U.S. Law Enforcement Seeks to Halt Apple-Google Encryption of Mobile Data | Hacker News Reader

U.S. Law Enforcement Seeks to Halt Apple-Google Encryption of Mobile Data

bloomberg.com

601 pointscoreymgilmore333 comments

I was living in DC during the first Crypto Wars of the late 1990s and covering them as a reporter (I've since shifted to working on recent.io, of course). It sure looks like this will be Crypto Wars II: the Feds Strike Back.

From my experience a key question to ask is: What would the eventual law say? Will it make it a federal felony to possess an encrypted phone? Or a federal felony to sell one?

The FBI endorsed H.R. 695 the last time around, which would have done the latter. Read it for yourself:

"Whoever, after January 31, 2000, sells in interstate or foreign commerce any encryption product that does not include features or functions permitting duly authorized persons immediate access to plaintext or immediate decryption capabilities shall be imprisoned for not more than 5 years, fined under this title, or both..."

"After January 31, 2000, it shall be unlawful for any person to manufacture for distribution, DISTRIBUTE, or import encryption products intended for sale or use in the United States, unless that product-- `(1) includes features or functions that provide an immediate access to plaintext capability... requiring any person in possession of decryption information to provide such information to a duly authorized investigative or law enforcement officer..." (http://thomas.loc.gov/cgi-bin/cpquery/T?&report=hr108p4&dbna...)

Note the distribution ban above. That would have hit open-source and free software projects.

Put another way, implementation details matter. A lot of voters might agree with the general proposition that law enforcement should have a way to snoop on terrorists|child pornographers|drug kingpins. They might not agree that a 14-year HN reader with a forked version of Android|AOSP on Github should go to prison for 20 years because he dared to distribute an unencrypted OS.

I may be as naive as hell here, but when you go from, "we don't want US citizens selling crypto devices to terrorists" to "Timmy's going to see the inside of a jail cell for 20 years for giving Mark a copy of TailsOS" I just can't see how a judge or jury would let it go that far, and I don't think unintended consequences have ever gotten that bad.

It just smacks of fear-mongering. "They'll literally lock up your children!"

Yep, sorry, you're naive. :) The law != common sense. If a law is on the books, it may be applied broadly, even to Timmy and Mark. That's why it's important to ensure the laws are sensible before they're enacted.

Here's one example. Let's say there's a 16-year old girl and a 17-year old boy who are in a consensual dating relationship and, you know, take some racy photos of one other. The photos were taken consensually, not shared with anyone else, and stored only on their own computers/accounts. And let's say they're living in Florida and under state law, they're legally old enough to have sex with each other.

It would be fear-mongering to expect that these two happy teenagers would ever be prosecuted and convicted on "child pornography" charges, right? Except they were. And, as I wrote in 2007, a Florida appeals court upheld their criminal conviction: http://news.cnet.com/2100-1030_3-6157857.html

Yes, sorry, Timmy and Mark, sometimes a judge and jury will let it go that far. Sometimes they will "literally lock up your children..."

Ah, but that plays into the US's very strange views on sex. It feels like an exception, rather than the general rule.

US has strange views on a lot of things, including the one in question – privacy.

I don't think the US's views on sex and the US's views on privacy are quite comparable, given the 500 year history that comes with our weird prudishness.

Your point, as I understood it, was that jailing children for children pornography is an exception from normal routine because US has strange views on sex. My point is that US views on privacy ("nothing to hide") are also strange (relative to my viewpoint), so that will also be an "exception", and you shouldn't be surprised when these strange views will be applied in the courtroom.

I don't think sex and privacy come anywhere near each other, in terms of deviation from the global norm. The US doesn't have any particularly deviant view on privacy from the rest of the world, unlike sex.

Yes, but... the law is not rational. It will execute the code you give it.

It is JIT-compiled though, and courts will throw compiler errors from time to time.

But those jury nullification errors are non-deterministic, so you can't rely on them.

A large part of the US judicial system relies on people to take laws and find rational and reasonable interpretations.

Exactly. This is precisely the point. It will interpret and execute whatever code is thrown at it. The problem is that the code is NOT DETERMINISTIC (or non-deterministic, whatever). It can be interpreted in a variety of different ways.

This and the fact that 'compiled' code is sometimes altered by applying some money-based side effects gives us some pretty ridiculous results.

Correct me if I'm wrong but there's no easy way to fix this problem.

Don't think of it as corruption, think of it as aspect oriented programming!

BEFORE: go to jail

APPLY: expensive lawyer, public pressure

Let's not overlook the fact that the law doesn't actually have to be applied, it can be a bargaining chip. The prosecution mentality is to 'throw the book' at defendants and then the defendant has to try to negotiate down from that starting point.

Firearms might be a good analogy here. You don't need to actually shoot a robber for your firearm to be effective. The mere presence of it is often enough to scare them off.

And how is this "everyone can be in prison if we want it" attitude any good? That's a huge enabler of selective enforcement and limitless corruption.

> That's a huge enabler of selective enforcement and limitless corruption

I don't think anyone will argue with you on that one.

Right. We go from a nation of laws, to a nation of people that can break the law .. if you're well-connected. Which has a strong resemblance to the situation commonly found in what was formerly called banana republics.

Yes, but the problem is, the current mindset is to write laws that give them the right to do that.

The question isn't whether sanity would prevail in court. (I'm somewhat optimistic that it would, eventually.) The question is, given the current fear-driven mindset, isn't it probable that something like that will be written? And how do we stop it from being written (or at least enacted)?

Sanity in the court room is the last line of defense, not the first...

> I just can't see how a judge or jury would let it go that far

Oh they will, and in a few short years this will be the new status quo, and people will be wondering how we used to allow child pornographers and drug traffickers to hide behind encryption. YOU don't have anything to hide, do you?

Besides, when was the last time government-induced fear mongering failed? Not in the last decade.

> It just smacks of fear-mongering. "They'll literally lock up your children!"

Prosecutors had every intention of sending Aaron Swartz to prison. We don't need more stupid laws, we need to remove the existing ones.

Aaron Swartz was never convicted. Being charged with a crime and being convicted of a crime are two entirely different things.

Being charged with a crime and being found not guilty can still bankrupt you and consume years of your life. You can't be charged with a crime that isn't on the books.

You also can't stop criminals with a crime that isn't on the books.

If it isn't a crime then they aren't criminals.

I disagree, though I note your adherence to the dictionary definition of the word criminal.

There isn't another workable definition of the word. Maybe you want a word like "deviant" or "degenerate".

(of an action or situation) deplorable and shocking.

Now that we've gotten to quoting dictionary definitions to words, I think we've killed any good spirit that may have been left in this conversation.

What dictionary does your definition come from? According to multiple sources[0], the closest match to your definition (American Heritage's "Shameful; disgraceful: a criminal waste of talent.") is typically used in a figurative sense ("that spinach dip is criminally awful").

[0]: https://www.wordnik.com/words/criminal

Defining "criminal" to mean wrongful rather than illegal doesn't actually help you. Aaron Swartz or graduate students publishing crypto code would not be doing anything wrongful either. And no one is suggesting that we remove the laws against unarguably wrongful things like fraud or homicide, none of which could plausibly be used to charge any of those people.

> You also can't stop criminals with a crime that isn't on the books.

If you make this sentence mean anything at all, which requires redefining "criminals" as something like "moral wrongdoers, independent of whether their wrongdoing is actually a crime", then it still isn't true, as the existence of a law prohibiting an act is neither necessary nor sufficient to create disincentives to committing the act.

17 year olds were put on sex offender lists for having sex together, despite every call that "anti-pedophilia laws will never be used against teenagers having sex!". If a law can be used for a malicious purpose, it will be.

I find it interesting that on one hand the government is telling a technology company they can't create technology which makes communication private and on the other hand the government is charging the CEO of a tech company[0] for creating technology which removes the privacy from communication.[0]

"In the first prosecution of its kind, federal officials said that StealthGenie violated the law by offering the ability to secretly monitor phone calls and other communications in almost real time, something typically legal only for law enforcement."

[0] http://www.washingtonpost.com/business/technology/make-of-ap...

The state tends to reserve a great many powers for itself that it will not permit the people to have. Congress itself routinely excludes itself from laws it writes with the full cooperation and support of the Administrative branch. It is rare if ever that the Judicial branch steps in because each loves its ability to act outside the law.

Was this part of the first crypto war? [1,2] I must not have been paying attention.

It's interesting to me that some claim the software didn't work at all:

> Now during all of this Jones and crew simply couldn't get the klutzy software to work.

And none other than Mary Jo was brought in from the home team. Rather strange déjà vu.

[1] http://cryptome.org/dirty-jones.htm [2] http://cryptome.org/dirty-lantern.htm#readers

They are going straight into "think of the children mode"

" Smartphone communication is “going to be the preferred method of the pedophile and the criminal. We are going to lose a lot of investigative opportunities."

Apparently "what about the terrorists?" isn't as effective anymore. Let's hope the public will see through their manipulative talking points.

Yeah, I let out an audible WTF when I read that. I wish this argument would stop.

Oh, it gets better.

"The notion that someone would market a closet that could never be opened – even if it involves a case involving a child kidnapper and a court order – to me does not make any sense."

Seriously. Perhaps one would call this sort of exotic and nefarious contraption a "safe"?

Well we all know that law enforcement gets a copy of every safe key made. you know just in case

I don't understand this argument. Wouldn't law enforcement still be allowed to access phone records unecrypted if they have an actual suspect and court order?

Yes but they want the data on the mobile device. For example, I use textsecure when texting my friends. Its encrypted locally and over the wire so the records would only help them show who not what I was talking about.

Probably harder and takes longer than searching through a confiscated phone from a suspect.

Bingo! You can, as far as I know, confiscate and search a suspect just based on probable cause, whereas you'd need to have at least a subpoena if not a warrant to get wiretap authorization or phone records.

A recent Supreme Court ruling[0] makes it unlawful for authorities to search confiscated cell phones without a warrant. They could, theoretically, confiscate your phone based on probable cause, but searching it would be a different matter.

[0] http://www.supremecourt.gov/opinions/13pdf/13-132_8l9c.pdf

Oh, excellent! At least that prevents overt searches.

With end-to-end encryption where the messages are encrypted and decrypted on the client it would not be possible for anyone with access to phone records or central servers to read what was said. They would need to obtain the private keys that are generated on the client devices themselves.

But they'd still be able to do that given a warrant? Or is this unwarrantable protection, for lack of a better word?

Nope. They could use a warrant to compel the sender or the recipient of the messages to unlock them or face jail time. But Apple doesn't have the keys.

wouldn't the 5th amendment protect against that?

er - possibly, I'm not a lawyer. I read it somewhere on the internet and it sounded credible at the time.

I think the most important thing here is that law enforcement must approach the individual. What happens next may end up a complicate web of legal acrobatics, but the individual at least knows the law is after them. That's a good thing, IMHO. If your privacy is being violated by police forcing you to open your phone to them... at least you know the "when", "how" and "what" info they're getting. I'm also pretty sure you'd at least have a strong suspicion on the "why" it's happening to you as well - fair or otherwise.

