8 ms·

CALEA requires a guarantee that customer traffic can be decrypted. S215 of the Patriot Act extends the larger body of the act and prior Acts to include "other

CALEA requires a guarantee that customer traffic can be decrypted. S215 of the Patriot Act extends the larger body of the act and prior Acts to include "other artifacts". Though not specified, this presumably extends outside telecommunications. The Stored Communications Act similarly requires key (or data) escrow mechanisms. Here is a Microsoft Cloud Key Escrow system that "Once a request comes in from a third party (e.g. a user, a business, a legal entity or governmental entity, etc.) to access user's data, the data storage system may send..." https://www.google.com/patents/US20120321086 https://www.google.com/patents/US20120321086

tptacek 12y ago
Please cite the portion of CALEA that requires commercial enterprises to subvert encryption in any way, key escrow or otherwise.
- xnull2guest 12y ago
  Let's try Title 47, Chapter 9, Subchapter I, § 1002. The whole subsection is good but calling attention to (b)(3): "(3) Encryption A telecommunications carrier shall not be responsible for decrypting, or ensuring the government’s ability to decrypt, any communication encrypted by a subscriber or customer, unless the encryption was provided by the carrier and the carrier possesses the information necessary to decrypt the communication." http://www.law.cornell.edu/uscode/text/47/1002 http://www.law.cornell.edu/uscode/text/47/1002 Here's the Wikipedia article: "The Communications Assistance for Law Enforcement Act (CALEA) is a United States wiretapping law passed in 1994, during the presidency of Bill Clinton (Pub. L. No. 103-414, 108 Stat. 4279, codified at 47 USC 1001-1010). CALEA's purpose is to enhance the ability of law enforcement agencies to conduct electronic surveillance by requiring that telecommunications carriers and manufacturers of telecommunications equipment modify and design their equipment, facilities, and services to ensure that they have built-in surveillance capabilities, allowing federal agencies to monitor all telephone, broadband internet, and VoIP traffic." https://en.wikipedia.org/wiki/Communications_Assistance_for_Law_Enforcement_Act https://en.wikipedia.org/wiki/Communications_Assistance_for_... Here's a checklist for CALEA: http://transition.fcc.gov/bureaus/pshs/services/calea/CALEA%20Checklist%202013.pdf http://transition.fcc.gov/bureaus/pshs/services/calea/CALEA%...
  - azernik 12y ago
    "unless... the carrier possesses the information necessary to decrypt the communication." That is, if a company is running a key escrow, then it is required to decrypt information for the government. But it's not already running a key escrow, there's nothing in the section you cited that requires it to.
    - xnull2guest 12y ago
      The parent comment asked about "subvert encryption in any way, key escrow or otherwise". CALEA relies on voluntary key escrow which essentially all major information providers have been willing to provide (see Snowden leaks). Voluntary only exists where incentives allow a full reasoned decision to be made by corporations. Look at the fines that Yahoo was forced to face on a daily basis for not providing the information requested by the government. Look at how QWest was unraveled. Soft power, financial leverage, standards manipulation, other laws and legal requirements (law praxis) - including those mentioned in the parent comments (ignored thus far by downvote brigade), executive orders and others effectively require key escrow. All major telecommunications carriers have been onboarded to 'voluntary escrow' in this regard. The presumed 'big news' being that Apple and Google providing escrow-less cryptography directly implies that there was key escrow before (there was encryption present before, but no law enforcement condemnation). I encourage readers of these comments to chase the provided links and information, as well as the fully body of knowledge leaked by Binney, Snowden and others, to bear on the 'truthiness' of this comment thread.
      - lern_too_spel 12y ago
        The "big news" wasn't that they are "providing escrow-less cryptography" but that iOS 8 added full-disk encryption and that Android 5 turned full disk encryption on by default. They never had access to the encryption keys. On iOS 7 and earlier, Apple could extract data from native apps "for which the data is not encrypted using the passcode." http://images.apple.com/privacy/docs/legal-process-guidelines-us.pdf http://images.apple.com/privacy/docs/legal-process-guideline...
- justcommenting 12y ago
  The commenter may be referring to CALEA loosely and referring to the secret interpretation of S215 of the Patriot Act.
  - tptacek 12y ago
    If PATRIOT compels commercial enterprises to subvert cryptography, how is it possible that huge companies have built sturdy end-to-end encryption systems without key escrow? Are some of the largest companies in technology simply flouting the law?
    - justcommenting 12y ago
      I wasn't personally suggesting that PATRIOT specifically compelled commercial enterprises to subvert cryptography, and we know from what's been leaked about BULLRUN that at least some of the times that those activities occur, it's probably been upstream during (for example) standards development. It may, however, still be the case that PATRIOT creates a legal authority from which multiples agencies might ask companies to undermine some of the goals of cryptography--depending on your politics and your vantage point--to be able to profile lawful intercept capabilities, e.g. by offering unmonitored access through something like Google's eDiscovery portal or just by complying with legal requests.
      - tptacek 12y ago
        I'm not commenting to defend NSA or, for that matter, cryptographic standards efforts. So: much of this comment is unresponsive to mine. What I'm interested in is, what's an example of some authority of PATRIOT compelling a commercial enterprise to weaken or subvert their cryptography or, as you put it, the goals of their cryptography? Be specific, please. This thread lead off with a truly wacky and false claim about compulsory key escrow. I'd prefer not to see it rehabilitated by a flight to abstraction and appeals to our shared dislike of NSA.
        justcommenting 12y ago

tptacek 12y ago

Please cite the portion of CALEA that requires commercial enterprises to subvert encryption in any way, key escrow or otherwise.

