Is the DEA Lying About iMessage Security?

First time accepted submitter snobody writes "Recently, an article was posted on Slashdot about the claim that law enforcement made about being frustrated by their inability to decrypt messages using Apple's iMessage. However, this article on Techdirt suggests that the DEA may be spewing out disinformation. As the Techdirt article says, if you switch to a new iDevice, you still are able to access your old iMessages, suggesting that Apple has the key somewhere in the cloud. Thus, if law enforcement goes directly to Apple, they should be able to get the key."

Comments

Are you kidding?

[IonOtter]

The mere fact that you even have to ASK such a question means the answer is "Yes."

Re:Are you kidding?

[BlkRb0t]

Betteridge says NO though.

Re:Are you kidding?

[Anonymous Coward]

Does Betteridge's Law Apply to All Headlines?

Re:Are you kidding?

[russotto]

Betteridge is probably right. The messages are likely technically interceptable but not through the means the DEA tried; they didn't ask the right people the right questions.

Re:Are you kidding?

[blackraven14250]

Getting the key from Apple isn't really "technically interceptible" anyway. The problem, from their end, is likely that they need to subpoena the information from Apple (both past messages and the key for future use), rather than intercept it easily.

Re:Are you kidding?

[Anonymous Coward]

People also think that the DEA or any other enforcement arm of the US government doesn't cheat the law to score convictions. That alone means you should never trust anything they say. The federal courts are ridiculously stacked against defendants.

Re:Are you kidding?

[Daniel Dvorkin]

Contrary to Betteridge, the answer to almost any question of the form "is the DEA lying" is yes. They're a worse propaganda machine than every other alphabet-soup agency put together, which is saying something.

Re:Are you kidding?

[Gr8Apes]

This is probably the crux of their complaint - they can't intercept the messages without going through proper procedures, getting a warrant, and leaving a paper trail. This is precisely how things should work.

Re:Are you kidding?

[Fuzzums]

What question? Oh! I see what you're doing here.
That question that is followed by the "or else..."

Re:Are you kidding?

[sjames]

Exactly. The problem (as far as the DEA is concerned) is that they might be forced to actually obey the law themselves for a change. They much prefer tapping what they want with no oversight.

Re:Are you kidding?

[mysidia]

Getting the key from Apple isn't really "technically interceptible" anyway. The problem, from their end, is likely that they need to subpoena the information from Apple (both past messages and the key for future use),

This assumes a certain architecture. If the cryptosystem is strong, there is probably a frequent key rotation schedule, in which, the same key that encrypted past messages will potentially be replaced in the future by the time any new messages are exchanged.

It would be ideal, if some portion of this key were secured by the password, e.g. a SCRPT, BCRYPT or PBKDF2 hash of the password, is part of the secret material required to decrypt the key on the client, and any change of the user's password results in key rotation.

It is conceivable that Apple could design a system, in which, the keys would be available on multiple of your devices (because you knew an additional secret), but not available to Apple, to extract or find out what the key is (because Apple denies themselves access to the secret)

Do I think it's designed that way? No... it would not happen by coincidence, for sure.

Could they have designed it that way? Yes

Re:Are you kidding?

[b4upoo]

Bcrypt is a wonderful tool but it is not strong encryption. PGP now yields to decoding. It could be really interesting to search old transmissions and decode them. Statutes of Limitation may not hold as the evidence of crimes was hidden until now. So the guy that put up a lot of kiddie porn years ago or downloaded such material could be in for a real shock. Politicians and lawyers and the like might also need to squirm a bit. If I got it right PGP can now be decoded in real time. Yesterdays munitions (yes they called PGP a munition) are today's toys.

Re:Are you kidding?

[ceoyoyo]

I'm pretty sure you're wrong. PGP uses RSA and IDEA. If RSA was breakable, particularly in realtime, there would be a lot more screaming. Some older versions of PGP had some bugs that were theoretically exploitable, but I don't think any of them have actually been exploited, never mind reliably or in real time. There have been several incidents over the years suggesting that authorities cannot decrypt PGP encrypted data.

It's possible that some early RSA encrypted messages using very short keys are technically decryptable, but you'd have to be a highly motivated government agency to do so, and you still wouldn't be doing it in anything close to realtime.

Yesterday's munitions are... pretty much unchanged today, except that you can be extra paranoid and use longer keys now.

Re:Are you kidding?

[Anonymous Coward]

Yeah, you got it wrong. Assymetric crypto is still good and it's vulnerability still depends on key lengh, so the paranoics, who used long keys are in the clear.

Re:Are you kidding?

[mysidia]

Bcrypt is a wonderful tool but it is not strong encryption. PGP now yields to decoding.

That's not true... BCrypt for a specified number of rounds (adaptation of the blowfish cipher) is stronger than PBKDF2; that is, more resistant against dictionary/brute force attacks using GPUs and other embedded hardware.

Furthermore, these have nothing to do with PGP.

All 3 are key derivation functions, which are used to generate an encryption key from a password, and may be salted; such that the key generated is dependent upon both password and salt.

These are strong, because the computational power required to test whether one specific password is the right one to provide access to the key, is large, and the algorithms cannot be efficiently scaled (at least not as efficiently as the use of a simple hashing algorithm such as SHA256).

the strength of all 3 algorithms can be varied, according to the computational power available, and the required strength of the key derivation function.

AES256 is still extremely strong cryptography, when the key is well-protected.

Re:Are you kidding?

[mysidia]

There have been several incidents over the years suggesting that authorities cannot decrypt PGP encrypted data.

I think it's that authorities can't always decrypt PGP encrypted data.

In some earlier versions of PGP, or on some certain OS versions, the entropy producing functions of the OS (secure random number generator), were broken, in such a way, that one or more of the asymmetric keys protecting an encrypted document would be a weak keypair, OR one of the symmetric keys protecting an encrypted document would be a weak symmetric key.

The authorities are more likely to break the encryption by obtaining the IDEA encrypted keyfile, and launching a dictionary/phrase-based attack in order to gain access to the key material.

Another option is to subvert the recipient; through lawful wiretaps, or a sneak-and-peak type warrant, where malware or covert keylogger is deployed on the recipient's machine, so the key material is exposed, through routine operations.

Re:Are you kidding?

[Anonymous Coward]

"This assumes a certain architecture. If the cryptosystem is strong"

It's okay, this is Apple we're talking about, there's no danger of any of that.

Re:Are you kidding?

[pantaril]

The mere fact that you even have to ASK such a question means the answer is "Yes."

IMO the very fact that slashdot suggested totaly closed and 3rd party controlled device to be used for safe communication speaks that this website has fallen. There is no news for nerds anymore, no knowledgable operators/moderators. Trully nerdy/inovative/liberating technologies (like bitcoin) are shuned and rejected here based on FUD. The majority of good users have moved elsewhere (reddit for example). Clueless apple fanboys and similar are the only ones left.

Re:Are you kidding?

[Anonymous Coward]

are you sure you are not cnfusing trust with believe?

Re:Are you kidding?

[Anonymous Coward]

BULLSHIT.

We all know they don't need a warrant if the company cooperates, even quietly.

"I'm going to the bathroom and leaving my computer unlocked. Please don't click on the file you want and save it to your thumb drive."

Apple, like most companies, are beholden to the government for their corporate power status, and the ability to operate without constant government issues... Did you see how easy it was for the gov't to get Tmo, ATT, and all the others to comply with phone tracking??? They rely on the government for spectrum, or they die.

Come and see the violence inherent in the system! Come and see the violence inherent in the system! Help! Help! I'm being repressed!!

Re:Are you kidding?

[Anonymous Coward]

"The key" is the message encryption key, and Apple does not have it. It's on the device, generated at activation time, and never sent to Apple. A public key is sent to Apple at activation and iMessage registration time, which is associated with your phone number/email, which it then vends out (like a keyserver).

Basically everything the peanut gallery says about the protocol is wrong, and based on guesses and ignorance. The truth is that it's impossible DEA to obtain the encryption key, as Apple doesn't have it. They just have to do regular police work (like in the old days), to obtain enough evidence to actually search the user's phone in person.

Re:Are you kidding?

[ceoyoyo]

The authorities are more likely to break the recipient (or the sender). Which is the approach they've been taking: in one of those incidents I mentioned somebody went to jail for nine months for not decrypting the message for the court.

As someone else pointed out, if the NSA or whoever could break RSA it would only make the drug dealers' messages more secure. They wouldn't want foreign governments and international baddies to stop using it because Joe Random got convicted for dealing after his computer was magically decrypted.

Re:Are you kidding?

[Anonymous Coward]

Reddit? Really?

If someone can tell me where all the good nerds have gone, I'd gladly follow... but not to reddit.

Re:Are you kidding?

[mysidia]

The truth is that it's impossible DEA to obtain the encryption key, as Apple doesn't have it.

Did you read the summary?

if you switch to a new iDevice, you still are able to access your old iMessages, suggesting that Apple has the key somewhere in the cloud

How is it possible that switching to a new iDevice would let you access your old iMessages, if Apple doesn't have the key, and the new iDevice never communicated with the old iDevice?

Also bugs in switching devices

[Anonymous Coward]

There were reports for a while of "wiped" devices bugging out and remembering to receive former owner's messages after being turned in to Apple Stores for replacement.

Who cares

[Anonymous Coward]

Well, drug dealers, terrorists and organized crime care obviously.

Anyone else?

Re: Who cares

[MrMarket]

Political dissidents, whistle blowers... and FREEDOM LOVERS.

Re: Who cares

[Anonymous Coward]

Political dissidents, whistle blowers... and FREEDOM LOVERS.

Like Martin Luther King was watched and harassed by the police and the FBI.

And now we have a national holiday honoring him. If I were President, I make every goddam FBI employee work 18 hour days on that weekend - scrubbing the bathrooms with toothbrushes from their anus.

John Lennon - yes, the dead Beetle - was watched by the FBI for - God forbid! - preaching peace!

We are a God fearing Christian Nation! We can't have those wackoes preaching Peace!

Re:Who cares

[Opportunist]

Everyone should. Not because they're breaking a law, but because laws are changing. And rapidly so. What is very legal today may be illegal tomorrow. And then try to prove that you stopped the behaviour just because it became illegal. What is that you say? They have to prove that you still did it after it became illegal? You think you'd be the first to be in jail because there is "strong evidence" (read: someone hinted at it) that you did again what you did before?