Maybe. See http://www.uclalawreview.org/?p=5168

Assuming they can get the client device(s) before they are destroyed.

"With end-to-end encryption where the messages are encrypted and decrypted on the client it would not be possible for anyone with access to phone records or central servers to read what was said. They would need to obtain the private keys that are generated on the client devices themselves."

Would that it were.

You are using the application processor (the "computer") to do that work, but there are two other computers inside your phone - the baseband processor and the SIM card.[1] Your carrier has access (OTA updates, etc.) to the baseband processor and can load new code/functions on it without your knowledge at any time. Depending on the SOC your phone is based on, the baseband processor can have DMA access to your application processor. What that means is, the baseband processor (which you have no control over whatsoever) can read your RAM directly.

Your cryptosystem that you describe probably works quite well on a desktop or laptop computer, but your carrier completely and totally owns your phone and everything on it.

... and we haven't even gotten to what they can do with the SIM card ...

[1] Yes, the SIM card is a computer with its own processor, RAM and programs running on it right this moment.

It seems like what we need to do is separate the damn things. Build the phone as two independent machines that only communicate with each other over ethernet. Then the user controls the one that runs Android and the other one never sees plaintext.

Don't expect to see that architecture on the floor of a retailer near you anytime soon. Maybe in the EU??? NOT in the US.

I'm surprised they even admit it's mostly used in the war on drugs. As if we want the US government to help [1] the Sinaloa cartel dominate even more - sorry, I meant to "win the war on drugs" (ha ha!).

[1] - http://www.businessinsider.com.au/the-us-government-and-the-...

Hmm. Kind of like the reverse of the bit in Charles Stross' "Merchant Princes" novel series where the trans-dimensional smugglers donate to the Partnership for a Drug-Free America to help keep drugs illegal and the price up.

Except your example is real, just like back in the 80s when the govt (CIA?) helped smuggle in cocaine.

Hmm sounds to me like they are trying to convince people to use their phones for illegal doings.

Also, all of the comments in this thread (not this one specifically) make me wish HN threads root comments defaulted to collapsed so people might avoid duplicate root comments. Maybe...

That's an interesting idea. It's not often that people in law enforcement or military intelligence will come out publicly and say "if such-and-such adversary were to use this widely-available technology we'd be stymied!"

Possibly reminiscent of the Freakonomics suggestion for terrorists to buy life insurance from their bank.

Quote from Cathy Lanier, the police chief whose ridiculous uniform resembles that of a four star general.

fwiw my friend's dad was our chief of police for years, and he only ever wore a shirt and tie.

For what it's worth -- and here I have to wonder how much it's worth to criticize someone's point of view based on a photograph of them -- that's a dress uniform.

http://en.wikipedia.org/wiki/Dress_uniform

Dress uniform for police? That's not quite as bad as the paramilitary BDUs, but, really?

Police do have official events to attend. In my state capital there is a yearly event to honor fallen officers where representatives from every police force in the state show up in their dress uniforms for a mass memorial service.

They could wear suits. That might remind them they are of the people, and their first priority is to serve the people. They might also consider attending the memorial service for Mike Brown. In suits.

They'd have to only attend if off-duty then wouldn't they? One point of police uniform is to identify a person as being a warranted police officer on duty (then there's the appearance of officialdom and the sense of inferiority it breeds in others, the camaraderie, ...). You'd probably need to change the law if you want to allow regular warranted officers to be on duty in civilian clothing, jurisdiction dependent of course.

I don't really understand why you don't want to be able to identify your police officers though - even the UPS drivers wear uniform.

Thank you for making this point. The very last thing we need is to have police disguise themselves as regular folks. It creates a number of dangerous conditions for both the police and the public.

"Who is this random person yelling and waving a gun?" Should I pull over for this random person with flashing lights in their grille?"

It's already bad enough having some traffic enforcement types in unmarked cars or in cars with "ghost" decals.

OTOH, her uniform is very "Aladeen" and while fussing about her uniform is a mostly trivial distraction, having a uniform that is a bit less "Aladeen" would probably short-circuit such criticism. If there weren't more important problems with this person, I would fully support mocking her ridiculous uniform.

The ones who work at NSA/CIA wear shorts and suits. I don't think they are reminded of who they are and what their priorities are, by it.

Sometimes a photo tells you all you need to know about a person: e.g., http://i.imgur.com/4CIFpFe.jpg . Modern American law enforcement: a gang of wannabe tinpot dictators with weapons they have no business with, and that they probably have no idea how to use.

Finger off the trigger, Sheriff.

"Instead of criticizing one person based on a picture, I criticize thousands of people based on a picture! That'll show him!"

Yeah, stereotypically speaking, it's the 90% of bad cops that give the 10% a bad name. Funny, though, the "good" 10% don't seem to have a problem with that.

I understand where you're coming from. I have an uncle that feels the exact same way about black people and Muslims. Wait, what?

To the extent police work is someone's religion, I'd submit that these are exactly the police I'm talking about.

So you're a bigot against Police _and_ Muslims.

Got it. At least you're consistent.

Yes, my simplistic worldview often gets me into trouble. But this will come as no surprise to you, I'm sure.

The ratios are nothing like 90 bad:10 good. That kind of hyperbole is uninformed at best, and disingenuous at worst.

Not only is his finger on the trigger but the weapon is cocked.

Don't worry dude it's probably not loaded.

cue cries of "every gun is always loaded"

I don't know why you're getting down voted, maybe people don't know the first rule of gun safety: Always treat the firearm as if it is loaded. (which on the internet is "the gun is always loaded" shorthand.)

That's an M1911. They're designed to be carried in condition one, which means that the hammer is cocked and the manual safety is engaged, otherwise known as "cocked and locked."

His trigger discipline is still inexcusable.

And a law enforcement "professional" shouldn't be carrying a gun that is "cocked and locked" SA firearms are not safe for everyone involved.

You do realize that's Joe Arapio, right? He's the poster child for law enforcement that's so egregiously overreaching it's become self-parody.

Of course he's holding a cocked firearm with his finger on the trigger. He pretty much doesn't have any other state.

I agree that her uniform is largely irrelevant to the discussion. She also likely has no choice in it.

I'm trigger happy pointing out police militarization, which manifests in overt ("tanks") and subtle ways (military dress).

Perhaps it's a stretch, but I believe that militarization doesn't ease the tendency of the police to desire and acquire powers they shouldn't have.

They talk about a balancing act and a criminal underworld free for all but I haven't seen too many complaints from the FBI about the millions of Americans whose constitutional rights are infringed upon every day during the NSA's total government free for all (as well as the wide variety of stories pertaining to other agencies and local law enforcement which are abusing various forms of intelligence gathering).

They are going straight into "think of the children mode" ... apparently "what about the terrorists?" isn't as effective anymore.

"They" in this case is the chief of a metro police department, whose forensic and surveillance resources are more often spent on pedophiles and drug dealers than terrorism. What else would they say?

If the article's authors wanted a "what about the terrorists?" quote they would have gone to a counter-terrorism official, just like they rang someone at the DEA for a "but drug organizations!" quote.

You're reading a paint-by-numbers article about government impotence and corporate supremacy like it's finely crafted pro-government propaganda.

Let's hope the public will see through their manipulative talking points.

You (and most HN commenters) didn't. Why should they? e.g.:

a) "Beyond lobbying the companies, there is little law enforcement can do without congressional action."

b) "A half-dozen police and federal officials interviewed said that Apple, in particular, was taking an aggressive posture on the issue."

When you take away the outrage-kindling, the gist of the article is that the stodgy old Washington government is incompetent and hip California tech companies are glorious. Not exactly a controversial opinion among the commentariat.

> "They" in this case is the chief of a metro police department, whose forensic and surveillance resources are more often spent on pedophiles and drug dealers than terrorism. What else would they say?

You're saying "pedophiles and drug dealers" as if it wasn't 99% drug dealers.

If anything I'm more prone to believe this is disinformation meant to allay our fears and draw us into a false sense of security when using our smartphones. xnull's comment nailed it: https://news.ycombinator.com/item?id=8390150

Is there any evidence that smartphone purchasing or use has dropped significantly as a symptom of widespread fear of government spying and overreach?

From what I can tell, the only thing most Americans are concerned about at the moment is whether the iPhone will bend if you keep it in your pocket for too long. Disinformation is a plausible strategy, but most Americans simply do not, and have never, cared (and a significant portion of those who do, think it's perfectly justifiable and would tell you Edward Snowden needs to swing from a rope, once you reminded them of who he is.) Would it even be necessary?

The average consumer isn't who they are trying to convince, it's the security conscious who take measures to protect their privacy. They are the people who need to be tricked into thinking the iphone's passkey is bulletproof.

Law Enforcement (aka FBI / DEA) battles pedophiles and drug dealers. These guys typically make the "think of the children" arguments.

Defense (Army / CIA / NSA) battles terrorists.

Keep an eye on the names of the agencies involved. This is an FBI / Law Enforcement story, so the excuses are going to be different than the NSA-case a few months ago.

Remember how iOS 6 stopped all child pornography? What a great operating system.

This seems like one of the most obvious media presses I've ever seen. I can't decide whether it's good to see the press that security is getting, and have the same terrible LE quotes show up, or bad that there is such widespread dissemination that LE is unhappy about this and hey if you're a good citizen you will buy a phone we can more easily unlock.

Here are the same or similar articles:

-WSJ 8[1] and 5[2] days ago

-Washington Post 5 Days ago[3]

-NYTimes 4 days ago[4]

-TIME 3 Days ago[5]

-Fortune 3 days ago [6]

[1] http://online.wsj.com/articles/new-level-of-smartphone-encry...

[2] http://online.wsj.com/articles/fbi-director-raises-concerns-...

[3] http://www.washingtonpost.com/politics/fbi-chief-new-phone-e...

[4] http://www.nytimes.com/2014/09/27/technology/iphone-locks-ou...

[5] http://time.com/3437222/iphone-data-encryption/

[6] http://fortune.com/2014/09/27/apple-and-the-fbi-re-enact-the...

Whether or not its a coordinated media blitz or just journalists piggybacking on each other for content I don't know. That it is coming out at the same time new iPhones could go either way.

Things that people are completely missing about this story: -Big difference between domestic & local law enforcement and NSA/DoD/CIA. Nothing prevents backdooring of a phone or someone spying as the user enters their simple password. Local law enforcement doesn't have these resources and has gotten used to access to all kinds of evidence that never existed. What Apple may or may not have done just pushes the cost up.

-I think Apple is very scared about being locked out of the Chinese market right now. The new iPhones have not been approved yet last I heard. This is a big fucking deal that would wipe out a huge chunk of Apple's market cap. They are not going to budge because some local law enforcement officers claim only child molesters use iPhones.

-Google is in a similar boat except they are already locked out of China, likely will get locked out of Russia soon. They would like to be able to still make money in Brazil and the EU.

