Slashdot Mirror
18th Century Law Dredged Up To Force Decryption of Devices
Cognitive Dissident writes The Register has a story about federal prosecutors using a law signed by George Washington to force manufacturers to help law enforcement access encrypted data on devices they manufacture. The All Writs Act is a broad statute simply authorizing courts to issue any order necessary to obtain information within their jurisdiction. Quoting the Register article: "Last month, New York prosecutors successfully persuaded a judge that the ancient law could be used to force an unnamed smartphone manufacturer to help unlock a phone allegedly used in a credit card fraud case. The judge ordered the manufacturer to offer 'reasonable technical assistance' to make the phone's contents available." What will happen when this collides with Apple and Google deliberately creating encryption that they themselves cannot break?
>> authorizing courts to issue any order necessary to obtain information within their jurisdiction.
Isn't this actually contradictory to the 5th admendment?
Really, as long as only "reasonable technical assistance" is required, there is no danger. Good encryption is designed to be (practically) unbreakable unless the key is known, hence expecting somebody to break it without the key is not "reasonable" at all.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
What will happen when this collides with Apple and Google deliberately creating encryption that they themselves cannot break?
That is answered by the former quote:
The judge ordered the manufacturer to offer 'reasonable technical assistance' to make the phone's contents available.
Breaking encryption that is not breakable does not fall under any sense of the word "reasonable".
All my liberal friends think I'm a conservative, all my conservative friends think I'm a liberal.
"New York prosecutors successfully persuaded a judge that the ancient law could be used"
The law was not sunset-ed, the law was not stricken down by another law, the law itself was not repelled on its own, the law was not stricken down by the supreme court.
So what is the problem ? Until a repell/strick down , ALL those law are still valid. Cue the shooting down welsh with a bow, but this is the basis of our judiciary process. just because a law is old does not make it invalid.
C. Sagan : A demon haunted world:
http://www.amazon.com/gp/product/0345409469/
visit randi.org
If the encryption is real (aka, a third party isn't holding the key,or a copy of YOUR key), then they may as well deliver the order to a donkey.
So there's no threat about Apple and Google "deliberately creating encryption that they themselves cannot break", because that just means they can't help the government when they ask, much as, for instance, my dog could not help them out.
But there's a lot wrong with that sentence. They aren't creating encryption, they are writing crypto code using existing crypto algos- arguably the same thing, but still. Also, YOU, the user, will be the one encrypting it, much like you can't sue a knife manufacturer for making a sharp knife. And encryption that is "breakable" isn't really encryption by any decent standard.
The real concern isn't some ancient law trying to force the hand of companies- this will only force them further along the path of making sure that it's not THEIR data, because they lack keys, it's the USER data, go bug him. That's the logical place for them to be anyway- no one spends hundreds of dollars for a phone and then encrypts it without expecting that the encryption is actually a thing- while it's wise to supposed that government level attackers have ways to get keys, it is obviously NOT WHAT YOU WANT WHEN YOU BOUGHT IT. I mean, so there's that.
Anyway, the real concern will be NEW laws that force the companies to do this. And they wouldn't have to be federal laws- if California made some law about how you can't blah blah offer real encryption unless X, and Washington was like no real encryption unless Y, and New York was like no real encryption unless Z, then you would be pushing the companies out of too many markets, and then all the federal courts have to do is drag their feet and the feds get another full decade of Total Access To Your Own Papers And Possessions.
The Bill of Rights is comparably ancient. So what? Old does not mean "wrong" (unless you are a teenager in the rebellious phase)...
Makes sense to me. In fact, seems like a good — forward-compatible — law indeed...
In Soviet Washington the swamp drains you.
Is it reasonable for Google to push an update to the phone in question that decrypts the phone the next time the password is entered?
This is the reason I prefer Android devices. You can install a firmware that is compiled from the open source you trust. There is still the possibility of hardware level backdoors, but there are a 100 different manufactures of Android devices, many of them have little to no presence in the USA. Google doesn't have to be involved with your device at all.
Versus Apple, Microsoft, etc who are easy targets for US courts orders.
The judge ordered the manufacturer to offer 'reasonable technical assistance' to make the phone's contents available." What will happen when this collides with Apple and Google deliberately creating encryption that they themselves cannot break?
Then the vendors won't be able to offer "reasonable technical assistance". What's so hard to understand able that? The existence of the law doesn't prevent them from creating said, unbreakable, encryption.
It must have been something you assimilated. . . .
America's modern left often argues that portions of the US Constitution can be safely ignored because it's old and was written by white dudes. Here's a (fairly calm) piece that explores that argument. (Also look up "constitution living document".)
"Is the Constitution Still Relevant?"
http://consortiumnews.com/2013...
