The FBI Is Wrong: Apple’s Encryption Is in the Public Interest
wired.com
wired.com
That made me laugh. As opposed to a country where several enforcement agencies including cops can spy on masses of people to their heart's content? It wasn't too long ago that cops could get someone's phone and look through it as much as they wanted. It took a battle to the Supreme Court to stop that from happening (hopefully). So I think there's a much higher chance it's them who are violating them law when the devices aren't encrypted, than the other way around.
I'm glad at least some journalists are calling out FBI director's BS arguments. Others like Washington Post and NY Times seem more than happy to give him a platform on which he can spread his propaganda to millions. It's a good thing for him that spreading propaganda on US soil isn't illegal anymore, I guess.
From the Oxford English Dictionary (also used in the Wikipedia entry): "The authority and influence of law in society, esp. when viewed as a constraint on individual and institutional behaviour; (hence) the principle whereby all members of a society (including those in government) are considered equally subject to publicly disclosed legal codes and processes."
"Rule of law" is more of a procedural guarantee for the citizenry than an assurance the people will abide by laws.
In Russia, Afghanistan, and Venezuela, the laws don't seem to matter very much; if Putin or the oligarchs/warlords/chavistas want things to be a certain way, there isn't much to stop them despite laws that in theory constrain them. That's the rule of men, as opposed to the rule of law, and it's antithetical to a free society.
Not sure the rule-of-law / rule-of-men dichotomy with regards to measuring a free society is as clear cut.
Civil disobedience, corporate political spending, judicial activism, selective legal enforcement at the local level, federal/state disagreement. These are not all good or all bad things.
Laws that are written up and known ahead of enforcement, and that are enforced fairly and impartially - that's rule of law. But the laws themselves may be unjust or otherwise problematic.
That is, this is a lawful / chaotic axis, not a good / evil axis.
Encryption of all data at rest on the device goes a long way to making good opsec more practical and easily achievable.
I'm pretty sure that most people want the non-smart criminals caught, too. I certainly have not heard too many victims or relatives of victims of murder, sex crimes, hate crimes, robbery, gang violence, and the like say that they don't truly want their crimes solved because they were victimized by non-smart criminals.
This idea of back doors being opened up to black-hat hackers seems to be the crux of the current leading argument against key escrow. Even the EFF is beating this drum.
Bear with me, I'm not disagreeing with that argument, but isn't there another point to be made here? And that is:
Key escrow systems ask us to assume that the current "good" guys in positions of authority will always remain good. Isn't that a bit too much of an assumption?
To statists, the state is infallible. If race inequality is the standard codified by law, then race inequality is good, because the government has declared it so. So many people operate under these assumptions, giving exception only to a few partisan issues which they've never even thought critically about.
There were a lot of questions in that talk along the lines of "How is this going to work?" which Comey admitted he had no good answers to.
Amendment IV
The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized.
Note: I added the emphasis. Maybe I'd wish the emphasis would be letters 10 feet high with two pounds of black ink each, but I'm not seeing a way to do that on HN.
Seems pretty clear to me.
Now when I lived near DC, as I recall, the FBI HQ was not far from the National Archives with the original copy and also not far from the Supreme Court where, maybe, the FBI could get some eighth grade civics tutoring on what that part of the Constitution means.
To me, what the part means is, in simple terms, keep your filthy, sticky hands the F off my stuff. That is, unless you have one of those warrant thingies. And I don't even own a mobile device.
I sound pissed off? Right: A lot of really good people fought and died to give us the freedom to write and adopt that Constitution. To track mud all over it now is, in a word, a bummer, and that's putting it very mildly.
The FBI needs to return and repeat eighth grade civics.
I know; I know; apparently some people in the FBI would say that the Constitution was written long ago, and now the FBI has much, much, much more important things to worry about than those old fuddy duddies who wrote that old piece of paper and, besides, they didn't have smart phones then. Some people might say such things, but I don't go along, and we do have a way to get an answer -- that's just what the SCOTUS is there for, in this case for a reading comprehension lesson in eighth grade civics.