-I think it is a good trend for the pushback from tech companies. There is no good answer for international legal compliance for user records. Records should be accessible once an account has been compromised locally, not because any judge in any country on earth can search all of your user data on any user in any other country. Between Dropbox, Dropcam & all of these other cloud services, right now a user has no idea who has access to all of their data all of the time. Time travel back two decades, no one is stealing all of your data over a dial up modem. Nor is a device recording every square foot of where you are at every moment. The tools law enforcement have access to right now are godlike

Stories need to be in the queue longer than the rate these were published by different news desks. This is obviously a PR push by skilled people placing stories. That is PR, public relations, press relations, people have a full time jobs getting stories placed.

I'd really like to see the government NOT be able to hire PR firms. This is propaganda.

Outside of having a plethora of security experts audit and certify these services I'd say this is about as close as you can get to a ringing endorsement. The only way it gets better is if other governments follow up with the same complaints.

Ultimately I'm pleased that this kind of thing even makes the news. Ideally government becomes almost totally transparent and private matters become nearly opaque (there will always be the investigative aspect of law enforcement). Any reasonably sharp person can now see that the exact opposite is happening. Governments are demanding an ever increasing amount of secrecy while simultaneously requiring that the public give up all hope of privacy. Just to have had this idea escape the realm of conspiracy theory seems like a miracle to me.

> I'd say this about as close as you can get to a ringing endorsement

Or they just want criminals to think that all they have to do is buy an Apple or Google phone, and they can't be caught.

> Or they just want criminals to think that all they have to do is buy an Apple or Google phone, and they can't be caught.

There is a greater incentive to let Apple or Google do that kind of marketing and quietly exploit the vulnerabilities (ie, what's been happening with the NSA for some time now). If it had the appearance of working but actually didn't you wouldn't hear a peep from any government.

The smartest thing for the govt is to complain but do nothing.

Unless they need to rebuild the reputations of companies that got hurt by the disclosure of their prior partnerships (ahem, which notably included Apple and Google).

After considering this and other comments saying the same I would tend to agree. There could certainly be a PR angle to the whole thing.

Bingo! This is a stunt to make people who do bad think they're going to be safe. It is all just a clever act. For those who believe this and do bad and get caught, ha!

Exactly. There's no real reason to believe they aren't forcing apple/google to say this while also forcing them to use a flawed encryption algorithm like the eliptic key method with a skeleton key vulnerability.

That might make sense if you believe their primary motive is to catch criminals.

Government has forced the issue before. I think BlackBerry, for example, had to allow Middle East governments access to their secure messages previously.

The difference now is that there can be dozens of different secure communication apps that the user can install. Potentially run on servers outside of the particular agency's jurisdiction.

This is a much more difficult situation for the agencies than when RIM/Blackberry ran all the messaging through their own service.

If the government were happy with their level of access, they wouldn't stop pushing for more because a) it reveals their hand and b) it weakens their position to acquire more power.

> Their requests to the companies may include letters, personal appeals or congressional legislation, said a federal law official who requested anonymity to discuss the sensitive issue.

I love that, in an article arguing against secure privacy, the official requested anonymity.

This happens so frequently that I've become numb to it, but now that you point it out it's still ironic.

My reply is... "What about the Fourth Amendment to the United States Constitution?"

Would we really be having these discussions if Americans (speaking as an American here) were better-educated on our own rights, our own foundation, the very fibers of our own history?

I mean, this is such a simple amendment, so crystal-clear and eloquent. After reading it (see below), how can there possibly be any doubt as to how the proverbial wool is being pulled over our eyes?

Fourth Amendment to the United States Constitution

"The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no warrants shall issue, but upon probable cause, supported by oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized."

You should better educate yourself, the article is about seizure with a warrant, with which Apple and Google will no longer be able to help them.

Don't worry, though, Microsoft and their NSAKEY will be there for them.

Why should Apple even be involved in a warrant served against my phone? When you serve a warrant against a house, do you expect that the builder of the house will be able to give you access to the interior even after they no longer own it?

You're implying that Apple doesn't own the content people store on their devices? I thought the entire point of their walled garden OS was that they did, and were quite willing to add, delete or modify it as they please.

Going to the actual owners of the content makes perfect sense.

What? Of course Apple doesn't own the content on my iPhone. Why would you think they did? I paid for the thing. It is now mine.

I'm pretty sure millions of people didn't decide for themselves to put a U2 album in their playlist. Apple made that decision for them.

It's pretty clear that unless it's entirely your decision what goes on that device, what goes off and who has access to it, you didn't pay to own it, you paid for the right to access their content on their device under their terms. It doesn't matter if you paid money for it - they own it in every way that's relevant.

I don't own the content on my iPhone because Apple put a U2 album on there for me if I checked the box that says "automatically download new purchases". That's the worst argument I've seen in quite a while.

Judging by the amount of karma i'm shedding, the consensus would seem to agree with you....

Just to clarify, I strongly dislike Apple's controlling policies on iOS. I think it's ridiculous that they won't allow sideloading apps or downgrading your OS, let alone installing custom OS builds. However, going from "they can tell your phone to download a U2 album if you ticked the box" to "thus they own your vacation photos" is still a complete non-sequitur.

Ignoring the actual legalities involved, if some three-letter agency went to Apple and said "we want all the data on the Apple devices belonging to to so-and-so," Could Apple theoretically access it, and hand it over?

If not, then I'll concede I was massively too paranoid, which wouldn't be the first time when it comes to Apple (and Google.. definitely and Google cars, and Adobe as soon as they pulled that BS with Creative Cloud) But if so then (even if I was wrong about the U2 thing) I don't believe i'm speculating too wildly.

Apple owns the content to the degree that they can limit your access to it more than you can limit theirs - "ownership" in this case is not so much a legal as a practical matter. You can't really own something you don't control. I'll extend this to any app-based OS as far as it applies.

That's the whole root of the discussion here. The answer used to be, yes, Apple could help extract user data from an iPhone and hand it over to authorities (although I think the authorities still needed to take physical possession of the device first). Now they're building it so that Apple can't access your data regardless, because it's encrypted with keys they don't have. This naturally annoys law enforcement.

Has a warrant ever been a guarantee that a search will produce results?

"You should better educate yourself, the article is about seizure with a warrant, with which Apple and Google will no longer be able to help them."

To add to the other great comments:

I understand that it is via warrant. In fact, the article states that Apple said, "It's not technically feasible for us to respond to government warrants [...]".

My concern is perhaps more nuanced. Put aside the warrant issue for a moment. That is to say, where do we draw the line and say, "This type of sweeping, 'open everything up and stop encrypting' request is a violation of, 'the right of the people to be secure in their persons, houses, papers, and effects?'"

In summary, my contention is that forcing companies to open up in this manner violates the explicit right of the people to be secure.

The cops can complain about Apple's policy but they can't do anything about it unless the law is changed.

> Put aside the warrant issue for a moment

I don't think we can put aside the warrant issue when talking about your right to be secure. Your right to be secure is only against unreasonable search.

"The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized"

You could argue that we should have the unqualified right to be secure, but the constitution disagrees. I think a better argument is that warrants are issued without probably cause or not explicitly describing what is to be searched.

I don't think anyone's unclear about the violations, but when our system of government is limited to 2 parties, and BOTH of them are bought and sold to various companies and departments with interest in violating that premise, the ideal is doomed.

Is it really two parties? Are they really that different?

What's the difference between ISIS and WMDs? Barack Obama and George W. Bush?

I see your point, but the difference between ISIS and WMDs [in Saddam Hussein's Iraq] would be. . . ISIS is unquestionably real.

Real and directly caused by the US Government's actions. Just like theocratic Iran and Al Qaeda.

Did they ever figure out what Saddam did with the large stock of WMD that we know he had prior? Trucked off to Syria before the invasion? Where did it all go?

I would say there are two parties, but it's not "Democrats/Republicans", it's "Tea Party/Everybody else".

There's a small group of people making Republican politicians do crazy things (shutting down the government, blockading Obama, various social issues [gay marriage/abortion]), but by and large the Democrats and Republicans are the same.

> [the fourth amendment]

If a warrant is issued, the government has the right to search and seize under the forth.

My argument is that they may search for and/or seize the physical medium containing the data. If I encrypted that data — on a disk, a piece of paper, a network connection —, the question, I think, is why should I, a citizen, tell you, the government, the key with which I encrypted that data?

As a citizen, I am not required to speak just because it might (or even will) help a government investigation. Likewise, I don't see why I should be required to divulge a key. Especially if there isn't yet a crime that people know to have been committed.

In other words: [No person] shall be compelled in any criminal case to be a witness against himself

I hypothesize that this is a coordinated yet simple ruse to rebuild trust in these brands post-Snowden [1][2]. There was similar press coverage regarding the DEA and iCloud encryption that was misreported in a similar way [3]. The Intercept (where Glenn Greenwald is now reporting from) has a story on what data Apple can still easily give away if you do believe they can't decrypt individual machines [4]. But maybe you don't believe it given the report from the ACLU on backdoors built into iPhones that circumvent encryption [5], and the Hope X talk on backdoors security researchers independently discovered [6].

More importantly, Apple's warranty canary was removed which either means they were served by National Security Letter or (if you're optimistic sort of person) that they are no longer committed to notifying consumers in the event that have been, which flies directly in face of all the PR talk of security commitment recently [7]. Plus remember, Apple can push whatever software they want to your personal device. That's how smartphones work.

We are led to two questions:

A) Why wouldn't the same tactics, National Security Letters and ORCHESTRA-type attacks work [8]? Don't we remember from the Snowden leaks that NSA agents infiltrate tech companies and backdoor software at the source when other avenues are closed or gridlocked?

B) Why all of the publicity about about how secure Apple's product are from snooping? Do we really think we can get away from ubiquidous global surveillance that easily?

I'm sorry. Investigative bodies don't publicly announce what technologies they can't track. There is no phone you can buy on the mass market that will keep your data safe with the exception of - perhaps? - the BlackPhone [9].

[1] http://www.businessinsider.com/apple-google-meet-with-obama-...

[2] http://www.huffingtonpost.com/2013/12/17/obama-tech-executiv...

[3] https://www.schneier.com/blog/archives/2013/04/apples_imessa...

[4] https://firstlook.org/theintercept/2014/09/22/apple-data/

[5] https://www.aclu.org/blog/technology-and-liberty-criminal-la...

[6] https://pentest.com/ios_backdoors_attack_points_surveillance...

[7] https://gigaom.com/2014/09/18/apples-warrant-canary-disappea...

[8] http://mirror.as35701.net/video.fosdem.org//2014/Janson/Sund...

[9] https://www.blackphone.ch/

Additional reading:

(1) https://www.schneier.com/blog/archives/2013/06/the_problems_...

(2) https://www.schneier.com/blog/archives/2013/10/defending_aga...

(3) https://www.schneier.com/blog/archives/2012/08/is_iphone_sec...

I believe that the decision to start encrypting data will just make it harder for local law enforcement to attain your data. When they subpoena Apple for your data they will get the encrypted data. The NSA will probably also receive your data encrypted however they probably won't have any problem unencrypting it.

When they subpoena Apple, they will get cloud data which will not be decrypted. The issue is whether they would be able to give Apple a device and say 'decrypt plz'.

