Slashdot Mirror


2002 US Wiretap Report

GMontag writes "Full report:2002 WIRETAP REPORT Administrative Office of the United States Courts Leonidas Ralph Mecham, Director I especially like this part: 'Public Law 106-197 amended 18 U.S.C. 2519(2)(b) to require that reporting should reflect the number of wiretap applications granted for which encryption was encountered and whether such encryption prevented law enforcement officials from obtaining the plain text of communications intercepted pursuant to the court orders. Encryption was reported to have been encountered in 16 wiretaps terminated in 2002 and in 18 wiretaps terminated in calendar year 2001 or earlier but reported for the first time in 2002; however, in none of these cases was encryption reported to have prevented law enforcement officials from obtaining the plain text of communications intercepted.'"

264 comments

  1. Hey by Bendebecker · · Score: 2, Insightful

    DES broken? The evidence mounts...

    --
    There's a growing sense that even if The Future comes,
    most of us won't be able to afford it.
    -- Lemmy
    1. Re:Hey by timeOday · · Score: 1

      DES or 3DES? Either way, it's probably easier just to sniff the keyboard or bug the encrypted phone.

    2. Re:Hey by Lord+Dimwit+Flathead · · Score: 2, Informative

      Nah, it's more likely the plaintext was recoverd by compromising keyring passwords. If short keylengths (e.g. 56-bit DES) were used, they also may simply have brute-forced them.

    3. Re:Hey by Skyshadow · · Score: 3, Insightful
      Either way, it's probably easier just to sniff the keyboard or bug the encrypted phone.

      Easier, sure, but also a helluva lot more detectible. You gotta figure that anytime you have a local device, you're running a pretty high risk of getting caught given that you (a) have to place it, (b) have to have something physically there that might be found, and (c) it has to transmit data out somehow. Tapping a line at the phone company has none of these drawbacks.

      --
      Every year during my review, I just pray the words "slashdot.org" aren't mentioned.
    4. Re:Hey by Anonymous Coward · · Score: 2, Funny

      HEY! We can see you, so stop playing with that.


      um...I was just straightening my pants... O_o

      [...while thinking of michael... -_-]
    5. Re:Hey by (54)T-Dub · · Score: 1

      I don't know what you are talking about.

      --

      "I can not bring myself to believe that if knowledge presents danger, the solution is ignorance" - Isaac Asimov
    6. Re:Hey by FroMan · · Score: 3, Funny

      You ceratinly don't want to be sniffing my keyboard. I have like 5 years of cheerios and milk and other food living/dying in there. I have it willed to science when I die. Granted the longer I use the keyboard the better chance I have of being killed by it. Like last night it went out on the town and didn't come back until the wee hours of the morning all tipsy and drunk. Damn, I think my keyboard has a better social life than my wife and I. Just to reiterate, my keyboard is not safe to sniff. So, any FBI agents, just be careful around my keyboard. And wear nasal protection if you try to smell it.

      --
      Norris/Palin 2012
      Fact: We deserve leaders who can kick your ass and field dress your carcass.
    7. Re:Hey by Qrlx · · Score: 2, Insightful

      Well, it seems that we should be able to get the answer with a little bit of work. So, there were 18 cases one year and 16 cases the next where the feds encountered encrypted traffic.

      I would have to think that at least one of those would be coming to a federal courtroom sometime soom. Unless these are all secret wiretaps for secret hearings, which seems to be more and more common these days.

      Another method would be a survey of which encryption methods are likely to be used by individuals seeking to secure their telelphonic communications. Such a survey probably already exists. We can make an educated guess that the most widely forms of encryption are represented in this (admittely tiny) sample size of 34, and assume they are broken.

      Look for reports like this one from the Administrative Office of the United States Courts to be classified soon, since knowing what encryption methods the feds can crack might be used to aid terrorism!

    8. Re:Hey by Steve+B · · Score: 2, Insightful
      You gotta figure that anytime you have a local device, you're running a pretty high risk of getting caught given that you (a) have to place it, (b) have to have something physically there that might be found, and (c) it has to transmit data out somehow.

      These difficulties are manageable if the feds are only conducting this level of surveillance on a few hundred targets. For law-abiding citizens in general, imposing this sort of practical limit on the government is a feature, not a bug.

      --
      /. If the government wants us to respect the law, it should set a better example.
    9. Re:Hey by theedge318 · · Score: 2, Informative

      You mean there is a question that DES is now insecure? For $10,000 you can buy the hardware to build a DES cracker. Still outside the range of private hacking, but definitely not outside the range of Corporate espionage. And as for the government, fur-get-abut-it.

      --
      Sig Nazi- "No Sig for you, come back 1 year."
  2. Encryption by Verteiron · · Score: 4, Insightful

    however, in none of these cases was encryption reported to have prevented law enforcement officials from obtaining the plain text of communications intercepted.

    So are we talking ROT13 here, or real encryption? Seems a little unnerving if it's the latter.

    --
    End of lesson. You may press the button.
    1. Re:Encryption by Anonymous Coward · · Score: 3, Insightful

      Doesn't really matter. Theres no industrial strength encryption for telephones readily available that hasnt been defeated these days, and as for electronic communications... PGP doesn't help you one whit when the feds slip into your house at night and plant a keysniffer to get your private key/pass phrase -- and they will.

    2. Re:Encryption by Surak · · Score: 0, Flamebait

      Heh. Right. Maybe on your Windoze box where you don't know what processes are running, etc., but that's much more difficult to do on Linux box, especially when the Linux box is owned by a Unix sysadmin with more than 10 years of experience (namely me. ;)

    3. Re:Encryption by Finni · · Score: 3, Insightful

      How does 10 years of experience translate into knowing about the hardware bug they slipped into your keyboard?

    4. Re:Encryption by xanadu-xtroot.com · · Score: 1

      How does 10 years of experience translate into knowing about the hardware bug they slipped into your keyboard?

      It doesn't. That was his/her/it's freakin' point. Esentially, the post was about "hidden" processes running on various OS's out there. *MUCH* easier to detect on *NIX. THAT was the point. I suggest you actually read articles and posts before posting in the future.

      --
      I'm not a prophet or a stone-age man,
      I'm just a mortal with potential of a super man.
    5. Re:Encryption by Anonymous Coward · · Score: 0

      Now Now Brown Cow..

      Chill out.

    6. Re:Encryption by (54)T-Dub · · Score: 1

      Kinda hard to detect this in any OS. I'm sure they have a smaller more discrete version for the Feds. Besides, did you check the back of your computer for the key sniffer today?

      --

      "I can not bring myself to believe that if knowledge presents danger, the solution is ignorance" - Isaac Asimov
    7. Re:Encryption by Surak · · Score: 2, Funny

      It doesn't. That's the point. :)

      Hardware keysniffers are easy to take care of. Simply make sure no one has physical access to your keyboard. It's impossible to install a keysniffer on a keyboard that you don't have physical access to.

    8. Re:Encryption by Anonymous Coward · · Score: 1, Funny

      It was just some law enforcement agents trying to watch DVDs on Linux.

    9. Re:Encryption by Qrlx · · Score: 1

      well, i thought it was +1 funny.

    10. Re:Encryption by 4of12 · · Score: 2, Insightful

      easy to take care of. Simply make sure no one has physical access to your keyboard. It's impossible to install a keysniffer on a keyboard that you don't have physical access to.

      Yes, but.

      I'm probably not the only person that feels their PGP key provides significantly greater protection than the lock on the front door of the house.

      If I lock my house and activate my cheapo burglar alarm, that will prevent most unauthorized access, but is insufficient to deter an expert with more resources intent on installing a keyboard sniffer. It's an arms race where anyone with lesser money and knowledge is at a severe disadvantage.

      Physical access is now the weaker link since PGP (or GPG) is readily available for negligible cost.

      I certainly don't have the kind of money available to bring up the security level of my physical perimeter to the same level of security that PGP provides. I have some knowledge, too, but since I have to work for a living I don't have the kind of time it takes to become an expert on physical perimeter protection.

      --
      "Provided by the management for your protection."
    11. Re:Encryption by Anonymous Coward · · Score: 0

      uh, what are you smoking?
      the fucking point of encryption is to be able to turn the encrypted data back into plaintext...
      WHAT THE FUCK is the point of encryption if that is impossible?

    12. Re:Encryption by Anonymous Coward · · Score: 0

      Yep, if they get physical access you're done for ... but I don't think a wiretap order allows them do do that does it? Not saying it isn't done, just that it requires a different kind of authorization.

    13. Re:Encryption by Helmholtz+Coil · · Score: 1
      I've been thinking about physical access security myself. I think that if I were to, say, pick up a couple of stay-at-home assistants I might feel a little better about the security/access issue. They don't even have to do anything, just be very visible.

      It might not completely rule out unauthorized physical access, but it'd be damn hard to get the evidence of the access hidden by the time I got home!

    14. Re:Encryption by Surak · · Score: 1

      For the really paranoid, get one of these keyboards or one of these keyboards and carry it around in your briefcase. Pretty to hard to stick a hardware sniffer in something that's always with you. :)

    15. Re:Encryption by Surak · · Score: 2, Funny

      Or better yet, get one of these keyboards and as an added bonus, cybersex is now 1000% easier. :)

    16. Re:Encryption by The_K4 · · Score: 1

      I can just see it now:
      "You Illeaglly searched my client's residence"
      "Actually we were just there fufilling the wire tap order"
      "INSIDE my client's home?"
      "Well he had a scrambler on his phone so we used a different method to install the legal wiretap, we placed a bug IN the phone. We just happened to see other incriminating evidence while performing the wiretap".

      Most good judges whould have a fit at this!

    17. Re:Encryption by N7DR · · Score: 1

      Most likely the reason is the obvious one: because service providers are required by statute to provide encryption keys if they know them. In many telephony services, the provider generates the keys -- because the purpose is to keep users' conversations secure from casual eavesdropping, not from eavesdropping by Law Enforcement or the operator itself.

    18. Re:Encryption by jackdoodle · · Score: 3, Interesting

      It's almost as if you can read the air quotes around the word 'encryption'...you can assume that even if it is military grade encryption, the NSA knows how to crack it, via back doors or otherwise. After all they were in on DES from the beginning, and had a hand in selecting Rijndael as the new AES.

      From an American Mathematical Society report, for instance:
      "NIST's evaluation used published research from academic and industry experts and private advice from the National Security Agency (NSA)." Gee, I wonder what kind of 'advice' they gave...

    19. Re:Encryption by Ironica · · Score: 1
      AC writes: PGP doesn't help you one whit when the feds slip into your house at night and plant a keysniffer to get your private key/pass phrase...

      Surak writes: Heh. Right. Maybe on your Windoze box where you don't know what processes are running, etc., but that's much more difficult to do on Linux box, especially when the Linux box is owned by a Unix sysadmin with more than 10 years of experience...

      Finni writes: How does 10 years of experience translate into knowing about the hardware bug they slipped into your keyboard?

      Xanadu writes: It doesn't. That was his/her/it's freakin' point. Esentially, the post was about "hidden" processes running on various OS's out there. *MUCH* easier to detect on *NIX. THAT was the point. I suggest you actually read articles and posts before posting in the future.

      You're right that the AC's point was that software intrusion is easier to detect on *nix. That post, however, entirely missed the point of the parent, which is that if the feds want to know what you're typing, they will install *hardware* detection.

      Reading threads before posting is a good idea... you're right about that too.

      (Apologies for the redundancy of this post go out to all those who read this stuff the first time around.)
      --
      Don't you wish your girlfriend was a geek like me?
    20. Re:Encryption by anonymous+loser · · Score: 1
      Theres no industrial strength encryption for telephones readily available that hasnt been defeated these days

      Yes there is.

    21. Re:Encryption by scrod · · Score: 1

      Well, what's to stop them from planting something either inside the machine itself or around it? It's still possible to pick up the electromagnetic emanations (a la TEMPEST) from the keyboard. And of course there's always Van Eck phreaking.
      A laptop is really one of the best solutions--you can use it for sensitive things when you're certain that there aren't any bugs in the vicinity and if you keep it with you at all times, you can be relatively sure that no one has planted any bugs in it.

    22. Re:Encryption by Suidae · · Score: 1

      And you can use that 'rubber hose' plausable deniability software to keep your data safe, and for the truely paranoid, install a small amount of shaped explosive charge in the PC card bay below the harddrive. Its *very* difficult to extract data from a shattered drive platter, and the amount of explosive required isn't enough to do serious damange to anything nearby. Just don't try to take it on the plane with you.

    23. Re:Encryption by CracktownHts · · Score: 2, Insightful
      It would help to know who these LEOs are before guessing on whether they can crack RSA, 3DES and similar. Two possibilities:

      1) The list consists solely of FBI, DEA or similar "non-intelligence" agency (wait, that came out wrong...) whose activities were not supported by an intelligence agency (NSA, CIA)
      2) The list includes NSA or CIA-supported entities.

      If (1), these wiretaps were performed by someone other than an intelligence agency, then the encryption probably became a non-obstacle either because the LEO was unwittingly helped by one of the parties to the communication (through carelessness or coercion) or because the LEO is using a loose definition of encryption (like GSM on a cell phone, for example, which has been demonstrated to be insecure). Non-intelligence-related LEOs are not likely to be a party to any heavy-duty cracking abilities that may be in the possession of NSA or CIA, assuming the pre-9/11 intelligence situation hasn't changed significantly.

      If (2), then we can assume the LEOs either had the help of NSA/CIA, or are NSA/CIA. The former is implausible because the NSA has bigger fish to fry than drug traffickers and mobsters, and the NSA doesn't want to tip off the international intelligence community if it can crack strong public key encryption, even if it means letting some mobster escape prosecution. The latter is plausible but one typically doesn't expect to read the NSA's official reports on the internet. You'd think they'd be more secretive about their wiretapping activities.

    24. Re:Encryption by Anonymous Coward · · Score: 0

      One way to prevent a keyboard wiretap might be to SUPERGLUE they keyboard shut, and glue the connector to the back of the PC as well so they can't stick a little connecter between the keyboard and PC that way.

      You might also have to glue the case shut though because if they can access the inside of it then they could clip somehting onto the conectors inside. Then again, you could possibly put an ALARM inside the case, but it would have to be some kind of alarm that you can tell if the batteries have been removed.

    25. Re:Encryption by ichimunki · · Score: 1

      Dogs are great for deterring casual intruders, but they would not deter serious intruders (like the FBI or organized criminals)-- dogs can be mitigated easily with things like heavy blankets or bags, non-lethal nooses, and tranquilizers. Nor can the dog communicate meaningfully about intrusions once they've occurred, so you might know someone had been in, but not what they did.