Re: Who cares

[houghi]

Freedom lovers who really love it will fight for it.
And one countries freedom fighter is another countries terrorist.

Re: Who cares

[Anonymous Coward]

Freedom lovers who really love it will fight for it.
And one countries freedom fighter is another countries terrorist.

The transcripts of your SMS and emails indicate you don't really
believe this.

Re: Who cares

[Anonymous Coward]

Political dissidents, whistle blowers... and FREEDOM LOVERS.

No, a freedom lover wouldn't be using an Apple product in the first place.

Re: Who cares

[Bobakitoo]

John Lennon - yes, the dead Beetle - was watched by the FBI for - God forbid! - preaching peace!

We are a God fearing Christian Nation! We can't have those wackoes preaching Peace!

Preaching peace in time of war is clear and present danger to the government's recruitment efforts. It is LITERALLY like shouting fire in a crowded theatre.

This is why it is important to defend the free speech right to shout fire in a crowded theatre. Worst that could happen is everyone walking out calmly and in order. Just because someone think there is a fire doesn't give him the right to push, stomp or strike anyone that stand in his way. If peoples act like ass-holes during emergencies then this is what need to be addressed. Restricting a fundamental freedom in way that will, and was, abused by the state is not a solution.

Re: Who cares

[camperdave]

What better proof do you need that your nation fears God, than FBI surveillance of people who preach peace.

Re: Who cares

[viperidaenz]

We are a God fearing Christian Nation

I thought church and state were separate?

Re: Who cares

[flimflammer]

I was with you until you said this:

Worst that could happen is everyone walking out calmly and in order.

That is far from the worst that can happen. That is in fact the best case scenario outside of no one believing them and there truly not being a fire. Provoking people into violent acts of desperation by instilling the immediate fear of death into them, such that their rationality is severely compromised is outright negligent. This is why we have things like temporary insanity and heat of passion defenses.

I feel that you should be perfectly free to shout "Fire!" in a theater. However I also feel that if you end up causing a situation where someone is injured, you should be held liable for your negligent actions. Freedom of speech should not mean freedom from responsibility of that speech.

What if you told a blind person that the light at an intersection was green and there was no traffic, causing them to walk into the street and get run over? Would you push the free speech argument? You didn't kill him; the guy behind the wheel of the car did. That doesn't mean you weren't immensely negligent as a result of what you said.

As a closer example to the theater, what if in that same situation you screamed in front of a blind man "Everyone get out of the way! A car is heading straight for us!" causing him to jump out of the way and into actual traffic? Would you still feel like you were completely free of the burden of responsibility?

Re: Who cares

[Anonymous Coward]

Provoking people into violent acts of desperation by instilling the immediate fear of death into them, such that their rationality is severely compromised is outright negligent.

Shouting fire should not provoke anyone to be violent. In my experience, when there is a fire alarm, peoples look around wondering if it real then move out in order. On the other hand, seeing fire running up the wall and ceiling could cause panic. But this thread is about shouting fire in a theatre, not setting fire to the theatre.

I feel that you should be perfectly free to shout "Fire!" in a theater. However I also feel that if you end up causing a situation where someone is injured, you should be held liable for your negligent actions.

I feel that you are perfectly free to advocate peace in time of war. However I also feel that if you end up danger the government's recruitment efforts you should be held liable for your act of sedition.

How about all the assault on brown peoples flowing the WTC attack? Are the perpetrators responsible for their action, or the media held liable for causing muslim-scare panic? (After you answer don't forget to check what judges decided in the real world)

Shouting fire when there is no fire is being an asshole. But freedom is freedom to be an asshole, and if you don't defend assholes your turn will come eventually. eg: When you advocate peace in war time.

Re: Who cares

[bigtrike]

Nope, God still gives us our rulers through divine right. Voting is simply a test of faith.

Re: Who cares

[Anonymous Coward]

No.

captcha: corrects

Re: Who cares

[Anonymous Coward]

What if you told a blind person that the light at an intersection was green and there was no traffic, causing them to walk into the street and get run over? Would you push the free speech argument?

Yes. A blind person is not helpless. If he is outside, by himself, then he is fully responsible for his action. He does not depend on strangers telling them what colour is the light. Stating otherwise is insulting to the blind and otherwise handicapped in general.

Re: Who cares

[sjames]

I'm pretty sure they're doing their best to figure out what Jesus would do and then do the opposite...

Re: Who cares

[Anonymous Coward]

[quote]That is in fact the best case scenario outside of no one believing them and there truly not being a fire.[/quote]
Unless that desensitizes them, so that the next time there really is a fire, nobody believes it until it is too late. This is where your argument gets difficult. What if, in every movie I go to, I shout "fire" half way through. Because of this, people know not to react when people shout fire, because it's just a prank. The next time there is a fire, people don't believe it until it's too late. How do you prove my liability there? At the time of the fire, I was laying in my bed sipping mimosas and twirling my mustache laughing evilly.

Re: Who cares

[demonlapin]

You can think that all you like, but the reality is that Americans have an immensely negative view of atheists. Here, observe that Americans consider atheists more objectionable than blacks, women, Catholics, Hispanics, Jews, Mormons, gays, or Muslims for political office. And that study does not discriminate about which political party you're discussing!

Re: Who cares

[ruir]

And that is why, as a European, I dont intend to ever set foot again in the USA. Only if I have to. Amerika is becoming the Iran of the West.

Re: Who cares

[Anonymous Coward]

Agree 100%. We should just exterminate all the idiots whose brains are too dysfunctional to think before acting. What kind of mindless cow tramples someone just because they hear a word...

Re: Who cares

[Sabriel]

Dear Anonymous Troll. It's not about being blind or handicapped. It's about trust. We are indeed responsible for our actions - and that includes the act of speech.

Re: Who cares

[yusing]

Und if you are schmart, you schut kip thinking zat.

Re: Who cares

[ceoyoyo]

It is LITERALLY like shouting fire in a crowded theatre [wikipedia.org].

I think you don't understand what "literally" means. Your post gets sillier from there.

Re: Who cares

[ceoyoyo]

At first your list sounds horrifying. On closer examination, over 90% of Americans said they wouldn't have a problem voting for a black, female, catholic, hispanic or jewish candidate. The others ranked... lower. It's still pretty bad, but not quite as horrifying as at first glance.

Re: Who cares

[Anonymous Coward]

Read the link and think again why it is written ALL UPPER-CASE.

It's easy to copy-past Internet meme like "I think you don't understand what \"literally\" means." before think about what was really said.

Closed proprietary software is NEVER secure!

[Anonymous Coward]

While I won't make the argument that free software is always more secure it's at least verifiable.

Re:Closed proprietary software is NEVER secure!

[Spiked_Three]

So by that argument, closed classified encryption, used for DoD communication, is not secure?

Re:Closed proprietary software is NEVER secure!

[moderators_are_w*nke]

Really? Is it? Could you tell by looking at some pgp source whether it has been compromised or not? Maybe you could but the majority of people reading this could not and if that's true of slashdot what hope does the rest of the wold have?

Re:Closed proprietary software is NEVER secure!

[viperidaenz]

Just because software is closed and proprietary doesn't mean you don't have access to the source code. It just means that access may be covered by a license.
If you're going to pay security experts to analyse the entirety of the code, the price of that license is probably insignificant.

Re:Closed proprietary software is NEVER secure!

[Anonymous Coward]

Correct. As long as I cannot verify the encryption, then I cannot say it is secure; secure being relative to my needs and concerns. As the U.S. government is one party I would want to keep my encrypted information from, the DOD or any other agency having potential access means that their encryption cannot be considered seriously for my interests.

Re:Closed proprietary software is NEVER secure!

[Anonymous Coward]

Really? Is it? Could you tell by looking at some pgp source whether it has been compromised or not?

I could, and I can verify it for other people who trust me.

Re:Closed proprietary software is NEVER secure!

[Spiked_Three]

I didn't ask if you considered it secure. I asked if you are insinuating it is not secure. Forget it, the fact that you got modded insightful is an indication the people who read and mod here are clueless, including yourself. If you think you can keep anything from the us government you are seriously delusional. If you ever by accident do, they will pay you a visit the next day, I promise. I spent a career worrying about if the navy could spy on the army could spy on the marines. Whether or not any one of those could spy on the public wasn't even a lunch time conversation - it was a no brainer. But you and the moderators just go ahead and have your fantasies, they depend on it.

It's American company so the answer is obvious

[thetoadwarrior]

If you're using software created in the US by a commercial company you can bet the government has access to it. Who would believe any different?

Re:It's American company so the answer is obvious

[the eric conspiracy]

Lots of people believe different because some US companies supply software based on stuff like openssh and truecrypt.

Here's the fundamental problem with this sort of theory - if the US can decode something, chances are other people can too.

Re:It's American company so the answer is obvious

[Anonymous Coward]

OpenSSH buys you very little. The key management has always been poor, especially the host key management, which is replaced and updated without signatures and is subject to more man-in-the-middle attacks due to the ediots who leave unsecured hostkeys and personal keys lying around on poorly secured filesystem.

OpenSSH ignores the user environment. Theo de Raadt's attitude is that if you don't trust the host you're on or the one you're connecting to, you're screwed anyway, so why bother implementing even the most basic steps (such as a more useful chroot cage for upload/download areas, proper management tools for updating locally recorded hostkeys, or *)turning off* the default support for passphrase free personal or host keys. There is *no excuse* for the default behavior passphrase keys for critical SSH servers, they should require a hands-on "start this server and unlock the keys" operation as Kerberos and Apache have done for years. Otherwise, it's like putting a really, really big lock on a door with the hinges on the outside.

Re:It's American company so the answer is obvious

[Anonymous Coward]

That is not at all true.

I am sick to death of this flagrant, wilful ignorance of the state of American civil liberties.

Re:It's American company so the answer is obvious

[Anonymous Coward]

"There is *no excuse* for the default behavior passphrase keys for critical SSH servers, they should require a hands-on "start this server and unlock the keys" operation as Kerberos and Apache have done for years. Otherwise, it's like putting a really, really big lock on a door with the hinges on the outside."

This is bullshit, the keypair in Apache is used to exchange both identity and the secred key. With ssh there is an additional exchange on top of the "vulneable" secred key. The hinges are only on the outside if PasswordAuthentication is on (which is only required just after initial installation). Force keybased authentication and Theo is right, you have to trust both the source and destination machines to keep EVERYTHING secure.