If the device is backed up in iCloud, Apple already has the decryption key and will have to provide it if they receive a supoena. The only way you're safe, even in theory, is to only do local encrypted backups.

The whole point of the updated system is that they don't have your decryption key. They will still turn over encrypted data, but LE won't be able to decrypt. That might be a leap of faith though.

So you are saying that if you lose your device there is no way to recover your data?

No, he's saying the decryption key will be a simple passcode for an encrypted private key stored on apple's servers, or something even worse than that. Promising, ain't it? ...with the examples we have of the type of passwords people use...

Is the decryption key something the user chooses like a password, or is it random noise generated on the device that the user does not need to know?

Not sure. I suspect it is chosen by the user, going by what I've read.

> The whole point of the updated system is that they don't have your decryption key.

It's a nice thought.[1]

> While Apple does not have the crypto keys that can unlock the data on iOS 8 devices, they do have access to your iCloud backup data. Apple encrypts your iCloud data in storage, but they encrypt it with their own key, not with your passcode key, which means that they are able to decrypt it to comply with government requests.

[1] https://firstlook.org/theintercept/2014/09/22/apple-data/

Apple has staked their reputation on the line and said "send us an NSL if you like, we have nothing we can give you". And the cryptographic principles, if executed properly, are sound.

Maybe they're lying. Maybe Snowden 2.0 will come out next year and tell us the truth and instantly destroy their credibility. That's a gamble I wouldn't take with my company, but it's plausible.

See I figure, if you're a threat to National Security, the NSA still has options. They just don't include monitoring over the wire or asking Apple or Google for it.

edit: The Intercept article [4] you mention above suggests to me more that they aren't yet finished implementing it properly and less that they are lying. I would take it as a work in progress.

Yeah, that's how I see it.

Since Apple's software isn't open source, it's possible they're lying. However, if they are, at some point the government is going to try to present evidence they gleaned through this lie, and that fact will leak out.

I think it would be an enormous risk for Apple to blatantly lie about something they put in black and white on their website. So I tend to think they're telling the truth.

Maybe one day, we'll get a real, bonafide, non-niche open source based phone where these things can be audited.

> However, if they are, at some point the government is going to try to present evidence they gleaned through this lie, and that fact will leak out.

No, they are not. That is the whole point of parallel construction.

But this isn't just about the FBI. It's about all of law enforcement. Sure, the FBI may be practiced enough to hide the facts of discovery, but will every law enforcement agency in the US be as adept. If Apple is lying, or law enforcement finds a way to circumvent the encryption, it will most likely leak at some point, an leaks are becoming more and more common, especially with highly visible targets like Apple and Google (both blackhats and white hats are itching to show up the tech giants).

They don't have to present evidence when they can just make their target disappear off to Guantanamo or some eastern European torture camp.

Why do you assume the fact will leak out? I thought the FBI disclosed they used parallel construction as an MO.

DEA. Not FBI. Keep your agencies in check.

Granted, both are under the Attorney General (formerly Eric Holder)... but Holder's recent MO has been to improve race relations between the Police Agencies and the general public. (See his exceptional handling of Ferguson... but his less-than-exceptional handling of "Fast and Furious")

If Ferguson was exceptionally handled, merely competently handled situations presumably somewhat resemble the plot of Jurassic Park.

I appreciate the criticism actually. But lets look at this rationally.

When the FBI sent in 40 agents to a town with only 52 cops, to investigate a single murder... Eric Holder was sending a very strong message to the Ferguson community.

Remember, Ferguson Police and the St. Louis Police were the bad guys in Ferguson. The FBI came in with their Black leader (at the time: Eric Holder) and reassured the community that the African American President (and African American-led FBI) got their back.

Eric Holder then announced that the 40 Agents were going to hold an independent investigation and conduct a 3rd independent autopsy.

With the FBI's arrival, the riots immediately stopped and trust was restored.

Now true, the Ferguson Police and St. Louis Police were _absolutely_ terrible. But the Federal response (specifically FBI's under direct order of Eric Holder) was extremely effective and exemplary IMO.

Remember, we have a federal system in the US. Cities are independent of the county, counties are independent of the state, and states are independent of the nation. Eric Holder holds no responsibility for the poor behavior of Ferguson City cops or St. Louis County Cops. But... he was able to use the FBI's influence to pressure the local cops to do the right thing.

Remember too: Eric Holder does not have the authority to prosecute Darren Wilson on murder or assault. The best the FBI can do is prosecute him (and the police department) on racism charges. Murder / Assault is a charge that can only be delivered from the local government in this case. For the most part, the Feds don't have much legal authority over the situation.

It's extremely difficult to implement cryptography correctly, and then cryptography != security != privacy.

You should also look through the other linked articles. Some of them include features built into iOS devices that already circumvent encryption.

I intend to. But my initial position is that it's far more likely that Apple will fail to be perfect than that they are intentionally orchestrating a coverup.

That said, I think all this syncing and cloud stuff - in its early days, at least - is way overcomplicated and more error-prone both in its features and its security than it needs to be. I expect mistakes from all implementations for quite some time to come.

> It's extremely difficult to implement cryptography correctly

The smartest CS undergrad at any vaguely reputable school could probably do this correctly. It shouldn't be a problem at all for one of the biggest companies in America if they actually care.

> then cryptography != security != privacy

Which is a more interesting point and assuming the left side was taken care of we could rapidly approach the right side by doing things like providing more granular permissions to applications.

> The smartest CS undergrad at any vaguely reputable school could probably do this correctly. It shouldn't be a problem at all for one of the biggest companies in America if they actually care.

You are very wrong about this.

> assuming the left side was taken care of we could rapidly approach the right side by doing things like providing more granular permissions to applications

It's actually an unsolved problem. Granular permissions have been tried before.

It's not really a gamble when you're forced to do something. You simply have no choice but to do what the government tells you to or lose your business.

Then they better have perfect security so there are no leaks proving that, or they're gonna lose their business anyway. I don't buy it, they'd fight that and they'd leak that they're fighting it.

They have leaked it with Apple's warranty canary which was removed.

That definitely could imply they have received an NSL. But as a user, when I say "they would leak that they're fighting it", I would consider that completely insufficient. If they are pulling the kind of crap you say they are, then it will come out. Guaranteed. And then nobody, including me, will ever trust them again.

editing my comment since I can't reply to hellbanner: Percentage doesn't matter, it only takes one. One person to destroy a hundred billion dollar company overnight. I am not saying "Tim Cook can not possibly be lying." I am saying "If Tim Cook lied, he just made a hundred billion dollar bet that he can keep a secret." Personally, I doubt he's that dumb.

(Clarifying I'm understanding your position): You're assuming that there are enough % of Apple employees who would refuse secrecy bribes || fear individual NSLs to leak something in public in a situation where they don't fear for their safety?

Sadly I bet most people would just shrug and say "well they are doing it for our own good".

I'd love to believe that, but then: http://www.reuters.com/article/2013/12/20/us-usa-security-rs... Plenty of people were furious with RSA over that, yet they still seem to be in business.

Then again, RSA isn't in the business of making consumer hardware. I'm not sure what difference to expect that to make.

What makes you think it's such a big gamble? People just don't care about privacy as much as the news would have you believe.

Don't believe me? Quick, think of one of the largest and most consistently flagrant private entities who violates the privacy of its users on a regular basis, and is well known for it.

Did you say Google? Facebook? Now quickly think of two of the largest companies on the Internet, both in revenue, and traffic volume.

Apple isn't taking nearly the risk you're suggesting, because people just don't care.

Until Apple promised it so explicitly, I'd have said you might be right. True, Google and Facebook make zillions off of monitoring people for advertisers. That will make it harder for them to follow suit, there will be far more weasel words and such when they try.

I think those of us that are willing to pay the premium for something that promises more have higher expectations. If they are lying, I believe we'll know within the next year or two and we'll get to find out if you're right.

Out of interest do you have an example of Google's weasel wording this issue? They're getting criticised by all the same people and seem to be doing the same thing - is there actually an advantage either way here?

Just to clarify, I'm skeptical on both sides - both companies were in the prism leaks after all. But I haven't seen weasel wording and I'm curious if I missed it.

Actually, no, that was just a prediction. I am making an assumption - and maybe not a fair one - that because Google mines user data on the web that they also mine user data on the phone.

Skepticism seems warranted. With Apple, I try to be skeptical, but with Google, I always assume that I am the product until they demonstrate otherwise.

I don't believe in that claim.

I do believe in that claim.

You could say that people don't take design seriously, and use google and Facebook as examples.

But Apple does. And though most people won't consciously notice that their products are well designed, it is a big part of what makes Apple "magical".

People do care. We care and while we may be a tiny minority right now, there are a lot more of us than there were 10 and 20 years ago.

" Quick, think of one of the largest and most consistently flagrant private entities who violates the privacy of its users on a regular basis, and is well known for it."

And then you go on to claim Facebook and Google as examples of your "violation of privacy". That's like saying my email provider violates my privacy because my email goes through their servers. Or the post-office violates my privacy because my snail mail goes through them. Quite a bit of a stretch, if you ask me.

What people do care about is targeted invasion of privacy, for lack of a better phrase. It's one thing having anonymized data "abused" for targeted advertising and selling as aggregated statistics. But it's completely different if you have an entity that can read your emails at will, and decide to throw you in a cage if you say the wrong thing to the wrong person.

Considering one of Apple's core axioms is "no comment", entirely sensible & expected that they close that venue for anyone, however influential, to compel Apple to say anything they don't specifically intend to.

If some Gov Agency wants clone your phone's data, isn't the process as simple as get an NSL to own your email/phone number for a few hours, go thru the password reset sequence and own your iCould account and "backup" the data to a new phone they have access to?

An easier methods maybe to get someone from Apple Store to do password reset on a phone #. Any local police can probably do this - kind of scary now I think of it.

How can Apple or anyone prevent this?

i think it's great to see ppl being skeptical of security claims from phone manufacturers. trying to secure a normal cellphone is pretty much impossible and if you're storing sensitive information on one, you are just waiting to get fucked.

i think all this "sound and fury" is likely a ruse to entice ios and android users into a false sense of safety post snowden disclosure. being able to encrypt your drive doesn't matter if your OS and its applications are exploitable. last time i checked, there is almost zero open source firmware out there, so your application processor can encrypt stuff hitting disk and the baseband processor can be used to get dma.

time to roll out the hypothetical child molester straw man...

> being able to encrypt your drive doesn't matter if your OS and its applications are exploitable

Because, you know, security measures that aren't 100% perfect are on equal footing as no security at all. Seriously? That's a huge fallacy.

In the end, it's all about the cost. When speaking of the NSA, we are primarily concerned with mass surveillance, because lets be honest, if you're targeted directly then you don't stand a chance, since they can always infiltrate your home then watch your fingers typing your password. And if these companies are raising the cost of doing mass surveillance, with encryption doing just that, then that's a good thing. It is in their interest to do so because the bad press they are getting is hurting their bottom line - you may not see it, but post Snowden at least governments and big corporations are starting to think of software/hardware stacks provided by non-US companies and now they have the ultimate argument for the balkanization of the Internet, which can't be a good thing.