That text I emphasized above is difficult to read and understand? Ah, now I get it, for some in the FBI, easy to read and understand but difficult to accept and easy to violate.
Am I handing over information to Moleskine when I write in a notebook I purchased?
If it was a real safe then a) Apple can't prove that the blob doesn't hold a document that a warrant is for, but equally law enforcement can't prove it is there. Unfortunately they can just ask for the whole thing. b) Chain of custody can't be shown by Apple, all they did is take the locked safe from you. I could send a document to the printer and ask you to take it to my boss, what if they received a resignation letter not a weekly report?
So, the way I read the Constitution, if I have an iPhone and the data on it is encrypted, then I don't have to give the FBI so much as a spit if they don't have one of those warrant thingies. Even if they do have a warrant, do I have to decrypt the data for them? I'd guess and hope not, but that might need a SCOTUS opinion.
But, for the cloud, hmm, let's see: I write a very personal diary and store it in a safe deposit box at a bank. Now that diary is no longer part of my "personal papers"? I would hope that that part of the Constitution would continue to apply to my diary, even though it is in bank's box.
And if I type my diary into a computer file and store it, encrypted, on a cloud server, again I would think that that file on the cloud server was still my "personal papers and effects".
Maybe we need some SCOTUS cases.
You seem to not sharing the Constitution's distinction between warrantless and warranted searches. The complaint being fielded by some in law enforcement is that recent changes in encryption mechanisms in iOS and Android will render many warranted searches useless.
Yes, in the first paragraph is implicitly assumed that law enforcement didn't have a warrant.
But eventually I also wrote "if they don't have one of those warrant thingies. Even if they do have a warrant, do I have to decrypt the data for them?"
So, there I was considering the distinction.
It should be legally irrelevant whether I handed someone a photo or sent it to them using an app and a network.
with encryption such Warrant becomes impossibility while their unquestionable loyalty to Constitution would protect your unencrypted data from Warrant-less access. Such position would play very well in public mind, and i kind of pessimistic here in the sense that i expect that compromise with escrow master-keys would probably be struck here, a compromise that we'll learn about only very long time after it happens.
And people have the nerve to COMPLAIN? I bet these same people will be up in arms when law enforcement wants back doors on our 24/7 encrypted voice box recorders @.@
The government has every reason to have us all use as much technology as possible because whenever our life touches technology, it leaves a trace which will eventually be a part of your personal profile.
I doubt that the Apple/Google encryption is a serious hurdle to the government. It's very likely that this is just a campaign to make the consumer trust these brands again because huge tech companies live (some maybe forced to live) in a symbiosis with government agencies. If the government doesn't want tech companies to unite and turn against it, which still hasn't happened yet and probably never will, then they must also give them something after/before they take something.
"""
First they came for the Socialists, and I did not speak out— Because I was not a Socialist.
Then they came for the Trade Unionists, and I did not speak out— Because I was not a Trade Unionist.
Then they came for the Jews, and I did not speak out— Because I was not a Jew.
Then they came for me—and there was no one left to speak for me.
"""
6.)FUN FACT. Look up the FOIA records of FBI files on Meyer Lansky. that's the reason why Lansky did so much in the open, with few or NO ARRESTS or 'investigation'?
8.)FBI hoover is master of publicity and crackdown on 'bank robbers' who are small and flashy, but not the BIG PROHIBITION GAMBLING and DRINKING by organized crime.
10.)NO ENCRYPTION ALLOWED. Plenty of ID theft, likely money laundering, medical fraud which will bankrupt the country.
SO THE ENTIRE WORLD DOES NOT NEED ENCRYPTION, nor basic Internet Security.
11.)Does NO encryption work in Mexico with the Mexico Organized Crime? No, why? a.)plenty of informants inisde the law enforcement b.)buy cheap one or two time use phones, which is too expensive for the average citizen. keep changing phones. c.)set up their own cell phone and radio communication towers.
d.)use low tech children to run back and forth e.)other ways that the CITIZEN CANNOT use.
.
