Sundar Pichai Responds to Apple and the FBI Hacking Request
twitter.com
twitter.com
Do we? Crime rate has been falling. Terrorism is a statistical bleep. The majority of "crime" is government's own invention (non-violent drug-related offenses, prostitution, civil forfeiture, arresting people because they don't pay their student loans [1] [edit: not actually true, as tzs pointed out below], cop murders).
Personally, I believe that even without any ability to access any digital communication/stored data, law enforcement wouldn't be in a worse position compared to 30 years ago.
[1] http://finance.yahoo.com/news/paul-aker-us-marshal-student-l...
[1] Well, actually, what you said was that arresting people because they don't pay their student loans is a crime, not that not paying student loans is a crime, but I'm assuming that was just an error of phrasing.
Besides that, the crime rate has been falling during a period coincident with aggressive policing, more incarceration, and more legal measures (RICO) to fight organized crime. While people have alternative theories for that decrease (e.g. banning leaded gasoline), aggressive policing cannot be ruled out as a reason for the decrease in crime.
Finally, tape recordings and wire taps are the backbone of investigations of sophisticated crime. It's disingenuous to pretend that pervasive encrypted communications doesn't dramatically change the landscape law enforcement is dealing with.
I happen to think the privacy benefits of encryption outweigh the cost to law enforcement, but I think it's ridiculous to pretend like there isn't real crime out there or that encryption doesn't make it harder to fight it.
And remember, the vast majority of violent crimes do not fall within federal jurisdiction, so it's unsurprising that a disproportionate number of federal prisoners are in for drug crimes or other non-violent crimes (e.g. white collar crimes). But most prisoners are in state rather than federal prison.
>where something like 17% of inmates are incarcerated for drug offenses.
I hope you don't mind if I use a single state, I know these thing will vary by state. The top drug crimes in Texas are different degrees of possession and manufacturing and distribution, and you're right, it's about 17%
>The majority of inmates are in fact incarcerated for violent crimes.
There are other crimes that aren't violent and aren't drug offenses, those appear to be about 43% (60% when you include drug offenses), and the violent ones about 40%, not a majority. Do you have a source for your "majority of inmates are in fact incarcerated for violent crimes" claim? The statistics I used are by offense, not by offender. I'm not sure how that will change if the statistics are broken down by offender.
https://www.texastribune.org/library/data/texas-prisons/crim...
One notes when examining the timeframe of the graph you linked that MADD was formed in 1980. That explains the legislative inventiveness; nothing drives policy like fat stacks of nonprofit cash! Take a trip to any courthouse anywhere, and you'll witness the racket that MADD, prosecutors, and municipalities have engineered to employ lawyers by depriving the poor of the mobility that would make their lives easier.
So thanks for the info; clearly the answer to my question is "yes".
> nothing drives policy like fat stacks of nonprofit cash
Oh yes, that well funded concerned mother lobby. Fucking it up for sociopathic assholes since 1980.
...can't require safety inspections for aircraft, gotta wait for a bunch of people to fall out of the sky first!
Don't tell any enterprising nonprofit interest-group enthusiasts, but we have "special" and "experimental" airworthiness certificates, which amount to basically that. Of course, those certificates don't cover aircraft which are naturally subject to the regulation of the state.
Oh yes, that well funded concerned mother lobby.
In fiscal year 2012-3, they spent $34,327,399, of which they spent 64.4% on actual programs. Nationally, 9 out of 10 charities spend a higher percentage. [0]
Fucking it up for sociopathic assholes since 1980.
As I have observed every one of the five or six days I've spent in various courthouses over the last five years (and as any practicing lawyer with a conscience surely has observed much more often), these laws do far more to harm the poor than they do to make the roads safe. Perhaps you've heard about protests in Ferguson, MO? Predatory policing and prosecution was one of the main focuses of that.
[0] http://www.charitynavigator.org/index.cfm?bay=search.summary...
Isn't that the way the judicial system typically works even when it is obviously broken? Isn't this the reason we have things like weird laws that are "unenforceable", because as a matter of policy we tend to wait for actual harm to occur before we expend effort to address it?
>can't require safety inspections for aircraft, gotta wait for a bunch of people to fall out of the sky first!
That's actually the way the FAA came into existence. The Wright brothers didn't have to send $5.00 to the FAA for a permit, or submit to safety inspections, or anything like that. Nor did anyone else, for a long time WRT the early aircraft industry in the US. https://en.wikipedia.org/wiki/Federal_Aviation_Administratio...