Re:It's American company so the answer is obvious

[david_thornley]

If you don't do your own key management you can bet the government has access to it. If you do all of your AES-128 or better crypto on your own box in your own space, with no outsiders logged in, and never let the key leave your secure storage, you're probably safe unless the government comes for you personally.

Yes and no

[Anonymous Coward]

I think one of the main problems law enforcement has with iMessages is that it is ridiculously easy to get a pen register from a telco for a phone number. This is a list of the calls made to/from that number and a list of SMS/MMS to/from that number. iMessage bypasses SMS/MMS if both the origin and destination device are iMessage capable, so those interactions do not show in a pen register. The same could be said for many other text/chat services, but iMessage is the default texting client for a large number of people and does not require the user to do anything special to message others without the telco knowing, unlike many other services.

iMessage isn't that special, the memo could just as easily been talking about FaceBook messages, which also won't appear in a pen register.

Apple owns it, Apple can access it

[Anonymous Coward]

Don't be ridiculous. You are only a guest in Apple's garden.

Key in cloud != Key accessible by Apple

[kc9jud]

Just because your messages are accessible on a new device, it does not necessarily mean that your messages are readable or key is accessible by Apple. For instance, if the decryption key for iMessage were encrypted with your Apple ID password, then your key could be transferred around between devices, but Apple or the DEA would still have to brute-force/social engineer/whatever to get your password and decrypt the key. Whether or not it's actually set up that way...

Re:Key in cloud != Key accessible by Apple

[Anonymous Coward]

Yes, that COULD be. In reality there are password reset methods and no company will ever tell a customer that they have just lost all their messages, photos, etc. because they forgot their password. Wake the fuck up.

Re:Key in cloud != Key accessible by Apple

[fustakrakich]

Yeah, brute force is something the government is very good at.

Re:Key in cloud != Key accessible by Apple

[AvitarX]

Does a password reset lose the key?

Re:Key in cloud != Key accessible by Apple

[fuzzyfuzzyfungus]

That would be saner than just storing the key; but I suspect that virtually everybody's password is substantially less entropic than all but the most horrible and obsolete cryptographic keys...

Re:Key in cloud != Key accessible by Apple

[Anonymous Coward]

What happens if you forget your password? .-)

Re:Key in cloud != Key accessible by Apple

[Forever Wondering]

Even if were set up that way, we already know Apple wipes [malicious] apps without user intervention/approval. It's not much of a stretch to assume they could [already have the capability to] surreptitiously download and run an app that snoops your private keys, since these keys must be in the clear on the user's iWhatever for iMessage to work in the first place.

Re:Key in cloud != Key accessible by Apple

[phantomcircuit]

Except apple stores passwords for iTunes in plaintext.

I received an email from apple reminding me that i had $10 in iTunes funds availalble.

Only problem is where my username should have been was my password in plaintext.

Re:Key in cloud != Key accessible by Apple

[Anonymous Coward]

Protip: don't make your username your password.

Re:Key in cloud != Key accessible by Apple

[MyFirstNameIsPaul]

BlackBerry phones are encrypted as OP suggests, so when a user forgets a password, then there is nothing BlackBerry can do to help the user.

Re:Key in cloud != Key accessible by Apple

[phantomcircuit]

In all fairness the password was "notapassword," but still.

Re: Key in cloud != Key accessible by Apple

[dugancent]

Name one app that has been removed from someone's device, just one.

Removing from the App Store doesn't count because it stays on your device and in iTunes, if you use it.

Re:Key in cloud != Key accessible by Apple

[gnasher719]

Yes, that COULD be. In reality there are password reset methods and no company will ever tell a customer that they have just lost all their messages, photos, etc. because they forgot their password. Wake the fuck up.

Actually, if you turn on two factor authentication then that is exactly what Apple will do. For authentication, there are three items that can be used: Your password, a 16 digit key that you should stash away in a secret place, and a device (iOS or Mac) that you registered with Apple. Any two of these, and you can do anything. With only one thing, there is nothing you can do, and nothing that Apple can do to help you.

Re:Key in cloud != Key accessible by Apple

[bloodhawk]

As a user does not lose access to all their old stuff after a password reset then I think it is safe to say that while they "could" do that, they definitely DO NOT.

Re: Key in cloud != Key accessible by Apple

[Forever Wondering]

No, it is removed from your device. This is done rarely because Apple screens most apps for malware before being put on appstore/iTunes. But, if one slips by, they can and have removed it.

Re:Key in cloud != Key accessible by Apple

[viperidaenz]

That means means Apple won't help you. They could, but they would compromise the added benefit of the two factor service. It's not a technical limitation.
Apple have your registered device ID's. Apple have that 16 digit key they gave you that you stash away. The only thing they may not have is your password. But they might, you don't know that.

Re: Key in cloud != Key accessible by Apple

[viperidaenz]

They can already blacklist apps on your iPhone.
https://iphone-services.apple.com/clbl/unauthorizedApps
They just haven't added any to the list yet.

Re:Key in cloud != Key accessible by Apple

[viperidaenz]

Your messages are readable and accessible by Apple.
They're probably also stored in plain-text too.
How do you think they deliver the message in a readable, plain-text format to the recipient?
How do you think they store in while the recipient is off-line?

The message is sent over an encrypted channel though. That's the only thing the DEA are complaining about, they can't easily intercept the message without the knowledge/co-operation of another party (you, Apple or the recipient in this case).

Re:Key in cloud != Key accessible by Apple

[Fuzzums]

If it's done, it could be something like this:
Encrypt message with key.
Encrypt key with password.
Encrypt key with FBI password.
Store both encrypted keys and the encrypted message.

Guess who has access to your message. No brute force required.

Re: Key in cloud != Key accessible by Apple

[Anubis IV]

I'd actually be curious if you could cite any examples of them having done this. I have several apps on my iPhone that were later pulled by Apple from the iTunes Store (including an app that purports to be a simple flashlight but actually allows the user to use the iPhone as a mobile hotspot without having to have pay for a tethering plan with their carrier), but I'm not aware of any that were pulled from user's devices. I'll readily agree that they do have the ability, but I can't recall them ever having exercised it.

Re: Key in cloud != Key accessible by Apple

[dugancent]

It's done so rarely that it has never been done. Do some research, it's never happened.

They can, but they haven't.

Re: Key in cloud != Key accessible by Apple

[GizmoToy]

You're correct. We know they have the ability, but they've never done it. They're not stupid. They know people are watching and that doing so will create a huge uproar. It would have to be something that's a serious threat to either Apple or their customers before they'd pull the trigger on it. Something they can hold up and say "We took extraordinary measures to protect our customers from this very serious threat," rather than something that would end up in the news like "Apple unilaterally removes purchased content from customer devices." The latter would be trigger at least a couple news cycles of Apple bashing, and fodder for competitors for months/years to come. Remember the uproar when Amazon did this with eBooks on the Kindle? They talked about that in the news for *weeks*.

Re:Key in cloud != Key accessible by Apple

[Anubis IV]

Spot-on. Though I should point out that iMessages are definitely not encrypted using the password at the time that they're sent, though they are later on in the process you described.

I'm too lazy to look up links right now, but there was an issue a few months (years?) back, where stolen iPhones had iMessages going to them still, even though the victims had received new phones and changed their passwords. If the password alone was the key, that wouldn't have been happening. That said, the backups that are stored in iCloud (or on your PC) — and which are used to migrate data to a new iDevice — are encrypted with the user's password, just as you said. iTunes makes this clear to anyone who encrypts their local backups, stating very plainly that losing the password will mean losing all of the data. In the case of someone resetting their password (which is a common question in many of the responses you've received), their next backup would simply make use of their locally-stored data and would be encrypted with the new password. It's simple, and there's no need to worry about losing the stuff in iCloud, since you'd be replacing it with the new backup regardless. If you happened to lose your iDevice at the same time that you reset your password, you may be SOL. I couldn't say.

As for how iMessages are sent, I suspect it's a bit more complicated, otherwise we wouldn't have seen that issue with stolen iPhones receiving iMessages. The way I figure it, if User 1 has two iDevices (which we'll call A and B) and User 2 owns iDevice C, we don't want C directly sending to A and B, since then 2 would have knowledge about how many devices 1 owns based on the number of copies he has to send (not to mention that they'd have to send multiple copies, which wastes battery life and the time of the user). So, we can assume that iDevice C will only send one copy of the iMessage, but how can it get to iDevices A and B without C knowing about A and B or Apple being able to read it, which would defeat the device-to-device encryption Apple has said it does?

My guess is that each Apple ID has a public/private key, as does each iDevice. When User 1 logs in for the first time on his iDevices, each of the iDevices registers their public keys with Apple. When iDevice C later wants to send an iMessage to User 1, Apple sends C the public key for User 1. C then sends a copy of the iMessage encrypted with 1's public key to Apple, and Apple then makes copies for iDevices A and B and applies an additional level of encryption on those copies, this time encrypting them with the public keys for A and B, respectively. When the iMessages arrive at A and B, they each use their own private keys to decrypt the iMessage, then use User 1's private key to complete the decryption process.

As for where User 1's private key comes from and how it gets to the iDevices without Apple knowing it, the first iDevice that a user logs in with could generate a private key for the user and then upload it encrypted with the user's password, just like how the backups we discussed earlier work. As such, any new devices that the user would log in with would immediately register their public keys with Apple and receive the user's private key, meaning that they're capable of receiving messages for the user in the manner previously described. It'd also explain how stolen iPhones could continue receiving messages, even after a password reset.

As you said, "[w]hether or not it's actually set up that way..." I couldn't say, but it'd be one way that Apple could set up a system that wouldn't break with password resets, could be migrated from device to device, would provide device-to-device encryption, and would minimize the amount of resources consumed by mobile devices while sending messages.

Re:Key in cloud != Key accessible by Apple

[cdrudge]

Perhaps you shouldn't use your username as your password too. ;)

Re:Key in cloud != Key accessible by Apple

[gnasher719]

That means means Apple won't help you. They could, but they would compromise the added benefit of the two factor service. It's not a technical limitation. Apple have your registered device ID's. Apple have that 16 digit key they gave you that you stash away. The only thing they may not have is your password. But they might, you don't know that.

Apple wouldn't need the 16 digit key. Obviously they _might_ have it since they sent it to you in the first place. Apple has enough info to send things to your registered devices, but that doesn't necessarily mean they actually have the code that your registered device is going to display. Again, they _might_ have it.