Wasn't it that those "pilgrim fathers" who went to the new world at the time (i.e. the times of the colonies) went there because they wanted religious persecution? At the time, there was too much religious tolerance for their liking (particularly for those who had already tried living in Holland, notorious libertines even then) and by establishing a colony they could enforce their correct religion and not have to co-exist with others (which they promptly did, insisting on their own brand of protestantism).
I am not the first to point out that it is stupidly easy to bruteforce passcodes that are based on digits (like many phone passcodes are). The FBI lamenting unbreakable phone encryption and the accompanying media buzz borders on farcical and is disingenuous given that there is still a backdoor on the iPhone[1] on port 62078. Am I missing anything?
Also, some of these vulnerabilities are slightly outdated with iOS8.
So even a 4-digit passcode with wipe on too many failures is secure except to hacking the OS from the lock screen, which is pretty difficult to do. Even then the cracking has to be done on the device, so while a 4-digit code could be cracked even a 6 character alphanumeric even will take days and longer passwords are basically uncrackable.
The NSA != your police officers
Just because encryption is a good technique to use against the NSA's surveillance that doesn't mean it's in the public interest in terms of law enforcement.
Could you imagine if there was some new lock technology that came along that forced everyone to abide by vampire rules. This lock would required police to obtain your express invitation to enter your home regardless of whether they had a warrant or not. Now imagine the uproar that would cause. That is exactly what this type of technology does for our phone.
It isn't a change at all. You have been able to anonymously rent a locker at a YMCA or a self-storage unit or a cabin in the woods since forever. Evidence of a crime stored there is inaccessible to law enforcement because they don't know where it is. There is no practical difference between "don't know where it is" and "don't have the password." This is not a new thing.
I think you forget you're living in the real world.
There is also no practical difference between accidental and intentional murder, so by your logic we should treat those the same way too.
Ever heard of civil forfeiture or someone's camera getting 'broken' after being seized for taking pictures?
It is more important the rights of the innocent are protected than the law enforcement system be enabled to catch the guilty.
Do realize I say this as someone who has had his home broken into with him in it and the guy was never caught. I've had family members who were robbed and no one was caught either. The cops responses was basically "Eh, we can't take the time to look for your $X,XXX worth of property" essentially and you didn't end up in the hospital.
9% of homicides in Nevada are police shootings. We don't have figures for the most of the US because law enforcement agencies refuse to provide them. (This is illegal, but because congress did not provide for enforcement, it just goes on.)
Everyone counts or no one does.
"An anonymous former drone operator for Joint Special Operations Command (JSOC) told The Intercept — a new publication helmed by Glenn Greenwald, who broke the first of many NSA revelations last year — that the US military and CIA use the NSA's metadata analysis and phone-tracking abilities to identify airstrike targets without confirming their veracity on the ground. The claims were corroborated by documents provided by the former NSA contractor Edward Snowden."
Eh? You sure the NSA doesn't help provide targeting data?
We have rights against unreasonable searches, we have rights to freedom of thought and expression.
We would not have had a civil rights movement if the FBI and local law enforcement could have been monitoring everyone's communication. We would not have legal alcohol today were it not directly because of the polices limited effectiveness against crime. Our greatest reduction in crime came directly from legalization of alcohol and that would not have happened if the government had the control we're talking about handing over to police forces.
It's in the public's interest to keep the public safe from the government. We have the lowest crime rates in history, this is not the time to hand the police more power. This is the time it will be abused and used to imprison people who do not deserve it.
Do we want every college kid going to jail because he texts his friend he's got a fresh Oz of weed?
It is every single persons moral duty to commit civil disobedience in the face of unjust laws. We will not have civil disobedience without freedom against unreasonable searches.
It has been operating as an intelligence agency for a long time, they just finally decided to own up to it.
If law enforcement agencies want the pendulum to swing back in the other direction, they should also be hoping for the overreach to end - not just blaming tech companies.
That said, It's worth pointing out that the NSA is known to have been active in exploiting endpoints, not just retrieving data from google/facebook/whatever. Of course it's questionable whether this would provide any substantial protection against such an exploitation.