But lets also think about things closer to home. I'm not from the US, I couldn't care less about the NSA. But I do care about my personal data ending up in the wrong hands - personal emails and photos, details on my accounts, projects, written down feelings and so on.

There are always organized crime syndicates looking for generating a quick buck. There are always incompetent clerks in your government institutions that out of an oversized sense of responsibility are doing stupid things. For example my personal identification details ended up in a local newspaper by mistake, because of a non-public contract leaked out of a public institution. Now how can I trust these people to handle my data? How could I let any cop inspect my laptop or phone on the spot as part of routine checks, which from what I hear, are becoming more common?

Yeah, encryption is not a good solution in the face of insecure apps, binary blobs and a potent global adversary. Thing is, for most people that global adversary is not the immediate threat they are facing and even for that global adversary, encryption makes surveillance more expensive.

GP is actually making a factual statement not just waving his hands around. Data at rest encryption doesn't matter if one can gain execution control with supervisor level privileges (or control another processor or part of the process which does.) This is why security is hard. These aren't NSA level attacks, they're what are used for the jailbreaks that come out for every version. It's a good idea to ask questions before getting fired up if it isn't your area of expertise.

Well, I disagree with his factual statement and I tried stating the reasons why.

I have my Android encrypted and I do feel safer, because I've got my 2-factor auth generator on it and now at the very least I feel safe about losing it. So why are we talking about a false sense of security, when an encrypted phone is factually more secure than one that isn't?

It's already there, in the third paragraph of the article:

“This is a very bad idea,” said Cathy Lanier, chief of the Washington Metropolitan Police Department, in an interview. Smartphone communication is “going to be the preferred method of the pedophile and the criminal. We are going to lose a lot of investigative opportunities.”

But the article isn't just talking about the NSA and National Security Letters - this is about law enforcement. If Apple and Google claim to be technically unable to comply with LE requests, it won't take long to see whether that is indeed the case or not - unlike national security-related demands, law enforcement won't be able to keep their successes or failures at demanding access to this data a secret.

If this was tech companies claiming to no longer comply with NSL's, I'd be at very least suspicious as there'd be no way to test these doubts short of another Snowden. But this is law enforcement, subject to all kinds of scrutiny in courts across the US. It'll be much easier to see whether Apple and Google are successful at resisting their demands.

A very good point. Local police will likely be able to access the device but only after calling up the chain. Previous versions of iOS and other smartphones had forensics kits that made it trivial for local law enforcement to grab data out of memory (via DMA/firewire for example) or by device management services. I expect those kits to continue working for devices that have not been powered off.

hhhhh, keys in RAM. Life is so difficult.

I don't see why it's such a big deal for law enforcement investigators. They'll still be able to force Apple and Google to send trojan clients to targets, as happened with Hushmail, won't they?

Yes, but it still makes their jobs a lot more difficult.

I'm of the opinion that this is not a ruse or scheme, and that law enforcement are genuinely dissatisfied with this. Note that law enforcement and the NSA have a tenuous relationship at best.

Even if the NSA still do have privileged access after default mobile encryption is fully rolled out, law enforcement generally will not be able to tap into that except in extreme and rare cases.

>law enforcement generally will not be able to tap into that except in extreme and rare cases

Like when they pull someone over for having a tail light out? I can't reconcile your statement here with what we already know about parallel construction.

Okay... so I guess someone here knows more about parallel construction than I do, however while they were kind enough to let us know this by downvoting my apparently wrong post, they were not kind enough to share their thoughts.

Are law enforcement agencies not getting data from the NSA to use in arresting and prosecuting defendants via parallel construction?

According to Binney they almost certifiably are. I think they downvoted because Binney cites the DEA, CIA and FBI - which are law enforcement - however in this thread posters have taken law enforcement to mean your friendly neighborhood municipal police officer.

Law enforcement is far over reaching in my opinion. This data is still hackable because all data is hackable. the fact it is inconvenient is a good thing. This is like saying you should only be allowed to have car or house locks that law enforcement has keys to. They can still acquire the data but they will need to spend significant resources to do it. Invading your citizens privacy should be difficult!

I agree.

> This is like saying you should only be allowed to have car or house locks that law enforcement has keys to.

Well... there's no real need to say that, because it's already the case. If they want to open your locks, they will.

You're not obligated to make the lock unlockable for them, though.

The government can probably break many consumer-grade encryption schemes if they so choose to as well, but much like having to break in to your house through your locks instead of merely unlocking them, it raises the cost of law-enforcement doing so, and incentivizes them to make more restrained choices (eg, not taking literally everything they can get their hands on).

They can ask. A court order to reveal your password is enough. If you don't comply you usually run into troubles. This Wikipedia page http://en.wikipedia.org/wiki/Key_disclosure_law explains how it works in some countries.

There has been a ruling about that in the USA recently http://blogs.wsj.com/law/2014/06/26/mass-supreme-court-defen...

So how does that work if you are using an encryption method that allows plausible-deniability?

"Legally, you must give us the key which probably does not exist"

Or putting it another way, law enforcement will still be able to break into individual phones, but indiscriminate collection of data on a large scale will become that much more difficult. Which is a good thing.

The tech crowd always seem to come to the conclusion that because the powers are over-reaching and bad that they must be unecessary in a partical sense. It is perfectly possible that the surveillance powers really are needed to fight crime. Maybe organised crime and terrorism would increase if all the vulnerabilities that the government use are patched. Technology will undoubtly have a profound impact on crime, and the consequences could be a technical arms race between the public, governments, and criminals. A frightening prospect!

“What concerns me about this is companies marketing something expressly to allow people to place themselves beyond the law,” Comey said.

Sure, they're dissatisfied. But the roots of their dissatisfaction seem to be that they've tasted the forbidden fruit, and now believe that they have a fundamental right to watch our communications. Their fundamental attitude is that they should have visibility, and that anyone who wants privacy must be trying to hide something. It's just the old saw "you don't need secrecy if you've nothing to hide", restated from the law enforcement perspective.

I have to wonder if this is in part driven by a disdain for civic observance. Seems like every week I hear about instances of people getting their phones taken away at least temporarily for video taping police actions only to receive their phones back with the video deleted.

> But the article isn't just talking about the NSA and National Security Letters - this is about law enforcement.

No it's not. It's just that "law enforcement" sounds more comforting than "tyranny".

Here's how to interpret "law":

    Law = A written order issued by your rulers. 
    Lawful = Good = Anything your rulers want you to do.
    Unlawful = Bad = Anything your rulers don't want you to do.
    Law enforcement, verb = Forcing you to do what they want you to.
    Law enforcement, noun = People whom laws don't apply to.

"Law = A written order issued by your rulers. "

Don't be so obtuse. A law is a written order, adding the remainder is just an inflammatory accusation that undermines the public at large.

You may believe that the public or those governed by which ever particular law you select are too scared or ignorant and have the law imposed on them from outside interests but the greater numbers always win in the end. A particular rule of law may be arduous today and for many more consecutive days but one day the rule will change.

This is evident throughout history and will continue to be.

> A law is a written order, adding the remainder is just an inflammatory accusation that undermines the public at large.

Undermines the public how?

> A particular rule of law may be arduous today

"Rule of law" is a misnomer. It's actually rule by those who decide what the laws are. That would be the "elected representatives", ie. politicians of course.

In other words, politicians are our rulers because they make the rules that are ultimately enforced at gunpoint, if you don't feel like obeying at first.

But a law is just text somewhere. But even if the text contains a decree on what everyone must or must not do, that alone does not change people's behaviour one bit.

For example, if I write down on a piece of paper that you have to give 30% of your income to me, will you do it? OK, what if I threaten you with imprisonment if you don't?

> OK, what if I threaten you with imprisonment if you don't?

You and what army?

(Not trying to be snarky. That quote seems very apt.)

You seem to be overlooking the point. Would it be morally permissible for me to scribble down arbitrary rules and enforce them on you if I had an army with which to ensure your compliance?

Laws are just arbitrary rules decided on by a small group of people, much like they were with Kings and their inner circles. Laws are enforced in much the same way too - there's no practical difference between getting assaulted by the King's Guard and getting assaulted by men in blue costumes.

> unlike national security-related demands, law enforcement won't be able to keep their successes or failures at demanding access to this data a secret.

They can and they do.

http://en.wikipedia.org/wiki/Parallel_construction

The thing is, parallel construction won't work out unless there's another legitimate path which exists anyways.

Scream it all you want, but if there's no other way to the conclusion, there's still no way to use the evidence short of outright lying and falsifying evidence.

I don't think parallel construction is nearly as big of a threat as people seem to make it out to be. It gives law enforcement nothing more than a hint and some unusable evidence. There still needs to be a path that works legally.

And that's not even getting into the fact that iOS is heavily reverse engineered, often searching for backdoors and cryptographic vulnerabilities and Android is open source and publicly reviewable. I've reviewed some of the key derivation code myself as I was curious if it was being done properly.

I'm all for paranoia, it just need to be useful paranoia under a given threat model. Beyond that, it's nothing more than speculation and a waste of time.

It's not about the rules of evidence. It's about the rule of law. Parallel construction is an unconstitutional and dangerous abuse of law-enforcement power that cannot be tolerated.

You can be technically unable to decrypt the messages, but the metadata is still available.

Once they have your metadata matching, they can subject you to increased scrutiny.

How and does this protect against attacks via the baseband radio processor. That thing is a black box with proprietary firmware that has pretty much unrestricted access to memory (the way I understand it, someone please correct me).

So now it is a bit farcical to say "these are all secure" now. But if you happen to know how the baseband processor works (say you are friends with Qualcomm), you can try to get the encryption password right from the memory.

If a (co)processor, firmware, battery, daughterboard, memory, (really anything on the north/south bridge), UEFI certs or code, harddrive, OS, microcodes, transistor doping amounts, protocols, touchscreen, drivers, services or crypto standards have either flaws or backdoors the encryption could be circumvented. Apologies for the incomplete list.

indie phone might be another, in development: https://ind.ie/phone/ I suspect there will be some competition that Apple/Google/Samsung will be up against for privacy at lease changing some market leaders towards privacy a bit. But in the end there is no privacy on a network with enough time so all of this is surface PR.

What will really blow your mind is that Snowden is a PsyOp.

If Snowden is saying things governments don't want you to hear, it's highly strange that the government-controlled mainstream media keeps yapping on and on about Snowden and publishing "his" material.

Cue shadowban in 3.. 2.. 1..

"Law enforcement officials emphasized that they get court orders, and that they aren’t seeking to randomly root through phones."

Right. Rooting through phones without a court order is the NSA's job. That makes me feel better.

The Chicago Chief of Police genuinely said this:

>"Apple will become the phone of choice for the pedophile. The average pedophile at this point is probably thinking, I’ve got to get an Apple phone."

Well, if I was trying to break the law then, yeah, I would absolutely go an get an Apple phone if I didn't already have one.

I'd also buy a Toyota or a Honda car, since it's less likely to break down while fleeing the police. Clearly, reliable automobiles are part of a pro-crime agenda.

fantastic.

i hear they are going to ban air soon because pedophiles can use it prey on children.