The website about two factor authentication says that Apple _cannot_ help you when you lose two of your three items. Not "won't", but "cannot". If they "won't" help you, then they would probably have to help the police if there is a subpoena, and then things will come out. If they "cannot" help you, then they cannot help the police either.

Re:Key in cloud != Key accessible by Apple

[Anubis IV]

Actually, that's exactly what Apple does. The password he's talking about would only be being used to encrypt the user's backup of their device. As such, even if the user resets their password, the iDevice would still have a local copy of the data that it could encrypt with the new password and then backup like normal. Whether the user has the same password or not doesn't particularly matter, since the old backup is going to get replaced either way. It just means that if you got a new iDevice, you'd have to wait for a backup to complete on the previous iDevice before you could migrate to the new one.

As for proof that it's happening this way, backups can either be done via iTunes or via iCloud, and when they're done via iTunes, I seem to recall that Apple makes it abundantly clear via obvious warning text that losing your password will mean losing access to your backup data. Similarly, with iCloud, unless you can answer the security questions associated with your account, Apple will be unable to recover your password since your password is encrypted using the answers to your security questions.

None of that is onerous or unfriendly towards customers, yet it works exactly as the OP said, provides plenty of protection, and would work perfectly well. Maybe you should give some thought to the possibility that someone else is correct before telling them to wake up so rudely?

Re:Key in cloud != Key accessible by Apple

[viperidaenz]

Your definition of cannot is wrong.
They cannot help you because they have not built a system for their support staff to help you in that situation.
The term should in no way imply the architecture of the system. It defines only the services they will provide you as a customer.

Re:Key in cloud != Key accessible by Apple

[RussR42]

Don't worry about that, it's an old feature. Here is an explanation of how it works.

Re:Key in cloud != Key accessible by Apple

[Anonymous Coward]

That is not how it works. When an iMessage is sent, it is sent, encrypted to each recipient's public key. E.g. if you're sending a message to 5 people who each have 2 devices, your phone will perform 10 different encryptions and unique pushes. This can be easily verified with reverse engineering.

So when you obtain a new phone, it registers for iMessage. Your old phone will be immediately deregistered, because registration works on a last-one-wins basis.

Re: Key in cloud != Key accessible by Apple

[Anonymous Coward]

How do you know they have the ability? Because they do not.

Re: Key in cloud != Key accessible by Apple

[Anubis IV]

They outright said that they have the ability. Back when the App Store was new, they were asked if they could pull apps in case of a major concern, and they confirmed that they had a kill switch that could be used to delete apps from user's devices. To date, however, no one here has cited an example of Apple having used this ability, but it would be foolish of them to not build something like that in, in case of a major vulnerability or the like.

Probably talking about two different things...

[fuzzyfuzzyfungus]

Unless the DEA is actively 'leaking' in order to attempt to move people into a vulnerable channel with a false sense of security(not impossible; but I'm inclined to suspect that the higher level drug runners take their paranoia seriously, or they wouldn't have lasted long enough to level up, and the lower level ones are probably more often foiled by the fact that they need to solicit customers, any one of which could be a plant), I'd be inclined to a more prosaic explanation.

With SMS, architectural security during transmission is somewhere between pitiful and nonexistent and the entity that handles the messages during their voyage is the phone company, which has substantial legal incentives to, and a long history of, supine cooperation with the authorities.

With iMessage, it looks pretty much like SMS on the handset; but it's all just data to the telco, and Apple presumably included some SSL/TLS or similar implementation that isn't totally broken, meaning that going through the telco is totally useless(this would also be why the leaked memo specifically mentioned that iMessages sent to non-Apple devices, which would be crunched into SMS at some stage, were still often recoverable).

The fact that Apple can, apparently, retrieve your iMessage history for you suggests that, indeed, a subpoena of Apple would leave you in the open; but I imagine that the DEA is much more familiar with, and pleased by, the 'service-oriented' attitudes of the phone companies, who are extremely forthcoming with customer information, with very low bars to clear, and minimal pesky judicial process.

Certainly not a good idea to trust anything that the service operator can 'recover' or 'restore' for you to be secure(since it can't possibly be); but the DEA jackboots probably do encounter significantly greater hassle with a message that is never available to the notoriously friendly telcos. You are still up shit creek if they are building a case against you specifically(or if Apple caves and starts providing bulk access at some future time); but casual fishing is likely to be more difficult.

Re:Probably talking about two different things...

[amiga3D]

Right. They're lazy and want to have it delivered on a platter. With this method they have to get off their asses and do work.

Re:Probably talking about two different things...

[fustakrakich]

Higher level drug runners have nothing to worry about, until they outlive their usefulness. They are well protected government employees.

Re:Probably talking about two different things...

[fuzzyfuzzyfungus]

Laziness is the optimistic option... The pessimistic possibility is that they are currently doing a nontrivial amount of surveillance that meets the (somewhere between low and nonexistent, depending on how you ask) standard of evidence for pen registers and similar; but would not meet the standards that would apply if they had to ask a judge to let them demand the goods from Apple.

Re:Probably talking about two different things...

[Xyde]

FYI there is no iMessage to SMS bridge that I am aware of. iMessages go to iDevices only.

laugh

[koan]

TinFoilHat: They brought Steve into the fold a long time ago, gave him top secret clearance and then asked him to make device no one could do without, that they could use to track and listen to people.

This just in: Toil Foil Hoodies selling like hotcakes.
http://kottke.org/13/04/the-anti-drone-hoodie

google glass for everyone

[dadelbunts]

We should just give everyone google glass with a direct feed to all the government agencies. Who would care except drug dealers and terrorists anyway.

Re:google glass for everyone

[Anonymous Coward]

They already have access to our browsing history, stored indefinitely by our ISPs. They can track us everywhere we go through our phones. They have live access to our webmail providers. They have access to any webserver storing our information. They get backdoor access to encrypted communications, such as Skype and 'trusted' CAs. But, by God, google glass for everyone would be excessive.

Re:google glass for everyone

[Anonymous Coward]

Google isn't the one you should be worried about. Using their products is a choice you can make or avoid. They also have a history of refusing to provide information to governments.

Microsoft is the dangerous one - they do the same data-mining of your online presences as Google, they're cooperating with the US government at every level, and they have a long history of unethical self-serving behavior.

Lets face it, if your computer running Windows sends every keystroke to the FBI, DEA or every other creepy agency, who cares what your browser or search engine or email client do?

Re:google glass for everyone

[Anonymous Coward]

...google glass for everyone would be excessive.

Truly, we must draw the line somewhere. Take a stand for due process and our privacy. It's worked so well so far. Jesus wept, this gets depressing.

Re:google glass for everyone

[Anonymous Coward]

Why would they need your keystrokes when they have that chip in your head? Better put on your tinfoil hat and watch out for the black helicopters.

FTA:

[fustakrakich]

I'd like to think that law enforcement is above attempting such tricks, but unfortunately that might just be naive these days.

Might be?? I would say extremely so.. An indication the writer has no knowledge of history... Or maybe just something he has to say to avoid legal issues, or worse..

PGP

[SigmundFloyd]

I've been wondering the same thing about older news stories, on how the FBI was unable to crack PGP encryption. That too might be disinformacija.

Re:PGP

[fustakrakich]

That too might be disinformacija.(sic)

Got news for ya, buddy. So is their story about 9/11, but we had to reopen the opium supply line somehow.

Re:PGP

[Arancaytar]

If they were the only ones who said so, I'd be inclined to distrust it too. However, RSA has been around for 36 years now with no serious challenges, so either there is a world-wide conspiracy that controls every single mathematician (or several that between them control all the mathematicians), or it's unbroken.

It's also possible that there are a few mathematicians decades ahead of current research that all work for various governments, but considering how much of mathematical work is derivative now, it seems far too unlikely that some unaffiliated researcher wouldn't have stumbled across the discovery independently.

(Well, or the NSA has a working quantum computer that can do work on a useful scale, which goes back to "decades ahead of current research".)

Re: PGP

[Anonymous Coward]

You guys want something REALLY SECURE, look up www.silentcircle.com. No one can break that including the government.

Cryptocop

Re:PGP

[Anonymous Coward]

but considering how much of mathematical work is derivative now

Ever since Newton's time, in fact.

Re:PGP

[Anonymous Coward]

A background in mathematics is integral to understanding that last pun.

Re:PGP

[femtobyte]

Suppose the darkest inner circles of government intelligence agencies actually can crack widely-used and trusted encryption like PGP. If you're merely an international drug dealer and child slave trader (or peaceful anti-war protestor, whichever the FBI loathes more), the tiny cabal of people within the FBI who have the clearance to know about the PGP crack aren't going to do anything that remotely risks leaking such information. Your secrets are perfectly safe with them, because they've got more important targets (like all the Top-Secret-equivalent info from foreign governments and corporations) that they'd lose covert access to if even a vaguely credible hint of a PGP crack leaked to lower levels of government law enforcement (and from there to other countries' intelligence operatives). A PGP crack would simply be too important an asset for covert intelligence to risk exposing on whatever mildly nefarious plots your encrypted emails are hiding.

don't know about imessage

[Trailer Trash]

But they've never lied about the effects of drug usage, right?

Right?

Um, right?

The drug war is suckled on lies

[mbone]

Every government statistic or statement on the drug war is not to be believed. There might be some truth in some of it, but after 80+ years of lies, it's not the way to bet.

The DEA is not the NSA.

[__aaltlg1547]

They're quite knowledgeable about DRUG TRAFFICKING. Expertise in other areas relevant to law enforcement should not be assumed. Apple either has a copy of your key or can crack their own encryption when they need to. The NSA could probably crack it too, but why would the DEA go to the NSA and why should the NSA concern itself with helping the DEA crack cases? That's not their job.

DEA can't TAP it

[mabhatter654]

The issue is not that the DEA cannot lawfully acquire the messages... It's that THEY HAVE TO ASK , EVERY TIME.

Most taps are just "wide open" until the warrant expires and the telco turns the tap off... There is very little oversight. Many online services give law enforcement more of an "open ticket" to keep coming back for email or Facebook as often as they need. While the line isn't "tapped" LEOs can refresh every twenty minutes if they want.

They are attepting to bully Apple into allowing a MITM or wide open ticket to people's accounts. The first post on this very carefully NEGLECTED to mention that Apple COMPLIES with lawful requests. Which they most certainly would. The issue is that Apple won't open a giant backdoors and look the other way while LEOs look up their ex-girlfriends, or people with fancy cars to pick on. Apple is probably making them request transcripts with dates and times... And then APPLE SENDS it to them.