An example the FBI used is a stupid criminal kidnapping a child and leaving their encrypted phone behind somewhere. Even if the FBI got warrants from multiple respected judges, they couldn't go through that phone to look for clues about where kidnapper may have taken the child. There are ticking bomb scenarios and other time sensitive situations. It's reasonable that the law enforcement should have some ability to access information with approval from the judiciary. We don't want to endanger ourselves in order to protect the banal communications on our cell phones or dissemble our legal system for the sake of keeping our sexting private.
Sure they could. They might not be able to practically decrypt it, just as legal warrants wouldn't magically make them able to practically decrypt encrypted notes on paper in the same situation.
> The bottom line is that our justice system is based around the idea that a lawful warrant allows law enforcement to search or seize anything that could be useful in a time sensitive investigation.
Which encryption doesn't change. However, our legal system is not based around the idea that everyone has a positive obligation to surrender tools to a third party so that anytime law enforcement has a valid warrant to search and seize something, they also have a third-party other than the target they can go to in order to get assistance interpreting what they've seized.
The fact that they ever had that ability with phones is simply an accident of the fundamentally broken approach to security taken previously with mobile phones, which also made them vulnerable without a legal warrant. The correction of that vulnerability may inconvenience law enforcement, but it does so in a way consistent with the inconveniences law enforcement has always faced with the hardcopy documents that were the primary form of data that they might seize for most of the time our legal system has existed, not in some way that is somehow novel or inconsistent with the history of our legal system.
You're talking about entrusting a government organization which has already repeatedly betrayed that trust to not interfere with political affairs in this country. They've already over-extended themselves in terms of what they can investigate, now you want them to have control of everyone's lives so they can't have any privacy if they wish.
>Sealed court orders and proceedings for google, twitter, apple, dropbox, yahoo.
>NSA scandal.
I would rather have a few criminals go free (if the only evidence was on their Apple device) than unfettered access to my data. I guess I just enjoy the little bit of freedom I have left.
Therefore it is reasonable that the law enforcement should have some ability to access our every thought and desire with approval from the judiciary. We don't want to endanger ourselves in order to protect our banal private thoughts or dissemble the legal systems for the sake of keeping our sexual desires private.
Also, something about "think about the children!".
> Even if the FBI got warrants from multiple respected judges, they couldn't go through that phone to look for clues about where kidnapper may have taken the child.
Yeah, and the same goes for when the kidnapper isn't dumb, or doesn't leave their phone behind. Sometimes it's tough. But that doesn't warrant everything.
> We don't want to endanger ourselves in order to protect the banal communications on our cell phones or dissemble our legal system for the sake of keeping our sexting private.
What you call banals is not banal to me, not at all. I would even say hundreds of millions of people having no expectation of privacy is a much bigger issue than all unsolved crimes in the US put together. And then there are past episodes like COINTELPRO, are there not. I would say that unbreakable encryption, combined with other things of course, makes a lot more impossible than just catching petty criminals via them making silly mistakes. It is also one sandbag against tyranny, and that is also a ticking bomb scenario. That bomb is far from being defused.
All but one of the examples that FBI Director James Comey gave in his speech at the Brookings Institute yesterday[1] were violent crimes (and you could argue that the drug bust was related to violent crime since he said that the group was also linked to homicides and robberies). The last example he gave showed that evidence taken from cell phones has been used to exonerate suspects as well.
[1] http://www.youtube.com/watch?v=Dkbh5fJoFhc#t=2313 (should automatically jump, but if not it starts at 38:33)
Serving prison time actually increases recidivism (by increasing debt, straining or severing ties with family and community, creating ties to other criminals, making it harder to find a job, etc.), so it turns out that in practice sending criminals to prison makes us less safe.
> The entire system is built around the idea that law enforcement can search and seize evidence if they have a lawful warrant from a duly appointed judge. Unbreakable encryption fundamentally threatens that framework.
Putting aside that the system doesn't actually work, it also doesn't require anything you're suggesting it does. Searching a suspect's mobile device is far from the only tool law enforcement has -- and it's one that they didn't have a decade ago, so suggesting that not having it would cause the world to descend into chaos is disingenuous.
