This is a dumb slightly unrelated question by me. Say I was a "crook"/bad guy. Why doesn't "well done" AES/RSA/ECC encryption stop law enforcement from being able to "snoop" on what one crook says to another crook?
The standard playbook for rolling up criminal conspiracies is to arrest a low level member, offer him a reduced sentence in return for testimony, arrest the next guy higher up based on that testimony, etc. (The only way to prevent that would be a fully trustless "cell" structure where none of conspirators know each other, which has never been done in real life.)
You will notice none of this requires communications intercepts. This is because the feds are simply lying when they say encryption prevents law enforcement operations.
Somehow they managed perfect forward secrecy.
For a while.
You can’t have a network with more than one cell where no one outside of the cell knows that it exists, and without those people using a communication method to people in the cell that at least one person in the cell knows exists. And when you minimize down to the minimum contact, the network is very much non-resilient: its hard to discover and roll-up, but (especially if the cells are doing high-risk functions, which is probably why you want to do it) its also easy to disintegrate accidentally, even without being discovered and rolled-up.
But practically there's a whole bunch of problems as you say - you've no idea how many - if any - cells exist, they can't coordinate on which one picks up a particular target, the communicator is obviously at risk from being tracked down, how do you tell people where the radio broadcast is, authorities can obviously listen in once they've found the broadcast, etc.
Couldn't be done by sending messages encrypted with private key and the cells decode it with public key?
Then the problem is: How to trust public keys to have been provided by the "right" correspondent, and not someone from another gang or law enforcement?
Cell systems have order, but only where the most risk is imposed. Lesser risk, less order. Infact, too much order imposes far more risk.
(Btw, you've been shadowbanned a while ago. I'm only mentioning this, because your recent comments seem sane as far as I can tell.)
I've only ever heard it on an episode of Monty Python. Wonder if it's just a UK thing.
When properly done, such organization is almost impossible to find. I'd not be too sure about them not existing. The idea is well known, so someone must have tried it at least.
The Crips and the Bloods are kind of like that cell structure, but cells have internal beef all the time. If you had different cells have no communication, that would happen way more as they try to expand
Think of a cell like a class in programming. If a class has a bug you can fix the bug, or make a new class with the same ins and outs. Never have to restructure the entire code base. Properly made classes don't leak to other ones. Worst case internal beefs take down prod for a bit but they don't take down the entire program
Perhaps you are in it for the ideology? Or perhaps they pay you?
My sense is that it has become a bit more lax since Apple has grown and, well, let's face it, Steve is no longer with the company.
Or you just have your buddies enact violence on the friends/relatives of anyone caught squealing.
"Why am I Mr. Pink?"
Good opsec is exceptionally hard. If you aren't building it from scratch it probably isn't secure. And even if you are, if you're a big enough target for nation states to be looking you're still going to have a hard time.
And if you are building it from scratch, it is definitely not secure.
Also they didn’t use disappearing messages or delete them so the full history was available without breaking any encryption
There are much more lucrative paths for intelligent psychopaths in the professional world.
For reference, in Bosnia and Herzegovina, the median salary for a software engineer is 3650 BAM (1867 EUR at today's rate), per month, making a yearly 43800 BAM / 22404 EUR, and that's gross, before taxes and stuff. 6 figures EUR, even assuming low 6 figures like 300k, is the equivalent of more than 13 yearly salaries, and is of course untaxed, so even more with that. One can comfortably retire with 300k EUR in Bosnia.
They'd need to kill those SWE to be -safe- after
PS: I wouldn't take a job that can get me killed, there's a reason I like working with computers
So all the cops need to do is go after the central server and then quietly hijack it. After that the choices are pretty much endless. If they used non-standard encryption, ggez, they're probably not smarter than the police. If they did, chances are that the server has an OTA mechanism to update the message application on the phone, so just push out a malicious update that quietly just resends every message to a police controlled server and uploads all messages still stored on the device. Less useful (not as much access to historical messages) but still very useful for tracking criminal activity if you run the tracking net for long enough.
Very few "crypto" exploits are ever the issue. It's almost always easier to break some other part of the system than the crypto.
To be honest, if someone were trying to sell me a cryptosystem for a criminal enterprise and I were in the market for one, I'd happily start tracing everybody in that company as they are almost certainly part of the Feds.
If you are the target of a nation state actor, you're pretty much fucked. Once a nation decides to put down that much resource to get you, you're getting gotten.
Crypto is only valuable in the sense of "I don't have to outrun the hungry tiger. I just have to outrun you so the tiger stops chasing me to eat." If you, specifically, are a target, crypto won't help you much.
Real winners write the law books.
Whether that's European colonial settlers, or William of Normandy.
(Not known as "William the Negotiator", or "William the all-around nice guy").
Descendants of the local warlords he installed still own huge (well, by British standards, the entire country isn't much bigger than New York State) tracts of land, a thousand years later.
https://en.wikipedia.org/wiki/A_language_is_a_dialect_with_a...
Or they just call up discord and ask for the name and billing address on the account.
Then there's traffic analysis (a talk to b, b kill c, b talk to a). See also: "well done".
The Pegasus malware for example was able to infect and spy any phone.
They claim it’s super secure, and then apparently implement whatever with no oversight.
The companies offering encrypted phones were infiltrated. Servers hacked. Employees intimidated with prosecution. Bank accounts seized.