Slashdot Mirror
How the FBI Hacks Around Encryption
Advocatus Diaboli writes with this story at The Intercept about how little encryption slows down law enforcement despite claims to the contrary. To hear FBI Director James Comey tell it, strong encryption stops law enforcement dead in its tracks by letting terrorists, kidnappers and rapists communicate in complete secrecy. But that's just not true. In the rare cases in which an investigation may initially appear to be blocked by encryption — and so far, the FBI has yet to identify a single one — the government has a Plan B: it's called hacking.
Hacking — just like kicking down a door and looking through someone's stuff — is a perfectly legal tactic for law enforcement officers, provided they have a warrant. And law enforcement officials have, over the years, learned many ways to install viruses, Trojan horses, and other forms of malicious code onto suspects' devices. Doing so gives them the same access the suspects have to communications — before they've been encrypted, or after they've been unencrypted.
Hacking — just like kicking down a door and looking through someone's stuff — is a perfectly legal tactic for law enforcement officers, provided they have a warrant. And law enforcement officials have, over the years, learned many ways to install viruses, Trojan horses, and other forms of malicious code onto suspects' devices. Doing so gives them the same access the suspects have to communications — before they've been encrypted, or after they've been unencrypted.
Hacking 'round encryptions
Gives Libertarians conniptions
Who really wants to be an unkempt slave?
From this fracas let be born
Finally, Federalist reform
Taking us to fabled fields of Burma Shave
Get thee glass eyes, and, like a scurvy politician, seem to see things thou dost not.--King Lear
It does not give the FBI bulk surveillance capabilities unless they work with bulk tools, namely botnets and worms trying to infect everything they can get. And that looks pretty bad when discovered.
So widespread use of end-to-end encryption would mean that the FBI would be mostly restricted to operating within the confines of the Constitution. We can't really have that.
To allow "hacking" to circumvent encryption, the FBI must have (direct or indirect) access to a suspect's device.
For that, they must first have a suspect. Encryption can still prevent becoming a suspect in the first place.
Ah, arrogance and stupidity, all in the same package. How efficient of you. -- Londo Mollari
guilt.. as for the motive for needing to watch us every second,, that's valid fear based that their behaviours will become more known about... cease fir stand down there's moms & babys in this town... new pontess candidate gay mom from jersey already having 'wardrobe' challenges.. never ends, hopefully
for her audition....? in every quirky way imaginable truth+mercy=justice uncontested universal spiritual axioms... thanks again moms
"they should be able to get a warrant to try to break that encryption"
RTFA, That's his point too. The trouble is he only finds 9 examples of judges giving opinions or court orders:
"Mayer analyzed the few public examples of law enforcement hacking he was able to find, most of them from the FBI and DEA: five public court orders and four judicial opinions."
He found discussions where the FBI expressed the belief that it is legal without a warrant and alluded to previous times they'd done it warrantless.
"He also looked through declassified FBI documents and found that officials there have “theorized that the Fourth Amendment does not apply” when investigators “algorithmically constrain the information that they retrieve from a hacked device"
"Mayer said that in internal emails, federal investigators argued that targeted hacking might not constitute a search, and hinted at past times when officials may have hacked without getting a warrant first."
So if you believe the FBI has only done this 9 times then perhaps Libertarians are crackpots. On the other hand it seems likely the FBI has done this hundreds of thousands of times, and thus 9 examples of judicial opinions on cases suggests they're not telling the courts.
The FBI of course won't even reveal the total number of targets its used malware against, be it 9 or 9 million.
... so can everybody. Chinese, Russians, Bulgarians, Ukranians, Germans....
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
This one is funny!
And if they haven't a warrant? It's illegal then, but who cares?
http://xkcd.com/538/
https://www.youtube.com/watch?v=OUzzAlorT7Q
It will another case similar to Stingray, the cell phone intercept:
http://www.yro.slashdot.org/story/12/10/27/144229/secret-stingray-warrantless-cellphone-tracking
Where the FBI claimed they could do it with a pen register (i.e. without a warrant), and used pleas bargaining and misdirection to keep the details of the intercepts from the court.