      Best bet is small hidden cameras or other intrusion detection systems. That way you have a much higher likelihood of getting an accurate record of what happened during the intrusion. This is important during the recovery phase, because otherwise you have no idea what was compromised. Did they bug the keyboard? Did they install software? Did they simply plant a small wireless camera facing your keyboard or monitor? If you can pinpoint what they did, then you can counter that threat directly rather than having to take the most extreme measures available (i.e. complete destruction of all incriminating evidence and/or keys).

      On deterring casual intruders: I like to leave my mp3 server running a little digital DJ I wrote, that uses voice synthesis to announce songs and times between songs. Very hard to tell if I'm home or not with that on. Lower tech solution would be to just leave the radio or tv running.

      --
      I do not have a signature
    26. Re:Encryption by Methuseus · · Score: 1

      the term "encryption" literally means to make a message hard to read and disguising it's contents. This is from a book all about cryptography (Applied Cryptography by Bruce Schneier, one of the better boks on the subject).

      In essence the people you talked to were talking about a one-way hash. You can think of it as an MD5 checksum. Running a checksum merely shows you that it's the same file, bit for bit, that it should be. But, you can't get the original file from the checksum.

      Anybody that truly knows much about cryptography knows that trying to protect your info totally is so much crap. You can only make it hard enough that spending the time and money to decipher it costs too much to be worthwhile. Such as encrypting the next week's sales prices at Target in an encryption scheme that couldn't be cracked in the time before you released the prices yourself. Now I could go on, but I know I've already said too much on the subject.

      By the way, you spelled placebo right.

      --
      Two things are infinite: the universe and human stupidity, though I'm not yet sure about the universe. - A Einstein
    27. Re:Encryption by Anonymous Coward · · Score: 0

      > PGP doesn't help you one whit when the feds slip
      > into your house at night and plant a keysniffer to
      > get your private key/pass phrase -- and they will

      They won't tap my keyboard. I wrote a computer
      program to monitor the keyboard and let me
      know when something like this has been done.

      Yes, it's paranoid, but it's just part of the
      drama we make in our lives. I had the skills
      to be paranoid, so there seemed no reason not
      to do it.

    28. Re:Encryption by some+guy+I+know · · Score: 1
      the [...] point of encryption is to be able to turn the encrypted data back into plaintext...
      WHAT [...] is the point of encryption if that is impossible?
      Undecryptable encryption can be useful for data verification.
      That's what md5, etc., do.
      --
      Those who sacrifice security to condemn liberty deserve to repeat history or something. - Benjamin Santayana
  3. FYI - Starium 100 TripleDES bump in the line by wherley · · Score: 3, Informative

    Here it is.

    1. Re:FYI - Starium 100 TripleDES bump in the line by alexandre · · Score: 1

      Any idea how much could this cost? :)

    2. Re:FYI - Starium 100 TripleDES bump in the line by Q+Who · · Score: 1

      Simple to use, great - but the company provides no specifications, like how random numbers are generated (most essential to Diffie-Hellman key exchange protocol), signal input/output details (so that the device can be verified properly).

      The cryptographic details also don't allow to trust this device too much - why did they use TDEA, the effective key length is not quite 168 bits (although meet-in-the-middle attack to reduce it to 112 bits is probably not applicable in this case), why do they use such a low modulus (think of it as 1024 bits in RSA), if they used such modulus for speed reasons, why didn't they use elliptic curve cryptography, again why the hell did they use TDEA which is susceptible to known attacks).

      Most importantly, this device seems to be completely useless against active wiretapping, since Man-in-the-Middle attack (which is trivial for the government in telephony) will break this setup completely. What is displayed on the screen is probably some hash of the shared secret, in which case it is completely useless due to its small size (exhaustive search done by the attacker would do, and even if it weren't possible, most people wouldn't understand why they need to check that they have the same hash each time they communicate).

      In short, no thanks.

    3. Re:FYI - Starium 100 TripleDES bump in the line by Q+Who · · Score: 1

      Any idea how much could this cost? :)

      In the worst case, the money-value of the secrets you trust it with, combined.

    4. Re:FYI - Starium 100 TripleDES bump in the line by shdragon · · Score: 2, Interesting

      Do you work for them or something? I went to their home page and I can't bring up anything on their products, just fluff about management and jobs. Not even an old Wired article from 1999 gets me to a "products" page.

      --
      "...we dont care about the economics; we just want to be able to hack great stuff."
    5. Re:FYI - Starium 100 TripleDES bump in the line by Beryllium+Sphere(tm) · · Score: 1

      They're comatose if not actually dead. What I heard was that they couldn't find a price/volume point that would bring in enough revenue to bring in enough venture money to ramp up.

      Eric Blossom speculates that the same functionality could be put into cellphone software someday. I bet the manufacturers wouldn't dare put strong encryption in at the factory, though.

  4. Stupid bad guys. by slyckshoes · · Score: 1

    Those bad guys really need to learn how to use some real encryption. Yeah, that's what happened....

    All your SSH... nevermind.

    1. Re:Stupid bad guys. by Skyshadow · · Score: 4, Interesting
      Those bad guys really need to learn how to use some real encryption.

      I tend to believe that the government is able to either break or circumvent levels of encryption at a much higher level than commonly thought. I mean, it's entirely possible that old devices were being used for communication, but it seems to be if you're going to be cautious enough to encrypt comms at least one or two would have done it properly.

      I wonder: If encryption on the line prevents a court-ordered wiretap from obtaining useful information, is that enough cause to, say, break in and bug the room? The wording of the statement seems to suggest that...

      --
      Every year during my review, I just pray the words "slashdot.org" aren't mentioned.
    2. Re:Stupid bad guys. by sethstorm · · Score: 1, Informative

      It wont matter much (aside from those who use keys to auth) on what crypto you use most of the time if the hardware you use to make the transaction work is bugged.

      --
      Twitter supports and protects racists - by smearing their critics with the "Hate Speech" label.
    3. Re:Stupid bad guys. by koehn · · Score: 4, Insightful

      Believe me, right now I'm more worried about the bad guys getting my passwords than law enforcement. The bad guys might know what to do with the data I send around, law enforcement can't touch it without going to jail themselves. I'll keep using SSH, thank you very much.

      I do find it interesting that most of the taps had to do with narcotics... what passwords do drug dealers use that are easy to guess?

    4. Re:Stupid bad guys. by Anonymous Coward · · Score: 0

      I tend to believe that the government is able to either break or circumvent levels of encryption at a much higher level than commonly thought.

      To break - you obviously don't have a clue about the current state of the science of encryption (no, they can't). To circumvent - you obviously don't have a clue about what is going on in electronic intelligence (they can, more than you can imagine).

    5. Re:Stupid bad guys. by Anonymous Coward · · Score: 0

      law enforcement can't touch it without going to jail themselves. I'll keep using SSH, thank you very much.

      Umm, you don't have rights anymore. You really think LEO give a flying fuck for your imagined "sanctuary". If they've have an interest in you, they will do whatever they want. Good grief, you been in a coma or something?

      Television zombies say the cutest things. "THinking happy because authority people here to protect! me thinking happy and safe!"

    6. Re:Stupid bad guys. by maxpublic · · Score: 1

      The bad guys might know what to do with the data I send around, law enforcement can't touch it without going to jail themselves.

      What a wonderfully naive view of the world. You seem to think that law enforcement officials feel compelled to themselves obey the law in the pursuit of an investigation.

      Speaking from personal experience, I can tell you straight out that this often isn't the case. If you have to bend or even break a few laws to get the bad guy, then that's what you do - just make sure that no one figures out what you've done.

      How this makes the officials in question any different than a pack of mafia thugs is rather beyond me, but they certainly seem to think that it's okay to say 'fuck the law' if that's what it takes. And nowadays, the next 'bad guy' could be you.

      Max

      --
      My god carries a hammer. Your god died nailed to a tree. Any questions?
    7. Re:Stupid bad guys. by lamber45 · · Score: 2, Funny
      what passwords do drug dealers use that are easy to guess?

      3m1n3m
      pot
      money
      big_high

      Or mabey the encryption was by financial insiders, but they wrote their passwords on notepads by their desks...

  5. Read carefully by Shimmer · · Score: 4, Interesting

    however, in none of these cases was encryption reported to have prevented law enforcement officials from obtaining the plain text of communications intercepted

    Does this mean that all the communications were successfully decrypted? Or maybe it just means that failures were not reported?

    -- Brian

    --
    The most rabid believers in American Exceptionalism are the exact same people whose policies are destroying it.
    1. Re:Read carefully by stratjakt · · Score: 5, Insightful

      Could be a ton of things.

      Could be that they got one end of the transmission to roll over on his buddy and hand out the plain text, this seems most likely. All the tough guy criminals squeal like little piggies when a DA starts talking about jail time.

      Could be they got the password to decrypt the wiretaps, or the plain text, through normal policework (like a warrant to search the PC). The fact that guy A is talking to known crime figure B is probably enough for such a warrant, regardless of whether its known what they said.

      I mean, if somethings encrypted on the wire, then it was plaintext when it went in, and when it came out. I'd think most detectives would try another angle before they sat around trying to brute force decrypt a transmission.

      --
      I don't need no instructions to know how to rock!!!!
    2. Re:Read carefully by Shimmer · · Score: 0

      Very good point.

      --
      The most rabid believers in American Exceptionalism are the exact same people whose policies are destroying it.
    3. Re:Read carefully by Tackhead · · Score: 4, Informative
      > > however, in none of these cases was encryption reported to have prevented law enforcement officials from obtaining the plain text of communications intercepted
      >
      >Does this mean that all the communications were successfully decrypted? Or maybe it just means that failures were not reported?

      Yes, it means all of the communications were successfully decrypted. It does not mean that failures were not reported.

      It is (deliberately) vague about whether decryption was done by s00per-s33kr1t quantum computers on Mars, or if it was done by using other methods to compromise the suspect's password, passphrase, key, or leaked transmissions of plaintext. I don't have a need to know, but I would suspect the latter is the more likely possibility. The weakest link in any cryptosystem is the moron behind the keyboard.

      I would point out that we're still barely talking about double digit numbers of wiretaps here. ("16", "18")

      Those of you with nightmares about everybody in the US being tapped can move along, because there's very little to see. While it may be possible to do such a thing, it would still be prohibitively expensive. Not just in terms of computing gear (which is getting cheaper and always will get cheaper), but in terms of manpower (which ain't any cheaper, and ain't gonna get any cheaper) to analyze it.

    4. Re:Read carefully by GMontag · · Score: 3, Insightful

      The main reason that I included that passage in the story was because it appears that no investigation was thwarted by encryption.

      Point being, all of this claptrap on restricting encryption is just that, meaningless nonsense.

      If encryption were creating a real problem for law enforcement then there would be some number of un-decripted messages to account for and I would not assume even that would create a problem in each instance.

    5. Re:Read carefully by Bradee-oh! · · Score: 2, Insightful

      I would point out that we're still barely talking about double digit numbers of wiretaps here. ("16", "18")

      Those of you with nightmares about everybody in the US being tapped can move along, because there's very little to see.


      I am not a huge conspiracy theorist myself, but playing devil's advocate on this is irresistable - do you really think that simply because the agency reported only 16 or 18 wiretaps for the given years that only 16 or 18 actually took place?

      Isn't the worry of all the 1984-ists out there not about the wiretaps the government legally executes but about the ones you never hear about?

      --
      "This is Zombo Com, and welcome to you who have come to Zombo Com" - www.zombo.com
    6. Re:Read carefully by Blaine+Hilton · · Score: 1

      Remember though that while the detective is using a brute force cracker he can be siting eating doughnuts instead of out looking for real bad guys.

    7. Re:Read carefully by Anonymous Coward · · Score: 0

      Yup ... simple traffic analysis may be all they needed. In fact, if traffic analysis alone wasn't enough for a warrent, traffic analysis PLUS the fact that it was encrypted may have tipped the scale in favor of a warrent. The plaintext would be gravy, but not worth the effort.

    8. Re:Read carefully by Q+Who · · Score: 1

      Point being, all of this claptrap on restricting encryption is just that, meaningless nonsense.

      Point being, due to restricting encryption various agencies can scan all the telephony communications without any effort.

    9. Re:Read carefully by GMontag · · Score: 1

      Point being, due to restricting encryption various agencies can scan all the telephony communications without any effort.

      How are the "real criminals" restricted? They can literally use whatever they like and, yes, this is yet another arguement against encryption restriction.

      Umm, how are the rest of us "restricted"?

    10. Re:Read carefully by Ironica · · Score: 1
      I would point out that we're still barely talking about double digit numbers of wiretaps here. ("16", "18")

      Those of you with nightmares about everybody in the US being tapped can move along, because there's very little to see.

      From the article:
      the number of wiretap applications granted for which encryption was encountered

      So, we see that:

      - The number of wiretaps applied for (i.e. that they had a legal justification for doing) which were actually encrypted was barely double-digits. This gives us no info about the total number of wiretaps applied for, and does not rule out un-applied for wiretaps.

      - The Patriot Act rescinds the restrictions on FBI wiretapping that require them to have a good reason. The numbers for 2003, which will probably not be released without the ACLU suing under the Freedom of Information Act, will probably be a lot higher.

      Those restrictions were put in place originally because the FBI was running rampant during the McCarthy era, tapping every phone line of everyone that wore maroon two days running. They're perfectly capable of tapping far more than they have been in the last couple decades, and almost certainly will step it up in the current political climate.
      --
      Don't you wish your girlfriend was a geek like me?
    11. Re:Read carefully by Peter+Eckersley · · Score: 1
      I would point out that we're still barely talking about double digit numbers of wiretaps here. ("16", "18")

      It appears you didn't look at the report.

      Intercept applications requested: 1359 Intercept applications authorized: 1358

      Those numbers are still very low, of course. Wonder if they include deployments of carnivore/"magic lantern"... I recall hearing much higher per-country figures for Europe. Wonder if they include deployments of carnivore/"magic lantern".

    12. Re:Read carefully by oh · · Score: 1
      I am not a huge conspiracy theorist myself, but playing devil's advocate on this is irresistable - do you really think that simply because the agency reported only 16 or 18 wiretaps for the given years that only 16 or 18 actually took place?

      This was the number of wiretaps that were executed and encountered encryption.
      According to this part of the article there were 1,358 wiretaps, of which only about 1.5% involved encryption.

