In test case, U.S. fails to force Facebook to wiretap Messenger calls | Hacker News Reader

In test case, U.S. fails to force Facebook to wiretap Messenger calls

reuters.com

185 pointsT-A47 comments

The US government will need to buy targeted ads. Then Facebook will let them hear the calls.

Please don't give them any ideas.

"Have you been peddling dope lately? Apply right now for a awesome plea bargain!"

Ultimately, the government will do what it wants with respect to wiretapping because the ruling class of both political parties in the US support it, so there is no electoral accountability. Thus Facebook would be wise to give the appearance of compliance and willingness to help, while resisting total dragnets.

No, it is much more advantageous for them to engage in stuff like PRISM which has no public oversight or accountability and then play pretend in courts. Also this gives them more leverage, they would much prefer these things come in the form of legislation that creates barriers to entry for social media.

>Facebook would be wise to give the appearance of resisting total dragnets, while giving the appearance of compliance and willingness to help.

FTFY

Don't forget that in August, Facebook's head of security, Alex Stamos, stepped down on the strength of his principles, and with that, I'd give a lot more credibility to the possibility that, as others have pointed out; that Facebook could intentionally weaken crypo at the behest of the government in exchange for plausible deniability allowing for parallel reconstruction.

> parallel reconstruction

No re- prefix needed.

https://en.wikipedia.org/wiki/Parallel_construction

Cyrus Fariver has the whole document online, it’s an interesting read.

https://www.documentcloud.org/documents/4951792-828c547a-33c...

Doing all this surveillance working for SV companies definitely pays better than doing it for an alphabet agency. SV will never just give up their data for free.

The government asks (demands) access, but takes no responsibility for abuse. Just saying...

There is a chance that Facebook is trying to change public opinion for the better with a move like this. Unlikely, but possible.

If in the course of a criminal investigation it becomes necessary to wiretap a suspect, Facebook should cooperate with the government and implement the wiretap. As long as a warrant is issued for the wiretap, there should be no issue with this.

Protection of people's privacy must be balanced with granting law enforcement sufficient powers to effectively prosecute criminals.

And should they ensure that encryption always has backdoors to enable this too?

I trust no government, especially the US government, to require the implementation of a wiretap. It has already been shown that they have greatly abused any trust given to them. Law enforcement already has the FISA court, Stingrays, PRISM, and enough other stuff that they don't have an issue breaking in to stuff. In every known circumstance that took a tech giant to court, the FBI just used a third party to provide them a method of gaining access to a physical device. It is absurd for them to receive implementations of wiretapping on any service when they should just do their job and unlock the physical devices. It is also blatantly clear that they tried to force Facebook's hand by using this case. I mean really why do you think this case involves MS13 members?

So you disagree that law enforcement should be able to tap phones.

Not the OP but on my case I disagree yes, there's been so much abuse from governments about wiretapping that the risk/benefit of allowing it isn't worth it.

What sort of abuse and what have been the effects of that abuse?

To add on to this, wiretapping has definitely brought some good including against our own government. For example, it was used to catch Rod Blagojevich, the governor of Illinois trying to sell Obama's senate seat once Obama became president [0].

[0]: https://en.wikipedia.org/wiki/Rod_Blagojevich#Impeachment,_r...

https://en.m.wikipedia.org/wiki/COINTELPRO#Illegal_surveilla...

A covert illegal mass surveillance program is a lot different than a judge approved wiretap on a specific person based on reasonable suspicion. There were literally only 3,168 approved wiretaps in 2016 [0] and as my other comment mentioned, it has even been used to catch politicians of illegal activity [1].

[0]: http://www.uscourts.gov/statistics-reports/wiretap-report-20...

[1]: https://news.ycombinator.com/item?id=18104461

I don't see any way to keep those ones and to restrict the mass surveillance in the same time. These few lawful interceptions are not doing enough good to me to counter-balance the availability of the mass surveillance programs. So that's why I argue about shutting off interception as much as possible technically.

You mean 3,168 across the US? Poland is like 9 times smaller population and we had 6402 approved wiretaps in 2017.

You mean something as catastrophic as Prism for example? Or the regular spying of political opponents, green activists or journalists? It's clearly not worth it.

Yes.

Do you think that building codes should require every bedroom to have a microphone connected to the local courthouse, to be activated only in the event that the authorities suspect the occupants are going to discuss a crime?

No, I consider that giving law enforcement too much access. Others may disagree.

From the article: "Telecommunications companies are required to give police access to calls under federal law, but many apps that rely solely on internet infrastructure are exempt. Facebook contended Messenger was covered by that exemption."

I think it's good that law enforcement can tap calls if necessary, and I see no convincing reason why the existing law and precedent should not extend to apps like messenger which are used just as traditional phones are by many people. Therefore I'm comfortable extending the law to internet based communications.

The powers granted to government should not be absolute, but there must be powers that are granted, so we debate about what powers to grant. The debate cannot be resolved on an a priori basis using abstract principles, it can only be resolved on a case by case basis. If we only rely on abstract principles we will inevitably be pulled toward absolute power or absolute impotency.

So let's walk through the logic here.

Suppose you say any system that can be used for communications must have a way to tap when a warrant is issued.

