps using a regularly updated list obtained from a reliable source. Microsoft, Apple, and the Linux kernel developers could then embed this list, and the necessary update mechanisms, directly into the OS. This would ensure that all agencies have access to the systems they desire. The problem that comes here of course is that which agencies should be granted access to which systems. Should it be only those within the same country? Should it be those of allied countries as well? How do you determine whether country A should have access to systems in country B? I understand there are legitimate needs of law enforcement. But I also, by default, take the position that computer systems should be secure, and that everyone who's work touches on this should be focused on ensuring this. This is the difference between white hats (the "good guys") and black hats (the "bad guys"). Disclaimer: I'm a computer scientist, not a politician, intelligence analyst, or international law expert. My views have also been influenced by the overreach of the NSA and it's partner agencies.
    - adestefan 12y ago
      You just described CALEA.
    - mike_hearn 12y ago
      I would say you've summed up one of the biggest and most important issues of our time. The internet is international. Governments aren't. What now?! My own gut feeling is that we should try and head in the same direction as the email system. The internet largely conquered spam without needing government intervention or international treaties through automatic reputation systems, blacklisting of email abusers and so on. It's basically a giant group consensus system in which spam is defined as "whatever our users think spam is" instead of an explicit law. It works! Similar techniques could be applied to other systems like Tor, if only the developers cared (they don't).
  - coldtea 12y ago
    >So to commit any crime at all, I just need to be sure to close my doors and not allow law-enforcement in when they ask to enter. Correct? Unless they have proper and signed warrant. Which is like any other citizen, eg. me or you, having a permit to go into some place X. If we have to follow those rules (e.g about unauthorised access) then they should too. Breaking into computer systems (or houses) to find evidence is not playing by the same rules. Nor is getting that kind of power arbitrarily over everyone, as they do, without specifics about a target/case.
- peterkelly 12y ago
  So which country's law should apply, in the case where a law enforcement agency from country A is breaking into systems owned and operated from within country B?
  - coldtea 12y ago
    They should not break into systems within country B. That's an act of war.
peterkelly 12y ago
Regarding computer security, yes. When we build software we have a responsibility to ensure that their use of this software - particularly for communication tools is secure. If there are instances where a piece of software is not secure, I believe (and I gather the general opinion in the industry is) that we should do what is necessary to fix those problems.
- sliverstorm 12y ago
  As a member of the private sector working on software, yes. Make it as secure as you can and fix holes. But that isn't the FBI's job.

So let me get this straight: enforcement should be bound by exactly the same rules as citizens - am I correct?

coldtea 12y ago

Yes, you are correct, and yes it should.

Loughla 12y ago
So to commit any crime at all, I just need to be sure to close my doors and not allow law-enforcement in when they ask to enter. Correct? That is unbelievable naive, whatever your view on the current state of law-enforcement is. There are times when law-enforcement needs slightly more space to work than regular citizens; search warrants, for instance. The questions arise when we discuss where the line is for how much more space they need and when they need it. 99% of the time, I agree with you; law enforcement should have to operate under the same rules as everyone else. But, for that one percent, asking politely if any crimes are being committed on the premises is just not enough.
- anon4 12y ago
  You're right but you don't want the executive branch to grant itself powers. You want the judiciary branch to give the executive branch an exceptional above-law right to do things in a specific situation that you don't want done to just any random person.
- peterkelly 12y ago
  So let's consider how we might encode this notion into an authorisation protocol. A given computer system allows access to a set of individuals who, according to some criteria, have been granted authorisation (by some party) to have access that system. This lists consists, at minimum, of: 1) The owner of the system 2) Other users who have been granted access by the owner of the system 3) Law enforcement agencies from one or more jurisdictions If one were to implement this, then this would involve the software explicitly granting access to the law enforcement agencies in question. And if we assume this is desirable, then the next question to arise would be which agencies should be granted access. Now, this is where politics and international law come in. Australia, for example, would love to have access to government systems of Indonesia. Similarly, China for the US. And arguably all permutations of these, and every country in the world. And in many cases they likely already do. If you were to take the transitive closure of the desires and claims of all law enforcement agencies worldwide, then this would result in a situation where all such agencies have access to all system worldwide. If this is the case, then why even bother with exploits? It should be explicitly encoded in the default ACLs of all operating systems, perhaps using a regularly updated list obtained from a reliable source. Microsoft, Apple, and the Linux kernel developers could then embed this list, and the necessary update mechanisms, directly into the OS. This would ensure that all agencies have access to the systems they desire. The problem that comes here of course is that which agencies should be granted access to which systems. Should it be only those within the same country? Should it be those of allied countries as well? How do you determine whether country A should have access to systems in country B? I understand there are legitimate needs of law enforcement. But I also, by default, take the position that computer systems should be secure, and that everyone who's work touches on this should be focused on ensuring this. This is the difference between white hats (the "good guys") and black hats (the "bad guys"). Disclaimer: I'm a computer scientist, not a politician, intelligence analyst, or international law expert. My views have also been influenced by the overreach of the NSA and it's partner agencies.
  - adestefan 12y ago
    You just described CALEA.
  - mike_hearn 12y ago
    I would say you've summed up one of the biggest and most important issues of our time. The internet is international. Governments aren't. What now?! My own gut feeling is that we should try and head in the same direction as the email system. The internet largely conquered spam without needing government intervention or international treaties through automatic reputation systems, blacklisting of email abusers and so on. It's basically a giant group consensus system in which spam is defined as "whatever our users think spam is" instead of an explicit law. It works! Similar techniques could be applied to other systems like Tor, if only the developers cared (they don't).
- coldtea 12y ago
  >So to commit any crime at all, I just need to be sure to close my doors and not allow law-enforcement in when they ask to enter. Correct? Unless they have proper and signed warrant. Which is like any other citizen, eg. me or you, having a permit to go into some place X. If we have to follow those rules (e.g about unauthorised access) then they should too. Breaking into computer systems (or houses) to find evidence is not playing by the same rules. Nor is getting that kind of power arbitrarily over everyone, as they do, without specifics about a target/case.
peterkelly 12y ago
So which country's law should apply, in the case where a law enforcement agency from country A is breaking into systems owned and operated from within country B?
- coldtea 12y ago
  They should not break into systems within country B. That's an act of war.

peterkelly 12y ago

Regarding computer security, yes. When we build software we have a responsibility to ensure that their use of this software - particularly for communication tools is secure. If there are instances where a piece of software is not secure, I believe (and I gather the general opinion in the industry is) that we should do what is necessary to fix those problems.

sliverstorm 12y ago
As a member of the private sector working on software, yes. Make it as secure as you can and fix holes. But that isn't the FBI's job.