xnull2guest 12y ago
Let's try Title 47, Chapter 9, Subchapter I, § 1002. The whole subsection is good but calling attention to (b)(3): "(3) Encryption A telecommunications carrier shall not be responsible for decrypting, or ensuring the government’s ability to decrypt, any communication encrypted by a subscriber or customer, unless the encryption was provided by the carrier and the carrier possesses the information necessary to decrypt the communication." http://www.law.cornell.edu/uscode/text/47/1002 http://www.law.cornell.edu/uscode/text/47/1002 Here's the Wikipedia article: "The Communications Assistance for Law Enforcement Act (CALEA) is a United States wiretapping law passed in 1994, during the presidency of Bill Clinton (Pub. L. No. 103-414, 108 Stat. 4279, codified at 47 USC 1001-1010). CALEA's purpose is to enhance the ability of law enforcement agencies to conduct electronic surveillance by requiring that telecommunications carriers and manufacturers of telecommunications equipment modify and design their equipment, facilities, and services to ensure that they have built-in surveillance capabilities, allowing federal agencies to monitor all telephone, broadband internet, and VoIP traffic." https://en.wikipedia.org/wiki/Communications_Assistance_for_Law_Enforcement_Act https://en.wikipedia.org/wiki/Communications_Assistance_for_... Here's a checklist for CALEA: http://transition.fcc.gov/bureaus/pshs/services/calea/CALEA%20Checklist%202013.pdf http://transition.fcc.gov/bureaus/pshs/services/calea/CALEA%...
- azernik 12y ago
  "unless... the carrier possesses the information necessary to decrypt the communication." That is, if a company is running a key escrow, then it is required to decrypt information for the government. But it's not already running a key escrow, there's nothing in the section you cited that requires it to.
  - xnull2guest 12y ago
    The parent comment asked about "subvert encryption in any way, key escrow or otherwise". CALEA relies on voluntary key escrow which essentially all major information providers have been willing to provide (see Snowden leaks). Voluntary only exists where incentives allow a full reasoned decision to be made by corporations. Look at the fines that Yahoo was forced to face on a daily basis for not providing the information requested by the government. Look at how QWest was unraveled. Soft power, financial leverage, standards manipulation, other laws and legal requirements (law praxis) - including those mentioned in the parent comments (ignored thus far by downvote brigade), executive orders and others effectively require key escrow. All major telecommunications carriers have been onboarded to 'voluntary escrow' in this regard. The presumed 'big news' being that Apple and Google providing escrow-less cryptography directly implies that there was key escrow before (there was encryption present before, but no law enforcement condemnation). I encourage readers of these comments to chase the provided links and information, as well as the fully body of knowledge leaked by Binney, Snowden and others, to bear on the 'truthiness' of this comment thread.
    - lern_too_spel 12y ago
      The "big news" wasn't that they are "providing escrow-less cryptography" but that iOS 8 added full-disk encryption and that Android 5 turned full disk encryption on by default. They never had access to the encryption keys. On iOS 7 and earlier, Apple could extract data from native apps "for which the data is not encrypted using the passcode." http://images.apple.com/privacy/docs/legal-process-guidelines-us.pdf http://images.apple.com/privacy/docs/legal-process-guideline...
justcommenting 12y ago
The commenter may be referring to CALEA loosely and referring to the secret interpretation of S215 of the Patriot Act.
- tptacek 12y ago
  If PATRIOT compels commercial enterprises to subvert cryptography, how is it possible that huge companies have built sturdy end-to-end encryption systems without key escrow? Are some of the largest companies in technology simply flouting the law?
  - justcommenting 12y ago
    I wasn't personally suggesting that PATRIOT specifically compelled commercial enterprises to subvert cryptography, and we know from what's been leaked about BULLRUN that at least some of the times that those activities occur, it's probably been upstream during (for example) standards development. It may, however, still be the case that PATRIOT creates a legal authority from which multiples agencies might ask companies to undermine some of the goals of cryptography--depending on your politics and your vantage point--to be able to profile lawful intercept capabilities, e.g. by offering unmonitored access through something like Google's eDiscovery portal or just by complying with legal requests.
    - tptacek 12y ago
      I'm not commenting to defend NSA or, for that matter, cryptographic standards efforts. So: much of this comment is unresponsive to mine. What I'm interested in is, what's an example of some authority of PATRIOT compelling a commercial enterprise to weaken or subvert their cryptography or, as you put it, the goals of their cryptography? Be specific, please. This thread lead off with a truly wacky and false claim about compulsory key escrow. I'd prefer not to see it rehabilitated by a flight to abstraction and appeals to our shared dislike of NSA.
      - justcommenting 12y ago