And the way the system actually does work is by creating a nontrivial possibility that committing a crime will result in punishment, thereby deterring the large majority of prospective criminals. This doesn't require anything even resembling 100% enforcement effectiveness. In fact, its actual effectiveness is almost irrelevant because people have no sense of its true effectiveness and the deterrent is based entirely on what prospective criminals think would happen rather than what would actually happen.
That is one of the reasons why the system is so broken -- the deterrent is effective even though the system isn't, so people think it's working and nobody demands that it be fixed.
> There are ticking bomb scenarios and other time sensitive situations.
Hollywood has confused everyone into thinking that ticking bomb scenarios are common. They are not. In the overwhelming majority of cases, law enforcement investigates crimes after they've been committed, not before. Basing major policy on something that occurs in a negligible percentage of cases is just silly.
Imagine someone suggested that forcing criminals to become addicted to cocaine or meth would be a good punishment. Yes, that is definitely a form of punishment. That doesn't imply that doing it would make the world safer or in any way better.
Moreover, from a "makes people safer" perspective, if you have a trade off between actual safety against attackers and law enforcement effectiveness, you almost always want to choose the thing that provides actual safety. Law enforcement effectiveness just doesn't make that much difference since actual effectiveness has such a tenuous relationship with perceived effectiveness and perceived effectiveness is what matters for deterrence.
Moreover, it doesn't change much when you substitute a different punishment. You don't ever want to be in that situation because you only get there after you've already failed to deter the crime. If the efficiency of your coroner's office seems like a problem, that isn't your actual problem.
Again, you're suggesting that criminals shouldn't face punishment because it's society's fault that the crime wasn't deterred in the first place.
It's not that we shouldn't try to do it. It's that failure is mostly irrelevant.
I have trouble believing that the massive increase in incarceration rates in the U.S. over the last 30 years is entirely disconnected from the drop in crime rates.
http://www.bjs.gov/index.cfm?ty=tp&tid=17
Short version: 76.6% of convicts released from prison are re-arrested within 5 years, half of those within one year. From this we have to add the percentage who committed crimes without being arrested and account for those who would not have re-offended regardless of whether or not they had served prison time. The latter numbers are obviously difficult to come by but I think it's safe to assume that they aren't both zero.
The recidivism rates in countries that use non-prison punishments or shorter prison terms are obviously lower than this (since it would be nearly impossible for them to be any higher).
> I have trouble believing that the massive increase in incarceration rates in the U.S. over the last 30 years is entirely disconnected from the drop in crime rates.
You may find this relevant: http://www.motherjones.com/environment/2013/01/lead-crime-li...
Also, the number of inmates in prison has finally started to decline over the last few years and the crime rate is still falling, consistent with the linked article but not with a link between higher incarceration and lower crime rates.
That there are places with lesser sentences and lower crime is a good data point for establishing that a society need not rely on imprisonment, but it actually isn't instructive as to the effectiveness of imprisonment in other societies.
I think the US imprisons too many people for too long, but you are using a phrase like 'empirical fact' to describe an opinion you have reached.
Also, note I said "completely disconnected", I'm at least somewhat aware of the speculation and research into lead and criminality (my favorite question is how the lead effect might compare to the Sesame Street effect). An alternate explanation of the trend you speak of in your last paragraph is that stricter enforcement has made criminality less attractive (I'm not endorsing that argument, I'm saying I think it has equal footing with your conclusions).
It's a direct corollary to the argument that not convicting them would harm public safety. The assumption made by both is that commission of crimes harms public safety. If that assumption is false then why do we even care about punishing those crimes at all? If they're not hurting anybody then there is no harm in letting them keep doing it and we should just repeal those laws rather than worrying about how well they're enforced.
> That there are places with lesser sentences and lower crime is a good data point for establishing that a society need not rely on imprisonment, but it actually isn't instructive as to the effectiveness of imprisonment in other societies.