      Does this sound like crypto technology is a major issue for law enforcement?
      --
      Democracy isn't about no one telling you what to do. It's about everyone telling you what to do.
  6. Indeedyay... by Hayzeus · · Score: 4, Funny
    however, in none of these cases was encryption reported to have prevented law enforcement officials from obtaining the plain text of communications intercepted.

    ... it'say orthway ememberingray atthay igpay atinlay isay ayay esslay anthay idealay ormfay ofyay encriptionay.

  7. An interesting number by truthsearch · · Score: 4, Interesting

    For those who don't RTFA, here's one interesting number: Average cost per intercept order = $54,586

    I don't see any reference to how the number is determined, like if it includes parts of salaries for employees.

  8. Makes me glad.... by JayAndSilentBob · · Score: 2, Funny

    This makes me glad I ordered a whole slew of phone tap warning stickers from CrimeThinc. I can't wait for them to arrive. Maybe it can help make a difference against the evil Patriot Act.

    --


    Love,
    Jay and Silent Bob
    1. Re:Makes me glad.... by Anonymous Coward · · Score: 0

      Did you see the other sticker set that site offers (about Iraqi blood)? That destroys any credibility the site might have have, and by sending them money, you've helped the terrorist cause.

      It will not help make a difference in the Patriot Act.

    2. Re:Makes me glad.... by Anonymous Coward · · Score: 0

      It'll probably just get you put on a gov't watch list.

  9. Public Report by Jim+Buzbee · · Score: 5, Insightful

    Make what you will about this report, but consider this for a moment: In what other country in the world would this report ever see the light of day?

    1. Re:Public Report by Anonymous Coward · · Score: 0

      Probably none.... every other country would publish a real report.

    2. Re:Public Report by Anonymous Coward · · Score: 0

      Canada...

    3. Re:Public Report by Anonymous Coward · · Score: 0

      Ever read "Brave New World"?

    4. Re:Public Report by jamboarder · · Score: 1

      Oh, oh so its all good since they're TELLING us they're doing it...

      amazing how we satisfy ourselves with the crumbs from the massa's table...

    5. Re:Public Report by alienw · · Score: 1

      This is a law enforcement report, not something published by the NSA or the CIA (who actually do most of the real wiretapping). The latter two agencies don't publish any such reports. As for your question: most civilized countries, which includes all of Europe, publish similar reports.

    6. Re:Public Report by limekiller4 · · Score: 5, Insightful

      Jim Buzbee writes:
      "Make what you will about this report, but consider this for a moment: In what other country in the world would this report ever see the light of day?"

      Oo! I know! A country whose government realized a long time ago that they could fool 99% of the population -- and simultaneously marginlize the remainder as leftists -- by releasing just enough and/or falsified data to make people think this is evidence of an open government?

      Am I right? Do I get a lolipop?

      Iran-Contra taught me everything I needed to know about the government's willingness to not only lie to the people and Congress itself but to be proud of doing so. For those who don't remember all the details, this was Oliver North being directed by Ronald Reagan to sell arms to Iran (despite a Congressional ban) and using the proceeds to fund the South American Contras (which was also specifically banned by Congress by way of the Boland Amendment). The Contras were fighting the Sandinistas, a democratically-elected government that wasn't kissing our ass).

      Don't get me wrong here... I'm not claiming this data is either falsified or incomplete. But claiming that because we've recieved something from the government is prima facie evidence that we have a government that puts us before it's own perceived interests is nothing short of hilarious.

      --
      My .02,
      Limekiller
    7. Re:Public Report by AndroidCat · · Score: 1

      They aren't allowed to do domestic operations. Hey, stop laughing!

      --
      One line blog. I hear that they're called Twitters now.
    8. Re:Public Report by Anonymous Coward · · Score: 0

      "prima facie"? That's Latin for "In your face", right?

    9. Re:Public Report by Anonymous Coward · · Score: 0
      Make what you will about this report, but consider this for a moment: In what other country in the world would this report ever see the light of day?

      Most of them. What a distorted view of the world you have.

    10. Re:Public Report by enkidu55 · · Score: 1

      W00t grats to you for speaking the truth.

      Don't you hear the knocks at your door yet??

      No worries I swear it's just a gas company rig parked in a van across the street from you for a week. :)

    11. Re:Public Report by Anonymous Coward · · Score: 0

      At least half of the EU countries, probably Canada, possibly Australia, New Zealand, Japan, there are likely others.

      Governmental transparency as a concept is certainly not unique to the US. If anything, the US hides an exceptionally large amount of information for "national security" reasons.

      Even if "most of the world is worse", that isn't an excuse to not try to be better.

    12. Re:Public Report by ces · · Score: 2, Interesting

      Sorry, but wiretaps really ARE expensive and aren't all that common. The tinfoil hat crowd may think the NSA/CIA/FBI is monitoring all of their phone and computer communications but, really, there just isn't the manpower or the time. I've heard the paranoids claim there is "s00per-s33kr1t" voice reconition to do automated monitoring, but based on what I know about computers and linguistics this just isn't currently possible.

      --
      Happy Fun Ball is for external use only.
    13. Re:Public Report by Jim+Buzbee · · Score: 1

      At least half of the EU countries, probably Canada, possibly Australia, New Zealand, Japan, there are likely others.

      Governmental transparency as a concept is certainly not unique to the US. If anything, the US hides an exceptionally large amount of information for "national security" reasons.

      Even if "most of the world is worse", that isn't an excuse to not try to be better.


      Agreed. I just wanted to spark some conversation!

      Jim

    14. Re:Public Report by pmz · · Score: 1

      The tinfoil hat crowd may think the NSA/CIA/FBI is monitoring all of their phone and computer communications but, really, there just isn't the....

      ICARUS HAS FOUND YOU!!!! RUN WHILE YOU CAN!!!!

    15. Re:Public Report by Anonymous Coward · · Score: 0

      "based on what I know about computers and linguistics this just isn't currently possible"

      well, i guess i'll just have to base my evaluation of the meaningfulness of your opinion on what you know.... which is what, precisely? or are you not allowed to talk about that...?

      "d00d, i work at NSA in the natural language analysis department, and we've got this slick-ass system that runs on the biggest beowulf cluster i have ever seen!!! i can't even COUNT the number of blinky lights!!!"

    16. Re:Public Report by limekiller4 · · Score: 1

      ces writes:
      "Sorry, but wiretaps really ARE expensive and aren't all that common. The tinfoil hat crowd may think the NSA/CIA/FBI is monitoring all of their phone and computer communications but, really, there just isn't the manpower or the time. I've heard the paranoids claim there is "s00per-s33kr1t" voice reconition to do automated monitoring, but based on what I know about computers and linguistics this just isn't currently possible."

      Post grad-level students were using 30-node (not a typo) AI nets to extract voices out of a noisy environment +30dB above the base level of the sought-after voices a few years ago. By this I mean circa 1998.

      But you kind of focused on what I went out of my way to stress specifically wasn't the point and glossed over what I emphasized was the point. Again, I never said this report was flawed or skewed. I said that for someone to claim that release of information by the government is not, inof itself, prima facie evidence that the government in question has the best interest of its citizenry in mind. In our case I'd more readily suspect that they merely learned how to play the game.

      --
      My .02,
      Limekiller
    17. Re:Public Report by Anonymous Coward · · Score: 0

      Since when is Nicaragua South America? Since when has the US NOT been overthrowing democracies and replacing them with dictatorships?

    18. Re:Public Report by Ironica · · Score: 1

      Wiretaps are (or, at least, until very recently were) far less common than they were in the 1960's, when the McCarthy bug was going around. That's because we started requiring the FBI to get court orders to do wiretapping. Since then, it's become much easier to do a wiretap, and we've had 9/11, which has opened the floodgates on funding to "counter terrorism."

      They don't have the means or the funds to monitor everyone, or even most people. But they do have the means to at least somewhat monitor the million or so they consider the most dangerous. But, since you're willing to patronize the conspiracy theorists, that will probably bump you far enough down the list that *you're* safe. And after all, that's what really matters, isn't it?

      Oops, I think I just moved myself up to 999,999...

      --
      Don't you wish your girlfriend was a geek like me?
    19. Re:Public Report by ces · · Score: 1

      Wiretaps are (or, at least, until very recently were) far less common than they were in the 1960's, when the McCarthy bug was going around. That's because we started requiring the FBI to get court orders to do wiretapping. Since then, it's become much easier to do a wiretap, and we've had 9/11, which has opened the floodgates on funding to "counter terrorism."

      They don't have the means or the funds to monitor everyone, or even most people. But they do have the means to at least somewhat monitor the million or so they consider the most dangerous. But, since you're willing to patronize the conspiracy theorists, that will probably bump you far enough down the list that *you're* safe. And after all, that's what really matters, isn't it?


      I'm a member of the ACLU, People for the American Way, the EFF, and the NRA. I am a strong believer in electronic privacy and Constitutional freedoms and have been for some time. I wrote letters (actually FAXes) to my Representative and Senators urging them to oppose the PATRIOT act.

      The problem I see is the paranoids make it much harder to oppose government intrusions on privacy. You often have to spend a lot of time convincing people you aren't just someone who's tinfoil hat is on a bit tight before they will listen to your arguments.

      Let's face it law enforcement resources are limited. There just isn't the manpower to monitor a million or even a hundred-thousand people on any sort of regular basis. This doesn't mean abuses don't happen or that the acceptable number of abuses is anything other than zero.

      --
      Happy Fun Ball is for external use only.
    20. Re:Public Report by ces · · Score: 1

      well, i guess i'll just have to base my evaluation of the meaningfulness of your opinion on what you know.... which is what, precisely? or are you not allowed to talk about that...?

      The information is out there if you care to look for it (hint start with Google). I'm not going to attempt to summarize many years of school, practical experience, reading, and converstations here.

      The short answer is current technology for speech recognition with multiple speakers with no training is very limited. The system Sprint uses for its customer service is pushing the state of the art and even then is quite limited and likely to be confused if someone isn't speaking clearly.

      There are a number of other problems such as bandwidth requirements to perform monitoring and the general lack of intercept capablity in most central office gear.

      --
      Happy Fun Ball is for external use only.
    21. Re:Public Report by Anonymous Coward · · Score: 0

      CIA no, NSA yes. Why else would they have acres of computer farms?

    22. Re:Public Report by Buck2 · · Score: 1

      Post grad-level students were using 30-node (not a typo) AI nets to extract voices out of a noisy environment +30dB above the base level of the sought-after voices a few years ago. By this I mean circa 1998.

      What are you talking about? If you are referencing extracting a few trained words in a "cocktail party" environment then you might be correct. The level of recognition necessary for automated wiretapping of any value is still far beyond anything currently available AFAICT.

      --

      As my father lik@(munch munch)... ....
    23. Re:Public Report by AndroidCat · · Score: 1

      Until the Patriot Act, the NSA weren't supposed to listen in on Americans, but they bent that rule quite a bit. And they did cut a deals where they got friendly agencies of other countries to return favours by doing it for them. (At least the was the situation cira The Puzzle Palace.)

      --
      One line blog. I hear that they're called Twitters now.
    24. Re:Public Report by limekiller4 · · Score: 1

      Buck2 writes:
      "What are you talking about? If you are referencing extracting a few trained words in a "cocktail party" environment then you might be correct. The level of recognition necessary for automated wiretapping of any value is still far beyond anything currently available AFAICT."

      So in the opening sentence you admit not knowing precisely what I'm speaking about and then continue to debunk ...it, ...whatever that happens to be.

      God, I love you people.

      --
      My .02,
      Limekiller
    25. Re:Public Report by Buck2 · · Score: 1

      I was asking you what, specifically, you were talking about. An expansion on your reference to a 30-node piece of AI.

      --

      As my father lik@(munch munch)... ....
    26. Re:Public Report by Vlad_the_Inhaler · · Score: 1

      The Sandinistas came to power in a (popular) revolution, overthrowing the Somoza clan who had been backed for years by the US. Jimmy Carter - to his credit - did not get involved. The 'boss' Somoza was a typical Latin American dictator, ruling through fear while robbing the country blind.

      Where I am less than sure is that the Sandinistas actually had held elections by then, or at least elections that would be accepted as 'Free and Fair'. Then again, Florida's election could have done with UN observers :-)

      Now to the point: Oo! I know! A country whose government realized a long time ago that they could fool 99% of the population -- and simultaneously marginlize the remainder as leftists -- by releasing just enough and/or falsified data to make people think this is evidence of an open government?
      You seem to consider 'the government' to be one monolithic block, marching in one direction. Administations are made up of people and these people have different interests and different viewpoints. This report could have seen the light of day in virtually any European country, or in most other real democracies. The US is nothing special there. Claiming that the report was released as a sop to the masses goes just as far in the other direction - it just smells of paranoia.

      --
      Mielipiteet omiani - Opinions personal, facts suspect.
    27. Re:Public Report by limekiller4 · · Score: 1

      Vlad the Inhaler writes:
      "...it just smells of paranoia."

      My only real point, the only aspect I'm really interested in is the notion that there are those inside the government who are willing and able to lie to the American people and, worse, able to convince themselves that they're acting patriotically when they do so.

      If we can agree on that aspect then I consider all the rest just cruft that can go either way.

      BTW, love your username. =)

      --
      My .02,
      Limekiller
    28. Re:Public Report by Vlad_the_Inhaler · · Score: 1

      Oh, absolutely no doubt about that. That is also the same in any organisation exceeding about 10 individuals - probably less. The organisations I worry about are the ones that promote that sort of thing . . .

      I also remember that behaviour at Watergate, and to a far greater extent during the Reagan administration. Both of them were Republican, I can't think of any Democrat administrations behaving like that, but Johnson (I was a kid then) seems a likely candidate.

      As to the username (thanks), the idea just came to me :-)

      --
      Mielipiteet omiani - Opinions personal, facts suspect.
  10. I wonder by Telastyn · · Score: 2, Insightful

    if that includes this. Or another situations where the wiretap failed, and the police were able to get the information in a more traditional or creative way rather than breaking the encryption.

  11. Oh my! by burgburgburg · · Score: 1, Funny
    Does this mean that my ROT 13 phone is not the security answer I was looking for?

    Am I going to have to filter everything through my Swedish chef filter? Bork bork bork, bork, bork bork?

    1. Re:Oh my! by Anonymous Coward · · Score: 0

      I've never gotten along well trying to rot13 my phone... I kind of prefer rot +-6.5 which amounts to holding the phone normally while laying down.

    2. Re:Oh my! by Graspee_Leemoor · · Score: 1

      " Does this mean that my ROT 13 phone is not the security answer I was looking for?"