Re:DEA can't TAP it

[ninetyninebottles]

Well, according to Apple's own (scanty) information on iMessage and on third party analysis, it looks like it is some sort of end to end encryption with Apple serving as the cert authority. it may well be that Apple cannot intercept the messages as the system is currently designed and can only reissue a certificate by killing the old one (and thus alerting the user because their iMessage stops working). That is by no means certain, but if it is not the case then Apple might have a false advertising lawsuit headed their way.

Re:DEA can't TAP it

[fustakrakich]

The issue is that Apple won't open a giant backdoors and look the other way...

Why not? I mean, aside from the possibility of getting caught...

Re:DEA can't TAP it

[mabhatter654]

Like getting caught stopped AT&T?? Didn't they make what the NSA asked for legal after-the-fact AT&T got caught?

There is a technical issue that Apple doesn't support redirecting messages...although they could allow the DEA to have an additional iMessage device. Apple probably "could" do it.

The REAL issue is that there is NO LEGAL MANDATE for Apple to do so. Aple running a chat program is legally no different than YOU running a chat program. Apple is not a telecommunications provider or an ISP, nor do they get the legal protections of those classes. If you are going to hold Apple to this standard, then you would have to tap EVERY instance of Blackberry Messenger or Microsoft Lync... Even PRIVATE ones operated by your company.

The DEA is hijacking the discussion to get something that has Congress has not wanted to pass multiple times. The DOJ has been able to push telcos and Microsoft around because of monopoly rules and applying laws based on their "class" as common carriers or ISPs. This is the classic "there should be a rule" because they have got what they wanted from "lawbreakers" so now non-lawbreaking companies should comply too.

Re:DEA can't TAP it

[fustakrakich]

The REAL issue is that there is NO LEGAL MANDATE for Apple to do so.

Actually we don't know that. Secret laws and all. There could be a gag order to keep them from mentioning it, like a national security letter. With all this secrecy, we don't have a clue of who knows what, leaving us to assume the worse, which is the recommended way of dealing with any of this.

Well color me surprised.

[Arancaytar]

Because who could have possibly seen THAT coming. Seriously, this is my shocked face.

So, post m4ssages on pubic bulletin boards

[ivi]

'looking like a "Lawnmower for Sale" but with message
encrypted into tel.# & eMail address

Better, encrypted into photos for an apartment / house
ad (on a free-ad web site)

Dump your eDevice(s)

QED

Do it yourself

[chowdahhead]

It may not be the most elegant solution, but hosting your own Mumble server works pretty well for secure private IM and voice chat. There's a really slick Android client called Plumble, and I believe iOS has a basic one as well. The built-in authentication and encryption is sufficient, and the newer builds support the OPUS codec.

Not necessarily

[Anonymous Coward]

The fact that old iMessages transfer to new iDevices is not proof of external keys. The method for secure transmission may decrypt on receipt. If so, then already received messages would be transferable. New messages would use the new key combination.

And, if Apple takes this route, they have no keys and no unencryptd data to give to anyone. Simplifies the issue for them quite nicely.

Just as encryption for email like PGP, it is then in your hands. If they can't get your device, then intercepted messages are useless.

Re:Not necessarily

[gnoshi]

True, but it does provide an avenue to check for external keys.
I don't have an iThing so I can't check, but if you can activate a new device and receive your iMessage messages while the previous device on which those messages were held is switched off, then at best the messages are protected by a password. It may be the passphrase for an encryption key, but it is still just a password. If you can get Apple to reset the password, and then activate a new device and receive your iMessage with your old device being off the whole time, then Apple must be able to read the messages (because the password can't be the key, or be a passphrase for the key, as the key is accessible with the password being changed).

There are also other permutations: if the old device must be on to configure iMessage on a new device, then there may be a key transferred from device to device. Without knowing the specifics of iMessage, I can't predict many other tests.

Without a Warrant

[whisper_jeff]

If they go to Apple _WITH_ a warrant, Apple can surely provide them with the information (well, I'd be shocked if they couldn't comply with a warrant).

That's not what the DEA wants, however - they want to be able to read the messages _WITHOUT_ a warrant. I imagine that is where they are having difficulties intercepting and reading iMessages.

Haters That Hated And I Busted Because You Busted

[plan1111]

IT Pros Don't Play With Peoples Bull S And They Reward Honesty So One Good Thing You Can Learn From Me Is My Mirror Is Windows 11 So These Boy and Girls Hating Have Nothing But A Hard Time Buying New Software And Rigs And Getting All Mad lol I See Who Blogged And Hated Me And What I Stand For And I Don't Believe you deserve To Be In My Domains Network

It is strong

[Anonymous Coward]

Apple claims to use "a minimum" of 128-bit AES to encrypt your backups, which includes every iMessage you've ever sent/received (unless you delete them of course).

They claim to never provide the encryption keys to third parties. That sounds pretty clear to me, they won't give it to law enforcement. I am not a lawyer, but my understand is if it's encrypted then there are restrictions in place for how law enforcement can access it. A court order would probably be needed at the very least.

They don't go into much detail about how the AES key is generated. Presumably either your iCloud login password (or forgot password questions) or your phone's PIN code will be used.

Re:It is strong

[Anonymous Coward]

There are Law Enforcement exceptions to just about every law on the books, including those that enforce contracts and regulate behavior.

What about Blackberry?

[shking]

Remember the fuss just a year ago when India and other gov'ts complained about Blackberry? How is this different?

What could happen...

[gnasher719]

It is of course quite possible as some people mentioned that it is harder, but not impossible, for the police to get access to iMessage messages than they like, and they interpret this as "we can't read iMessage" (whenever we like). It is also quite possible that they are just lying and want all the drug dealers to use iMessage because they have complete access.

It is also possible that Apple has absolutely no way to read your iMessages. I would think that making iMessage safe against hacker attacks would be harder if there is already a way to access iMessage that is open only to Apple, and I can't see how buying able to read iMessages would be in Apple's interest.

The Government Lying to You?

[wisnoskij]

That unpossible!

Note: Chrome thinks that unpossible is actually a word?

Re:The Government Lying to You?

[Anonymous Coward]

That's because it is an actual word. See also:

"But none returns. For us to levy power
Proportionable to the enemy is all unpossible."
- Shakespeare, The Tragedy of King Richard the Second

Erdos+Bacon=Pen register results in probable cause

[girlinatrainingbra]

And getting a pen register dataset can mean enough linkages can be shown to a "known drug dealer" or a "known felon" that they will then have probable cause to get a warrant, even if the number of linkages is so high that you're not the "friend of a drug dealer" or even the "friend of a friend of a drug dealer" but even "(friend of a)^5 of a drug dealer".
.
When you get links that are that long, you can ensnare everyone in the world, whether or not they are truly guilty of anything, just from guilt by association. See the comment about 6-degrees-of-Kevin-Bacon or the one about Bacon numbers and Erd''os Numbers.

probably just bending the truth

[stenvar]

They can probably not decrypt iMessage traffic without some other information or hooks; but they almost certainly have that.

No they arent.

[Anonymous Coward]

You guys are really sad and pathetic. Are you the president? Chief of staff? Work for the CIA? Infact do any of you even so much as scrub a toilet for the pentagon? No you do not. So what exactly do you know about the government? Nothing that's what. You make assumptions, make up fairy tales, assume the worst and you all talk about those things as if you have real factual tangible proof. When in reality you don't know squat and just sit around on the internet and say how the government lies to us.

I just wish they would pull every person from the internet that has outright lied about "what the government does" and sue them.

Come back when you have proof they are lying about something.

WHAT THE

[Anonymous Coward]

For the love of rms, people, the original article was about the DEA lamenting that their illegal unwarranted dragnet efforts via communication service providers couldn't intercept the messages because of the way CALEA was written. If they want the contents of your iMessages, they merely have to subpoena Apple for your devices' master keys and they can connect to it as long as it's on a network someplace (see: Find My Phone, Notifications) and read the #%^*#%^*#%^* iMessages.

Stop amplifying noise and amplify signal instead.

You make the commi fagboyz argument

[noshellswill]

Oh boohoo ... individual power leads to individually evil acts.  You are so emotionalized booohooopoo ...  Rational republicans say **Tutff tit**. Individual evil rising from individual power is **always** a better deal and less onerous  than statist evil arising from state power. Better the lone blind person die  from singular malicious speech than the entire citizenry die from malicious state politics.  Think of the **cosmopolitan **  Athenian port traders (ca 420 BC) who prompted their state into imperialist war with Syracuse ... better they die by vigilante murder than  the cultural suicide that --- by their hold on state decisions -- overtook the republic.

The DEA

[fyngyrz]

The DEA lies about everything else. Why would this be any different? The very fact that the DEA exists is an affront to personal liberty; We have decades of detailed records of them spreading falsehoods, destroying families, in general doing far more harm than drugs ever did or ever could.

DEA Informers: They lie about who they are, what they do, what their intent is -- and just about anything else they're asked. This is who they are. Liars. But that's not all they are. They're also as dangerous as any government agent you can imagine, wholly without concern for anyone but themselves.

DEA agents: They lie about where the danger comes from; they lie about toxicity; they lie about addictiveness. They lie about consequences (they ARE the primary consequences), and they have been known to attempt to trade your personal honor for your freedom if you fall into their hands. They created the violence underlying the black market drug trade; they created the black market itself. They're not shy of interfering with other sovereign countries, nor of playing fast and loose with our own "justice" system.

So when a DEA "anything" tells you something, you're best off assuming they're lying. It's what they do. Aside from destroying families, that is. If they're not lying, they're likely trying to hurt you some other way. Get away and stay away. Nothing truly good can ever come of contact with people so bereft of personal honor -- or so outright stupid -- that they would work for the DEA.

To heck with them. And the laws they rode in on. And those who made the laws. And those in the general population who thought, and perhaps still think, agencies like the DEA were ever a good idea.

The drug war: It's a war on you and your family and your friends.

Re:The DEA

[Jawnn]

The DEA lies about everything else.

[citation needed]

The very fact that the DEA exists is an affront to personal liberty;

Really? How so?

We have decades of detailed records of them spreading falsehoods, destroying families, in general doing far more harm than drugs ever did or ever could.