>Oh yes, that well funded concerned mother lobby. Fucking it up for sociopathic assholes since 1980.
There's the appeal to emotion common to arguments in favor of harsher sentencing for DUI offenders. It appears to be the case however that more and bigger sticks aren't really reducing the number of sociopathic assholes driving drunk.
Falling crime rates is happing all over the first world. Most countries have know-where near the policy infrastructure that the US has. So thats probably not a very good expiation.
Nobody says that their is no real crime. In all the speech by the state its sounds as if we are getting rolled over by a totally new wave of terror and crime while in reality its the exact opposite. What bother so many is that they underline all their arguments with this false impression.
We should end the war on drugs, of course, but we more urgently need to end what Ta-Nahisi Coates calls "the carceral state", and that will require much stiffer medicine than drug legalization.
Please post the study.
That doesn't mean that it's an "invented crime." It's undeniable that drugs, gambling, and prostitution have real social costs and harms. The people are entitled to regulate commerce in their society generally, but trade in harmful things especially. When people uses organized violence to circumvent that regulation, in the pursuit of profit, that is actual crime, not invented crime.
> Large numbers of violent crimes are done by people involved in drug dealing or consuming.
You're presupposing a direction of causation here. Your average street gang does not exist because of drug dealing or consumption (and indeed, violent street gangs long predate any restrictions on drugs or alcohol). They deal in drugs because it's easy money, but arise for other reasons.
So does banking and the police. Or firearms and alcohol. Both are regulated, but not outlawed.
As a country, the USA is actually constituted to allow these things. Because, individual freedoms. And inalienable rights. I hear somebody want to crack down on something, I think "There goes somebody who forgot what it means to be American"
I don't think you can make a decision based solely on the "pursuit of happiness" phrase from the Declaration of Independence, but you could use it as a supporting argument for your claim.
* Some people are going to take drugs without regard to legality.
* Some people are going to fill the market's need for drugs through smuggling or manufacturing.
* The government is utterly incapable (by design, actually) of completely preventing the above.
* Without criminalization of drugs manufacturing and sales, there would be very little or no reason for violence in the drugs trade.
>violent street gangs long predate any restrictions on drugs or alcohol
Violent street gangs opportunistically traffic in contraband because prohibition creates a dearth of supply, driving prices high enough to support an illegal black market.
> It's undeniable that drugs, gambling, and prostitution have real social costs and harms.
Its also undeniable that enforcing these things has real social cost and harms. In this balance I am of the opinion that it would be far superior to have a different policy.
> You're presupposing a direction of causation here. Your average street gang does not exist because of drug dealing or consumption (and indeed, violent street gangs long predate any restrictions on drugs or alcohol). They deal in drugs because it's easy money, but arise for other reasons.
That does not mean that these gangs would be much weaker and therefore less important if they could not make easy money. These are mutually supportive, a tight group can do well in a illegal market, and because of that it can produce benefits for its members, increasing memberships and power.
> According to a statement from the U.S. Marshals Service, Aker repeatedly refused to show up in court after being contacted several times. The agency said Aker told them by phone he would not appear in court to answer the summons. Disobeying a court order is a criminal offense. Within a few months, the judge issued a warrant for his arrest, which the U.S. Marshals carried out. So, yes, Aker was arrested, but not just because he owed a little student loan debt. He was arrested for disobeying a court order.
If some one called my home on the telephone and said "I'm a US Marshal, send money to pay for a 20 year old debt." or something to that effect, I'd probably interrupt the caller to tell them to put me on their Do Not Call list and then immediately hang up the phone before they ever got the chance to explain half of it. I've received much more creative attempts than that to scam me out of money over the telephone, and I'm sure that I'm not alone in that respect. I get calls from scammers all of the time, and in related news the IRS has recently warned people that scammers are calling and using that exact same pattern but pretending to be collecting an IRS debt instead of student loans. Therefore there is zero chance that I would take a telephone call like that seriously since there is zero way to authenticate the caller. We don't know whether other the marshals tried anything other than the telephone to contact Aker, but I've seen no comment from them to indicate that is the case. Assuming they've only contacted him by telephone then the proposition is that we must all obey anyone who calls us on the phone and claims to be a government agent.
Hello! This isn't a picture of the burger you had for lunch or a pithy remark fest, it's the most important thing affecting your users today.
Take some time and write a god damn letter with your company's stance.
