Slashdot Mirror


FBI Chief Calls Unbreakable Encryption 'Urgent Public Safety Issue' (reuters.com)

The inability of law enforcement authorities to access data from electronic devices due to powerful encryption is an "urgent public safety issue," FBI Director Christopher Wray said on Tuesday in remarks that sought to renew a contentious debate over privacy and security. From a report: The FBI was unable to access data from nearly 7,800 devices in the fiscal year that ended Sept. 30 with technical tools despite possessing proper legal authority to pry them open, a growing figure that impacts every area of the agency's work, Wray said during a speech at a cyber security conference in New York. "This is an urgent public safety issue," Wray added, while saying that a solution is "not so clear cut."

295 of 442 comments (clear)

  1. Think of the children by 110010001000 · · Score: 5, Funny

    Think of the children! No, not the children assembling iPhones in sweatshops: the children the FBI are looking to protect. Think of them.

    1. Re:Think of the children by Opportunist · · Score: 4, Funny

      As much as these asshole think of the children, I can't help but think that they're pedos.

      --
      We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
    2. Re:Think of the children by DickBreath · · Score: 1

      You mean think of the children which (some of) our elected officials want to diddle? Yes, seriously. Maybe the FIB should be looking into that instead of allowing us to be secure in our papers and effects. How the mighty have felon.

      --

      I'll see your senator, and I'll raise you two judges.
    3. Re:Think of the children by sexconker · · Score: 3, Funny

      It's the Reptilians. They have a penchant for pederasty. That's why so many powerful "people" get found out as being pedophiles. They're just Reptilians.

      What can you do to stop the Reptilians? Join the Church of Scientology. The organization's main goal is containing, and eventually eliminating, the Reptilian threat on Earth.

    4. Re:Think of the children by Anonymous Coward · · Score: 5, Funny

      No...this is cyberspace, where the men are men, the women are men and the children are FBI agents.

    5. Re:Think of the children by ISoldat53 · · Score: 2

      Doesn't pederasty have something to do with feet?

    6. Re:Think of the children by Opportunist · · Score: 3, Funny

      So... the FBI boss wants us to think of the FBI agents?

      Kinda makes sense, but it just doesn't really make for a catchy phrase.

      --
      We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
    7. Re:Think of the children by DickBreath · · Score: 1

      Sum land dwelling Reptilians have Feat.

      --

      I'll see your senator, and I'll raise you two judges.
    8. Re: Think of the children by dilvish_the_damned · · Score: 1

      I havenâ(TM)t run a tabulation but appearance indicates lawlessness and depravity has no political affiliation.

      --
      I think you underestimate just how much I just dont care.
    9. Re: Think of the children by Opportunist · · Score: 1

      Yeah, sure, and politicians only pretend to take bribes so they can unmask the people behind it.

      I kid you not, not too long ago that was the excuse by a politician in Europe who got trapped by some journalists.

      --
      We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
  2. Spoiled short-term-thinking brat by Tablizer · · Score: 2

    "I want free access to the cookie jar, waaaaaah!"

    1. Re:Spoiled short-term-thinking brat by DickBreath · · Score: 4, Insightful

      If the FBI gets their way on this weak breakable encryption, it will have economic consequences for the US.

      The other 96% of the world's population will know that they can't trust American products. They might make their own phones, systems, devices, etc even more secure against American TLAs. Thus accomplishing the opposite of what the TLAs want.

      Aren't the majority of smartphones already made outside the US? Maybe all they need to do is build their own secure OS with secure encryption that the US won't like. Will the US stop people coming in with foreign made phones that are too secure?

      What about economic consequences of American executives traveling abroad using insecure US made equipment and having valuable trade secrets stolen?

      But think of the children!

      --

      I'll see your senator, and I'll raise you two judges.
    2. Re: Spoiled short-term-thinking brat by houghi · · Score: 1

      We already do not trust the US and their produrs, so this would not make it worse.

      --
      Don't fight for your country, if your country does not fight for you.
    3. Re: Spoiled short-term-thinking brat by DickBreath · · Score: 1

      You must be in the 96% of the rest of the world's population that can't get behind Trump's: America First!

      --

      I'll see your senator, and I'll raise you two judges.
    4. Re:Spoiled short-term-thinking brat by KozmoStevnNaut · · Score: 1

      Implying that there is such a thing as a "European culture", it's obvious you have no clue. Compare a Swede to an Italian or a Frenchman to a Austrian. Shared culture, my ass.

      --
      Eat the rich.
    5. Re: Spoiled short-term-thinking brat by david_thornley · · Score: 2

      Right now, you don't trust US products not to have back doors. Wouldn't it be worse if you knew US products were legally required to have back doors?

      --
      "When you have eliminated the unacceptable, whatever is left, however improbable, must be the truthiness" - Holmes
    6. Re: Spoiled short-term-thinking brat by houghi · · Score: 1

      No, It would be better. Remember that it is not paranoia if you actually are followed.