      Yes. "Move along".

      (See also "Look Sir, encryption!").

      graspee

    3. Re:Oh my! by Steve+B · · Score: 1
      Does this mean that my ROT 13 phone is not the security answer I was looking for?

      Not by itself. You need to chain two of them in series.

      --
      /. If the government wants us to respect the law, it should set a better example.
  12. Wow, another number by truthsearch · · Score: 3, Informative

    I just noticed that for the NY Organized Crime Task Force's 7 intercepts, the average cost was $886,999. Yet for Special Narcotics it's only $8747. I suppose it's due to the duration of the intercepts.

    1. Re:Wow, another number by hpa · · Score: 2, Interesting

      More likely it is due to the number of lawful intercepts that they have to spill out the cost of the unlawful ones between.

      (If you think that doesn't happen, look at the past.)

    2. Re:Wow, another number by Angry+White+Guy · · Score: 1

      (If you think that doesn't happen, look at the past.)

      Or here, or here, or here, or even here!

      --
      You think that I'm crazy, you should see this guy!
    3. Re:Wow, another number by Black+Copter+Control · · Score: 1
      I just noticed that for the NY Organized Crime Task Force's 7 intercepts, the average cost was $886,999. Yet for Special Narcotics it's only $8747. I suppose it's due to the duration of the intercepts.

      At $900K/wiretap, that's 6.2Million dollars in the NY area. If you subtract $300K for some donught-eating dective to exclusively listen on each line 24/7 ($100K*3 shifts), that still leaves 4.1Million for hardware and social engineering to circumvent those combined wiretaps' encryption.

      For my part I'd say it's because the NY organized crime bosses put more thought and energy into their encryption methods. The mafia have a long history and a long memory. They've learned what circumvention methods have been successuful in the past and they're using (reasonably) effective counter-measures.

      The average non-mafia druggie, on the other hand, is probably going to shell out $1400 for an off-the shelf, spamvertized, phone encryption unit and presume that it'll keep the feds off of his line (rong!) even though (s)he didn't take the time to learn how to use it properly (double rong!).

      Good encryption -- like any other security regime -- isn't going to keep out an absolutely determined opponent.. It's really intended to make their life hard enough that most attackers will go find a 'softer' target.
      The Mafia appears to be a real 'juicy' target with an extremely hard shell.

      --
      OS Software is like love: The best way to make it grow is to give it away.
  13. How was the plain text obtained? by _bug_ · · Score: 5, Insightful

    You've got two ends of the pipe where the data winds up as plaintext. If either end was compromised, as would seem to be the case, then there's no need to worry about cracking the ciphertext.

    It's not the encryption algorithm or perhaps even the implementation that's weak. It's how the user manages his or her data.

  14. Stats out of context by Anonymous Coward · · Score: 0

    16 and 18 encypted. thats nice. is that 16 out of 16, 16 of 1 million? does it say it the artical that i just haven't opened yet?

  15. Form the report by Timesprout · · Score: 3, Interesting

    It looks like there were some 1350 odd state and federal authorised wiretaps. Anyone have any idea how credible this number is? Colour me paranoid but in the current climate I would have expected a much higher number. Or have I just misread the report (OK I admit I only glanced at it)

    --
    Do not try to read the dupe, thats impossible. Instead, only try to realize the truth
    What truth?
    There is no dupe
    1. Re:Form the report by Spasemunki · · Score: 1

      This report seems to include only wiretaps granted by judges in the course of criminal investigations. Thus it wouldn't reflect any intelligence gathering monitoring, which gets approval for domestic-related wiretaps from courts that are not required to report anything about their decisions (there are judges that are appointed with the duty of granting these orders; they never hear oppositional arguments, thus they almost always grant them). Furthermore, anytime one end of the call lands outside the U.S, all bets are off. I'd say this is probably a good indicator for what it's talking about; wiretaps used to break up gambling rings and catch murder-for-hire schemes. Little or no reflection on U.S use of wiretaps for intelligence/terrorism/etc. purposes (remember, they're not criminals- they're 'enemy combatants')

    2. Re:Form the report by Beetjebrak · · Score: 1

      Last time I checked here in the Netherlands (15,500,000 inhabitants) there were over 20,000 wiretaps conducted per year on average. I may be slightly off since the number comes from my own foggy memory, but 1350 for a country with at least an order of magnitude more citizens.. and a paranoid administration? I don't think so.

      --
      Learn from the mistakes of others. There isn't enough time to make them all yourself.
  16. eeek by sickboy_macosX · · Score: 1

    Am I going to have to get applicatitions so I can use my Bait n Switch or honey pot box(es) Someone awnser the freakin question!

    --
    --- /* In Soviet Russia, the Mac OS X kernel panics you! */
  17. obtaining plaintext probably not so hard... by tuffy · · Score: 1

    ...so long as the feds are able to "extract" the necessary keys and passwords from whoever is involved in the communication. If such data isn't forthcoming, it's easier than ever for the feds to label one a "material witness" and keep them imprisoned for as long as it takes. But that's life in the home of the free...

    --

    Ita erat quando hic adveni.

  18. A warning. by Jerk+City+Troll · · Score: 1

    If the government begins to make motions that encryption should be forbidden or removed from the hands of civilians, we're in serious trouble. It will be one of the final death blows to democracy as we know (knew?) it today. When encryption is outlawed, it will mark the end of privacy in the United States. Then things get really bad.

  19. They probably got the keys from the users by RhettLivingston · · Score: 3, Insightful

    10 to 1, they either found other evidence to force the users to voluntarily cough up the keys, got a warrant to put a sniffer on the user's keyboard in the case of computer communications and then retrieved the keys from the computer after they got the password, or they physically copied the encryption keys out of the phones in the case of encrypting phones.

    I've always wondered if they can get a password from you involuntarily by just hooking you up to a lie detector and asking questions like, "is the first letter a vowel? Is it 'A'? Is it 'E'? Is the second letter a number?... etc.

    Anyway, most encryption is pretty useless if the cracker can own the machine or its keyboard for a while without the user's knowledge and almost all of it is useless if you own the user.

    1. Re:They probably got the keys from the users by eht · · Score: 1

      I'd like to know what letter is a number.

      Thank you

    2. Re:They probably got the keys from the users by Anonymous Coward · · Score: 0

      I've always wondered if they can get a password from you involuntarily by just hooking you up to a lie detector and asking questions like, "is the first letter a vowel? Is it 'A'? Is it 'E'? Is the second letter a number?... etc.

      Just refuse to answer the question.
    3. Re:They probably got the keys from the users by angst_ridden_hipster · · Score: 1

      Wow. I can just see it now.

      This could lead to the slowest brute-force attack ever...

      FBI: So, is your password "jhT78$^&" ?
      Rube: No.
      FBI: He's telling the truth. Damn. So, is your
      password "jhT78$^*" ?
      Rube: No.
      FBI: Damn. He's still telling the truth.
      So, is your password "jhT78$^(" ?
      Rube: No.
      ...

      etc.

      (Yes, I *know* that's not what the poster suggests, but still...)

      --
      Eloi, Eloi, lema sabachtani?
      www.fogbound.net
    4. Re:They probably got the keys from the users by Mawbid · · Score: 2, Funny

      I, V, X, L, C, and M. You're welcome

      --
      Fuck the system? Nah, you might catch something.
    5. Re:They probably got the keys from the users by Mawbid · · Score: 1

      (ahem)
      and D :-)

      --
      Fuck the system? Nah, you might catch something.
    6. Re:They probably got the keys from the users by Alphtoo · · Score: 1

      "I've always wondered if they can get a password fromyou involentarily by just hooking you up to a lie detector and asking questions like, 'is the first letter a vowel? Is it A'?..." Man, they pull that ploy, they better bring along ten or twelve cases of beer (and none of that damn "light" crap) and a box of good cigars. We're gonna be there for awhile. }:~)

  20. Encryption by satanicat · · Score: 1

    Now, I certianly dont know too much about encryption, but I used to talk with people who know an awful lot about it. I was under the impression that if things were actually truely encrypted, they could not be turned into plain text. In essence all we are doing is making it hard to read. not impossible.

    This doesnt suprize me one little bit. Is it all a placebo(i cant spell) to make people think that public networks are safe enough to let out personal information? i dunno, just a thought.

    --
    How Now Brown Cow
  21. A message for those 'in the know' by Anonymous Coward · · Score: 0

    The chair is against the wall.

    John has a long mustache.

    1. Re:A message for those 'in the know' by Anonymous Coward · · Score: 0

      Excellent movie, at least for its time. An adult would have had no suspension of disbelief, but hey, I was like 12 when that movie came out. And I loved the bit about the Boy Scouts being a paramilitary youth organization :)

    2. Re:A message for those 'in the know' by Anonymous Coward · · Score: 0

      Be sure to drink your ovaltine :)

    3. Re:A message for those 'in the know' by Anonymous Coward · · Score: 0

      Setec Astronomy.

    4. Re:A message for those 'in the know' by istartedi · · Score: 1

      It was great because it was such an aberration for Hollywood. I wonder what they had to do to get that thing made. I mean, the Greens party was actually villainized right at the start. The story of how they got that script out has to be almost as good as the movie.

      If you've never seen the movie we're talking about here, Red Dawn, rent it and try to remember that the Soviet Union and nuclear annihilation were still a viable threat when it was made. Either it'll reinforce your opinions about the 2nd ammendment, or you'll think it's total schlock but you won't be bored and you're not likely to have a neutral opinion about it.

      --
      For all intensive purposes, "whom" is no longer a word. That begs the question, "who cares"?
    5. Re:A message for those 'in the know' by Anonymous Coward · · Score: 0

      Yeah, I espically liked the part when John Wayne, Red Buttons, and Eddie Albert yelled "Wolverines!!!"

  22. Maybe the plain text was ..... by Anonymous Coward · · Score: 0

    Maybe the plain text was recovered by other means rather than dycryption.

  23. Only 16? by lexbaby · · Score: 2, Insightful

    Only 16 taps were encrypted? Either the "bad guys" don't even try, or they're not tapping the right people.

    --
    lexbaby
    "Be Brave, Be Loyal, Be True." -- Hawkeye Pierce
    1. Re:Only 16? by Anonymous Coward · · Score: 0

      Or they are just reporting 0.01% of wiretaps.

    2. Re:Only 16? by Anonymous Coward · · Score: 0

      Maybe they AREN'T indiscriminantly wiretapping us citizens like Slashdot likes to FUD about...

  24. Ouch by RightInTheNeck · · Score: 1

    They have very special secret state of the art ways of breaking most encryption these days, expecially since the patriot act. They secretly arrest the person/s involve and tie them to a chair in a little room that doesnt exist on any architecture drawrings. Then some guy breaks the person/s arms until they just tell them the contents of the encrypted msg. You only get two chances. There ready for steganography too, and they put on the rubber gloves for that one, and I doubt they use vasoline folks.

  25. Steganography, anyone? by sssmashy · · Score: 4, Interesting

    Given that the average cost of a federal wiretap in 2002 was $75,659, I imagine there was a strong incentive for gov't wiretappers to get their money's worth. And given the feds' almost unparalleled codebraking resources, it would take pretty solid encryption to sneak one past them.

    The supposed 100% success ratio in cracking encrypted communications is most likely because the individuals under surveillance (mainly drug smugglers and organized crime) lack the sophistication necessary to match wits with the feds.

    I'd assume that the most elite, technically savvy criminals out there don't get caught by law enforcement wiretapping, for two reasons:

    1. They are subtle enough that they never even come under suspicion, and are thus not under surveillance.

    2. They are smart enough to communicate in ways that are not easily intercepted by the feds: private couriers, simple signals that were agreed upon in advance, etc.. Those that rely on electronic communications probably use steganography or other means to disguise the fact that a "message" is even being sent. Let's face it, a suspected drug dealer sending a simple, encrypted text message may as well be waving a big red flag and shouting: "look at me! I've got something to hide!"

  26. Simply changed interception points. by Anonymous Coward · · Score: 0

    Even if DES was broken, this would never be used for anything but national security concerns. Since when it comes to court, you have to lift the lid on how you obtained the information.

    In the few cases I've heard about in detail, it seemed that law enforcement "beat" encryption by simple changing interception points. Like, for one guy they broke into his house while he was gone, and put a transmitter right into his phone.
    In an internet case, they similarly broke into the guy's house and attached the transmitter to his PS/2 port on the inside of the box to get his PGP password.

  27. Explanation for the low number.... by lylum · · Score: 1

    Not listed are probably intercepts by intelligence organizations... at least that's what it smells like.

  28. Interesting tables. by RealAlaskan · · Score: 4, Interesting
    Take a look here. You'll see that there have been very few wiretaps on pagers, fac's machines and computers (59 total in 2002). The two groups doing that sort of tap are the Feds (17 taps) and the NYC Special Narcotics Bureau (24 taps). What do you want to bet that most of the NYC taps are drug dealer's pagers? So, wire-tapping computers doesn't seem to be a wide-spread practice.

    Another interesting table is this one. It gives $/tap. The average cost is over $50K. That suggests that a wiretap is going to take a big bite out of almost any agency's budget (average cost for the Feds is $75K). The cost may be the best protection of our privacy. Certainly it seems a better bet than the judiciary.

    Finally, there is the table which shows arrests and convictions. Slightly over half of the arrests related to wiretaps result in convictions. Does anyone know how that compares to investigations without wiretaps? It suggests that more than half of the wiretaps were in response to some broken law. Hopefully they were good laws, rather than DMCA-style disasters.

    In short, one could almost imagine that the folks in the tin-foil hats are crazy to worry about the cops tapping their computers.

    1. Re:Interesting tables. by Anonymous Coward · · Score: 0

      The cost may be the best protection of our privacy.

      Or it may just encourage them to automate the wiretapping process to make it cheaper.

      I'm not too worried about legally authorized wiretaps that are part of a criminal investigation -- I'm worried about the other kind.

    2. Re:Interesting tables. by ArgumentBoy · · Score: 1

      Finally, there is the table [uscourts.gov] which shows arrests and convictions. Slightly over half of the arrests related to wiretaps result in convictions. Does anyone know how that compares to investigations without wiretaps? It suggests that more than half of the wiretaps were in response to some broken law. Hopefully they were good laws, rather than DMCA-style disasters.

      95% of all arrests result in convictions. 90% are guilty pleas. Those cases that come to trial are about half and half. It looks like the people being wiretapped are pretty savvy about the court system.

