When Phone Encryption Blocks Justice
nytimes.com
nytimes.com
Police and "justice" authorities should be ashamed of their tacit admission that they are too incompetent to do their jobs without trampling on peoples' civil rights and/or neutering technology.
And I should be ashamed of myself for falling for the psy-op and believing that there aren't actually backdoors built into these systems and for forgetting that this could very likely be propaganda to make me think that all I need to do to protect my privacy is buy the latest device and/or make sure I always install the latest updates.
Would you rather they only print things you agree with? Would rejecting op-eds by some general rule sufficient to exclude this one improve things?
I think I'd rather live in a world in which both sides of every issue get to have their say than in which the losing side is excluded if they're sufficiently "bad".
Edit: that last part isn't quite my position, poorly worded; I'm fine with excluding e.g. neo-nazis and the like, my problem is when "sufficiently bad" includes things like arguing for less encryption.
No, I just don't want them printing things that are wrong ;-)
iMessage logs between users must be fairly hard to get. In yesteryear you could rely on SMS transcripts from the carriers.
The problem with giving "both sides" of an issue equal time is that it can legitimize completely indefensible positions. Global warming is a prime example of this. Virtually every scientist who is familiar with the data is convinced that global warming is happening right now and that drastic action is needed in order to stave off catastrophe. Only a tiny minority disagree. For decades, people on both sides of the issue have been interviewed as though this is something that is genuinely controversial when the truth of the matter is that scientific consensus exists that global warming is real and is happening right now.
Full-disk encryption is one of the best ways to protect users from having their privacy invaded. Cell phones contain a wealth of personal information and can be the starting point for identity theft. The benefit to consumers...the vast majority of whom are lawful...outweighs the risk that law enforcement will be locked out of collecting potentially useful information in the course of an investigation.
To say that full-disk encryption stymies the finest law enforcement minds in the world is ridiculous. There are other ways to collect information. They can serve the cell phone company with a warrant in order to get calling records and text messages. If they can find the e-mail address associated with the user's device, they can serve Google & Apple with a warrant to access GPS data and e-mail correspondence.
I understand that it's a blow to law enforcement to have something like cell phones be suddenly off limits, but technology always enables people to commit crime in new ways. Eventually, the police always catch up.
Let's say you're right, what decision rule do you propose for the NYT editors to decide when to exclude an opinion?
And here's the comedy sketch: http://www.youtube.com/watch?v=sGArqoF0TpQ
The problem with doing just that is that you run the risk of misinterpreting or subconsciously strawmanning the opposition. That's what op-eds prevent; they're an unfiltered statement of a view. If everything runs through a rewriter, the reader misses whatever arguments the rewriter feels are too weak to be included.
"Between October and June, 74 iPhones running the iOS 8 operating system could not be accessed by investigators for the Manhattan district attorney’s office — despite judicial warrants to search the devices." is a bit more than an anecdote.
Now who's posting claptrap? The judge issued a warrant with perfectly valid cause. He could have (and likely did) issue warrants to search their homes, cars, offices or even conduct autopsies. But heaven forbid they see your Instagram. Due process was not violated.
That said, it is pretty clear from the disclaimers, this is in fact propaganda and should be given as much weight as such [i.e. none]
Cyrus R. Vance Jr. is the Manhattan district attorney.
François Molins is the Paris chief prosecutor. Adrian
Leppard is the commissioner of the City of London Police.
Javier Zaragoza is the chief prosecutor of the High Court
of Spain.
The kinds of encryption being discussed go beyond the fourth amendment when it comes to reasonable searches and seizures. It's not an absolute right, and the kind of encryption we're talking about goes beyond any protections seen in the past (short of, perhaps, being able to physically store stuff in safety deposit boxes of banks in certain countries -- just as we might need to wait decades for encrypted data to be decrypted, it took decades for seekers of justice to access Nazi bank accounts).