The thing about facts is that they're all probabilistic. Nobody knows anything 100%. This is true even in hard sciences but it's especially true in social science. If you want to make the argument that then facts don't actually exist, fine. People are still going to call things facts when they're only mostly sure instead of exactly 100%. And sure, better data is always great. Let's commission some new research. But meanwhile you still have to work with what you have rather than what you would like to have.
> Also, note I said "completely disconnected"
But you're not providing any evidence for your position. Crime rates have gone down everywhere regardless of the presence of "tough on crime" policies. The recidivism rate is so abominable that doing nothing instead would at worst not significantly affect it (because it can't get much worse) and with nontrivial probability would reduce it.
> I'm at least somewhat aware of the speculation and research into lead and criminality (my favorite question is how the lead effect might compare to the Sesame Street effect)
The article goes into this. Lead was banned in different localities and countries at different times and the crime rates in each place matches the lead level in that place in the preceding decades better than it matches anything else proposed as an alternative.
> An alternate explanation of the trend you speak of in your last paragraph is that stricter enforcement has made criminality less attractive
http://www.fbi.gov/stats-services/crimestats
The clearance rate has been essentially unchanged since 1995 (the oldest date available). Moreover, a primary cause of the recent reduction in prison population has been imposing shorter sentences. Meanwhile the crime rate continues to fall.
Likewise if you wound up in a highly unlikely ticking time bomb scenario, ie being kidnapped, you would probably hope that the authorities were using every means at their disposal to find you, up to and including going through someone's iphone. The likelihood of a dangerous situation doesn't matter to someone who is at risk, and for that reason society should be able to offer every aid to people who wind up in rare circumstances.
If you're advocating that we throw out our entire legal system and start from scratch, I'd like to hear more about your proposal. The system that we have now is the careful combination of interconnected parts, one of which is the power of a judicial warrant. We have to be careful about what we do in the name of privacy. Weakening one part of the system can threaten the whole.
Are you taking into account that while in prison, the person is not committing crimes (except possibly against other prisoners)?
Prison will cause recidivism in some who would have given up crime if given some non-prison punishment, but it will also reduce crime from people who would have been recidivists anyway by delaying their return to crime.
Offhand, I don't recall seeing data on what the optimal term is for minimizing crime, but I don't recall looking for such, either. Anyone have numbers?
Their kids will pick up the slack as they grow up without a father.
Also, are you really suggesting that crimes against prisoners are not crimes?
> Offhand, I don't recall seeing data on what the optimal term is for minimizing crime, but I don't recall looking for such, either.
The optimal term for minimizing crime is obviously life imprisonment but I'm not sure that information can be put to any productive use.
No. I interpreted the original assertion and subsequent discussion to be about the effect of prison on crime against the general public.
> The optimal term for minimizing crime is obviously life imprisonment but I'm not sure that information can be put to any productive use
My guess is that the crime rate against the general public as a function of prison time curve [1] is not monotonic. I expect that there is at least one local minimum before the absolute minimum reached at life imprisonment.
[1] it would probably be better to say "curves", not "curve", because different kinds of criminals probably have different shape curves.
Even putting aside the implied exclusion of prisoners as members of the general public, it doesn't actually work that way. Prison inmates can cause physical or psychological damage to other inmates who are about to be released, increasing the subsequent drain they put on public resources and their likelihood of re-offending. Inmates can be threatened with violence if they don't convince their families or associates to commit crimes on the outside. Crime bosses can smuggle in cellphones and bribe prison guards to carry on running their organizations. "What happens in prison stays in prison" is the opposite of what happens in prison.
> My guess is that the crime rate against the general public as a function of prison time curve [1] is not monotonic. I expect that there is at least one local minimum before the absolute minimum reached at life imprisonment.
I agree that it probably isn't monotonic, but it seems like asking the wrong question. If a specific type of punishment causes harm to the convict and causing harm to the convict increases the probability of recidivism then every ounce of that punishment you mete out is counterbalancing itself. Increasing the deterrent also increases the damage. Sure, the two curves may not be perfectly symmetrical and therefore allow you to find a local minimum. But that's like trying to optimize the amount of poison to put in your food as a preservative. Is it not better to just use a non-poisonous preservative?