    3. Re:Interesting tables. by MisterMook · · Score: 1

      So, the solution for privacy rights is for us all to get into the business of providing wiretaps for the feds, unionize, and then inflate costs and engage in teamsters type practices against unauthorized decryption folks...like the NSA and FBI. Whoo hoo! We'll make millions!

    4. Re:Interesting tables. by Anonymous Coward · · Score: 0

      AC for obvious reasons, I really don't know what you're talking about... $75K for a tap? You think?!
      The company I work for makes CT (Computer Telephony) systems for these purposes exactly. SMTP? HTTP? Cell phones? Wire phones? Web mail? we intercept all of it. And the system costs around $200K for a 1000-wire license. tap any 1000 you wish today, any 1000 you wish tomorrow. And guess what? We sell a lot of these.
      So these $75K per tap are probably the same as ID4's $5K per toilet seat.

    5. Re:Interesting tables. by Anonymous Coward · · Score: 0
      So these $75K per tap are probably the same as ID4's $5K per toilet seat.

      It's probably $0.75 for the tap, and $74,999.25 to do the paperwork, listen, do the paperwork, deal with the data, do the paperwork, ...

      I expect that essentially ALL the costs are for the agency's labor, and (as another reply to my post said), the Telco is probably charging us for the actual cost of the tap. Glad to hear that the part coming out of our budget is low, and the part coming out of the cop's budget is big.

  29. Lack of evil genius by Anonymous Coward · · Score: 0

    Simple numbers game, if equation/algorithm generates key, key can be broken. With modern storage getting larger, cheaper, and most importantly: smaller; why the h$*# don't we see One Time Pad encryption utilizing a 1/2 gig compact flash card??? Depending on transmission environment (ie, XOR'd to 64kb/s MP3, WAV, WMA :) ) you could surely get at least 3-6mo of talk time... Then melt the card... Then again the NSA might pull up in a white van and kidna.......... :)

  30. Even if they weren't broken/decrypted... by L0stb0Y · · Score: 1

    ...first of all, it benefits them to *not* report failures- Heck, even lying about successfully breaking some encryption probably happens~ ...secondly, they aren't going to report failures, because they need to justify the budget and manpower to continue in this vein (ok, not that success/failure in the government seems to be a major factor in the funding decisions >:) ...third, if they want it bad enough, there are other means (thumbscrews anyone? ;)

    LosT

    --
    "We are the music makers, and we are the dreamers of dreams."
    1. Re:Even if they weren't broken/decrypted... by ocelotbob · · Score: 1

      Alternatively, the ones that haven't been broken are still going on, at least technically. They sniff the encrypted text, log it, and try to look for patterns, try to get known plaintext and attack it that way. They know it's a longshot, but in the game they're playing, they really only have to get lucky once.

      --

      Marxism is the opiate of dumbasses

  31. IN SOVIET RUSSIA... by raehl · · Score: 1

    They would just decrypt the encrypted message with you, a small room with one bright light, and an "instrument" or two. It's not all bad over here.

    What, were you expecting something different here? Fine..

    IN SOVIET RUSSIA... encryption wiretaps YOU!

    1. Re:IN SOVIET RUSSIA... by gerardrj · · Score: 4, Insightful

      Your right... in the U.S. They'd decrypt the message with you during a 20 year to life term in a maximum security prison without ever charging you with anything or giving you a trial by your peers.

      The decryption sessions would occur in a a small dark room where you would be "inconvienenced" and "annoyed" and "harrased" by being forced to stand for LONG periods of time, having food and water withheld, being locked in a 3x3 room with no human contact for weeks on end, being woken up at random times just to be asked a question hoping that in a sleepy state you might divulsge something, having sound payed and near painful levels for hours/days on end.

      Yea... the U.S. system is SOOO much better than the old Soviet system. At least the Soviets had the balls to make it common knowledge what they did, you knew what to expect. Here in the U.S. the government pussyfoots around the issue and makes you think that the "interviewees" are treated just like you and I when questioned by the local beat cop.

      --
      Article X: The powers not delegated... by the Constitution...are reserved...to the people
    2. Re:IN SOVIET RUSSIA... by Anonymous Coward · · Score: 0

      Actually, if this continues, expect the "local beat cop" to start using the same techniques on you, especially if you're from the wrong nation. I hope to god this will never happen but unless this trend reverses, at some point it will happen for some unlucky sods.

    3. Re:IN SOVIET RUSSIA... by Anonymous Coward · · Score: 0

      In Soviet Russia it takes special court order to not wire tap phone call.

    4. Re:IN SOVIET RUSSIA... by Alphtoo · · Score: 1

      To gerardrj: If you've got a problem with that, get your sorry commie ass back to Russia. And you are cordially invited to ingest excrement and expire. Asshole.

    5. Re:IN SOVIET RUSSIA... by gerardrj · · Score: 1

      Why is it that whenever I point out that our government violates our Constitution and seeks to further erode its meaning/value, that the only rebuttle I get is that I should leave the county and/or die?

      Why don't I ever get back a factual, logical exchange of opinions or ideas? Show me the justification for passing laws that completely trample our fundamental rights. Give me even one good reason for violating international laws and causing ill will in the other 90% of the world's population.

      As for leaving? Hell no. I am an American. Demanding that my country's values and laws be upheld by the government is not any reason for me to leave, or be expelled.

      --
      Article X: The powers not delegated... by the Constitution...are reserved...to the people
  32. Re: Polygraphs by Jerf · · Score: 1

    I've always wondered if they can get a password from you involuntarily by just hooking you up to a lie detector and asking questions like, "is the first letter a vowel? Is it 'A'? Is it 'E'? Is the second letter a number?... etc.

    Only if you believe in the polygraph's ability to tell truth. Polygraphs are garbage; see for yourself. Their primary use is to scare people who don't know better into confessing something they otherwise wouldn't.

  33. Old joke: "Need a job?" by Tackhead · · Score: 3, Funny
    "NSA is now funding research not only in cryptography, but in all areas of advanced mathematics. If you'd like a circular describing these new research opportunities, just pick up your phone, call your mother, and ask for one."

    - [source unknown, seen in .sig files for at least 10 years]

    1. Re:Old joke: "Need a job?" by Anonymous Coward · · Score: 0

      So that's how mom knew everything, she works for the NSA!

    2. Re:Old joke: "Need a job?" by ces · · Score: 1

      "NSA is now funding research not only in cryptography, but in all areas
      of advanced mathematics. If you'd like a circular describing these new
      research opportunities, just pick up your phone, call your mother, and
      ask for one."


      The first time I saw this was on a poster distributed by RSA Security. This was back in the clipper chip days when there was a real possiblity non-escrowed encryption might be banned.

      --
      Happy Fun Ball is for external use only.
    3. Re:Old joke: "Need a job?" by Anonymous Coward · · Score: 0

      Your pamphlet is on the way sir.

  34. Makes sense. by Duncan3 · · Score: 1

    The ones that they knew enough about already to even get a tap on are the stupid criminals - so not much crypto in use.

    If you can't tap them, you just bug them. Bugging is quite a bit easier anyway - so the crypto is not preventing them from getting the data.

    --
    - Adam L. Beberg - The Cosm Project - http://www.mithral.com/
  35. Encryption isn't the problem or the solution. by RealAlaskan · · Score: 2, Insightful
    I tend to believe that the government is able to either break or circumvent levels of encryption at a much higher level than commonly thought.

    If ``higher level'' means ``arrest the guy you sent the encrypted message to, and get him to decrypt it'', I'm sure you're right.

    The gov't may be able to do a bit more than they say, but keeping/learning secrets isn't generally a technological problem; it's a social problem. Governments have been solving the learning secrets problem for thousands of years. If they know you have a secret, they can learn it. If they don't know, they'll never try.

  36. Re-a:Ooh my! by Anonymous Coward · · Score: 0

    Dues thees meun thet my ROT 13 phune-a is nut zee secooreety unsver I ves luukeeng fur? Em I gueeng tu hefe-a tu feelter iferytheeng thruoogh my Svedeesh cheff feelter? Bork bork bork, bork, bork bork?

  37. AllYourRightsAreBelongToUs: +1, Patriotic by Anonymous Coward · · Score: 1


    You have no rights. This is the United States of Amerika.

    Very truly yours,

    Richard B. Cheney

    Get Your War On 23

  38. This is wiretaps terminated by Anonymous Coward · · Score: 0

    So, who knows how many active taps they have and how many of them are encrypted?

  39. Dumb question by teamhasnoi · · Score: 1, Interesting

    Is encrypting something multiple times more secure? Say if I run something through PGP twice with different keys, wouldn't that be pretty much bulletproof?

    1. Re:Dumb question by Anonymous Coward · · Score: 0

      yeah, I find running plaintext through des twice to be much more secure. I do use the same key for efficiency though. :p

      seriously though if your using the same algorithm your probably better off with a bigger key than multiple iterations... layers of different algorithms are a nice hedge against mathematical breaks though....

    2. Re:Dumb question by Cthefuture · · Score: 3, Informative

      Not necessarily. Especially not when encrypting multiple times using the same algorithm. Read Bruce Schneier's "Applied Cryptography" book. Good stuff. He covers this question much better than I can answer here.

      Even when using multiple different algorithms there is a chance of weaking the whole thing. Depends on which algorithms you're using and how you're using them. I think you are generally safe using different known-good algorithms though (say 3DES then AES). I would not encrypt multiple times with the same algorithm unless it has been mostly proven to be more secure.

      --
      The ratio of people to cake is too big
    3. Re:Dumb question by Xenu · · Score: 2, Insightful

      Not necessarily. Encrypting with key A and key B is often mathematically equivalent to encrypting with key C. It may not be any harder to crack.

    4. Re:Dumb question by DarkMan · · Score: 2, Insightful

      Sort of, but the security gained can be gained in other ways, for less cost (in terms of operator time and computer time).

      In general, assuming a rock solid algorithm, you will not gain anything by using two 1024 bit keys, over a 2048 bit key.

      In practice, I suspect that with any actual algorithm, the 2048 bit key would be more secure. This is becuase there entropy in the key is not evenly distributed, but is concentrated in the higher order bits. So by having two sets of low order bits, you have less entroy than you think in the key - which translates directly into less time to crack. [0]

      So, it won't improve the algorithmic security over a twice as large key. There are, I think, just two other reasons for considering this.

      If you use two different algorithms, then you might be able to cover a weakness in one algorithm by wrapping it in another. Frankly, just use a better, single, algorithm. There are plenty that have been shown to be secure, and there's not advantage to faffing around like that, unless you believe that the NSA have s00p3r s3kret decrypters for a particular algorithm. In which case, grab a tinfoil hat, and hack PGP so that it does not ouput any framing information on the encrypted data at all (to prevent algorithm identification). I think all your achieve is to make it difficult for people to send encrypted information to you.

      However, there is, I think, a reasonable algorithm for using two different keys. If you store them differently, and access them differently, then you can make it twice as hard for someone to steal your private key. So, for example, you might have a private key on a USB keychain, and the other on hard disk. If only one of them has a pass phrase, then it can be very difficult for, e.g. a keyboard sniffer, to identify that there are two keys.

      There are other solutions to this, which would not require double encryption though. Primarily, you could encrypt one key with the other, achieving a similar degree of operator level security, without the overhead [1] on others, making it far more likely to be sucessful. If it's too complex for others, then they may well just skip the encryption altogether.

      Encrpting one key with another is also how I would implement a 'need both people to decrypt' schema.

      (Aside: Anyone know of a method that would allow for a 'any n of m keyholders needed to decrypt' schema? It's something that has advantages, but I've no idea how to go about it)

      So, unless there is some purpose to the double encryption that I've missed (i.e. you ment something by 'secure' other than what I covered above), it nets you nothing over simpler methods.

      [0] Note that this applies only to asymetric (public key) encryption schemes, such as RSA, DSA etc (key lengths around 1024 bits), not to symetric ciphers, such ad blowfish or 3DES, with key lengths of around 128 bits .

      [1] And remember that this overhead is not so much for yourself, who can cope with it - but for those who wish to send you messages. If you are just encrypting files for your own use, then alternative solutions (a symetric cypher, or one time pad) have advantages.

    5. Re:Dumb question by Anonymous Coward · · Score: 0

      In general, using different keys/algorithms will improve the encryption (against brute force/algorithm/etc.. attacks), assuming a bad key/alg is not used. Also, keep in mind that when attempting to decrypt an unknown message, you have to know when you have actually found the correct key and have the originial message. If the encrypted data was plain ascii text, it is easy to know you have the right key. If the encrypted data was random, it is difficult to know you have indeed found the correct key, since it is not obvious you have the correct plaintext.

    6. Re:Dumb question by Anonymous Coward · · Score: 1, Insightful
      That's not a dumb question. I think it depends on the encryption used but I think many schemes double or even triple encrypt plaintext. In practicality though, I doubt this really secures things much. The achilles heel of today's encryption schemes are as follows and are easily compromised:
      1) The private key in a public key cryptography system is usually encrypted itself with a symmetric encryption method protected by a password. The encrypted private key is stored on the hard drive for the user's convenience. In effect, the whole system is like a house of cards. Obtaining this password makes the whole system topple. The feds could easily plant a hardware bug in a keyboard while the target was away from the computer and quickly get access to all encrypted communications.
      2) Most users of encryption schemes are so confident of its protection that they will send ciphertext over open mediums without the slightest attempt at being obscure. The feds can intercept this ciphertext, and even if they do not have the means to directly decipher it, they can try the following ingenius attack mentioned here.
      3) The target may be as secure as fort knox, but there will likely be at least one person with whom he/she communicates that drops the ball - somebody that uses "blank" as the password to their private key, is willing to rat on the target, or otherwise makes it easier to compromise the encryption scheme (meaning the feds can decipher all of the encrypted communications between the target and this one individual).

      So, you see using encryption as the primary means of integral security works about as much as those high school physics gravity problems applied to the real world which had to deal with such external factors as air resistance.

    7. Re:Dumb question by amorsen · · Score: 1
      Even when using multiple different algorithms there is a chance of weaking the whole thing. Depends on which algorithms you're using and how you're using them.