So is that why the federal government poured our money into GM and Chrysler?

Oftentimes those with an anti-firearms agenda point out that Glocks are preferred among mass murderers. Glock is to guns as Toyota is to cars; reasonably priced and notoriously reliable.

There's so much stupidity in the gun debate on all sides. It's rare to see a cogent argument anywhere.

The basic idea applies to any dual-use technology, of course: criminals will prefer the better items for the same reason law-abiding citizens prefer the better items. Thus, "criminals prefer X" is not, by itself, any reasonable argument against X in a dual-use technology.

I think your analogy is unfair. A standard car does make it harder but isn't being specifically modifed to make the action of police/TLA more difficult. A more appropriate analogy would probably be an armoured car or military humvee, possibly a tank. Should the public be allowed to buy a tank? It has got other uses than evading police but it makes the police's job much harder as they need to up their technology (bazookas and their own tanks) in order to handle criminal use of the tech in question.

Just to be clear I'm not commenting at all here on the question of limiting availability of crypto-lockers to the public.

I think it's fair. These measures protect against all unwanted intrusion, whether criminal or government.

These PC/Mac attack ads have gone too far!

Classic Fear mongering at its finest.

Blatantly violate the public trust repeatedly by Blanket illegal surveillance, discredit anyone who reveals it, call them a traitor.

Then when people & companies get pissed at this over-reach and the gloating (smiley faces on NSA slides) and start putting up technological fixes to ward-off against this bullshit begin fear mongering.

I think all manner of Masks, Steel doors, etc should be immediately outlawed -after-all some one can kidnap children wearing a mask and WE CANNOT CATCH THEM! Steel doors slow down access by law enforcement THINK OF THE CHILDREN!

BS at its finest.

What a terrible article. Excerpt:

They have created a system that is a free-for-all for criminals

So we should give up all rights to privacy to help catch criminals?

What concerns me about this is companies marketing something expressly to allow people to place themselves beyond the law

Maybe that says more about your laws than the desire for privacy?

My sympathies for the FBI's concern about people being "beyond the law" is lessened a great deal given the past decade of revelations of illegal actions at FBI forensic centers, and the complete lack of prosecutions, not to mention the NSA spying, etc. Even the TSA is in violation of the law (fourth amendment protects against search without warrant, USC 18-242 makes violating that a federal crime, and a felony if done while armed.)

I'd like to see the government stop being "beyond the law".

Okay the TSA argument is brought up all the time, and the overall consensus as that you are voluntarily giving up your fourth amendment rights by consenting to the search.

Which is nonsense. I don't voluntarily and implicitly give up constitutional rights just because I chose a particular mode of transportation. Even if there was some sort of magic implication, surely I could cancel this out by loudly declaring "I decline to forfeit my Fourth Amendment rights and I do not consent to a search".

But failure to comply = restrictions of freedom of travel. https://en.wikipedia.org/wiki/Freedom_of_movement_under_Unit...

It is not voluntary for airports to use TSA. Therefore you have no alternative options when it comes to air travel. Saying traveling by ground is an adequate alternative is nonsense.

Including quotes detailing a position you disagree with doesn't make an article terrible.

And they're not even the words of the author, they're a law professor and FBI Director. Necessary opinions from experts and subjects of the story. It would be a terrible article if they were absent.

> What a terrible article

Those are quotes from interview subjects, not editorialization. If the subject's opinion is horrible, you want that to show through in the article.

The interesting thing is that they're quotes from an NYU law professor who was the "top lawyer" for the FBI from 2011 to 2013. I do wish the reporter had asked him what responsibility he felt for so abusing the public trust that corporate America (of all possible parties!) felt they needed to respond in a way that could seriously raise the hackles of the federal government.

When people abuse the trust put in them, they deserve to lose that trust.

What's next?! Requiring warrants to search criminals' homes? Giving criminals jury trials? Banning cruel and unusual punishment of criminals?

Criminals shouldn't be able to use our freedoms against us. Accused criminals use our system of justice and freedom as shield that only weakens America further.

If the government had proven itself trustworthy enough to follow it's own processes for accessing information only after obtaining a warrant, I could agree with the argument. However, things escalate when one side can't trust the other. Encryption is needed.

This is my view. Law enforcement from the Feds on down have lost the trust of the American people.

They have lied to us, misrepresented what they are doing and now use the scoundrel's argument "what about the children?". The growing threat of a mass surveillance govt is real and in the long run a bigger threat to freedom than the so-called terrorist. I find the idea of a mass surveillance govt more terrifying than a few religious nuts with bombs or even hijacked planes.

This is a bit like protesting door locks because they make it harder to pop in and look around.

I don't support what the government is trying to do here, but minimizing this issue like this is not doing us any favors.

The issue isn't that law enforcement can no longer "look around" your phone. The issue is that they can no longer get a warrant and use what is on your phone as evidence in an investigation or court case without the phone owner's cooperation. Basically your phone goes from being personal property that can be used against you as evidence to an extension of your mind that is now subject to 5th amendment protection. That is a big shift.

In terms of your originally analogy, encryption isn't a simple door lock, it is a magical warrant proof lock. I certainly understand why law enforcement wouldn't be happy about this.

A big, crucial shift.

There have always been tools and procedures for destroying documents to prevent unwanted access.

What's very very bad about this, in addition to the direct effects on people's privacy, is that it creates a class system of people who are allowed access to strong encryption while the cattle being farmed on this plantation are not.

What do you mean?

This restricts access to strong encryption by a broad range of ordinary people. It's discriminatory. It creates a class system. Shepherds and mutton-eaters vs. the sheep. "Privacy for the rich/powerful/savvy, but not for you."

Yes, I understood that. What I didn't understand is what you meant by "this". Do you mean, the move by Apple and Google? Or the FBI? And in any case, how so?

Yes, but everything on your phone came from someplace where a warrant will produce evidence.

> Basically your phone goes from being personal property that can be used against you as evidence to an extension of your mind that is now subject to 5th amendment protection.

Actually, it does not go that far. The 5th Amendment protects people from being forced to inciminate themselves. Otherwise, a person could be charged with contempt of court, obstruction of justice, or similar crimes. Someone who refuses to decrypt their data when subject to a warrant will face that penalty, just like someone who refuses to answer a subpeona or destroys documents relevant to a counrt case.

We should ban the ownership of non-trivial safes for the same reason then. We should also prevent people from writing things in non-approved languages, in case in makes the understanding of things more difficult when a warrant is served.

Hell, if I just hide my information in a stack of a million other paper files, that would be enough to thwart all but the most determined investigator from accessing it without my cooperation.

A long time ago I worked in a guarded military vault with lots of safes - I've never seen one that would take more than an hour or two to break into. The idea is to slow an attacker down long enough that they can be detected and security can get on the scene to deal with them.

None of your examples would prevent an investigator from finding evidence, only delay them. Strong encryption enabled by default could slow down an investigation to the point where it would go on past the heat death of the universe.

Whether or not giving up a password or unlock code is protected by the 5th amendment is itself a gray area that the courts are still sorting out.

I would prefer to have the password NOT be protected by the 5th amendment and have strong encryption on phones than not have strong encryption on phones. That seems like the only way to prevent casual warrantless rummaging.

They can get a warrant, and they can use anything they find as evidence.

Encryption might make it hard for them to find much of use, but that's not our problem. A really sturdy safe will make it difficult to execute a warrant too, but that's not an argument for deliberately compromising the integrity of safes.

I can, of course, understand why law enforcement wouldn't be happy about this. They shouldn't be happy about this. But the rest of us should be perfectly happy to tell them to pound sand.

As I've pointed out in another comment on the thread, I've never come across a safe that couldn't be drilled in a few hours, and that's without any government intervention to compromise their integrity. Strong encryption is an entirely different beast.

How about encasing something in 20ft of reinforced concrete and then sinking it to the bottom of the ocean?

Strong encryption may be tougher to break but I disagree that it's entirely different. It's merely a quantitative difference. It's a standard principle that the police can break into whatever they can if they have a warrant, but they can't force you to make things easy for them ahead of time.

You can keep coming up with analogies that are increasingly more difficult for the cops to get into, but ultimately it's just an exercise in sophistry. Only when people begin commonly storing their belongings inside 20ft of reinforced concrete at the bottom of the ocean will it become analogous to seeking a warrant to gain access to their phone.

Even so, there's nothing that says we have to make it easy, or even possible, for police to execute a warrant against us.

Law enforcement (and the powers it necessarily must be granted) is intended to be harder. That's the whole point of the various requirements and procedures that make up "due process". Yes, we could catch more criminals a lot faster if we relaxed those requirements, but history shows that always increases the error rate.

If the situation has changed and there are legitimate law enforcement needs that simply didn't exist in the past, then they should request a change to the social contract through legitimate channels and propose the necessary amendment to the constitution. Law enforcement's failure to even try going through proper channels speaks loudly to how little they actually respect the law.

> Law enforcement's failure to even try going through proper channels speaks loudly to how little they actually respect the law.

Why do you say they aren't going through the proper channels? Law enforcement officials have just as much right to make their viewpoints heard through the press as you and I have. If they feel the need to seek new legislation, they would need to make the argument in advance in order to gain support any bills being proposed. Unless the Supreme Court thinks otherwise, I doubt a constitutional amendment would be necessary, but that depends largely on what was being proposed. I haven't seen any evidence that any law enforcement official is disrespecting any law with regards to this issue.

Parallel construction is one huge disrespect for the law; it hides the real accusation and necessarily requires hiding evidence from the defendant. It is a blatant attempt to bypass the "fruit of the poisonous tree" doctrine and the 4th amendment. There are probably other legal problems too, depending on the specifics of the case.

I'm not really suggesting that an amendment is (or should be) necessary, because the surveillance that is going on (and being passed down[1] from the NSA to the FBI, DEA, and local departments). These activities should not be necessary at all for law enforcement, as the warrant system is easily sufficient to allow any necessary searches. Even if a specific device such as cell phone is inaccessible (despite having a valid warrant), that doesn't stop any policeman from conducting traditional (in person) surveillance or upstream wiretaps.

Yet police insist they need far broader access and we have numerous examples of the 4th Amendment warrant requirements being ignored[2]. IFF their claims have merit, the proper way to get exceptions to needing warrants would be an amendment, which has not been suggested. There could be some edge cases where "merely" a circuit court or SCOTUS ruling could "find" additional powers for police, but it doesn't matter - I don't see the the various TLAs trying to setup a test case on this matter, either. Instead we see many cases where law enforcement (and/or people in Obama's administration) have tried to prevent lawsuits from going forward.

[1] [pdf] https://s3.amazonaws.com/s3.documentcloud.org/documents/1011... Some of the training slides and request forms. Especially interesting is how often they repeat the need to keep the practice secret, including having a 24-hour hotline local police can use to get advice on how to hide the source even if they have to immediately give testimony in court. I believe (and a friend of mine who is a lawyer agrees) that these repeated statements like "To use it, we must protect it, or lose it." easily counts as mens rea.

[2] Riley v. California being a notable exception, though I know at least two friends that had their phones searched (in their presence) just a couple weeks ago in Oakland, CA; some departments haven't gotten the message yet, unfortunately.