We do? Where?
Look. I am not apologizing for the failed "war on drugs", but you are making a lot of bold, and as of yet unfounded, assertions about the DEA. That's not exactly contributing to needed rational discourse about the matter. It damn sure isn't proving a thing about collusion between government enforcers and (in this case) Apple. Not that there's much doubt, but let's at least try to not sound so much like Fox News. M'kay?

Re:The DEA

[fyngyrz]

Really? How so?

Good grief. Ok, here's the obvious example: You can sell, or smoke, a joint - a light intoxicant which does far less harm (probably none at all in most cases) than alcohol - and go to jail for years for these acts. After which, you are often considered a felon, which pretty well puts paid to your future. I'm sure you know this and you're just being disingenuous.

You're confusing your uninformed state with the idea that my statements are unfounded.

Go spend some time with Google. The DEA's actions and policies are largely a matter of record, as is the massive amount of harm they have caused.

Re:The DEA

[anagama]

I don't know about the spreading of falsehood part, but destroying families and doing far more harm than good -- that's fact.

Glenn Greenwald debated GWB's drug czar on the question of whether the US should legalize all drugs. http://vimeo.com/32110912 Greenwald identified the following costs, all of which we pay due to the drug war, all of which would go away if reason prevailed, and challenges prohibitionists to address why these costs are worth it. Listen closely to Portugal's experience with decriminalizing all drugs (evaporation of the following costs, slight increase in usage rates of some drugs (but less of an increase than neighbor countries during the same time period), a DROP in usage rates of drugs among young people, reduction in the spread of HIV etc, returning people who use drugs to the productive economy rather than making them burdensomely unemployable, acceptance of the police as a helpful organization rather than an enemy, which leads to the police being able to actually investigate real crime).

If you are unable to address those costs with evidence based information, we will know your opinion is based on mere personal dislike for drugs and drug users, i.e., moralizing, fear mongering, and prejudice:

1. The US is the world's largest prison state on a per capita basis AND on an absolute basis. We hold 25% of the world's prisoners despite having only 5% of the world's population.

2. The War on Drugs is undeniably racist. All ethnic groups use drugs at essentially equal levels, but certain minorities comprise the greatest number by far of those convicted.

3. Economic costs in the 100s of billions and yet no reduction in drug use.

4. Drug war has spawned the privatised prison industry.

5. The erosion of civil liberties experienced in the last 40 years has been rooted in the drug war.

6. Militarization of the police force which turns it from an organization community members will trust for help, into one which is feared and deemed an enemy. This hinders solving crime.

7. International resentment to the US based on US demands that other countries criminalize their population and take on what are seen as unnecessary social and economic costs.

8. Extreme violence due to the fact that in a black market, only criminals will participate and criminals use violence to secure market share ("you don't see Budweiser and Heinken shooting each other over territory").

9. Drug war breeds contempt for the law, because millions of people use drugs, even frequently, without any consequences at all (depending on one's demographic profile).

10. The drug war destroys the lives of the very individuals the government claims it wishes to help because as felons, they become unemployable. So while imprisoned and after release, such people are unable to provide for their families and being separated from families is highly corrosive to families.

Re:The DEA

[Anonymous Coward]

I don't know about the spreading of falsehood part, but destroying families and doing far more harm than good -- that's fact.

Glenn Greenwald debated GWB's drug czar on the question of whether the US should legalize all drugs. http://vimeo.com/32110912 Greenwald identified the following costs, all of which we pay due to the drug war, all of which would go away if reason prevailed, and challenges prohibitionists to address why these costs are worth it. Listen closely to Portugal's experience with decriminalizing all drugs (evaporation of the following costs, slight increase in usage rates of some drugs (but less of an increase than neighbor countries during the same time period), a DROP in usage rates of drugs among young people, reduction in the spread of HIV etc, returning people who use drugs to the productive economy rather than making them burdensomely unemployable, acceptance of the police as a helpful organization rather than an enemy, which leads to the police being able to actually investigate real crime).

If you are unable to address those costs with evidence based information, we will know your opinion is based on mere personal dislike for drugs and drug users, i.e., moralizing, fear mongering, and prejudice:

1. The US is the world's largest prison state on a per capita basis AND on an absolute basis. We hold 25% of the world's prisoners despite having only 5% of the world's population.

2. The War on Drugs is undeniably racist. All ethnic groups use drugs at essentially equal levels, but certain minorities comprise the greatest number by far of those convicted.

3. Economic costs in the 100s of billions and yet no reduction in drug use.

4. Drug war has spawned the privatised prison industry.

5. The erosion of civil liberties experienced in the last 40 years has been rooted in the drug war.

6. Militarization of the police force which turns it from an organization community members will trust for help, into one which is feared and deemed an enemy. This hinders solving crime.

7. International resentment to the US based on US demands that other countries criminalize their population and take on what are seen as unnecessary social and economic costs.

8. Extreme violence due to the fact that in a black market, only criminals will participate and criminals use violence to secure market share ("you don't see Budweiser and Heinken shooting each other over territory").

9. Drug war breeds contempt for the law, because millions of people use drugs, even frequently, without any consequences at all (depending on one's demographic profile).

10. The drug war destroys the lives of the very individuals the government claims it wishes to help because as felons, they become unemployable. So while imprisoned and after release, such people are unable to provide for their families and being separated from families is highly corrosive to families.

Oh boy, what rubbish. Let's address some of your points:

1. You failed to show a correlation between drug prohibition and incarceration. Do we have substantially more people in jail *because* of the war on drugs? If so, prove it.

2. It doesn't matter that everyone consumes drugs at the same level (to be proven, where is your source?). What matters is who deals and distributors said drugs. I highly doubt that as many white people distribute drugs as other ethnic groups and it makes perfect sense to dish out longer jail time to distributors than users. So what are you really complaining about here?

3. There is a reduction (on a gross-level, not net), but the population is increasing and drug distributors are better funded than people enforcing the law. Are you implying that ineffective drug enforcement means we should give up altogether? Sex trade and child labor is on the rise too, should we stop trying to curb those crimes too?

4. I'm not going to argue for/against this.

5. I'm sure terrorism had n

Re:The DEA

[djl4570]

Go spend some time with Google.

I don't disagree with you, but digging up citations to support your argument is your job, not the readers.

Re:The DEA

[jcr]

Do we have substantially more people in jail *because* of the war on drugs?

Are you serious?.

-jcr

Re:The DEA

[Anonymous Coward]

Fail. His post is an opinion, not a journalistic article. The onus is on you to disprove his opinion via citations.

Re:The DEA

[anagama]

Oh boy, what rubbish. Let's address some of your points:

1. You failed to show a correlation between drug prohibition and incarceration. Do we have substantially more people in jail *because* of the war on drugs? If so, prove it.

2. It doesn't matter that everyone consumes drugs at the same level (to be proven, where is your source?). What matters is who deals and distributors said drugs. I highly doubt that as many white people distribute drugs as other ethnic groups and it makes perfect sense to dish out longer jail time to distributors than users. So what are you really complaining about here?

3. There is a reduction (on a gross-level, not net), but the population is increasing and drug distributors are better funded than people enforcing the law. Are you implying that ineffective drug enforcement means we should give up altogether? Sex trade and child labor is on the rise too, should we stop trying to curb those crimes too?

4. I'm not going to argue for/against this.

5. I'm sure terrorism had nothing to do with it. The world is changing my friend, drugs are only part of the problem.

6. I'm not sure what you're referring to here. The DEA and main police force are separate beats. I trust my local police force just fine, thank you very much.

7. Last time I checked, drug use was illegal (and enforced as such) in most countries around the world, so I have no idea what you're referring to.

8. Poor logic. Again, should we legalize all form of criminal acts for fear of what the black market will do? Laws exist for morale reasons. Selling drugs is like selling Alcohol to a known Alcoholic. It is highly addictive and prays on people's weakness.

9. Many people experiment, but most move on and hold nothing but respect for law enforcement. Most people don't smoke pot and do crack through the rest of their life.

10. That's a problem that affects all felons. Where do you draw the line? Shouldn't we try to improve the life of *all* felons? Why the focus on drug felons alone?

Obviously you failed to watch the debate.

1. 50% of the Federal inmates, 25% of state inmates for drug offenses: http://www.drugwarfacts.org/cms/Prisons_and_Drugs

2. You're just being racist.
http://healthland.time.com/2011/11/07/study-whites-more-likely-to-abuse-drugs-than-blacks/
http://www.hrw.org/news/2009/06/19/race-drugs-and-law-enforcement-united-states#_Part_I:_Race

A recent study in Seattle is illustrative. Although the majority of those who shared, sold, or transferred serious drugs[17] in Seattle are white (indeed seventy percent of the general Seattle population is white), almost two-thirds (64.2%) of drug arrestees are black.

3. I don't even understand you're point in the first sentence. It's totally incoherent. The second, about the sex trade, completely misses the point because the number of people who use prostitutes is vastly smaller than those who use drugs. The drug war is like outlawing french fries -- sure, they make you fat but so many people use them, it's pointless to push against the tide. The same cannot be said about prostitution. If we ever get to the point that is the case, then we can address that -- right now, it's just off topic. A diversion.

5. As Greenwald pointed out in his debate, the egregious civil liberties violations of the last decade, first took root in the drug war.

6. Google "drug war militarization of the police force" and pick an article: https://www.google.com/search?q=drug+war+militarization+of+the+police+force

7. Again, you totally didn't watch the debate

Re:The DEA

[Anonymous Coward]

Wrong, the writer stated his opinions as if they were facts, facts require evidence.
It is reasonable to expect that if you state something as fact you should be able to provide evidence backing your statements and it is not up to the reader to find those facts themselves so the onus lies with the writer or it is reasonable to assume that what the writer says is nothing but hot air, posturing, conjecture or blatant lies.

Re:The DEA

[b4upoo]

I rode motorcycles for over 45 years. The dangers of motorcycles are many and only a fool would argue that motorcycles are not dangerous.
                    So what, you may say. Well I have seen more drug addicts in life and death emergencies on the streets and sidewalks than I ever seen seen motorcyclists in critical condition. In other words even forgetting disease and subtle losses it is obvious that the use of drugs is far more dangerous that riding motorcycles. I may add that I live in a climate in which we can ride every day of the year normally.
                    The carnage of drug use is not trivial at all. And some jump sitting behind bars for a few years is trivial to what i have seen dope do to people. And it is not just the users either. It is their kids, their families and the entire town that suffers. And I can tell you that I would eagerly throw away the key and keep a person in a cell for life rather than suffer the risk of having them drive near me in traffic and I do include drunks in that as well. I can tell you flat out that addicts will look at a judge and plead innocence claiming the dope made them do it. You know the drill. "I just had a relapse and fell of the wagon for a couple of days. You can't blame me for being sick.".

