Slashdot Mirror
2002 US Wiretap Report
GMontag writes "Full report:2002 WIRETAP REPORT Administrative Office of the United States Courts
Leonidas Ralph Mecham, Director I especially like this part: 'Public Law 106-197 amended 18 U.S.C. 2519(2)(b) to require that reporting should reflect the number of wiretap applications granted for which encryption was encountered and whether such encryption prevented law enforcement officials from obtaining the plain text of communications intercepted pursuant
to the court orders. Encryption was reported to have been encountered in 16 wiretaps terminated in 2002 and in 18 wiretaps terminated in calendar year 2001 or earlier but reported for the first time in 2002; however, in none of these cases was encryption reported to have prevented law enforcement officials from obtaining the plain text of communications intercepted.'"
however, in none of these cases was encryption reported to have prevented law enforcement officials from obtaining the plain text of communications intercepted.
So are we talking ROT13 here, or real encryption? Seems a little unnerving if it's the latter.
End of lesson. You may press the button.
Here it is.
however, in none of these cases was encryption reported to have prevented law enforcement officials from obtaining the plain text of communications intercepted
Does this mean that all the communications were successfully decrypted? Or maybe it just means that failures were not reported?
-- Brian
The most rabid believers in American Exceptionalism are the exact same people whose policies are destroying it.
Roving Web-Teleoperated Robot
For those who don't RTFA, here's one interesting number: Average cost per intercept order = $54,586
I don't see any reference to how the number is determined, like if it includes parts of salaries for employees.
Developers: We can use your help.
Make what you will about this report, but consider this for a moment: In what other country in the world would this report ever see the light of day?
I just noticed that for the NY Organized Crime Task Force's 7 intercepts, the average cost was $886,999. Yet for Special Narcotics it's only $8747. I suppose it's due to the duration of the intercepts.
Developers: We can use your help.
I tend to believe that the government is able to either break or circumvent levels of encryption at a much higher level than commonly thought. I mean, it's entirely possible that old devices were being used for communication, but it seems to be if you're going to be cautious enough to encrypt comms at least one or two would have done it properly.
I wonder: If encryption on the line prevents a court-ordered wiretap from obtaining useful information, is that enough cause to, say, break in and bug the room? The wording of the statement seems to suggest that...
Every year during my review, I just pray the words "slashdot.org" aren't mentioned.
You've got two ends of the pipe where the data winds up as plaintext. If either end was compromised, as would seem to be the case, then there's no need to worry about cracking the ciphertext.
It's not the encryption algorithm or perhaps even the implementation that's weak. It's how the user manages his or her data.
It looks like there were some 1350 odd state and federal authorised wiretaps. Anyone have any idea how credible this number is? Colour me paranoid but in the current climate I would have expected a much higher number. Or have I just misread the report (OK I admit I only glanced at it)
Do not try to read the dupe, thats impossible. Instead, only try to realize the truth
What truth?
There is no dupe
Easier, sure, but also a helluva lot more detectible. You gotta figure that anytime you have a local device, you're running a pretty high risk of getting caught given that you (a) have to place it, (b) have to have something physically there that might be found, and (c) it has to transmit data out somehow. Tapping a line at the phone company has none of these drawbacks.
Every year during my review, I just pray the words "slashdot.org" aren't mentioned.
10 to 1, they either found other evidence to force the users to voluntarily cough up the keys, got a warrant to put a sniffer on the user's keyboard in the case of computer communications and then retrieved the keys from the computer after they got the password, or they physically copied the encryption keys out of the phones in the case of encrypting phones.
I've always wondered if they can get a password from you involuntarily by just hooking you up to a lie detector and asking questions like, "is the first letter a vowel? Is it 'A'? Is it 'E'? Is the second letter a number?... etc.
Anyway, most encryption is pretty useless if the cracker can own the machine or its keyboard for a while without the user's knowledge and almost all of it is useless if you own the user.
Believe me, right now I'm more worried about the bad guys getting my passwords than law enforcement. The bad guys might know what to do with the data I send around, law enforcement can't touch it without going to jail themselves. I'll keep using SSH, thank you very much.
I do find it interesting that most of the taps had to do with narcotics... what passwords do drug dealers use that are easy to guess?
Given that the average cost of a federal wiretap in 2002 was $75,659, I imagine there was a strong incentive for gov't wiretappers to get their money's worth. And given the feds' almost unparalleled codebraking resources, it would take pretty solid encryption to sneak one past them.
The supposed 100% success ratio in cracking encrypted communications is most likely because the individuals under surveillance (mainly drug smugglers and organized crime) lack the sophistication necessary to match wits with the feds.
I'd assume that the most elite, technically savvy criminals out there don't get caught by law enforcement wiretapping, for two reasons:
1. They are subtle enough that they never even come under suspicion, and are thus not under surveillance.
2. They are smart enough to communicate in ways that are not easily intercepted by the feds: private couriers, simple signals that were agreed upon in advance, etc.. Those that rely on electronic communications probably use steganography or other means to disguise the fact that a "message" is even being sent. Let's face it, a suspected drug dealer sending a simple, encrypted text message may as well be waving a big red flag and shouting: "look at me! I've got something to hide!"
Another interesting table is this one. It gives $/tap. The average cost is over $50K. That suggests that a wiretap is going to take a big bite out of almost any agency's budget (average cost for the Feds is $75K). The cost may be the best protection of our privacy. Certainly it seems a better bet than the judiciary.
Finally, there is the table which shows arrests and convictions. Slightly over half of the arrests related to wiretaps result in convictions. Does anyone know how that compares to investigations without wiretaps? It suggests that more than half of the wiretaps were in response to some broken law. Hopefully they were good laws, rather than DMCA-style disasters.