On the other hand, we keep so much of our lives in our phones and computers (in a sense they are extensions of our minds). If we're going to make this argument, perhaps it should be more like the fifth amendment. After all, we may literally have our personal computers built into our bodies in the future, what rights would we have over the data in them?
There is some legal precedent for the fifth amendment argument -- whether personal diaries are protected is a subject of contention, and are not cell phone data stores very much like personal diaries?
Unlike the fourth amendment, the fifth amendment is pretty much absolute, so it's a stronger case.
The fourth amendment was not written with strong encryption in mind, just as the second amendment did not consider nuclear weapons. So far, even the NRA hasn't tried to argue that we have a second amendment right to tanks and nuclear weapons.
The fourth amendment, and other constitutional issues, were discussed via encrypted mail. It's not like strong encryption (strong in the sense of 'beyond contemporary cryptanalysis', just as the cryptography we have today is maybe not secure against future developments, e.g. quantum computing) was an unknown concept 200 years ago. Indeed, a derivative of a device Thomas Jefferson used for the purpose was used by the US Army in the first part of the 20th century.
http://lfb.org/thomas-jefferson-used-encryption/
https://books.google.com/books?id=xI_Um3dTTeYC&pg=PA176&lpg=...
https://en.wikipedia.org/wiki/Jefferson_disk
I might post on /r/AskHistorians about this 1785 Continental Congress resolution. Everyone, including Ludlow, seems to quote Unmailable rather than referring directly to source material, and I haven't been able to find any kind of archive of pre-Constitutional law (which might have a copy of the actual resolution in it).
In any case, that the government of the time was tampering with long distance communications, i.e., postal mail, with the express purpose of interfering with political discourse should serve as a reminder to everyone to be ever vigilant when some public servant or politician proposes to weaken safeguards against the same.
In any event, both the impenetrability of strong encryption and the scope (the value of the data that can be encrypted) are perhaps further beyond hand-executed codes than an atom bomb is beyond a musket.
The same is true of modern encryption. At some point the key (or the passphrase used to secure the actual key) will either be written down (or stored digitally in plaintext) or memorized.
I don't necessarily see why that must have been the case when the bill of rights was authored. For as long as language has existed, human beings have possessed the ability to encrypt sensitive communications without needing a computer to do it for them.
> The homicide remains unsolved. The killer remains at large.
> Until very recently, this situation would not have occurred.
Until very recently, people weren't carrying smartphones, so the murders would remain even more unsolved. At least the phone is a perfect medium for fingerprints. And anyways, what were the police hoping to find? A photo of the murderer? A note saying which direction the killer run? Most "useful" information (messages, phone calls, location data) is available from the network operators anyways.
Until very recently, people didn't even have smartphones that could have been suspected to contain useful information.
> Apple and Google […] could no longer unlock their own products as a result.
It is not "their own product". It is the customer's. He has bought it.
The rest of the article is based on these false assumptions.
It is still their "Product" though, yes, they no longer own it. My car is a product of General Motors. My computer is a product of Lenovo. My Phone is a product of LG. Even though all are owned by me.
However, it seems the article author is under the assumption that Apple and Google still "own" the devices and are just leasing them to the user, which would imply that the companies should retain the ability to decrypt them at will. However, the user is the one who ultimately owns the device, and Apple and Google have started respecting that level of ownership by going hands-off with encryption and allowing the owner to choose whether to encrypt and who has access.
All of that said, I'd be surprised to learn there isn't some sort of limited back door, probably in the baseband.
While I feel for these families, I don't think it's a fair trade-off to have the government snooping on us all the time for the sake of a bunch of scared old white people.
To have rights, you accept the slight increase in criminality that comes along with that. My right not to be unlawfully searched does indeed let some criminals get away because the cops can't search them. My right to privacy does indeed let some people get away with murder because the cops can't search my phone. That's the price and risk I take to have any civil liberties at all. Of course, someone like Vance who wants to remove civil liberties altogether (from this article), cannot possibly be expected to understand such an idea.
