Hacker News Reader

Comment by zaroth | Hacker News Reader

These are the wrong questions to ask. There's no doubt that total surveillance would result in more crimes being solved, and more criminals being successfully prosecuted. It's not a question of whether the technique is effective enough that it should be allowed.

The question is can the government be trusted with a backdoor into our personal devices that "only they" can use? Should the people trust their government to only use that access lawfully, and can the people trust their government to protect that access from unlawful outsider access?

Since we've seen nothing but incontrovertible evidence, throughout history and to this day, that government cannot be trusted with this level of access to our personal devices (lives), then I can only hope that Apple and companies like it will fight to provide us with secure devices, and that our courts will protect our right to strong encryption to protect our personal data.

View on HN

Actually, for practical purposes, your question is the wrong one. A lot of people think the more ideologically pure argument is the one to make, but it's usually the one with the least impact and least likely to bring about your desired situation.

"Right" and "Wrong" are thrown out the window as soon as law enforcement makes the case that there is simply no time for the constitution. They're saving little tiny babies! but "OK, how many little tiny babies are you actually saving as opposed to blatant overreaches into the lives of private citizens" is the more effective point. The numbers will look bad, they can't help themselves once they get a whiff of some new power.

In this case, arguing for the _idea_ of liberty (incorrectly) labels you a pedant more concerned with red tape than being a hero.

>they can't help themselves once they get a whiff of some new power

Semantics, but I don't think it is necessarily the "power", so much as it is a new vector to get the evidence they feel that they need to perform their job with less effort. It is a lazy method that circumvents the laws that stand in their way for good reasons.

> I don't think it is necessarily the "power", so much as it is a new vector to get the evidence they feel that they need to perform their job with less effort

I am inclined to agree with you, but I have no evidence. Hence the questions. HN is well aware of the risks. But I've never seen any work done into the potential benefits. If the benefits are slim, then the discussion is moot. If there are cases that can be solved with phone data only, and if those cases are horrible or frequent enough, then there is a valid debate at hand.

No laws are being circumvented if the police have a warrant. The problem (from a law enforcement perspective) is that technology now makes it easy for people to communicate and store data in a way that the police can’t monitor even with a warrant. This wasn’t an issue when the police could obtain warrants to monitor telephone lines and break into safes.

>"Right" and "Wrong" are thrown out the window as soon as law enforcement makes the case that there is simply no time for the constitution. They're saving little tiny babies! but "OK, how many little tiny babies are you actually saving as opposed to blatant overreaches into the lives of private citizens" is the more effective point.

This. Freedom isn't free.

"How many kids have to die before you give up your..."

"All of them you twat!"

> There's no doubt that total surveillance would result in more crimes being solved

I guess I'm doubting that. In any case, we're weighing costs and benefits in a limited context: access to a phone's data with a court order in hand. Framing an attempt to understand the benefits as "the wrong questions to ask" is counterproductive.

Can I ask how you're doubting this:

> Total surveillance would result in more crimes being solved

With perfect and total information how would fewer crimes be solved?

When you’re trying to find a needle in a haystack adding more hay isn’t the solution.

Total surveillance doesn't guarantee "perfect and total information".

I expect the rationale is that once governments have total access to phones, criminals will stop using them, and governments will still have the access.

But he's saying that even if the answer to your concern is satisfying, there are other factors which outweigh that benefit and should be considered.

> there are other factors which outweigh that benefit

How can you weigh a cost against a benefit when you have no idea how big the benefit is?

I can't say in the particular case of surveillance.

One generalized answer to your question is:

"if the cost is unethical" then paying it really isn't on the table for ethical people.

So the cost of doing something unethical is infinite, assuming that you need to remain ethical, and any benefit is necessary smaller than the cost of losing your ethical status.

You might not agree that ethics are pragmatically important, but the point here is that it's possible to do a utilitarian calculus even if you don't know fully understand the possible upsides.

Or simply, in free societies sometimes the bad guys get away with things. Or maybe they're not the bad guys and the state has deemed them "bad guys".

