4 ms·

Haha, thanks Thomas. I'm half in agreement with you about CALEA, but think the thread missed the larger point. Forests and trees and all of that. If one were

Haha, thanks Thomas. I'm half in agreement with you about CALEA, but think the thread missed the larger point. Forests and trees and all of that. If one were to take my point as a specific claim about only CALEA and as a specific claim only about key (and not data) escrow under a strong letter of the law reading, then yes most certainly I was wrong. However this interpretation of the thesis is/was an injudicious one. There are laws requiring plaintext access to communications records and computing services records upon lawful request. CALEA does have a section on this (focused on telecommunications, which have been expanded to include digital transport such as VOIP technologies), as does 18 U.S.C. § 2703(f) (which do apply to digital services such as cloud technologies), as do others. The thread fixated on CALEA - yet from the beginning my thesis was about a constellation of laws and the interpretation of these laws under EO 12333 and the Third Party Doctrine, current political climate and the real world pragmatic implementation of policies in tandem with the private sector (e.g. telecoms in America today do not provide strong escrow-less crypto). From what I can ascertain for large providers the Department of Commerce streamlines the process. Telecommunications have been streamlined since the late 90s. Internet services are still in the process of being streamlined - PRISM was one of said programs. For smaller providers requests/demands are run when the value of ends supersedes the cost of means. Lavabit is an extreme example of how leverage has been applied to acquire plaintext access to communications.

tptacek 12y ago
If a law exists that requires a software company to retain the capability to provide plaintext transcripts of encrypted messages, and to provide those transcripts on demand, you've been unable to provide any citation to it. Lavabit is exactly the problem with your analysis. The core problem of Lavabit wasn't that that the government compelled Levison to retain the ability to decrypt messages. No, Levison chose to do that, because the market punished real secure message providers for forcing users to install software. (a) If you have the ability to decrypt messages, (b) the government is allowed under current law to exploit that. Now Levison's defenders want to point the finger at the DOJ and surveillance law, insulating him from the consequences of his own (frankly) terribly irresponsible decision to expose his users secrets in exchange for market share. The original citation to CALEA which people "fixated" on was yours. Your claim was that CALEA compelled software companies like Apple to backdoor encryption. It does no such thing. No law exists preventing anyone from building a truly secure messaging service. TextSecure and Silent Circle are doing it out in the open right now. A disinformation campaign suggesting otherwise would be harmful to end-users.
- xnull2guest 12y ago
  What do you think about 18 U.S.C. § 2703(f)?
  - tptacek 12y ago
    I think that it says nothing whatsoever about encryption. What am I missing? If you're going to claim something in here could be interpreted to apply to encryption, cite some authority that says so. In the unlikely event that you're right, a lot of big companies are in serious legal trouble.
    - xnull2guest 12y ago
      I included this law in the discussion since it applies to digital services. What you are missing is that unless encryption is used directly by the endpoints (not added by the provider) by definition (a) holds from your previous comment. Skype is an example of a communications service (like TextSecure) that offered secure E2E communications but was stripped of that functionality. Blackberry is an example of a company that has drowned because political pressure to backdoor communications was greater than the market incentive to provide real security. Apple today stores electronic communication and service records, logs and artifacts from your phone encrypted in the cloud. But it will decrypt for law enforcement upon request. Are you suggesting they do this voluntarily or are they compelled to by law? http://images.apple.com/privacy/docs/legal-process-guidelines-us.pdf http://images.apple.com/privacy/docs/legal-process-guideline... For the record I am a strong advocate of TextSecure/Silent Circle/others. To be a strong advocate, however, one must be a strong skeptic. So far I do not believe these two projects have been compromised ("CryptoCat" on the other hand...) I do not believe that there are laws requiring all crypto implemented by every provider everywhere to be subverted. The laws that exist however do ensure that any encryption provided transparently are subverted. When E2E crypto becomes a problem (e.g. Skype) the intelligence community has other ways of dealing with it. What this means for the surveillance state is that anything that becomes popular enough to represent a non-neglegible portion of traffic will be subverted. Mom and pop can't have secure communications. It's only us cipherpunks who get to have any short reprieve.

tptacek 12y ago

If a law exists that requires a software company to retain the capability to provide plaintext transcripts of encrypted messages, and to provide those transcripts on demand, you've been unable to provide any citation to it. Lavabit is exactly the problem with your analysis. The core problem of Lavabit wasn't that that the government compelled Levison to retain the ability to decrypt messages. No, Levison chose to do that, because the market punished real secure message providers for forcing users to install software. (a) If you have the ability to decrypt messages, (b) the government is allowed under current law to exploit that. Now Levison's defenders want to point the finger at the DOJ and surveillance law, insulating him from the consequences of his own (frankly) terribly irresponsible decision to expose his users secrets in exchange for market share. The original citation to CALEA which people "fixated" on was yours. Your claim was that CALEA compelled software companies like Apple to backdoor encryption. It does no such thing. No law exists preventing anyone from building a truly secure messaging service. TextSecure and Silent Circle are doing it out in the open right now. A disinformation campaign suggesting otherwise would be harmful to end-users.

xnull2guest 12y ago
What do you think about 18 U.S.C. § 2703(f)?
- tptacek 12y ago
  I think that it says nothing whatsoever about encryption. What am I missing? If you're going to claim something in here could be interpreted to apply to encryption, cite some authority that says so. In the unlikely event that you're right, a lot of big companies are in serious legal trouble.
  - xnull2guest 12y ago
    I included this law in the discussion since it applies to digital services. What you are missing is that unless encryption is used directly by the endpoints (not added by the provider) by definition (a) holds from your previous comment. Skype is an example of a communications service (like TextSecure) that offered secure E2E communications but was stripped of that functionality. Blackberry is an example of a company that has drowned because political pressure to backdoor communications was greater than the market incentive to provide real security. Apple today stores electronic communication and service records, logs and artifacts from your phone encrypted in the cloud. But it will decrypt for law enforcement upon request. Are you suggesting they do this voluntarily or are they compelled to by law? http://images.apple.com/privacy/docs/legal-process-guidelines-us.pdf http://images.apple.com/privacy/docs/legal-process-guideline... For the record I am a strong advocate of TextSecure/Silent Circle/others. To be a strong advocate, however, one must be a strong skeptic. So far I do not believe these two projects have been compromised ("CryptoCat" on the other hand...) I do not believe that there are laws requiring all crypto implemented by every provider everywhere to be subverted. The laws that exist however do ensure that any encryption provided transparently are subverted. When E2E crypto becomes a problem (e.g. Skype) the intelligence community has other ways of dealing with it. What this means for the surveillance state is that anything that becomes popular enough to represent a non-neglegible portion of traffic will be subverted. Mom and pop can't have secure communications. It's only us cipherpunks who get to have any short reprieve.