In short, one could almost imagine that the folks in the tin-foil hats are crazy to worry about the cops tapping their computers.
See what I've been reading.
- [source unknown, seen in .sig files for at least 10 years]
Your right... in the U.S. They'd decrypt the message with you during a 20 year to life term in a maximum security prison without ever charging you with anything or giving you a trial by your peers.
The decryption sessions would occur in a a small dark room where you would be "inconvienenced" and "annoyed" and "harrased" by being forced to stand for LONG periods of time, having food and water withheld, being locked in a 3x3 room with no human contact for weeks on end, being woken up at random times just to be asked a question hoping that in a sleepy state you might divulsge something, having sound payed and near painful levels for hours/days on end.
Yea... the U.S. system is SOOO much better than the old Soviet system. At least the Soviets had the balls to make it common knowledge what they did, you knew what to expect. Here in the U.S. the government pussyfoots around the issue and makes you think that the "interviewees" are treated just like you and I when questioned by the local beat cop.
Article X: The powers not delegated... by the Constitution...are reserved...to the people
You ceratinly don't want to be sniffing my keyboard. I have like 5 years of cheerios and milk and other food living/dying in there. I have it willed to science when I die. Granted the longer I use the keyboard the better chance I have of being killed by it. Like last night it went out on the town and didn't come back until the wee hours of the morning all tipsy and drunk. Damn, I think my keyboard has a better social life than my wife and I. Just to reiterate, my keyboard is not safe to sniff. So, any FBI agents, just be careful around my keyboard. And wear nasal protection if you try to smell it.
Norris/Palin 2012
Fact: We deserve leaders who can kick your ass and field dress your carcass.
/. If the government wants us to respect the law, it should set a better example.
the polygraph is not a lie detector. A polygraph actually records a number of different signals. Respiration, persperation... A polygraph only detects your output, not your internal processes. That may eventually change with walk-through brain scanners at the airports...
The polygraph operator may be thoroughly trained to interpret this data, or they might simply have bought a polygraph and hired themselves out immediately. Training and certification varies greatly from state to state. It's claimed that they measure 'deceptive reactions' pretty well, (bear in mind that they also run on Windows..No, i'm not kidding.) If you really believe what you're saying, a polygraph won't pick that up. But on the other hand, it might. I would say that the jury's out on their effectiveness, but they don't let polygraph results anywhere near a jury. (we'll get to that.) Dweceptive behaviour is not the same as lying. If you give a patently false answer to every question, it messes with the baseline. If you give honest answers that mislead, it may or may not pick them up. If you tell the truth but think about something bad you've done lately, you might get a false positive. It's that messy.
Voice analysers promise similar results- the ability to pick up changes in a person's voice, microtremors, when deceptive intent creeps in... but have also been shown to be faulty. And then shown to be fine. And then faulty again. And so on.
The supreme court has ruled that polygraph tests can be administered- but that the data may not be used as evidence in court. Although it is illegal to make a polygraph test part of the private industry hiring practice, the feds can do this all they want, and are expanding their activities in this regard as more sophisticated, digital equipment becomes available.
It's more likely that brain imaging will evolve to replace the polygraph- and even then, it probably won't be 100%. There will always be those who can believe what they are saying to be true. It's all about confidence. So to answer the question- yes, they could try, but they might not be able to get anything useful from it, and if you know enough about how they work, you could give them enough false positives that they'd never work it out. Then they'd simply get a court order to bug your keyboard instead, out of sheer frustration. Unless you were deemed a REAL threat to national security- in which case they import you to egypt for 'questioning...'
sorry if i sound pessimistic. But the answer is that if it's that important, they'll use something more proven than a polygraph....
"I'd say 'Have a good time,' but arson is still illegal.
Or maybe I just need to check the shielding on my tinfoil hat, but history says that the above is probably much closer to the truth than anyone in the administration wants to admit.
Scientists restrict study to entire physical universe; creationist
Has anybody read about chaffing and winnowing? (http://theory.lcs.mit.edu/~rivest/chaffing.txt) What is its strength compared to normal encryption?
Anyway, the reason I was wondering is all the comments about extracting passwords from people. What would happen if something were encrypted in a way that different passwords revealed different content? It would be trivial with chaffing and winnowing, but I'm sure it could work with other types of encryption.
The key idea is that of plausible deniability. Say you interleave three streams of data: the real stuff, the decoy stuff, and some random garbage to mess with messages sizes. If you can give 'them' the password for the decoy stuff, and it works, aren't you pretty much off the hook?
Lisa: But I don't see any tigers around, do you?
Homer: Lisa, I want to buy your rock.
Additionally, given the immense inertia of the government, could the Patriot Act even have an effect by now? My guess is that any successful intercepts of terrorist plans recently are still done the same way they would have been done five or ten years ago.
A good example of the inertia would be the Department of Homeland Security. They are progressing towards their goals, but I wouldn't be suprised if another decade goes by before any changes have really become effective. There are just too many people, too many departments, too many systems, etc.
Healthcare article at Kuro5hin
Not necessarily. Especially not when encrypting multiple times using the same algorithm. Read Bruce Schneier's "Applied Cryptography" book. Good stuff. He covers this question much better than I can answer here.
Even when using multiple different algorithms there is a chance of weaking the whole thing. Depends on which algorithms you're using and how you're using them. I think you are generally safe using different known-good algorithms though (say 3DES then AES). I would not encrypt multiple times with the same algorithm unless it has been mostly proven to be more secure.
The ratio of people to cake is too big
That, however, does not mean that he wasn't guilty as sin; only that he can't legally be punished for it. In any event, under no circumstances should he be serving in a senior Pentagon position requiring any level of security clearance.