And what's really pathetic is that societies don't have discussions about unintended consequences of laws, and that prosecutors don't have checks-n-balances on their power/authority.

> Or maybe they're not the bad guys and the state has deemed them "bad guys".

Fun conversation topic. A large proportion of people cannot comprehend such a concept.

Even if it _were_ possible to only have the “government” have access to our personal devices and information, why would anyone want them to have that access? There are things I want to share only with my family, and ideally, I should have the ability to do that comfortably in this age of IoT. We won’t solve crime by allowing the government to spy on us; at best, it will cause the crime to be diverted or changed in form.

I see this line of thinking a lot in tech circles, but you really have to divorce this issue from the digital world. Imagine the exact same argument is about a safe instead of a phone. The government would simply request a warrant and then work on brute forcing their way into the safe.

If you have the same objections when using a safe, the answer to the problem has nothing to do with technology because you believer there is a fundamental flaw in the US criminal justice system. You aren't going to be able to consistently defeat the government by repeatedly trying to outpace them technologically. You have to instead change the laws that govern their actions.

If you think the rules should be different for a safe and a phone, you need to be able to explain why digital evidence should be treated differently than physical evidence?

The government is allowed to crack open a safe with a warrant. The government is allowed to crack open an iPhone with a warrant.

What does either of those things have to do with decrypting things found inside either the safe or the iPhone?

If the FBI found coded papers inside a safe, they could try to decrypt those papers, but couldn't compel the owner to assist them.

Security flaws are fair game for law enforcement. Secure encryption without exploitable weaknesses will probably defeat them even in the presence of a court order.

Compare and contrast the different levels of effort required to gain access to a safe VS a persons iPhone prior to this data update.

Authourities must first gain access to premises with a warrant and then get a safe cracker in.

VS: authourities (at an airport or just about anywhere) take the phone off the person, there is a layer of obsfucation as to whether a warrant has been obtained or is needed, and data is collected.

If you look at the history of digital data (ie echelon etc) there is a clear trend for vast data hovering of all and any resources. This is not possible with physical data, as it leaves behind a more concrete trail when authorities go after it, and causes them to (generally) be more selective about what they are doing

I consider the analogy to be does a manufacturer have a legal obligation to not make a safe that can't be broken into by the government?

Absolutely. Breaking a physical safe and breaking encryption don't differ in the _kind_ of hoop you're jumping, just the height you have to clear. But the encryption hoop is (almost) infinitely high, and that leads people to think about it as if it were another sort of thing entirely.

> The question is can the government be trusted with a backdoor into our personal devices that "only they" can use?

I think a better question is what happens when we go to a paperless society? Because it's coming, and search warrants will be useless in such a society.

And while some of your rhetoric about the abuses of government spying on citizens is justified (e.g. COINTELPRO, Watergate, etc.), search warrants as a whole do far more good than harm.

And I'd hate to see this power for prosecutors disappear just because drug dealers started using iPhones to keep their illegal activities hidden from police.

I think a better question is what happens when we go to a paperless society? Because it's coming, and search warrants will be useless in such a society.

Were this true, crimes would have been practically unsolvable before about the mid 1990s. Back then nobody carried pocket computers/communicators (encrypted or otherwise) and criminals also largely failed to make paper records of their crimes.

You can't smuggle guns via SMS. You can't vandalize shop windows over the Internet. You can't kill people with a digital photograph. Most crimes, and especially the violent crimes that scare people the most, require physical actions that leave physical traces.

The major exception would seem to be certain white collar crimes: insider trading, trade secret theft, perhaps tax evasion and other financial shenanigans. That's where I can see secure electronic devices making law enforcement significantly harder. But when LEOs speak against encryption in public they usually seem to invoke killers and kidnappers, as if victims' bodies were now regularly hidden inside encrypted iPhones instead of car trunks and shallow graves. Maybe LEOs believe their own rhetoric or maybe they just realize that "think of the victims of inside trading!" isn't the sort of terrifying scenario that will get the public on their side.