Re:The DEA

[Anonymous Coward]

1)--http://www.nytimes.com/2008/04/23/world/americas/23iht-23prison.12253738.html?pagewanted=all&_r=0

http://en.wikipedia.org/wiki/List_of_countries_by_incarceration_rate

2)--http://www.americanprogress.org/issues/race/news/2012/03/13/11351/the-top-10-most-startling-facts-about-people-of-color-and-criminal-justice-in-the-united-states/

http://www.drugpolicy.org/race-and-drug-war

3)--http://www.drugsense.org/cms/wodclock

http://www.cnn.com/2012/12/06/opinion/branson-end-war-on-drugs

4)--http://en.wikipedia.org/wiki/Private_prison

http://thinkprogress.org/justice/2012/08/03/627471/private-prisons-spend-45-million-on-lobbying-rake-in-51-billion-for-immigrant-detention-alone/?mobile=nc

http://www.nbcnews.com/id/44936562/ns/business-cnbc_tv/t/private-prison-industry-grows-despite-critics/#.UWJCD5OG35A

5)--The war on terrioism is only 12 years old (14, if you count the follow up to the bombing of the US embassies in Kenya and Tanzania and thwe bombimng of the USS Cole).

http://en.wikipedia.org/wiki/War_on_Terror

6)--http://en.wikipedia.org/wiki/Law_enforcement_in_the_United_States

7)--http://en.wikipedia.org/wiki/Drug_policy
http://www.bbc.co.uk/news/uk-11001803
http://www.drugabuse.net/drug-policy/drug-laws-around-the-world/
http://www.thefix.com/content/worst-places-be-caught-drugs?page=all
http://www.nytimes.com/2012/05/11/opinion/saying-no-to-costly-drug-laws.html

8)--So...do you mean we should also prohibit alcohol sales and use in the U.S?

9)--So...that just means that most drug laws are irrational, right?

10) very few people who have been convicted of felony for drug use have robbed banks, businesses, homes nor have committed murder or assault. Indeed most people convicted of drug sales, production, or smuggling, exhibit qualities that are respected in most business operations. Honesty, promptness, and hard work.

Re:The DEA

[countach]

Having seen my wife turn into a paranoid schizophrenic by smoking joints, ultimately leading to our divorce and extreme trauma for our children - something that would be unlikely to happen with alcohol, I disagree with you most strenuously. Of course, that doesn't necessarily mean going to jail is the answer, but pretending that smoking joints is harmless really doesn't help.

Re:The DEA

[Anonymous Coward]

I'm guessing your wife also wore shoes. Shoes turn you into a paranoid schizophrenic, you heard it here first.

Re:The DEA

[Moral Judgement]

I am very sorry about your wife and your experiences. Many people may have adverse reactions to recreational drugs, which is why some form of quality control and minimum age policies will have to be instituted to make legalization work. However, alcohol abuse can and does lead to mental health problems, at a much higher rate among the general population than marijuana. While it's true that your wife may have been more susceptible to marijuana, that is not the case with the population as a whole, for whom alcohol is much more dangerous. I have supplied an research paper, a quote from the abstract of which is pretty illuminating, "Schizophrenia is frequently complicated by comorbid disorders such as medical illnesses, mental retardation, and substance abuse. Substance use disorder is the most frequent and clinically significant comorbidity in this population, and alcohol is the most common substance of abuse, other than nicotine (nicotine is much more prevalent than any other substance of abuse in this population) (Cuffel 1996)." I know the abstract only cites co-morbidity of drug use, mostly alcohol, with schizophrenia , rather than cause and effect. However, the same could be the case with much of the population for which marijuana "causes" schizophrenia. After all, no one is suggesting that cigarettes cause schizophrenia, and just about all mental health patients use them (only a slight exageration).

Re:The DEA

[Moral Judgement]

God dammit! I didn't include a source for the quote! How embarassing.

Re:The DEA

[Anonymous Coward]

So you never seen a mariage broken because of alccolism. Children beat by alcoolic father mother. Drunk rape.
Good for you.

Do you citation about all this little thing?

Re:The DEA

[Moral Judgement]

facts require evidence.

The above requires evidence, and it is not up to me, as the reader, to find this myself. Or maybe not all facts are empirically determinable?

Re:The DEA

[cinky]

something that would be unlikely to happen with alcohol.

yeah, because alcoholism isn't destroying families every day...

Re:The DEA

[TheRaven64]

something that would be unlikely to happen with alcohol

It's also unlikely to happen with marijuana. It's even unlikely to happen with LSD, although probably more likely. Unfortunately, unlike tobacco and alcohol, there is no requirement to put warning labels on marijuana when it's sold. It is also difficult to do detailed studies on the effects of the drug, and it is not possible to go to a doctor and be tested for the latent conditions that can be triggered by certain chemicals, if those chemicals happen to be illegal.

Re:The DEA

[mjr167]

Actually, it can happen with sever alcoholism. I'm sorry for what happened to your family, but alcohol can have the exact same impact on a family. There are plenty of ways for people to destroy themselves and hurt the people they are supposed to love. Sometimes it isn't even their fault (inability to deal with a traumatic experience for example).

Some people take Tylonal and die. Most don't, but some do. We don't ban Tylonal. Instead we sell it over the counter to anyone who asks because we recognize that people are responsible for themselves and the choices they make.

Re:The DEA

[Anonymous Coward]

I1. The US is the world's largest prison state on a per capita basis AND on an absolute basis. We hold 25% of the world's prisoners despite having only 5% of the world's population.

This seemed like BS, but it seems it's true:
http://www.nytimes.com/2008/04/23/world/americas/23iht-23prison.12253738.html?pagewanted=all&_r=0
I didn't realize quite the extent of this.

Re:The DEA

[Anonymous Coward]

Yes, but you don't have to risk jail by smoking the joint. Whether you agree with the law or not - is it so great of a thrill to be worth risking jail for? When you get caught and jailed and labeled a felon, it was after you KNOWINGLY broke the law. I think willingly breaking the law is much worse than the actual act of smoking a joint - because it says "Fuck you" to the whole democratic system and is just BEGGING the judge to put you in jail. You can smoke cigars all day, find almost-pot to smoke, drink all the booze you want, and hell even paying a hooker is only a misdemeanor. Why do you *have* to smoke pot so bad to risk all that trouble? I think that says something right there.

Re:The DEA

[Anonymous Coward]

Well...
the big problem isn't with the war on drugs - the big problem is that the "war" isn't going well, it's dragging on forever and costing lots of money, like Vietnam.

I hate to make it "all or nothing" and be accused of not being able to see shades of grey, but the reality is this:
1. Countries which have legalized drugs have far less problems than the US with them. Even when they legalized hard drugs like heroin, addict may die and families may be destroyed - but huge amounts of violence and public spending to prevent it doesn't happen and people don't feel scared to walk down the street. The addicted can have their fun and other people can mostly not worry about it.
2. Countries where drugs are *really* illegal (like here in Japan) don't have much problems with drugs because for the most part, people don't do them. They don't want to be in jail for life, and since being in jail isn't some kind of badge of honor, people want to stay away from that scene and 99.9% of them do.

Spending tons of money every year, but not quite enough to stomp the problem out doesn't solve the problems, and only serves to make the DEA rich.

Same thing with guns really. Criminals in Japan are afraid to own guns because if they get caught, they are *done* - no matter what lawyer they have.

Re:The DEA

[sudon't]

"you don't see Budweiser and Heinken shooting each other over territory"

Not anymore, anyway. But of course we saw exactly the same problems anagama outlines above, during alcohol prohibition.

Re:The DEA

[phorm]

2. The War on Drugs is undeniably racist. All ethnic groups use drugs at essentially equal levels, but certain minorities comprise the greatest number by far of those convicted.

Does that also take into account income levels/regions? Inability to afford a decent lawyer is likely a strong factor as well.

Re:The DEA

[sudon't]

In other words even forgetting disease and subtle losses it is obvious that the use of drugs is far more dangerous that riding motorcycles.

Drugs? There are a lot of different drugs, my friend, many of which are not dangerous in the least. In fact, a great deal of the "carnage" is a direct result of prohibition. And, just as with alcohol, there will always be a minority of people who get into trouble with substances. The vast majority of people use drugs and alcohol, as the commercials put it, responsibly.

The sad fact is, that there is an incredible amount of ignorance around drugs, even among users. Of course, this is no accident. We've all been spoon-fed disinformation since childhood. But don't take my word for it. There is a lot of good information available for those who are actually interested in hearing it. Let me recommend a very well researched and inexpensive book. It certainly opened my eyes on a number of points.

http://www.amazon.com/Saying-Yes-Jacob-Sullum/dp/1585423181

Re:The DEA

[Anonymous Coward]

Anecdotal evidence is anecdotal. No one cares about your wife. We need statistics.

Re:The DEA

[Anonymous Coward]

Sounds like you've got some anecdotal evidence, and you are using it to paint a wide brush. FYI, you are wrong.

Re:The DEA

[Anonymous Coward]

Not when the reader wants cites for "the sky is blue" type of statement. If you demand cites for all speech at every level, you are missing the point. A conversation is not a paper in a scientific journal, it is supposed to be the exchange of ideas.

Re:The DEA

[bkcallahan]

This:https://plus.google.com/photos/113256656618948802091/albums/5833202495410018593/5833202493378526386

Re:The DEA

[fyngyrz]

So is what you're saying that Rosa Parks should have stayed at the back of the bus? Because she was "saying "Fuck you" to the whole democratic system and was just BEGGING the judge to put her in jail"?

What you're completely missing here is that the law can be wrong. The whole system can be wrong. It can fail to respond to corrective forces, such as information or awareness of side effects, or to take civil rights into account. Even when there are large, organized groups of people carefully organizing the data and presenting it regularly to the government. Even when the government's own studies indicate the accuracy of that data. At that point, you have government out of control; not a correct expression of a democratic process, or more to the point, correct action of the republic.

You're also missing the point that it isn't about the thrill of smoking; it's about the government wrongfully repressing personal choice, and in the process, creating a whole series of side effects that do huge harm, and then refusing to admit it was wrong. Even though prohibition II has produced exactly the same problems, albeit written larger, as prohibition I did; and even though just like prohibition I, prohibition II has utterly failed to control the substances it was intended to control and the people it was intended to control. It's junk law from junk minds which does huge damage to the citizens.