Unfortunately, this isn't just a fringe belief: in 2010 a USA Today poll showed that 1 in 4 people no longer though the Constitution was "relevant"
http://usatoday30.usatoday.com...
This tells us that the cryptography is working and that they're only able to access data with legal power rather than some unknown height of technical prowess.
"When information is power, privacy is freedom" - Jah-Wren Ryel
I like the idea that well written laws will apply to anytime.
Nothing. The law requires people to give reasonable assistance to law enforcement. It does not require them to architect systems so that such reasonable assistance is fruitful. Safe manufacturers are not required to know the combinations to their devices.
I'm watching this carefully, because the hardware vendors and carriers who actively resist are going to be the ones I do business with.
Oliver's law of assumed responsibility: If you're seen fixing it, you will be blamed for breaking it.
The corporate build of Apple OSX that's used by employees has a "corporate key" for filevault.
Yes, and every computer I deploy at my company has a Institutional Recovery Key for its FileVault encryption (we do a combined Institutional/Personal deployment). This is a key I generated on-site, and is only stored locally (in a very secure manner)
If an employee is walking around with a company-issued machine, and storing company-owned data, of course the company is going to use tools to make sure it can access any/all data on the machine if something happens to the user.
This has nothing to do with my personal iPhone, and even less to do with the US Constitution.
Your comment is a complete red herring.
More information on what Apple is using: http://training.apple.com/pdf/...
From a business point of view, nope. Any corporation would drop Androids like they're penny stocks.
Tell me about how Windows suffered by having the NSA Key embedded.
My God, it's Full of Source!
OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
Really, as long as only "reasonable technical assistance" is required, there is no danger. Good encryption
The Justice Department feels that having an embedded back door into the devices' crypto is very "reasonable" and has been pushing for just that. Now they need a judge to rule on their version of the word and the corporations will fall in line.
Throw in a Patriot Act gag order and some import/export barriers vis-a-vis patent wars, and let's make a bet about how many 2015 backdoors will be discovered in 2018.
This is the kind of government the voters support.
My God, it's Full of Source!
OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
One thing I learned with going through the federal process (see my bio at The Market is not Random), is that the constitution is irrelevant and that the use of it becomes pure interpretation and loophole. I doubt that the current legal structure was anything close to the forefathers imagined, but never doubt that the governmental employees will utilize any and every loophole at its disposal to justify its actions. The oxymoron of united states government.
-------
artlu.net
America's modern left often argues that portions of the US Constitution can be safely ignored because it's old and was written by white dudes. Here's a (fairly calm) piece that explores that argument. (Also look up "constitution living document".)
Thomas Jefferson was concerned greatly about the "Tyranny of the Dead" -- that the laws and debts of dead elder generations will inhibit progress in younger generations that are facing entirely new types of problems not envisioned by the older generations. He wanted the Constitution (or at least federal law) to be effectively completely rewritten every generation -- every 18-20 years or so. You can read about it in his letters.
I would say that probably the results of that poll are not people being "stupid" and "forgetting" that the Constitution is important, but rather, evidence of a yearning that the current system is not entirely working and it needs modification. Just like we have done so 27 times in the history of the US (i.e., the Amendments). It's not relevant today, but we Amend it to be more relevant. For example, the move to get a 28th amendment that strikes down the Citizens United ruling and makes more free and fair elections (see any number of organizations: Move to Amend, WolfPAC, etc.). We know there's money in politics, and here's one proposed solution to it. Not by ignoring the constitution or laws, but actually, working the way the constitution is supposed to work! The people can call for an amendment if our national leaders do not.
I don't think I've heard anyone make the argument that they can ignore laws because old white dudes wrote them. I *have* heard that we need to change laws because they are stupid and we want to make a more perfect union, though. Don't let people like the ones that wrote the article in your link trick you into think their opinion is public opinion (its easy to spot because of the use of words like "The Left thinks blah" and "The Right does blah" -- there is no Left and Right as one huge bloc, but a spectrum of smaller groups with differing opinions, and even if it was one big bloc, who is this author to be able to speak for half the country? I've never heard of him.).
I'm not that worried. I think when our current leaders that have been in office for 30+ years finally retire or are voted out as the younger generation comes up, we will see laws and constitutional amendments that fix problems. Not ignored, fixed.
Google and Apple can help them by making the encryption breakable.
Nope, that battle has already been fought. That would constitute compelled speech.
They can compel the company to provide information (such as source code) for their current data. Subpoenas have been doing that for decades.
They can compel the company to help them perform certain research.
They can even use NSLs to compel the company to intercept certain communications.
But at least so far, they cannot compel the company to modify their product to become defective.They still need to do that themselves, commonly by intercepting shipments or less commonly modifying chips inside the supply chain. Note that both routes are considered clandestine, they don't compel the business to intentionally release a faulty product, instead they just sabotage the results.
//TODO: Think of witty sig statement