> You can't vandalize shop windows over the Internet. You can't massacre people at a concert [snip]. You can't smuggle weapons over a border [snip].

I could commit these crimes over the internet by using others to perform them. So the people you catch are not the prime cause of the crimes. This was not feasible before the internet, and digital monitoring would be the only way to catch me.

Even in the 20th century, heads of organized crime and terrorist groups generally weren't the ones actually smashing the windows of businesses that didn't pay protection money or blowing themselves up in crowded markets. If lower level criminals were guided by phone call, then law enforcement could get call records after the fact but not the actual contents of the past calls. If all communication was face-to-face, they wouldn't get even that. It seems about the same to me today. Phone service providers still have call records. PGP encryption on email bodies doesn't keep recipients secret. Apple can supply analogous iMessage metadata in response to a warrant.

Perhaps law enforcement is angry at the passing of a brief golden age where most Americans carried a cell phone and that phone's security was almost always terrible. I'd put that era roughly between 2000, when American cell phone ownership rates rose past 50%, and 2009, when Apple introduced iOS full disk encryption and began regularly improving other data-at-rest protections.

I don't mean to be a jerk here by constantly raising counter examples because I think you have some good points. But apps like Signal prevent all that data from being collected. It just stays on the phone, locked by the secure enclave.

> Perhaps law enforcement is angry...

I wonder if what they're truly feeling is worried. Would that change the way you thought about them?

I get that whole thing with "COINTELPRO", and Watergate where there were abuses. But assuming everyone is of the honest type here, wouldn't you want them to have more tools?

It’s not about honesty here, it’s about honesty in law enforcement/government.

I wonder if what they're truly feeling is worried. Would that change the way you thought about them?

I want to see the evidence that forms the basis for their worry, if they're feeling worried. Sincere feeling is better than pretending, but sincere feeling isn't enough.

The most compelling evidence would show:

- A statistically significant decline in solving violent crimes or serious property crimes now over the 1990s.

- A statistically significant increase in solving these serious crimes among police departments with access to phone-unlocking (e.g. GrayKey devices) vs. otherwise-comparable police departments without access to such devices.

If nothing regarding smartphones shows a statistically significant correlation to serious crime solution rate, then everyone will just go with their gut feelings. The gut feeling of police is, apparently, that they need to be able to look at the contents of phones. My gut feeling is that they don't. It's an impasse.

If serious crimes are solved at a higher rate in departments with phone-unlocking capabilities, but the rate in the departments without unlocking tech is still no worse than in the 1990s, I still would resist weakening phone protections. It would make me think that maybe things have become harder since 2008, when phones were widespread and insecure, but that secure phones aren't a notable hazard to public safety.

If it turns out that departments with phone-unlocking tech are doing significantly better than departments without it, and that departments without it are now solving crimes of violence and serious property crimes at a lower rate than in the late 20th century, I'd have to have a long, hard think about my personal stance on this issue. There would still be gnarly technical issues even if I decided that less secure phones were a net benefit to society.

But I have changed my stance on security issues before. For example, I changed my mind about video surveillance of public streets. I find it more reassuring than dystopian. I'm more worried about hit-and-run drivers than about the cameras being used by a future dictatorship against the resistance. I've yet to be convinced that monitoring should extend to private spaces like my domicile or phone.

I am amazed that you completely throw out the window the wisdom in preventive measures and simply wait for the crimes to physically happen then respond to them. It's a no-brainer that most of the extreme and mass violent crimes have been facilitated and coordinated digitally.

Even if Apple could unlock iPhone storage given the phone and a valid warrant, law enforcement would still need to get the warrant and take the phone from the owner. Unlocking individual devices is not broadly useful as a preventive measure; it's something that could be done only after you have probable cause and don't mind alerting the target that law enforcement is interested in him.

There were no iPhones in 2001 and 9/11 still happened. All the coordination was done by unsecure communications and face to face.

Having access to more worthless data only makes it harder to find the information amongst the sea of data.