      Assume that you have a message, M. You encrypt with with algorithm f using key kf into M'. Then you encrypt it with algorithm g using key kg into M''. If an adversary is able to decrypt M', he may or may not be able to decrypt M''. Let us look at the possibilities for the adversary:

      1. The adversary can decrypt every message encrypted with f: In this case encrypting it with g too can only increase security, since security is entirely broken.
      2. The adversary can decrypt every message encrypted with g. This leaves the adversary with M'. If encrypting with g somehow helped break f, the adversary could just use that as a strategy for decrypting f (if someone sends a message encrypted with g, the adversary encrypts it with g and breaks the result.) Therefore we are again no worse off than with just f.
      3. The adversary can decrypt messages encrypted with g, but only if the messages are produced by encrypting something with f. In this case we are just as badly off as with just plain f, whereas it would have been better to forget about f and use g. Still, no worse than just f.
      This shows that if you use encryption within encryption you should use what you believe to be strongest at first. Hopefully a really strong f does not leave patterns that can be used to attack g. It is also important that the keys for f and g are entirely independent; the reason should be obvious. Whether it is worth it to add g is debatable, but it cannot hurt security.
      --
      Finally! A year of moderation! Ready for 2019?
    8. Re:Dumb question by jukkaTheFinn · · Score: 1

      Answer is...it depends. Encrypting something 1000 times takes 1000 times longer to decrypt. As such doing something like this is fairly effective against brute force key guessing attacks, since it takes 1000 times longer to see if the current iteration of guessing is successful.

      On the other hand if the algorithm it self has been cracked, no.

    9. Re:Dumb question by LEPP · · Score: 1

      That is not really a dumb question. The answer is yes and no. 3DES is essentially standard DES done 3 times. It has a kind of kink in the procedure. First, it encrypts. Next it decrypts with a different key from the first. Next it re-encrypts with yet a third key. The result is not 3 times as secure. A DES encryption scheme is 56 bits (56 encryption bits plus 8 parity bits). DES is not (3*56) 168 bits encryption but it is much more secure than standard DES. That said. The math behind the encryption is very strange. Those that can "see" the math are very very intelligent. The actual implementation of an algorithm is easy to do by hand. The long and the short of it is encryption multiple times probably has little or no effect unless you know what you are doing and then there might be a way to increase the encryption level with multiple passes through an algorithm.

    10. Re:Dumb question by Cthefuture · · Score: 1

      I think you're basically agreeing with me in principal. That is that using different algorithms to encrypt multiple times is mostly safe.

      However, your example is missing a possibility. It is completely possible that the interaction between algorithm f and g could produce a weaker result M". Of course it would be easier for anyone trying to break it to know which algorithms you used, but we have to accept that there is a chance they would have this information.

      The attack would not be to try and break each algorithm separately (eg. break g, then to try and break f). Instead the attack would be based on breaking some weaker result of the two algorithms. You can look at "f encrypted with g" as a new algorithm "h" which is possibly weaker than f or g alone.

      --
      The ratio of people to cake is too big
    11. Re:Dumb question by amorsen · · Score: 1
      You can look at "f encrypted with g" as a new algorithm "h" which is possibly weaker than f or g alone.

      h can be weaker than g, but never weaker than f (assuming independent keys).

      Assume h is weaker than f. Then f can be attacked by the adversary applying g to f, producing h. Therefore it clearly does not matter whether the output of f or the output of h is provided to the adversary, and therefore h is not weaker than f. Contradiction.

      The same does not apply to g, h may very well be weaker than g.

      --
      Finally! A year of moderation! Ready for 2019?
    12. Re:Dumb question by Cthefuture · · Score: 1

      No, you have to look at "f encrypted with g" as a whole new algorithm h. It's a complete system. In a sense it's really just one algorithm (with more steps) not two.

      Mathematically it's possible that h is weaker than either f or g alone. A very simplistic example:

      - f encrypts by adding 5 to every binary value.
      - g encrypts by substracting 5 from every binary value.

      Use the two together and, oops, no encryption. Of course a real algorithm is more complicated, but it's all just math.

      --
      The ratio of people to cake is too big
    13. Re:Dumb question by Anonymous Coward · · Score: 0

      Ok, A maybe possible scheme for your n out of m users needed to decrypt. Lets us imagine that we can give part of a key to each user. Actually it would probably be done by each user having a password that could decrypt a file containing part of a key. If you have enough users, then the parts of the key can be put together and you now have a whole key. So how do we make sure that say, any three out of four or any n out of m users will provide enough of the key to enable a complete key to be reassembled? For a total of m users, you divide the key into m parts. Lable the parts a, b, c, d and so on. Now, for n users to be required to decode, you give each user (1+m-n)/m parts of the key, and you ensure that the combination of parts given to each user is different. For instance for two out of three users, you will give them each (1+3-2)/3 parts, eg two parts, and they will each get a different combination, so alice gets a and b, Bob gets b and c and Charlie gets a and c. You will see that any two of these gives all three parts, so you can reassemble the whole key.

      Trying with three out of four users , we find that we must give out two of four parts to each user. For two of four we must give 3 out of four parts to each. I haven't fully checked this out, so you may find that this is not a fully general solution, eg that you cannot find a suitable unique set of parts to give to each user, but I think it can be worked out for many if not all possible values of n and m.

      Anyway it will give you some lines to work on

    14. Re:Dumb question by DarkMan · · Score: 1

      Ah! Of course. Forward Error Correction.

      It's a well understood mathematical principle, and is used in networking. Actually, FEC is a little broader than what I mean.

      What I am talking about is algorithms for spliting a data packet up into m parts, and allowing recovery of the whole with any n of those m (n < m). For example, one such algorithm is the Tornado code, used by Digital Fountain for multicast file distribution.

      Here, the application would be somwhat different. You'd take your private key, and split it into m semi-redundant sections, by, well, any of the FEC algorithms you like. Encrypt each part with the individuals public key, and there you have it.

      I'll go back to my information theory stuff, and patch together something.

      Thank's for the heads up. It's one of those things that once it's pointed out, it's so clear, I can't believe that I didn't see it before.

      Note that this would require m+1 encryptions (1 main key, split over m encrypted sections), and n+1 decryptions (n parts brought together, and the manin key). That's a hefty price, but you want to ensure that no person can see part of the private key. This is because (if you want an n from m stratagy in the first place) you do not completly trust the private key holders, so you do not want to give them part of the major key directly.

      Hmm. Come to think of it, most FEC codes currently do not have that as a design criteria (but I reckon that one like that could be found). From memory, however, most of the more sophisticated codes have that as a side effect, which results from the even distribution of data between the m packets.

      The only other alternative scheme I thought of ... well wasn't really. I think that there might be something clever that you can do with RSA, by playing around with products of exponents in Fermats Little Theorum. But I've not got round to pusing the algebra around yet.

      Forward error correction - damn, but that's so obviously correct.

      If I get a fully working algorithm (or, rather, protocol for utilising the algorithms) I'll stick it in my journal.

    15. Re:Dumb question by amorsen · · Score: 1
      If f can be attacked by applying g, like in the previous example, then an adversary can attack it by applying g. In your example, providing the output of f or the output of h to the adversary makes no difference; the adversary breaks both cases.

      Your example is also flawed because you are using a fixed key and reusing the same key for f and g. Systems with fixed keys are uninteresting since it is usually assumed that the attacker has access to the encryption algorithm but not to the key. Therefore fixed-key systems are all trivially breakable.

      --
      Finally! A year of moderation! Ready for 2019?
    16. Re:Dumb question by Cthefuture · · Score: 1

      You are completely missing what I am saying. I see no point in continuing this.

      Go read a good book on this subject.

      --
      The ratio of people to cake is too big
    17. Re:Dumb question by amorsen · · Score: 1
      Go read a good book on this subject.

      I understand what you are saying, you just happen to be wrong. I have repeatedly pointed out why you are wrong. And I already have read enough good books on cryptography.

      --
      Finally! A year of moderation! Ready for 2019?
    18. Re:Dumb question by Captn+Pepe · · Score: 1

      (Aside: Anyone know of a method that would allow for a 'any n of m keyholders needed to decrypt' schema? It's something that has advantages, but I've no idea how to go about it)

      See Applied Cryptography, chapter 3, "Secret Splitting", for an introduction. I found a toy implementation and mathematical explanation here. Or just Google for "secret splitting".

      --

      Quantum mechanics: the dreams that stuff is made of.
    19. Re:Dumb question by some+guy+I+know · · Score: 1

      Since you are giving different keys to f and g, the example should be more like:

      - f encrypts by adding kf to every binary value.
      - g encrypts by subtracting kg from every binary value.

      In this case, f*g is no weaker than f or g alone (although, in this case, it's no stronger, either).

      Now, if you want to adjust the algorithms thusly:

      - f encrypts by adding kf to every binary value.
      - g encrypts by subtracting kg+1 from every binary value.

      and the user picks a keys kf and kg=kf-1, then the combination is weaker, but only for those keys.
      It is highly unlikely that a user will, by accident, pick keys kf and kg that compromise f*g.

      In addition, there are ways to reduce further the likelyhood of picking algorithm/key combinations that, together, are weaker than a single algorithm/key.
      For example, in for block cyphers, pick different block sizes for the different encryption stages.
      In your example case, the blocks sent to f could be 7 bits long, and those sent to g could be 11 bits long.
      This would effectively make the f*g combination an 77-bit cypher.

      --
      Those who sacrifice security to condemn liberty deserve to repeat history or something. - Benjamin Santayana
    20. Re:Dumb question by Anonymous Coward · · Score: 0

      Yes, yes, typos.
      I hit "submit" too early.

  40. Re:PATRIOT Act and Freedom by Steve+B · · Score: 5, Insightful
    Since the PATRIOT Act was signed into law, how many terrorist attacks have we had? None. Zero.
    Homer: Not a bear in sight. The Bear Patrol must be working like a charm.
    Lisa: That's specious reasoning, Dad.
    Homer: Thank you, dear.
    Lisa: By your logic I could claim that this rock keeps tigers away.
    Homer: Oh, how does it work?
    Lisa: It doesn't work.
    Homer: Uh-huh.
    Lisa: It's just a stupid rock.
    Homer: Uh-huh.
    Lisa: But I don't see any tigers around, do you?
    Homer: Lisa, I want to buy your rock.
    --
    /. If the government wants us to respect the law, it should set a better example.
  41. Re:[From] the report by GMontag · · Score: 1

    Table 3
    Major Offenses for Which Court-Authorized Intercepts Were Granted
    Pursuant to 18 U.S.C. 2519
    January 1 Through December 31, 2002


    Other
    Racketeering
    Homicide and Assault
    Narcotics
    Gambling
    Kidnapping
    Bribery
    Larceny, Theft, and
    Robbery
    Loansharking, Usury,
    and Extortion

    See report for numbers.

  42. Re:When will they ever learn? by symbolic · · Score: 2, Funny


    'muffy' is NOT a good encryption key. Either that, or get a better name for your pet.

  43. well, not really. by SolemnDragon · · Score: 4, Informative
    Lie detectors don't work. THat is to say, they work, some of the time, when the person doing the lie detecting knows that there's a lie to detect. The problem with lie detectors... *cough* Fine. Let me rephrase that. There are a number of problems with lie detection equipment, and here are some of them.

    the polygraph is not a lie detector. A polygraph actually records a number of different signals. Respiration, persperation... A polygraph only detects your output, not your internal processes. That may eventually change with walk-through brain scanners at the airports...

    The polygraph operator may be thoroughly trained to interpret this data, or they might simply have bought a polygraph and hired themselves out immediately. Training and certification varies greatly from state to state. It's claimed that they measure 'deceptive reactions' pretty well, (bear in mind that they also run on Windows..No, i'm not kidding.) If you really believe what you're saying, a polygraph won't pick that up. But on the other hand, it might. I would say that the jury's out on their effectiveness, but they don't let polygraph results anywhere near a jury. (we'll get to that.) Dweceptive behaviour is not the same as lying. If you give a patently false answer to every question, it messes with the baseline. If you give honest answers that mislead, it may or may not pick them up. If you tell the truth but think about something bad you've done lately, you might get a false positive. It's that messy.

    Voice analysers promise similar results- the ability to pick up changes in a person's voice, microtremors, when deceptive intent creeps in... but have also been shown to be faulty. And then shown to be fine. And then faulty again. And so on.

    The supreme court has ruled that polygraph tests can be administered- but that the data may not be used as evidence in court. Although it is illegal to make a polygraph test part of the private industry hiring practice, the feds can do this all they want, and are expanding their activities in this regard as more sophisticated, digital equipment becomes available.

    It's more likely that brain imaging will evolve to replace the polygraph- and even then, it probably won't be 100%. There will always be those who can believe what they are saying to be true. It's all about confidence. So to answer the question- yes, they could try, but they might not be able to get anything useful from it, and if you know enough about how they work, you could give them enough false positives that they'd never work it out. Then they'd simply get a court order to bug your keyboard instead, out of sheer frustration. Unless you were deemed a REAL threat to national security- in which case they import you to egypt for 'questioning...'

    sorry if i sound pessimistic. But the answer is that if it's that important, they'll use something more proven than a polygraph....

    1. Re:well, not really. by RhettLivingston · · Score: 1

      I think the difference in this case is that the proof is in whether or not the password works. If the password works, you've met your goal which was to be able to get into the user's machine and decode the message using the keys there (and perhaps another password). The password itself doesn't have to be admissable in court.

      Also, I suppose I wasn't thinking of a normal polygraph. I was thinking of a device that I played with 17 years ago where you could put a set of electrodes on your head and move a cursor around. The device could also fairly reliably detect whether you were conscious or not (that was actually its purpose). We also discovered that we could detect "recognition". For example, we'd go through a phase of tuning it to the user. Then we'd get the user thinking about a certain object and show a bunch of pictures. Recognizable signal changes occurred when the object you got them to think about was shown to them. Its this ability to detect "recognition" that I think could be utilized here.

      For most users with fairly weak passwords anyway, I'd doubt that you'd have to be correct on every character of the password. If you got a few of them, there's likely a recognizable pattern or word that will fill in the blanks.

      In short, its because the effectiveness of the method doesn't have to be 100%, just a correct attack on a few of the characters and recognition of which ones its unsure on might do, and because I don't think admissability in court matters one bit that I think you could do it.

  44. Misdirection; answer is elsewhere by Spamalamadingdong · · Score: 4, Insightful
    There is a simple and obvious reason for the decrease in reported Federal wiretaps:
    No statistics are available on the number of devices installed for each authorized order. This report does not include interceptions regulated by the Foreign Intelligence Surveillance Act of 1978 (FISA).
    The obvious explanation is that the agents have knocked so many holes in the "Chinese Wall" between domestic criminal surveillance and foreign snooping that they just ask the guys on the foreign side (where they don't need no steenking warrants) rather than troubling a judge.

    Or maybe I just need to check the shielding on my tinfoil hat, but history says that the above is probably much closer to the truth than anyone in the administration wants to admit.

