Slashdot Mirror
2002 US Wiretap Report
GMontag writes "Full report:2002 WIRETAP REPORT Administrative Office of the United States Courts
Leonidas Ralph Mecham, Director I especially like this part: 'Public Law 106-197 amended 18 U.S.C. 2519(2)(b) to require that reporting should reflect the number of wiretap applications granted for which encryption was encountered and whether such encryption prevented law enforcement officials from obtaining the plain text of communications intercepted pursuant
to the court orders. Encryption was reported to have been encountered in 16 wiretaps terminated in 2002 and in 18 wiretaps terminated in calendar year 2001 or earlier but reported for the first time in 2002; however, in none of these cases was encryption reported to have prevented law enforcement officials from obtaining the plain text of communications intercepted.'"
DES broken? The evidence mounts...
There's a growing sense that even if The Future comes,
most of us won't be able to afford it.
-- Lemmy
however, in none of these cases was encryption reported to have prevented law enforcement officials from obtaining the plain text of communications intercepted.
So are we talking ROT13 here, or real encryption? Seems a little unnerving if it's the latter.
End of lesson. You may press the button.
Make what you will about this report, but consider this for a moment: In what other country in the world would this report ever see the light of day?
if that includes this. Or another situations where the wiretap failed, and the police were able to get the information in a more traditional or creative way rather than breaking the encryption.
Could be a ton of things.
Could be that they got one end of the transmission to roll over on his buddy and hand out the plain text, this seems most likely. All the tough guy criminals squeal like little piggies when a DA starts talking about jail time.
Could be they got the password to decrypt the wiretaps, or the plain text, through normal policework (like a warrant to search the PC). The fact that guy A is talking to known crime figure B is probably enough for such a warrant, regardless of whether its known what they said.
I mean, if somethings encrypted on the wire, then it was plaintext when it went in, and when it came out. I'd think most detectives would try another angle before they sat around trying to brute force decrypt a transmission.
I don't need no instructions to know how to rock!!!!
You've got two ends of the pipe where the data winds up as plaintext. If either end was compromised, as would seem to be the case, then there's no need to worry about cracking the ciphertext.
It's not the encryption algorithm or perhaps even the implementation that's weak. It's how the user manages his or her data.
10 to 1, they either found other evidence to force the users to voluntarily cough up the keys, got a warrant to put a sniffer on the user's keyboard in the case of computer communications and then retrieved the keys from the computer after they got the password, or they physically copied the encryption keys out of the phones in the case of encrypting phones.
I've always wondered if they can get a password from you involuntarily by just hooking you up to a lie detector and asking questions like, "is the first letter a vowel? Is it 'A'? Is it 'E'? Is the second letter a number?... etc.
Anyway, most encryption is pretty useless if the cracker can own the machine or its keyboard for a while without the user's knowledge and almost all of it is useless if you own the user.
Only 16 taps were encrypted? Either the "bad guys" don't even try, or they're not tapping the right people.
lexbaby
"Be Brave, Be Loyal, Be True." -- Hawkeye Pierce
Believe me, right now I'm more worried about the bad guys getting my passwords than law enforcement. The bad guys might know what to do with the data I send around, law enforcement can't touch it without going to jail themselves. I'll keep using SSH, thank you very much.
I do find it interesting that most of the taps had to do with narcotics... what passwords do drug dealers use that are easy to guess?
The main reason that I included that passage in the story was because it appears that no investigation was thwarted by encryption.
Point being, all of this claptrap on restricting encryption is just that, meaningless nonsense.
If encryption were creating a real problem for law enforcement then there would be some number of un-decripted messages to account for and I would not assume even that would create a problem in each instance.
Eve Fairbanks says I drive a hybrid!LOL
I would point out that we're still barely talking about double digit numbers of wiretaps here. ("16", "18")
Those of you with nightmares about everybody in the US being tapped can move along, because there's very little to see.
I am not a huge conspiracy theorist myself, but playing devil's advocate on this is irresistable - do you really think that simply because the agency reported only 16 or 18 wiretaps for the given years that only 16 or 18 actually took place?
Isn't the worry of all the 1984-ists out there not about the wiretaps the government legally executes but about the ones you never hear about?
"This is Zombo Com, and welcome to you who have come to Zombo Com" - www.zombo.com
If ``higher level'' means ``arrest the guy you sent the encrypted message to, and get him to decrypt it'', I'm sure you're right.
The gov't may be able to do a bit more than they say, but keeping/learning secrets isn't generally a technological problem; it's a social problem. Governments have been solving the learning secrets problem for thousands of years. If they know you have a secret, they can learn it. If they don't know, they'll never try.
See what I've been reading.
Your right... in the U.S. They'd decrypt the message with you during a 20 year to life term in a maximum security prison without ever charging you with anything or giving you a trial by your peers.
The decryption sessions would occur in a a small dark room where you would be "inconvienenced" and "annoyed" and "harrased" by being forced to stand for LONG periods of time, having food and water withheld, being locked in a 3x3 room with no human contact for weeks on end, being woken up at random times just to be asked a question hoping that in a sleepy state you might divulsge something, having sound payed and near painful levels for hours/days on end.
Yea... the U.S. system is SOOO much better than the old Soviet system. At least the Soviets had the balls to make it common knowledge what they did, you knew what to expect. Here in the U.S. the government pussyfoots around the issue and makes you think that the "interviewees" are treated just like you and I when questioned by the local beat cop.