Personally, I think Reddit/HN when combined with imgur.com serves all purposes in the world, there is no need for the other bloated stuff. But unfortunately, non-techies are going to be non-techies, they will never understand what is minimalism and elegance, may God help them see the light of truth, amen.
Now that's not to say that once people do figure out how to navigate, they're turned off by the culture. However, I do think the UI has something to do with more people not joining.
Personally, I feel even 4chan is much cleaner than reddit (yes I know 4chan uses linear threads while reddit supports branching. Hence the HN example)
I guess if one stays on the main roads and doesn't stumble into the dark alleys, he'll be ok.
I personally get twitchy whenever I see a facebook or twitter link, but I also know that the times are changing, so I withhold my angry rants.
https://lawfareblog.com/not-slippery-slope-jump-cliff
Quotation from, Not a Slippery Slope, but a Jump off the Cliff By Nicholas Weaver.
The request to Apple is accurately paraphrased as "Create malcode designed to subvert security protections, with additional forensic protections, customized for a particular target's phone, cryptographically sign that malcode so the target's phone accepts it as legitimate, and run that customized version through the update mechanism". (I speak of malcode in the technical sense of "code designed to subvert a security protection or compromise the device", not in intent.)
The same logic behind what the FBI seeks could just as easily apply to a mandate forcing Microsoft, Google, Apple, and others to push malicious code to a device through automatic updates when the device isn't yet in law enforcement's hand. So the precedent the FBI seeks doesn't represent just "create and install malcode for this device in Law Enforcement possession" but rather "create and install malcode for this device".
Let us assume that the FBI wins in court and gains this precedent. This does indeed solve the "going dark" problem as now the FBI can go to Apple, Cisco, Microsoft, or Google with a warrant and say "push out an update to this target". Once the target's device starts running the FBI's update then encryption no longer matters, even the much stronger security present in the latest Apple devices. So as long as the FBI identifies the target's devices before arrest there is no problem with any encryption. But at what cost?
NSL's don't work like that.
A national security letter (NSL) is an administrative subpoena issued by the United States federal government to gather information for national security purposes... By law, NSLs can request only non-content information, for example, transactional records and phone numbers dialed, but never the content of telephone calls or e-mails.[1]
Apple would challenge a NSL on three grounds:
1) The subject of this investigation in this is dead. The secrecy requirements are unrequired.
2) What the FBI wants here is not information, it is to force Apple to do work. That's why they've had to try the Writs act - it's a pretty unprecedented thing to try
3) The information requested is not "non-content"
I'd say Apple would have a good case on any of these grounds, and the FBI knows it.
2: https://twitter.com/sundarpichai/status/700104342720761856
3: https://twitter.com/sundarpichai/status/700104383762026496
4: https://twitter.com/sundarpichai/status/700104433183502336
5: https://twitter.com/sundarpichai/status/700104478360342528
Or we can read an article by The Verge: http://www.theverge.com/2016/2/17/11040266/google-ceo-sundar...
Another Edit, OT: Twitter is really, really, really hard to use. Stop worrying about onboarding new users, please make twitter usable for existing users.
https://storify.com/fuzzywah/sundar-pichai-responds-to-apple...
Tweeting it also seems to massively trivialise it.
Gruber's take: http://daringfireball.net/linked/2016/02/17/pichai-apple-fbi
http://www.zdnet.com/article/this-is-how-the-fbi-wants-apple...
I think Pichai is making a distinction between handing over data they already own (eg. a Gmail account) and data stored on user-controlled devices, which must be hacked to access.
Which is interesting, since he's essentially admitting that their push to send everything to "the cloud" makes their users less safe from governmental snooping (justified or not). Of course, we already knew that, but it's curious to see Google's own CEO say it.
No, Pichai is making a distinction between giving the information after a correct process and developing a backdoor to slurp the data. It has nothing to do with cloud/device differences
Aside from the non-sequitur, what Apple has been asked for is a custom build of iOS.
Really the most important part there is the "sign" step, and the fact that the FBI isn't straight-up asking for the signing keys is telling; they didn't want this request to escalate the way it has.
The precedent they want is that All Writs can be used to force Apple into creating a backdoor.
The next step is an online attack backdoor which slurps data over LTE from a suspect's device while it is unlocked.
https://assets.documentcloud.org/documents/2714001/SB-Shoote...
Some people are suggesting that Apple would create this back-doored code, and hand it to the FBI, who would then use it to access any data they want without bothering with court orders. That doesn't seem to be what the FBI are asking for.