    1. Re:Misdirection; answer is elsewhere by Anonymous Coward · · Score: 0

      The foreign side isn't supposed to keep an eye on citizens...so, they just ask our foreign allies (England, Canada, etc.) to spy on us.

    2. Re:Misdirection; answer is elsewhere by Hackboy · · Score: 2, Interesting

      The numbers for FISA taps are available for 2001. The 2002 numbers aren't available yet.

      Interesting post on this from Orin Kerr, a law professor at George Washington.

  45. chaffing and winnowing by stdarg · · Score: 5, Interesting

    Has anybody read about chaffing and winnowing? (http://theory.lcs.mit.edu/~rivest/chaffing.txt) What is its strength compared to normal encryption?

    Anyway, the reason I was wondering is all the comments about extracting passwords from people. What would happen if something were encrypted in a way that different passwords revealed different content? It would be trivial with chaffing and winnowing, but I'm sure it could work with other types of encryption.

    The key idea is that of plausible deniability. Say you interleave three streams of data: the real stuff, the decoy stuff, and some random garbage to mess with messages sizes. If you can give 'them' the password for the decoy stuff, and it works, aren't you pretty much off the hook?

    1. Re:chaffing and winnowing by angst_ridden_hipster · · Score: 3, Interesting

      Check out the "Rubber Hose Filesystem" for other approaches to this idea: http://www.rubberhose.org/

      --
      Eloi, Eloi, lema sabachtani?
      www.fogbound.net
  46. in related news..... by Anonymous Coward · · Score: 0

    federal goverment has released stats that said no one dies in federal prison....

    because people are always pronouced dead in an ambulance or off the property. Can't trust any stats especially ones that don't sound likely

  47. Re:PATRIOT Act and Freedom by Anonymous Coward · · Score: 0

    Actually, Bush is a lawless illegal president.

  48. What a bunch of FUD!!! by cavemanf16 · · Score: 2, Interesting
    Seriously, let's think about it:

    • What's our "population"? Criminals (and from the looks of that report, primarily drug dealers.
    • What are we trying to answer? Whether computer encryption is easily breakable by government wiretapping and other mechanisms.
    • What info do we know?
      • 1) Criminals are generally stupid (why else would they be breaking the law so blatantly to require an investigation that cost >$50k?!)
      • 2) The government wiretaps did not encounter any problem with encryptions that prevented a wiretap from being successful
    The primary problem with most of you is that you're making a mountain out of a statistical molehill. Considering 95% or more of all criminals are complete morons, why would you assume any of them would be using secure 128-bit encryption, steganography, and other such encryption tools to encode their communications? They're usually more interested in how they're gonna whack that jerkoff down the street for lookin' at their girl the wrong way.
    1. Re:What a bunch of FUD!!! by valdis · · Score: 1
      Criminals are generally stupid (why else would they be breaking the law so blatantly to require an investigation that cost >$50k?!)

      Note that we're talking about the 2,000 or so cases a year where the criminals are smart enough that 10 minutes of detective work doesn't break it wide open - they're sneaky enough that we have to spend $50K in resources to nail them to the wall.

      A criminal running a $10M/year drug ring is probably *smarter* than the average businessman who has a $10M/year business - the guy working the legal side of the fence doesn't have to worry about keeping it all under wraps, laundering the money, etc....
    2. Re:What a bunch of FUD!!! by greenhide · · Score: 1

      Hmm,

      They can't all be that dumb. Otherwise, we wouldn't need to be spending $50k+ to track them down. Actually, at a certain point, criminal behavior -- particularly what is known as "organized crime" -- resembles a corporation in its structure and in the ability of its workers.

      These criminals' key weakness may not be normal run of the mill "I broke my cup holder" stupidity, but an arrogant belief that, unlike most criminals that came before them, they will not be caught.

      If these people really were stupid we'd be using the crew from COPS, not surveillance teams.

      --
      Karma: Chevy Kavalierma.
  49. Re:PATRIOT Act and Freedom by Anonymous Coward · · Score: 0

    I think you missed the point... this was supposed to ridicule an unsuccessful measure.

  50. Obviously they don't suspect some filters... by Anonymous Coward · · Score: 0

    Anyone remember the SPAM-ENCRYPTION-FILTER?

    Or how about my own filter: RECIPE-FILTER_101, it goes like this:

    I am entering the PAGE1 of the Curie Salmon Onion Fried Cake. The Ingredients have been injected, this berry moment. The oven is lit. I am proceeding to return the pan to the baker.


    Or this:

    The ingredients have been collected. They are mixing...done. Proceeding to pinch the loaf into the pan. The baster is in the way of the spoon, must attain spatula. Baker is delivering the loaf. Baker has retained the pan. Proceeding to the store exit. The change has been received. Have a nice day, sir.

    You obviously don't know what I have been talking about...Because that is my conversation in a restraunt as I take a shit! HAHAHA! Yes, I pinch many loafs into the toilett! I unclog many log jams too! And don't get me started on log cabins... :-)

  51. Re:PATRIOT Act and Freedom by Anonymous Coward · · Score: 0

    > The authorities of our great nation will not abuse these extra survelliance powers, they will only use them to safeguard our freedoms.

    Yea, right, dream on.

    All this non-abuse would be why we're facing massive (years of) falsified DNA evidence and purgered testomony from the FBI?

    And every few years we face massive (sometimes numbering in the hundreds) of prisoner releases for similar prosacutorial abuses by various "authorities" in various places?

    Dear sir, I am an American and I am against you.

  52. Re:PATRIOT Act and Freedom by pmz · · Score: 3, Insightful

    Lisa: But I don't see any tigers around, do you?
    Homer: Lisa, I want to buy your rock.


    Additionally, given the immense inertia of the government, could the Patriot Act even have an effect by now? My guess is that any successful intercepts of terrorist plans recently are still done the same way they would have been done five or ten years ago.

    A good example of the inertia would be the Department of Homeland Security. They are progressing towards their goals, but I wouldn't be suprised if another decade goes by before any changes have really become effective. There are just too many people, too many departments, too many systems, etc.

  53. Re:And to make matters worse... by symbolic · · Score: 1


    I'm convinced that Iran/Contra must have been considered the penultimate act of patriotism. How else could one rationally explain former convict John Poindexter's involvement with the TIA effort? (For those with short memories, his felony conviction for his involvement with Iran/Contra was overturned on a technicality).

    Oh wait...there's this thing called irony.

  54. Re:PATRIOT Act and Freedom by Anonymous Coward · · Score: 0

    They're just looking out for the interests of the American people. The rich anyway.

  55. Re:PATRIOT Act and Freedom by kcurtis · · Score: 1
    > The authorities of our great nation will not abuse these extra survelliance powers, they will only use them to safeguard our freedoms.

    Assuming you are serious...

    Check out this Nixon enemies list info about how the government can use its power to screw over citizens who disagree with it.

    I worked for Cong. John Conyers for a few years, and I know the FBI and IRS was used against him personally, in part because he helped lead the impeachment process.

    Anyone who believes the government won't abuse its powers and use them against honest citizens is sadly misinformed.

  56. Microsoft/Encryption by Anonymous Coward · · Score: 0

    Encryption can not be that easy to crack. Just last year a former FBI man was trying to get congress to outlaw the strong encryption and to put back doors for obtaining encryption keys... supposedly it never made it through congress. Which tells me they can't crack strong encryption, or it would be extremely difficult.

    Most likely this story is referring to people who used very little encryption strength. Or one of Microsofts back doors.

    This is why Microsoft never gets in real trouble from the Justice Department, because they make their "deals" with the Justice Department... this is my opinion anyways. (just like their hidden and locked index.dat files).

    1. Re:Microsoft/Encryption by Anonymous Coward · · Score: 0

      I should also add, I doubt they could crack strong encryption, just due to the fact no one else is able to crack it. I truely doubt the FBI is more tech savy than many hackers.

  57. Sounds like a bluff by slartibart · · Score: 1

    My take on this is that the feds cannot most encryption - there's no way they are breaking 1024bit PGP and the like, not with brute force or mere analytical technique. No, more likely, then get a search warrant for your house, take your computer, and find the plain text password and secret key on it. That doesn't count, it my mind. This announcement is just a bluff - "don't you criminals use encryption, because we can break it!" I think they are lying. I think they are doing anything they can to discourage encryption because they can't break it.

  58. Bureaucratic reading by Anonymous Coward · · Score: 1, Interesting
    Encryption was reported to have been encountered in 16 wiretaps terminated in 2002 and in 18 wiretaps terminated in calendar year 2001 or earlier but reported for the first time in 2002; however, in none of these cases was encryption reported to have prevented law enforcement officials from obtaining the plain text of communications intercepted.

    Remember, in these kinds of reports the government agency generating the report for Congress (the source of all $$$) is trying to make themselves look good. With that in mind, pay attention to the bolded parts:

    ...wiretaps terminated...

    OK, if we don't want to report failure don't "terminate" the wiretap. Just stop using it and we don't have to tell anyone that we're stumped.

    In this case, pay attention to what isn't written:

    ...in none of these cases was encryption reported to have prevented law enforcement officials from obtaining the plain text of communications intercepted .

    Note that the report doesn't say all text of communications intercepted. So if all the feds got off a wiretap was "OK, turn on your encryption now!", under what appear to be the rules of this report that wiretap would be considered "successful" in getting plaintext messages.

    1. Re:Bureaucratic reading by Anonymous Coward · · Score: 1, Informative

      Terminated in the telco world means that it is active, not that it has been disconnected. As you terminate wires on a terminal strip - you terminate whatever equipment that the warrant calls for to the phone or data line.

    2. Re:Bureaucratic reading by Anonymous Coward · · Score: 0

      I believe all wiretaps are granted with a definite time frame by the judge. LEOs can always do what they will but to be legitimate, such as when introducing recorded evidence into trial, they can't just let a wiretap sit on a line until something incriminating pops up. When the timeframe runs out, they can alway go back to the judge and tell him why they need an extension on the tap.

  59. Re:And to make matters worse... by mahler3 · · Score: 3, Insightful
    The technicality that overturned Poindexter's appeal was that he'd testified under an immunity deal with Congress. So, the appellate court decision that kept him out of jail was on solid legal ground.

    That, however, does not mean that he wasn't guilty as sin; only that he can't legally be punished for it. In any event, under no circumstances should he be serving in a senior Pentagon position requiring any level of security clearance.

  60. Encrypted communication is not needed by Tiger+Smile · · Score: 2, Interesting


    There are two main problems at work here. Whom is listening in on your conversations, and who let them?

    The person within the law enforcement community listening in on your calls may not be perfect. They could use this information to their own ends. They might tip off a friend as to when you are going on vacation and have the rob you. Or they might let that information slip in a public place, with the same result. They might be a childmolester in the making, or a murderer, or something else. Just because you get a government check does not make you a saint. I wish it did.

    Problem one : Unknown people spying on you.

    The second problem deals with lazy people. Mainly the public who hjave given our governemnt their passive approval of this abuse. The public agrees and maybe even likes this lack of liberty in their own home. They enjoy their temporary safety, at the expenses of some unseen freedoms.

    Problem two : The people.

    The people, meaning you reading this, if you want things to change need to change yourself first. Change. Become someone who takes an active role in the shaping of your community and become a letter writing machine. Vote! Get the word out. Get out of that chair. If you don't I really don't want to hear your complaints, because you are the problem.

    I have faith in the people. I have greater faith in those that read Slashdot. They are people who "hack" things when they need it. The government needs to hear from us. We have to enlighten people as to the lost freedoms. I see that things will change. The dream of freedom must live in the United States at all costs for the simple reason that without that dream there is little need for the United States.

    I know how stupid and corny that sounds, but it's true. When you drive by a school and see those kids playing, know that they are counting on you to correct these problems. Think about what you would tell them about maintaining freedom. What advise you might offer. Take your own advise.

    Freedom is not free. It take time, effort, and sometimes lives. There are peolpe who lied bloody in a field as the life slowly drained from their bodies who all had the same thoughts in their minds as they died. They though that dying was not that high a price if others will live free and keep the dream alive.

    With all that is happening sometimes I think that the dream of freedom and liberty will die with us, but then my faith returns. I wil take action. I hope you will also.

    --
    -- Prepared at the direction of, or to be sent to Legal Counsel, in anticipation of litigation. Attorney Client Pri
    1. Re:Encrypted communication is not needed by Tiger+Smile · · Score: 1


      Right, "the whom" arguement. That one has been around before. And I apologize, because as I recall using whom in a way that offended the single nitpicker on Slashdot invalidated everything I said.

      Damn

      --
      -- Prepared at the direction of, or to be sent to Legal Counsel, in anticipation of litigation. Attorney Client Pri
  61. Re:PATRIOT Act and Freedom by Anonymous Coward · · Score: 0

    ...I think if the terrorists had a repairman see the bombs they had...

    Previously, you mentioned the Sept. 11, 2001 attackers. I'm going to presume then, that by "terrorists", here, you mean them. What bombs, then? Who needs bombs when you've got a large projectile with a lot of fuel inside?

    Ohh, I see... *points* TROLL!

  62. Re:PATRIOT Act and Freedom by Anonymous Coward · · Score: 0

    "You're either with us or against us."

    Well, given that option, I'm against you. What do you intend to do about it? Come and bomb the shit out of me like Bush did all of those people that were "against" him?

  63. Re:PATRIOT Act and Freedom by Anonymous Coward · · Score: 1, Informative

    And why exactly should it have any effect ? The way things are going in the USA right now, we're getting slowly but surely in a state of near everlasting, constant terror. At what point will the number of people that "disappear" in the "special" facilities outnumber the real terrorism victims ? On top of that the CIA, FBA and NSA had more than enough man power and funds to tackle the problem before it happened. They were just too busy doing some economical espionage on their european allies.

  64. Re:And to make matters worse... by Anonymous Coward · · Score: 0

    These technicalities are essential to the legal system.

    It is tempting to 'cut through the crap' and make decisions go the way that they ought to, but ultimately this destroys justice. After all, there are people out there who believe the Miranda warning is also a "technicality," and in general that it is a "technicality" when illegally acquired evidence is thrown out of court. And it is true that these rules sometimes allow the guilty (like Poindexter) to be declared free and innocent.

    But believe it or not, when this happens, it's actually good. Yes, a slimeball gets to go free, but it is much more important that prosecutors and law enforcement agents have a respect for the protections that the law gives to all citizens. If we do away with these "technicalities," then there is that much less protection against illegal search and seizure and self-incrimination as a matter of general policy.