      --
      Don't fight for your country, if your country does not fight for you.
  3. Oh no! by gfxguy · · Score: 5, Funny

    Heaven forbid people actually be secure in their persons, papers, and effects!

    --
    Stupid sexy Flanders.
    1. Re:Oh no! by MachineShedFred · · Score: 4, Insightful

      If he can find unbreakable encryption to be an urgent public safety issue, can I find him to be an urgent public privacy issue?

      Also, no amount of wishing will put the AES-256 toothpaste back in the tube. Because, math.

      --
      Slashdot still doesnâ(TM)t support Unicode after it was added to the HTML standard in 1997.
    2. Re:Oh no! by TheGratefulNet · · Score: 3, Insightful

      pigs just keep on piggin'.

      each month is a new cry about their lack of ability to STROLL THRU OUR LIVES and even plant shit on our computers.

      we will not give in. but I suspect we'll lose anyway, because they have infinite money, power, almost people, who want to invade our privacy for lulz (mostly).

      its sad that we are now in a perpetual state of WAR with our own governments on this very issue. and they show no signs of giving in.

      --

      --
      "It is now safe to switch off your computer."
    3. Re:Oh no! by suutar · · Score: 2

      This. Even if it was mandated tomorrow that all encrypted communications shall use X cipher to which the government has a backdoor and through magic psychic software it actually cannot be decrypted without proper cause and judicial review, there's not anything that would prevent the payload from being encrypted again using a different system, and there would be no way to tell without actually decrypting the outer wrapper.

    4. Re:Oh no! by sdinfoserv · · Score: 4, Insightful

      People said that when television first went to satellites. Back in the '80;s, home satellite TV boxes had card readers (just like credit cards) that had all your data id: channel and subscription info, on them. Possession of card readers, used by hackers to read/write their own cards, even for legitimate purposes (like making library cards on the same technology) became a crime - So too did even the "knowledge" of how the readers worked. It was a crime to post or share data layouts or how the hardware functioned. When a society reaches a point where it accepts that knowledge itself is a crime, essentially, outlawing ideas, the notion of "freedom" from there on is nothing more than veneer.

    5. Re:Oh no! by wyHunter · · Score: 1

      Oh for crying out loud. You use credit cards, do you not? Don't say "We won't give in" - because you already have. Now, if you pay cash for stuff, encrypt your data securely, etc. I can say "No you won't give it." But for most people? They don't give a rip.

    6. Re:Oh no! by sexconker · · Score: 1

      Until they force Intel, AMD, ARM, Nvidia, etc. to backdoor the encryption-accelerating instructions.

    7. Re:Oh no! by sconeu · · Score: 1

      This. So much this.

      Boo-frickin'-hoo, Mr. Wray. Read the Fourth Amendment, as well as the First, Second*, and Fifth.

      *Crypto was under ITAR at one point, therefore, it falls under the right to keep and bear arms.

      --
      General Relativity: Space-time tells matter where to go; Matter tells space-time what shape to be.
    8. Re:Oh no! by sl3xd · · Score: 1

      no amount of wishing will put the AES-256 toothpaste back in the tube

      Or the fact that pen & paper cryptography with the Vigenère_cipher and a sufficiently long key of random characters is still considered unbreakable. (Key sharing is a pain, but AES has the same problem)

      It's all especially ironic as the "Advanced Encryption Standard" was a US Federal Government program where the world's cryptographers competed & collaborated to come up with unbreakable encryption. Or that other governments have done the same with NESSIE ECRYPT, and CRYPTEC.

      And that US Federal Government is sponsoring workshops & standardization on post-quantum cryptography, ostenably so we'll have something secure & standardized before we can crack RSA, DSA, El Gamal, Elliptic Curves, etc. with quantum computers.

      It's almost as if law enforcement doesn't want to go back to the heady days of 2006 when they did stake outs.

      --
      -- Sometimes you have to turn the lights off in order to see.
    9. Re:Oh no! by rickb928 · · Score: 2

      The question might better be phrase 'is it unreasonable to require breakable encryption that may expose all of a person's 'papers and effects' despite their intention to be private in such?'

      Because we recognize a right to be secure from unreasonable searches and seizures.

      --
      deleting the extra space after periods so i can stay relevant, yeah.
    10. Re:Oh no! by jittles · · Score: 2

      Also, no amount of wishing will put the AES-256 toothpaste back in the tube. Because, math.

      Which is exactly why I would like to outlaw specific types of math. Nobody needs anything larger than a 32-bit number for anything, nor a decimal point number. Let's ban floating point math and any number larger than 2^31 (for scientific use) and 2^29 (for economic use). This prevents strong encryption (remember that symmetric encryption can be done in far fewer bits than the FBI would like to allow). Problems solved for everyone.