Two points with regards to that: 1) Parallel construction has nothing to do with the iPhone encryption issue. 2) People tend to overlook a few key points from the original Reuters article[1] that introduced the concept of parallel construction:

(emphasis mine)

"...Today, the SOD offers at least three services to federal, state and local law enforcement agents: coordinating international investigations such as the Bout case; distributing tips from overseas NSA intercepts, informants, foreign law enforcement partners and domestic wiretaps; and circulating tips from a massive database known as DICE. ...

...Wiretap tips forwarded by the SOD usually come from foreign governments, U.S. intelligence agencies or court-authorized domestic phone recordings. Because warrantless eavesdropping on Americans is illegal, tips from intelligence agencies are generally not forwarded to the SOD until a caller's citizenship can be verified, according to one senior law enforcement official and one former U.S. military intelligence analyst."

[1] http://www.reuters.com/article/2013/08/05/us-dea-sod-idUSBRE....

Nonsense - parallel construction (and any other widespread use of the capabilities the NSA/etc is providing to other "their customers" (DEA/FBI/various-local-PD)) is likely the primary reason for this attack on Apple and encryption on the iPhone. The data covered by that kind of encryption would likely be of very limited use for national security; the NSA gets most of the data at the backbone switches anyway, and encryption doesn't do anything to prevent relationship mapping from logs of routing metadata. Also, any kind of targeted investigation could simply bypass encryption by installing custom firmware. Several of the tools in the TAO catalog were based on that style of attack.

What would be lost with local iPhone encryption keys is the ability to gather large amounts of data by strong-arming Apple (Prism, possibly). Note that most of the people freaking out over Apple's changes are not NSA. It is law enforcement who is fearing losing their access; the same law enforcement that would be using parallel construction to actually use the data that logically they didn't have a warrant to search and seize. (if they did have a warrant, they can bypass the encryption with various other ways, which apparently includes compelling passwords)

As for the Reuters article, I linked to a specific document that was a follow-up to that Reuters article, which had very little to do with foreign governments, and a lot to do with protecting access to the surveillance infrastructure. If you want the TL;DR version (understandable; it's 300 pages of slides and forms), [1] is a decent overview though it lacks some of the relevant details.

[1] https://www.techdirt.com/articles/20140203/11143926078/paral...

This issue has absolutely nothing to do with the NSA. As you point out yourself, this applies only to data stored locally on the phone. When was the last time the NSA had physical access to your phone?

Your argument seems to be that law enforcement wants to keep the phones unencrypted so that they can seize them with a warrant, hand them over to the NSA, and then the NSA can hand the data back to the police using "parallel construction" in order for the police to hide where the data came from (i.e.: acquired lawfully by the police with a warrant)

"Basically your phone goes from being personal property that can be used against you as evidence to an extension of your mind"

Yes, and...? That sounds about right. An implanted device wired directly to your brain seems like the ultimate conclusion to this age of "wearables" we're just now entering.

They can just break down a door, though. They can't break proper encryption with a good passphrase.

Not that many people will choose a good passphrase...

The sections of government that care about searching people's property already have a plethora of ways to get around the supposed protections.

> Smartphone communication is “going to be the preferred method of the pedophile and the criminal. We are going to lose a lot of investigative opportunities.”

Wow, the think of the children lines are so overused, I wonder why they aren't obnoxious for regular folks. And I'm a father of a 4-year old and I can really understand the natural urge to protect children from pedophiles, but this is becoming ridiculous, plus as a father I also don't want my child to grow up in a world in which he has no privacy rights. If a device for reading one's mind would be invented, it would instantly be used by government agencies, because investigative opportunities and if law enforcement could do that, than so could criminals and oligarchs - yet our laptops and phones are an extension of our mind and we really aren't far from such a dystopian future.

These people act as if this technology existed since the dawn of men. What on earth did people do before being able to snoop on our digital footprint? And is there any evidence that these investigative opportunities are lowering criminality or are we talking hypothetically?

So..

its revealed that the NSA is abusing our privacy, and people react accordingly, and now legitimate law enforcement efforts are being thwarted.

Don't blame the tech sector, let them blame the NSA's over-reaching charter

Exactly. The world has had some time to react to last year's revelations, and this is just getting started!

Nobody's law enforcement efforts are being thwarted. They just want to convince demographic A that their devices are unhackable and completely NSA-proof, and convince demographic B that anyone who values their civil liberties is a terrorist pedophile that hates freedom.

These companies are documented data providers for the NSA.

Google and Apple's marketing teams must be relishing this. I'm guessing it's very dangerous in their departments right now with the champagne corks flying everywhere.

I doubt that. I'm sure they anticipated this response, but I think you greatly underestimate how many people subscribe to the "nothing to hide" theory of privacy and/or are genuinely worried this might aid pedophiles or terrorists.

I can't see how you'll see a backlash against the companies on the move, if only because there's no real competition and no value in being "the phone the authorities can easily monitor"

The worst case scenario is that they get large amounts of press (not all positive), fight for the rights of their users to have private data, and lose to a government they never expected to defeat. That's still a win.

There is value in not being the pedo/terror phone. That's one of the traditional attacks on information privacy.

Well, until the law gets changed and they have to allow government access to the smartphones.

I've giving it better than 70% odds legislation is passed within 4 years that ensures just that.

The Director of the FBI James B. Comey says: "What concerns me about this is companies marketing something expressly to allow people to hold themselves beyond the law."

See, that's funny. Because what concerns me is that the government thinks they are beyond the law.

You can never trust any "encryption" that you don't handle entirely yourself.

This seems to be some more theater, aiming to deceive the general public with regards to the "safety" of this "encryption".

Of course if you implement encryption yourself you almost certainly did it wrong and are leaking data. This assumes you even know how to "do it yourself".

I didn't mean "write your own solution", I meant:

You can only trust public key encryption and you need to create all keys yourself and you need to have 100% exclusive access to the private key.

And then, you need to pray and hope that the NSA hasn't figured out a way around it and won't too soon.

I have full disk encryption enabled on my Mac since Lion. Why is it such a big deal that I have it on my phone too? Or am I missing something and the keys to my computer storage are leaked to Apple somehow?

By default it is backed up to iCloud through your keychain...

This is why I enabled encryption with the fdesetup command manually so the GUI can't "have a bug" that backs it up to iCloud/keychain anyway.

https://developer.apple.com/library/mac/documentation/Darwin...

edit: you want to ensure you don't use the -keychain option, and then you want to write down the recovery key it prints out and store that somewhere safe.

Once again this is an issue of centralization. Imagine everything is decentralized - mesh networks, open source server software, social networks etc. How is a government going to enforce that no one runs a private encrypted network? And using one step of tunneling how would it make sure no one runs a VPN? Short of a total physical police state like the USSR under Stalin the only thing they could do is mandate backdoors in physical devices. Because manufacturing is going to be the last bastion of centralization. If you think I'm joking, see this and this:

http://wccftech.com/intel-possibly-amd-chips-permanent-backd...

http://www.technologyreview.com/news/519661/nsas-own-hardwar...

And lest you think only governments do this, a lot of hardware DRM has been almost entirely the result of the entertainment lobby and licensing:

https://plus.google.com/app/basic/stream/z13qtnxhuojytbjbr04...

As you can see the main targets are still INSTITUTIONS. Once they are decentralized it will be harder to control who makes the software. If you want to read my own thoughts on these things, see these two links:

http://magarshak.com/blog/?p=114

http://magarshak.com/blog/?p=169

Again, I find the narrative interesting. It would be more compelling if the government had shown that it could be trusted with the ability to snoop, too bad they screwed that up.

I remember reading about Hal Finney about a year ago, and then about the cypherpunks and all, including about PGP. And I was surprised to see how recently an encryption standard was deemed a weapon, and sharing the algorithm was deemed exports of weapons, a punishable offense, particularly if say, an Iranian would come to read the algorithm on some forum post! That meant jail-time, treason!

Ridiculous, I thought surely we'd be a bit more enlightened about these things in the 1990s. It felt almost comical, as if it was a joke.

Now this. Two consumer companies we all know and love, implement an encryption standard by default that has been openly available to the world for many years, and we already see talk of preventing it through congress. It feels like we're back in 1993.

Just gonna leave this here: http://weknowmemes.com/wp-content/uploads/2012/01/how-would-...

How would you want it wrapped? Protect the kids or anti-terrorism.

They literally wrapped this one up twice, mentioning both the terrorism and the pedophiles. Sigh.

"“This is a fundamental tension,” Howe said. The “balance between how much privacy you’re allowed to have and how many rights the government has” is a question that has continued historically in the U.S., he said."

Uh.. I thought I had unalienable rights as a human being, from the Creator or whatever. It's not about privacy the government "allows" me to have.

I don't think they care so much about preventing encryption --after all, you can already encrypt your iPhone or Android device, if you really want to.

What they're much more concerned about, IMO, is that this could now be the _default_. No longer would there be a presumption that someone has "something to hide" if they're encrypted when everyone else is, too.

"Well I ain't passed the bar but I know a little bit, enough that you won't illegally search my shit!" -Jay Z

So this does actually pose an interesting conundrum, I think.

Setting aside the specifics of this matter, I think that most people would accept that in some circumstances, covert surveillance of suspected criminals is an acceptable law enforcement tool. Of course, it must be subject to suitable (not rubber-stamped) judicial approval, rigorous guidelines, limitations etc.

From that perspective, secure and encrypted communication channels that are now becoming more generally available and usable by the public reduce the ability of law enforcement to gather evidence using traditional surveillance tools. It's no wonder that they would react negatively to them, even assuming there were no malicious intentions.

I wonder what the balance will be? Does law enforcement have to simply accept that surveillance of this sort will no longer be possible? I can't see any logical way of simultaneously retaining useful control and allowing regulated legal access to communications.

Getting access to your personal life recorder, which is what smartphones are, is not a "traditional surveillance tool" as you call it. It's a new surveillance tool that has shown up over the last 7 years. Before cops had access to every single thing you do via the smartphone, civilization did not collapse.

You're making a thoughtful point here (though one that I happen to strongly disagree with), so I'm not sure why the downvotes.

But anyway, it's worth noting that the publicly switched telephone network, email, SMS, etc. are all wholly compromised and will remain so for the foreseeable future. The reduction in law enforcement snooping ability being contemplated here is tiny by comparison, and they're making an incredible amount of noise about it.

First the government puts itself above the law by engaging in unconstitutional surveillance. And then they complain that some companies retaliate by tightening up the encryption? Even though they have some valid point, it's very hypocritical. I doubt this would have happened if not for the Big Brother's behavior to begin with.

I am actually encouraged by this. I feel like 8-10 years ago they would have never even bothered complaining to the press--just swooped in with some invisible court order and forced tech companies to do their bidding, with (of course) no ability to publicly disclose any of it.

James Soiles, a deputy chief of operations at the Drug Enforcement Administration, said the stakes in resolving the dispute are high.

Stakes for who? For LEA of course they are, they make the job much harder.

Maybe this will help end the drug war and some of the other silly things we do.