Article X: The powers not delegated... by the Constitution...are reserved...to the people
/. If the government wants us to respect the law, it should set a better example.
Or maybe I just need to check the shielding on my tinfoil hat, but history says that the above is probably much closer to the truth than anyone in the administration wants to admit.
Scientists restrict study to entire physical universe; creationist
Lisa: But I don't see any tigers around, do you?
Homer: Lisa, I want to buy your rock.
Additionally, given the immense inertia of the government, could the Patriot Act even have an effect by now? My guess is that any successful intercepts of terrorist plans recently are still done the same way they would have been done five or ten years ago.
A good example of the inertia would be the Department of Homeland Security. They are progressing towards their goals, but I wouldn't be suprised if another decade goes by before any changes have really become effective. There are just too many people, too many departments, too many systems, etc.
Healthcare article at Kuro5hin
Not necessarily. Encrypting with key A and key B is often mathematically equivalent to encrypting with key C. It may not be any harder to crack.
Sort of, but the security gained can be gained in other ways, for less cost (in terms of operator time and computer time).
.
In general, assuming a rock solid algorithm, you will not gain anything by using two 1024 bit keys, over a 2048 bit key.
In practice, I suspect that with any actual algorithm, the 2048 bit key would be more secure. This is becuase there entropy in the key is not evenly distributed, but is concentrated in the higher order bits. So by having two sets of low order bits, you have less entroy than you think in the key - which translates directly into less time to crack. [0]
So, it won't improve the algorithmic security over a twice as large key. There are, I think, just two other reasons for considering this.
If you use two different algorithms, then you might be able to cover a weakness in one algorithm by wrapping it in another. Frankly, just use a better, single, algorithm. There are plenty that have been shown to be secure, and there's not advantage to faffing around like that, unless you believe that the NSA have s00p3r s3kret decrypters for a particular algorithm. In which case, grab a tinfoil hat, and hack PGP so that it does not ouput any framing information on the encrypted data at all (to prevent algorithm identification). I think all your achieve is to make it difficult for people to send encrypted information to you.
However, there is, I think, a reasonable algorithm for using two different keys. If you store them differently, and access them differently, then you can make it twice as hard for someone to steal your private key. So, for example, you might have a private key on a USB keychain, and the other on hard disk. If only one of them has a pass phrase, then it can be very difficult for, e.g. a keyboard sniffer, to identify that there are two keys.
There are other solutions to this, which would not require double encryption though. Primarily, you could encrypt one key with the other, achieving a similar degree of operator level security, without the overhead [1] on others, making it far more likely to be sucessful. If it's too complex for others, then they may well just skip the encryption altogether.
Encrpting one key with another is also how I would implement a 'need both people to decrypt' schema.
(Aside: Anyone know of a method that would allow for a 'any n of m keyholders needed to decrypt' schema? It's something that has advantages, but I've no idea how to go about it)
So, unless there is some purpose to the double encryption that I've missed (i.e. you ment something by 'secure' other than what I covered above), it nets you nothing over simpler methods.
[0] Note that this applies only to asymetric (public key) encryption schemes, such as RSA, DSA etc (key lengths around 1024 bits), not to symetric ciphers, such ad blowfish or 3DES, with key lengths of around 128 bits
[1] And remember that this overhead is not so much for yourself, who can cope with it - but for those who wish to send you messages. If you are just encrypting files for your own use, then alternative solutions (a symetric cypher, or one time pad) have advantages.
That, however, does not mean that he wasn't guilty as sin; only that he can't legally be punished for it. In any event, under no circumstances should he be serving in a senior Pentagon position requiring any level of security clearance.
1) The private key in a public key cryptography system is usually encrypted itself with a symmetric encryption method protected by a password. The encrypted private key is stored on the hard drive for the user's convenience. In effect, the whole system is like a house of cards. Obtaining this password makes the whole system topple. The feds could easily plant a hardware bug in a keyboard while the target was away from the computer and quickly get access to all encrypted communications.
2) Most users of encryption schemes are so confident of its protection that they will send ciphertext over open mediums without the slightest attempt at being obscure. The feds can intercept this ciphertext, and even if they do not have the means to directly decipher it, they can try the following ingenius attack mentioned here.
3) The target may be as secure as fort knox, but there will likely be at least one person with whom he/she communicates that drops the ball - somebody that uses "blank" as the password to their private key, is willing to rat on the target, or otherwise makes it easier to compromise the encryption scheme (meaning the feds can decipher all of the encrypted communications between the target and this one individual).
So, you see using encryption as the primary means of integral security works about as much as those high school physics gravity problems applied to the real world which had to deal with such external factors as air resistance.
I agree that the GOVERNMENT has only our best interest in mind. However the government is not a friendly, father figure like a diety. Many people are under the impression that because of what our country (and government) stands for is good, the government can only do good.
Unfortunately the government is not a friendly, caretaker. The government is composed of people and people can be evil. It is men (and women) that will have access to our information via the PATRIOT act. It is these people that I believe have no right to my private information.
In a perfect world this would not be a problem. However in a perfect world, we would not have terrorists, governmental scandals, or war.
I do not oppose the PATRIOT act because I am a criminal or have something to hide. I oppose the PATRIOT act becuase I am NOT a criminal and have the right to be treated as such.