This means any encrypted communications system must have a back door built in that the government can access. And not just some single highly-regulated federal task force: any federal, state or local court in the US could in theory issue a warrant for someone's communication data, so the backdoor would have to be accessible to all of them.

Which means there's no encryption. There's no way that many separate people and agencies, all with access, would be able to maintain operational security; sooner or later it's going to blow wide open and anyone who wants to get access to someone else's communications will be able to with little effort.

That's what you're arguing for. Is that what you want to argue for?

And this is not idle abstract hypothetical slippery-sloping here. When the legal fight was happening, to try to force Apple to decrypt the San Bernardino shooter's phone, news came out that local police agencies around the country were literally lining up things like "someone was in a car crash, decrypt their phone for us so we can see if they were texting while driving" requests in anticipation of Apple being forced to decrypt phones in response to court orders. The instant you open up and force a backdoor/decrypt for one case, it will be wide open for every case, everywhere, and then we're back to effectively no encryption.

Can I see a source for the last bit, where police where lining up to use phone decryption tech? I don't doubt it, I just want sources so I can use this that fact in future arguments.

> There's no way that many separate people and agencies, all with access, would be able to maintain operational security

Then why isn’t this already the case for unencrypted communications? Law enforcement agencies all over the world routinely obtain lawful access to private data stored in Facebook, Dropbox and Gmail accounts, yet these services are still reasonably secure if, like the average person, you trust the service provider and are not the subject of an active investigation.

The NSA didn't obtain 'lawful access' to wiretap billions of people/communications.

Well, not really.

You could have a single secure system that holds encrypted session keys (and encrypted data if needed) for all the calls, and have it give them out under arbitrary logic, which could include rate limiting, multiple approval and publishing access requests (maybe after a delay), which would prevent "no encryption" from happening, assuming that system is properly secured.

Non-physical security can obviously be made perfect, and physical security can be achieved by launching the system hardware on a rocket, which still allows to communicate with it but makes physical access obviously impractical.

But obviously the issue is that the users have no incentive to use such a program as opposed to one without "key escrow", and there are plenty of PCs and Android smartphones on which arbitrary software can be installed.

One’s right to life, liberty, and property, to free speech, a free press, freedom of worship and assembly, and other fundamental rights may not be submitted to vote; they depend on the outcome of no elections.

— West Virginia State Board of Education v. Barnette, 319 U.S. 624 (1943).

I use Sprint myself... just sayin ;)

IMHO the right for secrecy of correspondence should be absolute and included in the constitution. Nobody should be legally allowed to wiretap anybody (but a victim that expects a call from a criminal and has given their consent perhaps) ever.

Reducto ad absurdum:

"I've got a warrant to search these premises for a kidnapped child. What's inside that big crate with the air holes?"

"Nice try, officer, but those are postcards to my business associates, which makes it a big crate of correspondence."

---

If you prefer, substitute the child/crate with cash, drugs, weapons, letter-bombs...

Nice try, officer, people advocating against privacy and Internet freedom always use child protection as their banners but start abusing the anti-privacy facilities for whatever else they want (and that's rarely about children) as soon as they manage to establish them.

What I mean is it's Ok for an officer with a search warrant to look inside a big crate but if they actually find letters there it's not Ok to read them without the consent of the recipient or the author.

There are very many cases in which both a 21st century and 18th century person would agree that it's reasonable for an officer with a search warrant to read through a box of letters without the accused recipient's consent; conspiracies to commit fraud justify reading your archive of business correspondence and using it as evidence in court; murders done for relationship reasons justify reading your archive of love letters and using them as evidence in court.

It says so right in the 4th amendment "...and no warrants shall issue, but upon probable cause, supported by oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized."

A warrant to search "your archive of business correspondence" or "your archive of love letters" is fine, reading those things while serving a warrant for your neighbors' stolen cat, Fluffy, not so much.

> A warrant to search "your archive of business correspondence" or "your archive of love letters" is fine

But that's not what qwerty456127 proposed. They proposed an "absolute" right to secrecy of all correspondence.

In other words, you could catch a murderer covered in blood and you would be impossible to ever get legal permission to open the sealed envelope marked "Payment For The Job" that was in their back-pocket.

> Nice try, officer, people advocating against privacy and Internet freedom always use child protection

Oh get off your goddamn high-horse already:

1. I explicitly told you it was reductio ad absurdum.

2. I lampshaded it with a silly "crate with air-holes."

3. I outright told you to pick some other scenario if you wished in the final paragraph.

> if they actually find letters there it's not Ok to read them

Hey, didn't you read the final sentence of my post? This isn't actually about giant crates with air-holes, you know. It's about the problems of asserting an utterly inviolable right which is also fundamentally impossible to validate.

Let me put it this way: Your search warrant is to check the premises for threatened blackmail photos, the stolen military bomb plans, and illicit cash payoffs. The letter-envelope is noticeably thicker than normal and crinkles.

What happens?

Or: "US government releases PR press release to hide what facebook and the secret services are really up to".

Bullshit. Facebook capitulated and have access. No doubt. They made backroom deals.

Call me paranoid, but if the government wants something, there’s honestly little anyone can do about it.

Reply on news.ycombinator.com