You mention Aleynikov. Here's what Vance is doing[1]:
An ex-Goldman Sachs Group Inc. programmer who
twice won reversal of guilty verdicts for taking
the firm’s high-frequency trading code when he
left for another job isn’t yet in the clear as
prosecutors press an appeal.
Manhattan District Attorney Cyrus Vance Jr. will
challenge the dismissal of charges against Sergey
Aleynikov, whose saga helped inspire Michael
Lewis’s “Flash Boys,” Joan Vollero, a spokeswoman
for prosecutors, said Monday.
[1] http://www.bloomberg.com/news/articles/2015-07-27/aleynikov-...
"None of our agencies engage in bulk data collection or other secretive practices"
The United Kingdom is ground zero for bulk data collection. They're been keyword-grabbing phone calls in real time, and had London under near total video surveillance since the 90s.
The point is that claiming the UK doesn't do mass surveillance is hilarious. They just haven't had a Snowden yet.
I'm really running out of "if they can do this bad thing, we'll be super fucked" because they've been able to get clearance to do or keep doing more and more invasive surveillance over the years. If local PDs can crack into our phones at will (and they are already there via stingrays and their airplane equivalents) we are going to be in for a bad time. Remember how petty and disgruntled the cops are? Now they've got the metadata and content data of your communications because you said the wrong thing at a traffic stop. That's assuming they aren't owning you from the moment your phone connects to the tower. "Exigent circumstances require it" and all.
Though of course it doesn't help if the owner of the device is unknown, as alluded to in the linked article.
[1]: Europe human rights court: http://www.bailii.org/eu/cases/ECHR/1996/3.html#para45
I feel like they just wanted what was on the phone, rather than who owned it.
Yes, yes it is.
This is an EMBARRASSINGLY sad excuse for journalism. NYT should be ashamed for publishing such crap.
I'm not trying to add to the debate here but couldn't they brute force it?
In addition you can use long alphanumeric pass codes and even the default new passcode option is being increased to 6 digits (though you can choose a 4 digit option).
This renders the brute force option pretty useless. Which I'm fine with, I don't want to make things easier for crooks or identity thieves.
Unless the iPhone has some fairly high-grade encryption hardware I suspect you can just do fun things like copy the (encrypted) storage/key to brute-force it without the safety mechanisms kicking in.
David Schultz wrote a pretty comprehensive article about it:
In this case they cut the power to the device before it can write to memory the failed attempt (IIRC) allowing them to keep trying over and over (with a small delay for the phone to restart every 9 tries).
Main: (212) 335-9000
Press: (212) 335-9400
Cyber: (212) 335-9600 (Hotline)
Please think about what you will say beforehand, be very polite, but be heard. And given that Vance wrote alongside DA's from France, UK, and Spain, there is no reason to not call if you live outside of Manhattan.
We should probably share similar information for the offices in London, Paris, and Madrid.
This is insane. I quietly hope the explanation is cynical motivation that they expect these arguments will be effective, because I am otherwise genuinely terrified that these people are in a position of power with such a poor grasp of the technologies in question as would be required to actually believe what they're saying.
The ONLY people that will be harmed are the general public that did not violate any laws because they would be blocked by laws to use the tools to protect themselves from the criminals who does not give a flying fuck about the laws against encryption tools. These guys are fooling themselves if they think having a legal law authorizing backdoors will make everything okay.
Full disk encryption has been around for a decade or more for PCs, where is the outcry about that?
Furthermore if someone died and used privacy tools then so be it. For all we know he likely wouldn't want his entire life (personal photos, videos and messages) to be seen by a bunch of random people.
The real reason why things are gonna be end-to-end encrypted from now on is because we can and there is nothing anyone can do about it. Technology > policy.
I really will loathe the day where I am required by the cell phone company to take an update which negates the current encryption my phone has. People who think that day might not come are kidding themselves.