Slashdot Mirror
FBI Chief Calls Unbreakable Encryption 'Urgent Public Safety Issue' (reuters.com)
The inability of law enforcement authorities to access data from electronic devices due to powerful encryption is an "urgent public safety issue," FBI Director Christopher Wray said on Tuesday in remarks that sought to renew a contentious debate over privacy and security. From a report: The FBI was unable to access data from nearly 7,800 devices in the fiscal year that ended Sept. 30 with technical tools despite possessing proper legal authority to pry them open, a growing figure that impacts every area of the agency's work, Wray said during a speech at a cyber security conference in New York. "This is an urgent public safety issue," Wray added, while saying that a solution is "not so clear cut."
Decapping a chip is difficult, expensive and not guaranteed. Most TPMs and security-chips are almost impossible to open without damage.
Go look at the arcade-ROM decapping efforts. Even 30-year-old ROMs have protections that mean some games are now permanently lost forever, and the ones that are successful rely on "seeing" (via X-Ray etc.) the data as a visible effect on the image. That doesn't work for anything modern at all, you'd need new kinds of instruments or something to measure the individual charge on an individual transistor from billions of them on a tiny sliver of silicon.
Modern chips, especially those designed to be secure and avoid tampering? Not a chance. Nobody has yet demonstrated an attack on a modern TPM chip like that, and the private keys aren't exactly just sitting there in plain-text even if you could.
And then updating for EVERY technology change, nm-advancement, etc.? Cost would not just be prohibitive but astronomical.
Do you believe that those 7800 devices a year are all just one read away from stopping a terrorist attack each? Highly unlikely. If anything one arrest could result in 20-30 devices, not even worrying about whether it was a drug-deal or a telecoms violation or whatever else the FBI might deal with.
The value just isn't there, even if the technology could exist.
To my knowledge, literally NO-ONE in the world has read a key from a physical iPhone security chip, for instance. There have been software flaws, and things found in publicly available firmware that are quickly patched out but even those don't cause the processor to magically give up all its private keys. That's not how those chips work. Even Apple themselves may not be able to do it (only replace the device in question and reset it, not bring across the private keys).
This is part of the "problem". The system is secure. And that means secure from all attackers, including the people who want access to the devices for legitimate reasons (e.g. the owners in some cases!). If it wasn't, it would be insecure, against both those categories of people, and thus not be fit for purpose.
Sure, at some point, someone will find a hole. And then the next round will devices will counter that. But the FBI expecting to have something that nobody else in the world has, possibly even the manufacturer, which can only be given by weakening the whole purpose of the system for everyone, and for it to be cost-effective, to handle a boat load of enquiries that they presumably have NO OTHER evidence for? That's just silly.
I'm sure if it was "go to war or not" territory, someone would find a way. But there, no expense is spared. As a run of the mill "let's see what this terrorist suspect texted via WhatsApp" enquiry? Not a chance.
If they COULD do this, they would be. And they'd be keeping very quiet about it. Because the second it was public, every new phone, chip and computer would be redesigned to stop it in the future.
Actually, the IRS cancelled that contract and went with Experian. How much better that is is up for debate, of course :)
Apparently they suspended the contract on 10/12, Equifax protested, and the GAO denied the protest.
No downvotes for you at the moment, so I'll have to settle for pointing out how stupid your argument is.
First, "think of the children" is a shitty, fear-mongering argument designed to play to people's base instincts, and trap them in a corner so they can't produce a good argument against you. How do you argue against protecting children without seeming like a monster?
Second, if there is a switch to flip, that can and will be abused. Between nation states and malware, if you want it on there's the chance that it will get turned off without your notice, and if you want it off there's a chance it will get turned on without your notice.
Third, enabling authorities to invisibly snoop on anyone not smart enough to turn on their encryption is stupid and wrong. It sets up an expectation that they can check in on anyone when they want to, and creates the "why are you encrypting if you have nothing to hide" line of thought.
Last, technology isn't some magic shit that prevents law enforcement from doing it's job. It's the opposite, actually. Not only can they can do the same damn job the same damn way as they always have, we now live in a world with cameras everywhere, face identification, cell phone tracking, OnStar and other car tracking and remote control abilities, etc., etc., etc.
Law enforcement already has orders of magnitude more tools with which to catch bad guys than they had even a decade ago. There is absolutely no reason to allow them invisibly monitor every facet of a large percentage of people's lives, data mine and machine learn, heuristically profile, and otherwise pry into their lives without a trace because there's a vanishingly small chance they might be up to something. I don't care how bad or stupid those people are - that's abusive fascist secret police shit right there.
Velociraptor = Distiraptor / Timeraptor
To be honest, I don't think he's exactly wrong to say that unbreakable encryption is a public safety issue. It's an issue.
He's absolutely correct that it's a public safety issue. The last century taught us (those who were paying attention, at least) that authoritarian government is the biggest public safety issue that has ever existed, save for maybe the bubonic plague. So, sorry FBI, the bottom line is that we have bigger fish to fry than "encryption".
Do you have ESP?
If encryption is breakable with a large amount of effort, then it does several useful things:
* It prevents people without the resources from accessing your mail.
* It may provide short-term security, which may be sufficient.
* It makes those who do have the resources be selective in whose encryption they break.
For example, if it takes a minimum of a week to break the encryption on an encrypted web connection that discusses an embargoed news item that will be published in 6 days, that's good enough.
Another example: If a government wants to crack down on encrypted communications among drug traffickers, but it costs them $10,000,000 for each decryption effort, they will need to pick and choose who they go after.
There are encryption systems that are provably unbreakable without a key, such as a one-time pad. Unfortunately, they are usually not practical to implement correctly.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.