I don't do a lot if recreational drugs outside of wine with dinner and a cup of coffee from time to time. I'm not personally fond of pot. But I absolutely deny that the government is correct in saying I cannot smoke pot; and it's outright evil in what it does to people it catches selling or smoking pot. As far as the DEA goes, that's a violent and corrupt force deployed against our own people to no good purpose. The government does not deserve my support in this matter, and it does not have it.

Re:The DEA

[fyngyrz]

Having seen my wife turn into a paranoid schizophrenic by smoking joints

This is not a reasonable argument against pot. There are people out there who can't drink milk; who can't eat bread; who can't take aspirin, etc. The correct response to that reality is not to make milk and bread and aspirin illegal, and then to escalate such that someone who sells milk or bread or aspirin, or consumes them, goes to prison, etc.

There are people who will have severe reactions if they see flashing lights. Should we therefore make flashing lights illegal? What about peanuts? I like peanuts on my sundaes; but they will really hose some people. Should we outlaw peanut butter and all other peanut products? And then go shooting people on sight if they grow or sell peanuts?

It is an unreasonable argument to assert that these things are bad because some small percentage of the population has trouble with them. The reasonable conclusion, in fact, is that there's something unusual about that small percentage, and that is certainly worth looking at. But that's darned difficult to do when the whole thing is massively illegal and has its own ultra-violent specialized military to enforce that illegality.

Of course, that doesn't necessarily mean going to jail is the answer, but pretending that smoking joints is harmless really doesn't help.

It's harmless for the vast majority. We're quite sure of that, because the number of people who have indulged is extremely large. Pretending that your wife's experience, even if correctly attributed to marijuana use, is sufficient to categorize marijuana as generally harmful is very poor procedure. It is exactly the same kind of cognitive error that would categorize peanut butter as generally harmful because occasionally someone is found to have an adverse reaction to peanuts.

Re:The DEA

[Anonymous Coward]

She has a weak mind then. Just slip her some LSD, and the weed will seem like a kid's ride. Also, not exercising moderation when no tolerance to cannabis exists is not wise.

Re:The DEA

[Jawnn]

Nice try, but wrong. The DEA will have nothing to do with you being busted, prosecuted, convicted and sentenced for smoking a joint, and almost certainly not with you selling a joint. A few hundred pounds of product? OK, now you might get their attention. But you are clearly bitching about the nature of drug laws - in general. Let's try to focus on the real problem and not go off on some "they're all Nazi's" rant about the DEA. The DEA is only a part of a much bigger problem. While you're about it, how about actually providing your proof that "...the DEA lies about everything..."?

Re:The DEA

[Anonymous Coward]

Having seen my wife turn into a paranoid schizophrenic by smoking joints, ultimately leading to our divorce and extreme trauma for our children - something that would be unlikely to happen with alcohol,

Sorry about your marriage really but I think your wife had "other" problems than just smoking pot. Schizophrenia is in the mind and is a sickness. Yes it can be heighten by smoking still the real problem is in the illness not the pot.

something that would be unlikely to happen with alcohol,

Sorry I got to call bullshit on that. Think about the thousands of people who get drunk daily and go home and beat their kids. Drunks are a lot more volient and crazy. 99.9% of all pot smokers I have met (and I have met a lot) just want to chill and bother nobody when stoned. 60% or more of the Red Necks I know when drunk want to fight.

Personally I'd rather hang out the the stoner.

oh well

[smash]

Back to SMS with Android huh?

Re: oh well

[Anonymous Coward]

Check out Off the Record Messaging. Cross platform (mobile and desktop, all major OSes on each), strong encryption with good key rotation. Works natively with Google Chat and AIM but supports other networks when you link them with your Google Chat account using XMPP capabilities.

Way geeky, but stronger than any other solution out there.

One wonders

[Impy the Impiuos Imp]

> Is the DEA Lying About iMessage Security?

The government made a similar statement about TOR last year, and I wondered the same thing, that maybe it was disinformation.

Fuck a squirrel right in the ass

[Anonymous Coward]

I pooped my pants.

Obscurity

[dutchwhizzman]

Your messages would be just as easily for them to read once they know how you embedded them. Encrypt them with a decent algorithm implemented properly. Then use a channel that they might not discover, at least for a while. Don't use the same channel too long and use encrypted messages to inform the recipient of a change in channel. Use PKI, so you don't have to change keys when someone can no longer be trusted. Use PKI, so others can't pretend to be your without stealing your private key. Using steganography the way you describe it is for religious fanatics and boy scouts. Trojans that lack the resources and the channel to do proper encryption may use steganography to remain undetected for people that only casually inspect their proxy/firewall but that's about the only serious modern application I've seen so far. Anyone under surveillance that will only use steganography to hide their data, will be caught.

ummm, no

[Anonymous Coward]

I didn't see anyone mentioning it, but your iMessage data is not stored in the cloud, it is all stored locally. if you switch devices, you have to restore from a full backup of all the data, which can be stored in the cloud if your using that iCloud feature... but it's not stored/archived in the same sense that your email is. you can't just plug in your Apple ID and have the iMessages pulled down like you can when you add a GMail account to your phone.

Why did Techdirt have to tell them?

[michelcolman]

The DEA had no idea how to access iMessages but now Techdirt just told them how to do it. Your iMessages are no longer safe...

Same crap with Google Talk

[spacefight]

I keep hitting the "off the record" option on Google Talk chats. However, I log in from e.g. an Android device and voila - the chat is back there with the chat log.

So much about off the record.

These companies lie to us.

It's Monday,...

[Anonymous Coward]

...it's /.

Time for a conspiracy theory. Nothing to see here, move right along...

I am sure they are...

[DarkOx]

and that is the real problem. I think a better broader question to be asking is should a "free and democratic society with government by the people and for the people" have agencies spreading disinformation to the people?

I ask this because there is already large portion of the population that has a very cynical mistrustful view of government (myself included). When officials are known to provide inaccurate information to the public it harms societies ability to trust any other information from government. Most of us are taught honesty is a virtue; when we see government being purposely dishonest it degrades our respect for its institutions.

I don't deny the short term usefulness it might provide certain law enforcement efforts. I would further suggest there is some line to be drawn between broadly announcing disinformation like "we can't intercept/read iMessages" in hopes of drawing in stupid criminals, and providing disinformation in a very targeted way to someone who is already a suspect. Directly E-mailing a recipe for explosives made form easily obtained materials, that dose not really work to a bomb plot suspect for example.

I also understand we need military secrets and disinformation about our capabilities there in makes some sense as well provided the real target of that disinformation is foreign threats.

It's Apple, you knuckleheads

[Anonymous Coward]

Am I the only one who realizes the truth? Apple made the whole thing up to sell more iPhones.

Huh?

[Anonymous Coward]

Seriously? This is how you attempt to determine the underlying cryptography, by making ill informed guesses based on the functionality? Moronic.

Let me explain to you how this works. When you attempt to send an iMessage to someone, your phone looks up their public keys for their devices. Then, it encrypts the message to them. When you get a new phone, it generates a new key, and registers it with its phone number.

This kind of like a pgp key server with automatic lookup.

They Known You Know This is a Lie

[Anonymous Coward]

The DEA thought you would think this is a lie before they even released the news!

int he cloud you say?

[Anonymous Coward]

suggesting that Apple has the key somewhere in the cloud

interesting....see -> http://yro.slashdot.org/story/12/11/02/1737219/us-government-you-dont-own-your-cloud-data-so-we-can-access-it-at-any-time

i'll let you all piece the rest of it together from here

One of the assumptions in the article is flawed.

[Andy Dodd]

If the encryption key is derived from the users' password, and it's hashed differently than whatever algorithm Apple uses for login (one example might be PBKDF2 for encryption and crypt() for login) - it's very easy to store encrypted "blobs" of data that can only be accessed by the user (with their password). I believe this is how Blackberry operates - their servers store encrypted data, but BB is never in possession of the key.

That said, if you read the DEA's memo more carefully, all it pretty much says if you think about it is "herp derp we can't sniff SSL. Call the waaaaaahmbulance!".

The memo is talking about their intercept systems that are installed at the service provider level (cellular provider or landline ISP). These systems can't intercept SSL traffic.

wait a second

[milkmage]

FTA "An internal Drug Enforcement Administration document seen by CNET discusses a February 2013 criminal investigation and warns that because of the use of encryption, "it is impossible to intercept iMessages between two Apple devices" even with a court order approved by a federal judge. ...the key word is INTERCEPT.

I'm not a security or network expert, but isn't "intercept" different than "decrypt messages stored on a server"?

couldn't it be difficult to intercept (whereas reading messages stored somewhere is trivial - with a warrant)

i can send an imessage using the phone number or one (or more) email addresses. w/o knowing how imessage actually works, it looks like phone to Apple to phone - presumably, only Apple knows the relationship between email addresses and phone number so that traffic is sent on the internet (not a cell network) - don't forget, imessage works on non-cellular devices. how does LE track a message end to end with Apple in the middle?.. remember, the keyword is INTERCEPT which implies realtime, so intercepting a message may not be impossible, but impractical - certainly not as easy as SMS. in theory, I could have an imessage conversation and never use the same email address twice - which means cloning an iphone isn't a solution either.

Open source

[DrYak]

Who would believe any different?

If the source is open, it's actually possible to check if the data safety is sane.

Exemple: Mozilla's Sync.
It *does* store web passwords on the server.

Data sent and received from the server is always encrypted. (the server never has access to the clear text, only to the encrypted form)
Without the password that the user keeps for him/herself, all the rest is useless.

Three-letter agencies could subpoena all that they want, there simply isn't a technical way to extract the data. All that they can get is only a bunch of random-looking encrypted data, which is useless without the password stored into the user's head (or a nearby post-it... saddly, no matter how much advance an encryption scheme is, there are always users who will screw up badly).

Counter example: Skype

Skype's license clearly state that they will collaborate with local authority as required by local law.
It's closed source, so you can't actually check, but given the license, you can safely bet that there is very likely a backdoor somewhere inside to comply with the various wire-tapping law.
(very probably in the form of a way for law-enforcement forces to obtain the encryption key, so it's possible to later decrypt any intercepted network traffic).

under the heading of DUH!

[BigLonn]

no no, your comms are secure pay no attention to the crypto geek behind the curtain