> Back then nobody carried pocket computers/communicators (encrypted or otherwise) and criminals also largely failed to make paper records of their crimes.

But they did use fixed-line telephones and talk in person. These communications can be monitored with a warrant for the use of a telephone intercept or listening device.

> Most crimes, and especially the violent crimes that scare people the most, require physical actions that leave physical traces.

To borrow a page from your argument book, if physical evidence alone were enough, we wouldn't have so many unsolved homicides. Look at the KC unsolved murder list for 2017:

http://kcmo.gov/police/homicide-3/2017-unsolved-homicides/#....

> You can't smuggle guns via SMS.

Technically, you can send the plans for a plastic gun over the internet now, which just needs to be printed on the other side.

You can also send a virus, if the other side has a gene sequencer.

> You can't vandalize shop windows over the Internet.

You can vandalize digital signage over the internet. As well a steal credit cards from the store's credit card readers.

> You can't kill people with a digital photograph.

Well... technically it's animated gif. But yeah you can.

http://fortune.com/2017/03/22/twitter-epilepsy-gif/

> Maybe LEOs believe their own rhetoric or maybe they just realize that "think of the victims of inside trading!" isn't the sort of terrifying scenario that will get the public on their side.

Honestly, I think law enforcement believes that they need more tools. I don't think they want unsolved murders any more than the citizens do. So telling law enforcement officers, "you can pry open my iPhone from my cold dead hands" tends to ring hollow, especially if they really are of the honest kind and really do want to put criminals away as well as respecting your privacy.

Is the murder clearance rate worse than it was in the late 20th century? Also worse than before iOS implemented full disk encryption? Your hyperbolic original claim was that search warrants will be useless in a paperless society. Had you made a mild and reasonable claim like "the contents of a phone, if available in unencrypted form, can help to solve crimes" I wouldn't have bothered to reply.

As for the rest, I can't tell if you are just trying to demonstrate that you can think creatively, or if you actually think that iOS disk encryption is an important element of a scheme to get away with murdering someone with a pathogenic virus recreated from sequence data. (Or to get away with 3D printing guns under illegal circumstances, or deliberately inducing an epileptic fit.)

> Is the murder clearance rate worse than it was in the late 20th century?

Why do you insist on this artificial restriction on whether or not police officers should have access to the data on an iPhone? It seems to me this would help the clearance rate if anything. It's another tool in the arsenal.

> As for the rest, I can't tell if you are just trying to demonstrate that you can think creatively...

The internet allows new styles of crimes, perhaps crimes you or I have never really thought about yet. Or maybe I've been paying attention to crimes on the internet lately. And for the record, I'm not the first to think about resequencing viruses. See point #5 here:

https://www.vox.com/2014/5/22/5739380/why-were-never-really-...

And to answer the rest of your comment, your rhetoric reads stronger than it truly is.

It's a high bar to show that encrypted devices enable a new era of unsolvable crimes. Isn't that what you were originally warning about, with the line about search warrants being useless in a paperless society? Such bold claims call for at least a bit of empirical evidence, like statistically significant solve rate declines vs. the immediate pre-mobile era.

>Honestly, I think law enforcement believes that they need more tools. I don't think they want unsolved murders any more than the citizens do.

The US Constitution makes it clear that the rights of the people to be secure in their persons and possessions is paramount, but for a narrowly defined list of exceptions. That crimes may go unsolved because the state is kept on too short a leash, or because modern technology has made their job more difficult, is a feature, not a bug. A government with perfect knowledge about its citizens behavior and correspondence, or one that can perfectly enforce its laws, is indistinguishable from tyranny.

>So telling law enforcement officers, "you can pry open my iPhone from my cold dead hands" tends to ring hollow, especially if they really are of the honest kind and really do want to put criminals away as well as respecting your privacy.

They can pry my iPhone from my cold dead hands, or my live warm hands will hand it over if they have a warrant, but it will remain encrypted either way, for no other reason than I have the right to do so, and they have no right to demand otherwise.

Reply on news.ycombinator.com