  65. polygraph is a fraud by sleepingsquirrel · · Score: 1

    You might want to check out this site which debunks the myth that polygraphs work. And yes, I'll bet most people probably give up their passwords themselves. For instance, Jim Bell, the guy behind Assination Politcs, a guy who should know better, gave up his PGP passphrase as part of his plea bargin. He is now suing the state of Washington and a host of others for the costs of breaking the encryption, brute-force using 1997 hardware.

    1. Re:polygraph is a fraud by RhettLivingston · · Score: 1

      I'm aware of the issues with polygraphs, but as posted elsewhere the conditions and objectives are different here in a way that changes the equation. In this case, I have a 100% accurate test to put in a feedback loop with the polygraph. Basically, if I can get a password that works, my objective has been met and the polygraph worked with 100% certain accuracy. So, even if it only works with 1 person in 10, its value is not significantly reduced. It still made an attack possible for that one person that might have been impossible otherwise. Furthermore, even with that one person, I don't have to get everything right, just a significant reduction in the search space could help. If I can knock 3 characters off of a 10 character password or even just determine with a high degree of certainty that its a 10 character password, I've done something useful. Heck, if you've watched wheel of fortune enough, 3 might be all you need to allow the old ultimate computer to solve it in seconds.

  66. Criminals are dumb. by ces · · Score: 1

    According to the report encryption was encountered on only 18 wiretaps. It is entirely possible very poor encryption tools were used in these cases.

    Given that most wiretaps were for narcotics and that your average drug dealer isn't exactly a rocket scientist, I suspect most of the "encryption" was somthing lame Joe criminal picked up out of a "spy/PI" catalog.

    --
    Happy Fun Ball is for external use only.
  67. paranoids by sleepingsquirrel · · Score: 1

    I thought that the tin-foil-hats were crazy by definition.

  68. Ummm by Mondain98 · · Score: 2, Funny

    So if they got around the encryption to decypher the conversations, they violated the DMCA and should be punished. Right? Hillary where are you now, bitch!??

  69. Re:PATRIOT Act and Freedom by Anonymous Coward · · Score: 0
    you forget that such a legislative act is not a gateway to action, but merely a legitimization (and formalization) of action that most likely already occurs. that is how things work, i.e., "easier to obtain forgiveness than permission" at head-crushing (armed government) level is practiced as "easier to paint the lie on afterwards than before".

    another way to look at it is that this kind of legislation is (to borrow economic terms) a trailing indicator, not a leading one.

    still, the inertia of the beuracracy is not to be discounted; just keep in mind that said inertia is very negligible when the ability to doublethink is concentrated among the few people, behind closed doors, who hold the lever of control. this is a wonderful thing if those people are good people but highly destructive otherwise.

  70. Keystroke logger by Anonymous Coward · · Score: 0

    Remember the Scarfo case where they tapped the keyboard:
    http://www.cbsnews.com/stories/2001/07/28/tech/pri ntable303859.shtml

    If you're using a crt monitor, they can also reproduce the image in a van outside your place.

  71. CALEA costs by KD7JZ · · Score: 1

    The part of this report that I find interesting is how few wiretaps there actually are. CALEA (Communications Assistance Law Enforcement Agencies) has caused many millions of dollars of upgrades to telephone switches. Unless wiretaps prevent a truly national crime (i.e. Twin Towers) it does not seem like we are getting our moneys worth.

    OTOH.. it is also encouraging that out of 260 million or so citizens, so little wiretap activity is required.

  72. Actual costs of wiretaps. by Animats · · Score: 1
    The average cost is over $50K.

    That's only part of the cost. Back when Guliani was busting the New York Mafia, they had to pay New York Telephone's retail rates for each wiretap. Their wiretapping bill exceeded $1 million a year, and the New York FBI office wasn't budgeted for it. Much of the pressure for CALEA (the "communications assistance to law enforcement act) came from those days.

    Now, law enforcement doesn't have to pay telcos directly. Telcos are authorized to pass wiretapping costs along to their customers. During the "transition period", when wiretapping was being added to the phone system, tax money was paid directly to telcos to install wiretapping gear. Those numbers aren't included in the court figures, but they appear in the CALEA report to Congress.. Between 1997 and 2001, $499 million was spent on adding wiretapping technology to the phone system. Your tax dollars at work.

  73. Privatel by aberson · · Score: 1
    how about the Privatel?

    - 168 bit 3des, Diffie-Hellman (1024 bit modulus)
    - fips 140-1
    - installs on handset side, which means it can work with digital/pbx, ISDN, IP phone, etc, and would require a tap to be placed in the handset, not just in the phone base
    - no password for you to find or beat out of me, so your recording of my modem noise is that much harder to figure out

  74. FBI and Van Eck devices? by mrmeval · · Score: 1

    http://mediafilter.org/CAQ/CAQ56brother2.html

    Nothing affirmed in this, looks like supposition or rumor but the FBI can call on ANY Federal agency for almost any item or process.

    --
    I'd go on a Vegan diet but the delivery time from Vega is too long. --brownkitty
  75. defeating keysniffers /w software by sleepingsquirrel · · Score: 2, Interesting
    From the Tinfoil Hat linux readme...
    Tinfoil Hat Linux has gpggrid , a wrapper for GPG that lets you use a video game style character entry system instead of typing in your passphrase. Keystroke loggers get a random set of grid points, not your passphrase.
  76. Re:PATRIOT Act and Freedom by dkarney · · Score: 2, Insightful

    I agree that the GOVERNMENT has only our best interest in mind. However the government is not a friendly, father figure like a diety. Many people are under the impression that because of what our country (and government) stands for is good, the government can only do good.

    Unfortunately the government is not a friendly, caretaker. The government is composed of people and people can be evil. It is men (and women) that will have access to our information via the PATRIOT act. It is these people that I believe have no right to my private information.

    In a perfect world this would not be a problem. However in a perfect world, we would not have terrorists, governmental scandals, or war.

    I do not oppose the PATRIOT act because I am a criminal or have something to hide. I oppose the PATRIOT act becuase I am NOT a criminal and have the right to be treated as such.

  77. Re:PATRIOT Act and Freedom by Anonymous Coward · · Score: 0

    Since the PATRIOT Act was signed into law, how many terrorist attacks have we had? None. Zero
    richard reid ++

  78. wiretaps online? by Anonymous Coward · · Score: 0

    Does this report say if an intercepted internet communication is considered a "wiretap"? Or is it just modem taps that are included in the report? Something like a network sniffer, or the artist formerly known as Carnivore, or of course Echelon or the new USAPA powers probably are not counted in this report. In fact the Patriot Act stuff is definitely not counted, according to the site. It seems likely that the vast majority of intercepted communications these days are done under the new powers of the FISA... so this report tells us nothing.

  79. Re:PATRIOT Act and Freedom by Anonymous Coward · · Score: 0

    Since the PATRIOT Act was signed into law, how many terrorist attacks have we had? None. Zero.

    At least one. The farmer who drove up to D.C. and threatened to blow up a bomb unless the tobacco laws were changed. That was a use (or rather, threat to use) force against a civilian target for the purpose of changing a governmental policy, so falls under the rather liberal definition of "terrorist" that people use these days.

    The fact that it didn't succeed is besides the point. The US has charged other people for much less than that.

  80. Doesn't include wiretaps under the PATRIOT Act by Anonymous Coward · · Score: 0

    From what I recall (I'm sure someone will bring it up) this data seems to only include wiretaps that are requested under judical review. However, under the PATRIOT act, the FBI doesn't need to go to judical review in some instances (e.g. such as demanding library or bookstore records, or tracking computer activity. Can't remember the exact wording for terrorists). Therefore, despite a 9% decrease over 2001, the reason is more likely that officers that were looking at racketeering aand drugs have been transferred over to homeland security duties or catching terrorists(e.g. less people are tracking crimminals). And hence their new activities are more or less unregulated (such as those poor sods who have been detained and not charged and have been sitting in jail for months) the actual wiretapping rate is much higher than indicated.

  81. Re:And to make matters worse... by symbolic · · Score: 1

    It's not just 'free' that concerns me - that he's in a key position that demands a level of integrity that he does not posses.

    I have no problem with the notion that Poindexter is free, but he should be serving in a position that is more suited to his character. I have a few ideas of my own, but I'm also open to suggestions.

  82. Re:And to make matters worse... by zenyu · · Score: 1, Informative

    It's not just 'free' that concerns me - that he's in a key position that demands a level of integrity that he does not posses.

    I think this is exactly why he was chosen. Remember these are the same people demanded less accurate felon information so they could eliminate at least 50,000 legal black voters from the rolls in Florida, the same people who deployed the same voting machines to white and mixed districts but programmed the ones in 95%+ white counties to return a spoiled vote to the voter, and to trash the spoiled votes in the 25%+ black counties. They asked for more innacurate felon information to the point where less than 5% of those kicked off the rolls were actually inelligable to vote, they kicked off a judge, an senior election official, and a shitload of ministers for heavens sake. Do you think they WANT an honest man directing the office of domestic contro-- err, surveillance?

  83. Re:PATRIOT Act and Freedom by senrik · · Score: 1

    Since the PATRIOT Act was signed into law, how many terrorist attacks have we had? None. Zero.
    How about John Mohammad? Lee Malvo? The Anthrax Killer.

    --
    "the difference between myself and a madman is that I am not mad" -Salvadore Dali
  84. I'm pretty sure they just won't tell... by Kjella · · Score: 1

    I tend to believe that the government is able to either break or circumvent levels of encryption at a much higher level than commonly thought. I mean, it's entirely possible that old devices were being used for communication, but it seems to be if you're going to be cautious enough to encrypt comms at least one or two would have done it properly.

    I wonder: If encryption on the line prevents a court-ordered wiretap from obtaining useful information, is that enough cause to, say, break in and bug the room? The wording of the statement seems to suggest that...


    Now, I'd be suspicious if only the American government were the ones making the standards. But something like Rijendel (aka AES) was developed in Europe. Unless you get all global-conspiratory, I very much doubt the government has broken all the ciphers. If they did, they'd keep in under wraps as NSA/military intelligence anyway.

    However, in civilian matters, if they know who you are and have enough to get a wiretap on you, you're on very thin ice already. I hardly doubt they'll brute force it with so many easier ways of getting the information they seek. Despite all the talk of encryption, the primary defense is still obscurity.

    As for the second point, yes I'm sure it is. If they have enough evidence to get a wire tap, they'll also get the search warrant required to wiretap in at the end instead. After all, I believe a wiretap is usual harder to get than a search warrant really. One is just a one-time search with your knowledge, the second is recording your actions without your knowledge for an extended period of time.

    Kjella

    --
    Live today, because you never know what tomorrow brings
  85. MOD PARENT DOWN by Anonymous Coward · · Score: 0

    The parent post is probably the dumbest thing I have ever read in my life. I am a stupider person for having read that post. If there were some way I could un-read that post, I might be able to continue my career in IT. Since that is not possible, I will have to retire now. Thanks a lot poster, you've ruined my career.

    When you admit that you know nothing about a subject, following that admission with a bunch of conjecture in a forum full of people with at least half a clue doesn't really make for interesting reading.

    BT

  86. IN SOVIET RUSSIA by Dolemite_the_Wiz · · Score: 1

    ...oh wait...never mind. There isn't any difference here.

    Dolemite
    _________________

    --
    Save the World! Use a Quote!
  87. Australians know this all too well ... by Anonymous Coward · · Score: 0

    http://www.abc.net.au/news/newsitems/s844062.htm

  88. Diffie-Hellman by Thor+Ablestar · · Score: 1

    WARNING! ADVERSARY IS LISTENING!

    In 2-way communications, there is no need for entering a passphrase except for the authentification to exclude "Man in the middle". The key exchange should be fully transparent for the user. For instance, there is "Diffie-Hellman key agreement". The used key should be destroyed. Then, if the user is caught and tortured, he cannot reveal the key, and maximum that law enforcement can do - to obtain a passphrase that is of no use for deciphering past traffic.

    The second. I believe the usable phone scrambler should be a standalone device with public domain (Or GPLed) software and hardware. The attempt of law enforcement to include a backdoor into such code will presumably fail. To create such a device, a popular PIC16F873 microchip and any external modem is quite sufficient.

    And the last. I have no pity to criminals. If you can control a criminal gang but have not spent some money to secure your comms - then your fate is in your own hands. Darwinism rules.

  89. how to use brute force and be faster than the govt by Festering+Leper · · Score: 0

    I'm sure most here will scoff at what i'm about to say but I find it interesting that no matter how many people, no matter how many faster and faster processors (and more of them) there are - seti *always* has plenty of data to send to everyone at all times of the day.

    I think it's disgustingly brilliant that the u.s. gov't most likely has access to the computing power from people all over the world. most likely for such purposes.

    --
    if you want people to think you know what you are talking about, just put ".com" at the end of everything you say.com
  90. Obviously Anonymous by Anonymous Coward · · Score: 0

    I have it on good authority* that what passes for (not bad) encryption these days has a cracking time measured in a few tens of mS on specialized hardware.

    Further, this person related that trunk lines are screened for encrypted info to specifically decrypt and examine.

    *Second hand from someone who would know.

  91. FISA warrant data by ces · · Score: 1

    Some were wondering abut this elsewhere.

    In a March 4 Senate hearing, Federal Bureau of Investigation director Robert Mueller announced that "in the one-year period from September 11 [2001] to September 19, 2002, we have obtained more than double the number of emergency FISAs [warrants] as compared to the total number of emergency FISAs we obtained in the prior 23-year history of the FISA statute." Attorney General John Ashcroft announced at the same hearing that the FBI had sought "over 1,000" FISA warrants in 2002.

    So it appears the number of post-9/11 covert warrants is about equal to the number of public ones.

    While I find this disturbing, 3,000 or so wiretap orders still isn't much in the grand scheme of things.

    --
    Happy Fun Ball is for external use only.
    1. Re:FISA warrant data by ces · · Score: 1

      Sorry forgot to cite the source of the above quote:

      "Red Means Big Brother's in Charge" Village Voice April 23, 2003.

      --
      Happy Fun Ball is for external use only.
  92. I can tell you how it's done..... by trex44 · · Score: 1

    ... but then I'll have to kill you . :)

    --
    "I'll have a witty .sig next time, promise." :)
  93. Re:And to make matters worse... by symbolic · · Score: 1


    If this is true, it suggests that the U.S. government has become quite corrupt, albeit in ways that are not entirely obvious. Given that whomever suggested and/or supported Poindexter's involvement had their reasons for doing so, the fact that it has happened in no way suggests that there is anything right about it, that it should be allowed to go unchallenged, or that remedial action should not be forthcoming.