And of court every little district cop used it without a warrant, or even a legal basis for its use:
http://yro.slashdot.org/story/15/05/25/0344206/san-bernardino-sheriff-has-used-stingray-over-300-times-with-no-warrant
Eventually the courts find outs its a blanket sweep of data and then required a warrant for this use:
http://www.wctv.tv/home/headlines/TPD-Stingray-Use-Raises-Privacy-Questions-262047771.html
IMHO, it will be similar. Some hypothetical specious theory that lets them hack without a warrant, and they're keeping the details from the court so as to not face any scrutiny. Similar to Stingray.
this is about keyloggin, ya know what windows ten does...
so they hack you thinking you have it turned off , put a process hider in or change the app with ms help and you are boned for encryption cause your keys are 100% compromised
this is why YOU SHOULD NOT USE WINDOWS 10 or WINDOWS at all if you can help it
Of course the FBI isn't happy about people going dark.
It's easier without having to deal with the encryption.
More and more endpoints are also getting full disk encryption.
Thinking long term, the FBI doesn't want to be in an arms race with the software developers of browsers, operating systems and the like.
Will they still be able to hack to software running on the endpoints ?
Maybe someday they won't find a way around it. Even though they have a court order they might not be able to do what they are asked to do. That is what scares them.
New things are always on the horizon
Translation: We don't want to search for criminals.
How long until general warrants appear in the USA? There must be a hive of criminal activity in towns outside those 'no rights when the US border is less than 100 miles distant' zones.
"It’s fascinating – there are four excuses that keep coming back for every single dismantling of democracy. It’s terrorism, child porn, file sharing, and organized crime.", Rick Falk Vinge
The point is not whether that can decrypt a selected target, rather it is that encryption causes a problem with surveillance from both a practical and legal standpoint. First by encrypting your communications, you clearly establish an assumption of privacy, which isn't as obvious with clear text (IANAL, but I assume that creates a hurdle in the courtroom). Second, applications that take in massive data of warrentlessly available data streams don't have the facilities to hack each one and still provide timely indicators of malfeasance. This kinda relies on the first point, because if someone didn't encrypt their communications, one MIGHT argue that the communicatee didn't mean for it to be private.
I'm curious if off the shelf protection programs detect the FBI malware, or they've been compromised at the money layer.
blindly antisocialist = antisocial
And let all criminals know the encryption products that stump them since criminals using encryption are keenly aware that civilian cases are all public, so if the FBI walks into court and says we can't break this encryption on product A. Suddenly every criminal, and terrorist in the world knows their capabilities. Not a smart move. I'm no fan of how the government works, but this is one of the smarter moves its made despite the toll it has on public opinion. Public opinion, like on most issues, needs to learn to follow cause and effect chains, where the effect becomes a cause, what effect will it have? Like raise taxes on the wealthy. The wealthy own businesses, the wealthy don't want to lose money. The wealthy demand a higher salary to offset the higher taxes. The company obliges. The company doesn't want to see it's bottom line hit, lest the shareholders get pissed. It raises its prices to compensate for the owners higher salary. Price increase works out to be a tax on the middle class and poor. Good job. The essence of cause and effect chain analysis? Shit rolls down hill. You can try and pass the shit up the hill, but it will just roll back down. Corollary is there's no such thing as a free lunch. Same is all true in the case of encryption. They cannot tell you which cases they can't bust. They'd love to offer proof for public opinion, but the shit will roll back down to criminals and terrorists. Better to just sit in the shit of uninformed, unthinking public opinion.
The criminal mind-set is obviously strong with the FBI. No surprise there.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
I had no idea /. had so many legal experts! And, my, look at all these people here who seem to have inside information on the FBI, NSA, and Homeland. My goodness! Why would we need spies when you already know it all!
It's okay, don't be shy. No need to resort to profanities such as "unencrypted".
(Though it is acceptable as a noun.)
Elections are coming up. Is it an issue worth bringing up? Since it's given that neither democrats or republicans are going to reign them in, what's the plan? There are other choices. Or is everybody just going to treat it like the weather and complain because they can't work an umbrella?
“He’s not deformed, he’s just drunk!”
If they can't remotely exploit your machine and exfiltrate what they want...they'll just show up when you are gone and use a hotplug kit to keep your machine on long enough to hack it and make copies of the storage devices.
As we all know, if you have physical access...
The FBI trojan horsed tor browsers on a mass scale which was revealed in the pirate bay case. Last I checked there are no warrants or probable cause covering random users of tor.
https://freedomgeek.quora.com/Secure-communication-Use-a-Raspberry-Pi
https://xkcd.com/538/
Much easier to take a hammer to somebodies kneecaps until they give you the decryption key.