We could eliminate this guy's concerns by just shutting down the DEA altogether. End of problem.

I remember in the 1990s when the FBI and NSA were doing the good work: going after organized crime syndicates on the web, making public advice for US businesses to secure their networks, releasing Linux and Windows security patches, etc.

Times have changed.

It doesn't matter what these articles say. Under what Constitutional law is law enforcement going to force Apple and Google to change their encryption systems? Perhaps the NSA and the (still unconstitutionally vague) FISA court can force them by putting a secret gun to Tim's head but ordinary non-secret law enforcement organizations have no legal way to challenge this that would pass even this Supreme Court which is where anything would eventually wind up years from now.

My expectation is anyone participating in illegal activities would already be using encryption. Encryption is readily available and and isn't very tedious as long as someone walks you through it. It is not like terrorists use Google docs and write their plans in plain text. What am I missing? The best I can infer from desperation of government is that they want to control people by collecting as much info as possible.

Your intuitions and reality are very different. In general terrorists and the like aren't savvy like your average HN-reader. They're savvy like that weird kid in school who had all the Anarchist Cookbooks and likes to build and set off pipe bombs for fun. They can teach you how to not blow off your hand, that's about it.

I don't know how many times you've tried to 'walk someone through' using moderately complicated software, but I've had to do it enough times to realize that there's no such thing as foolproof. I once advised a lady who kept three phones because she was worried that her ex-husband was breaking into her communications.

At one point she called me frantic that her husband had broken into her phone. I calmed her down and asked her what had happened. He'd called/texted her at a number she had been trying to keep secret from him. I surmised that she had accidentally sent him a text from the secret phone and had her go through her recent communications until she'd found it.

Information security is something that doesn't seem terribly hard to most geeks, because many of us have an intuitive understanding of threat models and how things work underneath. We can be skeptical of companies that say that they take security seriously. Most everyone else is utterly reliant on commercial solutions and has no idea how to understand how following a set of procedures makes them safe, or what happens when they fail to follow them, what the failure modes are.

It is completely unsurprising to me that criminals use their cell phones to document criminal acts, it falls totally in line with how people tend to think about technology. So I believe law enforcement when they say that cell phone searches have become an important tool to help them investigate crime.

Do I believe they should have that access? To me the answer is unclear. It would be easy to conflate LE with the NSA and say hell no. But there are some very bad people out there that cell phone searching gives us a critical advantage over. If it were up to me, I'd say to solve this problem at a different level by legalizing the drugs whose trade promotes criminality. In absence of that, legal searches procured through warrants seems to be better than nothing, and we should fix abuses through regulatory action rather than blanket, reactionary bans on useful enforcement techniques.

It's not like LE hasn't had its own fair share of power abuse.

But regardless, I think you're missing that for LE to obtain those keys with a warrant, we must entrust them to two private multinationals without any court order. And by trusting those two companies, it's not only included trusting their board but also their protection from hackers and rogue employees. For example, Google already had an incident of an employee tapping a minor's account and getting personal information: http://techcrunch.com/2010/09/14/google-engineer-spying-fire...

(This is, of course, assuming the encryption actually works as announced. Personally, I don't trust it)

"What concerns me about this is companies marketing something expressly to allow people to place themselves beyond the law."

This guy has it exactly wrong: it allows people to place themselves beyond the illegal snooping of NSA et al. The one to blame here is the NSA, together with those who failed in their duty as counter-power to administrative abuse.

Am I the only one who thinks this is just a farce ? Apple and Google probably simply claimed this to save their reputation and "Law Enforcement" is putting up a fight which it has already planned to lose publicly but Google and Apple will co-operate through the backdoor while giving a false sense of security to its user base ?

We want to attack command-and-control structures of drug organizations, and to do that we have to be able to exploit their communication devices.

This doesn't make sense on so many levels. If a law was passed so than Apple and Google had to reverse their decision, no drug cartel is going to store incriminating data on their iPhones anymore.

"Beyond lobbying the companies, there is little law enforcement can do without congressional action. " Wait, what? Even with the privacy Apple and Google are offering there are huge amounts of ways to access data useful to law enforcement and the law enforcement seems to have the tools to force the companies to give it.

I think the point is that these companies literally can't unlock the phones and give access to the data, since (according to them) they no longer have the keys to do so.

It shouldn't be legal for the government to request companies to do things that aren't codified in laws. No "asking" or "buying". We decide what and how the government functions. If the gov wants to do things differently, it can ask congress. Not apple or google.

They always pull the pedophile card.

If this annoys you at all, you should check out the 'blackphone'. It's not cheap, but if you value your privacy and security it is the phone for you. Full disclosure: I have nothing to do with this phone; it's just a cool related project.

Okay, so we know this will be changed, Apple will be forced to allow government the ability to access the information on the phone.

the question I have is, will we be told before this fix is pushed out to phones and can be not update the phone to prevent its installation?

I think this adage puts it best:

You reap what you sow.

If the NSA hadn't so deeply and fundamentally violated our personal privacies in addition to US and International law, I don't think we'd even need to have this conversation. But now we're having it.

“going to be the preferred method of the pedophile and the criminal. We are going to lose a lot of investigative opportunities.” - Cathy Lanier, chief of the Washington Metropolitan Police Department

Oh, the delusional world Cathy lives in...

Reminds me of this:

http://www.ign.com/articles/2000/12/20/iraq-scores-hordes-of...

I'm amazed at the how FBI and the Justice Department somehow managed to not notice that Apple was improving their security in iOS 8 until after iOS 8 was launched, despite months of public beta testing.

I like how cliche this is. They would have written word for word "think of the children" that it would have been exactly the same.

Watch every Android vendor and Apple stock go down massively if this actually happens due to all non US companies switching phone vendors.

Is that to provide users with a false sense of security since US law enforcement can secretly ask for the decryption keys?

Was there ever a law forcing the manufacturers of safes and locks to provide access to law enforcement?

I assume they're going after the manufacturers of safes, paper shredders and burn barrels, next?

Of course the anti-privacy crusaders lead with "think of the children!"

Google and Apple to law enforcement: hah, funny, no.

I read the article without noticing who wrote it.

Stewart Baker.

Yeah, that figures.

This is a cost saving measure with a good PR component to it. Its expensive to comply with requests and uses up important resources. By taking the technical ability out of the equation for getting into the device itself Apple is saving itself time money and resources and looking good to the public for doing so with no legal damages.

This does not actually fully protect any ones data though. Government has full access to the cell phone companies that can with warrant provide location information including dates and times, SMS information, and can still monitor any un-encrypted traffic from a users phone. At worst Apple is providing a false sense of security to individuals that do not understand the other part of the equation, which is the Cell Phone companies and the Interweb can monitor and log stuff. But I do believe Apple that iMessage, FaceTime and the device itself is not intentionally open for spying on. But what about the other apps. Whatapp, and Blackberry messenger and Skype and all the other apps that sends data to 3rd parties. None of that is protected. But Apple only ever talks about itself not 3rd party. Take a iPhone and use only Apple software on it you will probably have the best protection in the industry for consumers. But its limited to that.

END OF REPLY -------------------------------------

----Start of slightly off topic but still on topic rant -----

Apples business model isn't based on data either. So when they say they don't scan your emails to profit from it I believe them. They are probably the only major ecosystem that does not need to do that. Yahoo Mail, Outlook (hotmail) mail, Gmail all have business models that provide a free service in exchange for your information. Its rooted into how they make money. Apple makes money from the sale of Hardware and direct cost services.

At the end of the day anything NOT in your head is exposed and a potential security risk. Even writing something on paper creates something to be discovered. Not putting thoughts into a tangible readable and accessible form is the first line of personal security. Followed by absolute control of what ever you do put those thoughts onto. Paper, paper goes in pocket. Paper is burned when no longer needed.

Computer, no wifi, no blue-tooth, no always on connection in your physical possession is as secure as you will get with encryption in case you lose physical possession. A smart phone can reach this level of security but defeats all of the abilities it which makes it a smart phone. You can disable data and wifi and use the phone only as a phone but at that point why do you even bother owning it.

As the CEO of Google once said, if its something that can hurt you don't do it. In this case don't make a record of it. Dont take pictures, dont text about it, don't use a calender to plan it out. Keep it in your head. No one ever takes responsibility for there own stupidity when it comes to security. Go back to a book and pen if you are worried. But that can be seized and read if arrested.

Technology used right can offer better protection then ever before.

That cat is out of the bag. People wan't encryption that is why Apple is offering it. And even if they thwart the effort on ios, android will be much harder to tame.

If you support this sort of system, you are saying that individuals should be able to place themselves above democracy. Like it or not, we have a legal system that entitles the government to execute lawfully obtained warrants. Tech companies seeking to make this harder are acting against democracy.

It's time for Silicon Valley to decide what side it's on: Democracy, or the alternative.

Our democratic system has enacted laws that say encryption is legal. Why do you think following the law is somehow "acting against democracy" here?

It's in the intent. I don't think anyone is denying that Apple and Google are doing this to make it harder for police to search through user files. They could have implemented this at any point since the inception of AES, and are doing it now because of the backlash against PRISM. They want to demonstrate to users that they care more about them as individuals than they do about their role in a democratic society.

Notice also that your comment, and others respondents to me in this thread, are not disputing my actual point, i.e., that bundling crypto features in products is meant to put individuals above the reach of the democratic legal system.

>Like it or not, we have a legal system that entitles the government to execute lawfully obtained warrants.

The same legal system also says using encryption is perfectly legal.

Some people would say they are putting themselves above oligarchy.

But they're wrong. The United States is, whether you like it or not, a democracy. Voters can be influenced, but they still decide the outcome. Everything backends to them.

If you disagree with that, there are legal avenues. This is an example of an extralegal avenue of political change.

Gilens and Page think they have shown that's only true for trivial matters: http://talkingpointsmemo.com/dc/princeton-scholar-demise-of-...

People vote all the time in all kinds of undemocratic systems.

Are you seriously saying strong encryption is, or should be illegal?

The interview you link to points out numerous problems with that study, but beyond that, the very existence and success of activist groups disproves that premise. If the United States was truly an oligarchy, gay marriage or marijuana legalization would never have happened.

Lawrence Lessig is making serious progress with his Rootstrikers group, and the fact that he's doing so proves that ordinary citizens do have political influence. Battles aren't won overnight, but

>Are you seriously saying strong encryption is, or should be illegal?

Do you think I'm saying this? If so, where?

Or are you asking leading questions in order to put words in my mouth? In which case, are you seriously saying that democracy is an idea we should totally abandon in order to embrace the rule of whoever-can-summon-the-most-technological-power?

The oligrachs have little or no money to lose on those issues.

You used the word "extralegal." What does that apply to if not the use of encryption in mobile devices?

You might as well have thrown in the term "patriotism" while you on that buzzword kick.

There is nothing in the actions of Apple or Google that will prevent search warrants from being issued. Now you'll need to go directly to the person who owns the device in question. As for what happens then is likely to depend on the country and how the courts view this, from a self-incrimination perspective.

Get a fucking subpoena you asshole motherfuckers.

Reply on news.ycombinator.com