Yes, and Apple doesn't want this as a precedent. It does away with one of their go-to selling points these days: security/privacy.
If device security can be surreptitiously undone by an OTA upgrade, what's really the point? I'm sure the brilliant legal minds at the DoJ can come up with creative interpretations to enable the next stage, which would be to do this in bulk as a special point-release.
In the case of cloud data, the government should be held to a higher standard of restriction, because all of the data is in one location, and requires only a single "factor", the identity of the target to collect data for. This applies to both "encrypted at rest" and "encrypted in flight" data.
But for data encrypted at rest on actual physical devices, there's an inherent '2-factor' security to the private invasion. The government must not only know the identity of the target to collect the information, they must possess the physical device as well. ("something you know" + "something you have")
This means, IMHO, there is far less danger, and far less scalability to "one off" hacks like the ones being requested to Apple. They don't scale to Snowden-level dragnets, they don't present low transaction cost barriers to acquisition.
The dangerous think for decentralized data is having an active attack on the device, or something which intercepts the data "in flight". These are scalable attacks you need to worry about. E.g. "push a key logger to every iphone software update"
Perhaps the law needs to make a distinction to warrants for 1-factor data vs 2-factor data, due to the inherent danger of 1-factor data, given that it scales easily to monitoring millions with little transaction cost.
So in this regard, I think there should be MORE push back for collection of cloud data, but individual one-offs for physical devices have a safer threat model.
I view this more like a Vault being found at the home of a murderer, and the cops asking the Vault maker to help unlock the Vault without revealing the proprietary locking mechanism, or without the cops needing to blow up the vault and potentially lose whats inside.
It is precisely the design of the device that the FBI wants Apple to alter using some sort of tool that Apple will make for them.
Each of us info-tech "professionals" downplaying this reality by falling for GOOG marketing are not merely cattle but sheep. Cool open-source projects count as successful opinion manipulation ("marketing") as well btw (Angular, Kubernetes, etc).
I admit it, I'm a sheep meeeeeehmeeeeeehmeehmeh but it might be about time to finally change that meehmeehmeh.
e.g.
* Remind me that it's time to leave for my meeting. Taking traffic and preferred method of travel into account.
* Alert me about that breaking news story that I'm really interested in following.
* Tell me what the weather is going to be like when my plane lands.
All of these are things I value and they are only possible if Google knows enough things about me to answer those questions. A phone can't power it you need software running in a datacenter somewhere. People want these features which is why Google is able to make money.
Everytime this topic comes up people rant about how Google is creepy but it's disingenuous because the tradeoff is Incredibly useful features vs user privacy.
It's a perfectly valid position to want governmental protections for one's data to provide some recourse for violations of your privacy while still enabling those same useful features.
I'm sure they could download the memory, stick it all in some kind of iOS VM and try every 4-digit PIN in no time, all without worrying that the phone would self-destruct.
Couldn't they?
Encryption keys are stored unencrypted in RAM, but only as long as the device is active. RAM loses it's content quickly when it is not refreshed every few micro seconds. Moreover the RAM in the iPhone is a package on package design which makes it hard to connect to it.
Consider that if Cook had wanted to make the statement more official and tie his company to this stance, he could have very easily ordered investor-level press release and then linked it from the homepage for general public awareness. That would cause a much bigger shockwave.
IMO, an intelligence agency would be more likely to invest in other methods (algorithm implementation weaknesses, software bugs, insider access, etc), due to the higher liklihood of sucess.
That said, it's interesting to note that the NSA is moving towards "post-quantum" cryptography[2], under the assumption that suitably powerful quantum computers will be, or have been, built. Whether the NSA already has such suitably powerful quantum computers is anybodys guess.
[1] https://en.wikipedia.org/wiki/Key_size#Brute_force_attack [2] https://www.nsa.gov/ia/programs/suiteb_cryptography/
Post quantum algorithms are simply algorithms designed and analyzed against a stronger threat model. Some of the attacks and techniques are still being developed, so no one knows if new quantum algorithms will be invented tomorrow that trivialize certain problems but the same danger is present to some extent for conventional cryptography today.
If the device were truly secure we wouldn't be having this conversation. Alternatively, if law enforcement wanted to get into a dead guy's filing cabinet on suspicion of conspiracy murder, with a valid court order, there wouldn't be any outrage.
We're being bamboozled by a PR campaign in favor of closed-source software. If the guy was still alive apple could just push him an IOS update containing backdoors galore. This is not a secure device!