    11. Re:Oh no! by Bob+the+Super+Hamste · · Score: 1

      That would be easily detected given that it isn't that difficult to check ciphers against their specification. It may be a bit time consuming but verification of one block for any of the modern symmetric key block ciphers would probably take a few hours at most for one person to do by hand to see that it is producing valid output. Given that they work on blocks you should be able to pick any block and check it and given a few people one could build a fairly high confidence that it hasn't been backdoored fairly quickly.

      --
      Time to offend someone
    12. Re:Oh no! by outlander · · Score: 1

      But...but....my IPv6 addresses! They're 128 bits! We will run out of internetses numbers! ;)

      --
      "Truth is what works" -- William James "It works!!" -- o-dark-AM comment
    13. Re:Oh no! by outlander · · Score: 1

      I think it's still considered a munition under ITAR. At least the trainings that I've attended re ITAR seem to think so.

      --
      "Truth is what works" -- William James "It works!!" -- o-dark-AM comment
    14. Re: Oh no! by BlueStrat · · Score: 1

      If there is no way to distinguish between encrypted message and a random blob of data, are people going to get thrown in prison for not handing over the encryption keys for scrubbed hard drives or noise on some recording? Will posession of random bits be illegal?

      That ship has largely already sailed.

      Try boarding an airline flight carrying a laptop in carry-on luggage with a blank HDD/no OS through TSA "security".

      Don't attempt this if you actually need to fly somewhere on that flight and/or remain in possession of said laptop, as you're likely going to be missing that flight while playing '20 questions' with TSA..The guy ahead of you may have just walked through with a loaded handgun in his carry-on luggage (TSA is notoriously, hilariously bad at catching actual weapons and stuff, though they're murder on those dangerous water bottles!), but you'll be the one they catch and put through the wringer.

      Strat

      --
      Progressivism (aka US 'Liberalism'): Ideas so good they need a police/surveillance-state to enforce.
    15. Re:Oh no! by jittles · · Score: 1

      But...but....my IPv6 addresses! They're 128 bits! We will run out of internetses numbers! ;)

      Worst of all, everyone with more than $536M in their net worth will all of the sudden see a whole lot of zeroes drop off!

    16. Re:Oh no! by AmiMoJo · · Score: 1

      Be vigilant. In China they just block stuff they can't decrypt. You can get around it, but then you make yourself a target. People go to jail for using VPNs.

      Don't say it couldn't happen here. China is more like the UK than I am comfortable with.

      --
      const int one = 65536; (Silvermoon, Texture.cs)
      SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
    17. Re:Oh no! by suutar · · Score: 1

      True. As long as they're _supposed_ to get a warrant to decrypt anything, they have to come up with an explanation for why they know that the payload is itself encrypted. If they get permission to decrypt all wrappers preemptively that goes out the window, but it becomes even harder for them to claim that they won't look at things without proper oversight.

    18. Re:Oh no! by Agripa · · Score: 1

      This. Even if it was mandated tomorrow that all encrypted communications shall use X cipher to which the government has a backdoor and through magic psychic software it actually cannot be decrypted without proper cause and judicial review, there's not anything that would prevent the payload from being encrypted again using a different system, and there would be no way to tell without actually decrypting the outer wrapper.

      They could pass a statute making it unlawful to use unapproved encryption. If a jurisdictional hook was needed, then link it with using hardware which has traveled or affected interstate commerce. So like travel, you are free to walk anywhere you want or encrypt using pen and paper but using public transport requires ID as is currently the case.

    19. Re:Oh no! by suutar · · Score: 1

      Either I'm misunderstanding you or you're misunderstanding what I said. Let me go into more detail.

      Say you have a message M that you want to hide.
      Encrypt it using an unapproved method. Now you have U(M).
      Encrypt that using an approved method. Now you have A(U(M)).

      Just looking at that from the outside, it's using an approved method. You can't tell that there's an unapproved method inside without decrypting it back down to U(M), and that's not supposed to happen without a warrant. So either they have a warrant before they look, and they're still in the position of "we have a warrant but we can't read it", or they don't, and they have no justification for knowing that you used unapproved encryption.

    20. Re:Oh no! by Agripa · · Score: 1

      It is not suppose to happen without a warrant now but it does. The key escrow proposals all allow mass surveillance. Even the DoJ's position is that copying, decrypting, and automated searching of traffic is not a search for purposes of 4th amendment protections.

  4. The benefit of the doubt by sinij · · Score: 5, Funny

    I will grant Christopher Wray benefit of the doubt and interpret his words charitably - he must have meant it is public safety issue that more people don't use strong cryptography, potentially exposing sensitive data to FBI and other crooks.

    1. Re:The benefit of the doubt by Scarred+Intellect · · Score: 1

      That's how I'm reading it. I'll double up on my encryption right now! Can't let the public be unsafe!

    2. Re:The benefit of the doubt by pr0fessor · · Score: 5, Insightful

      What the law enforcement clambering for a back door or weaker encryption forget or fail to see is that the 7k cases they are talking about isn't even a drop in the bucket compared to the 17 million identity thefts each year

    3. Re:The benefit of the doubt by Holi · · Score: 1

      After the Equifax hack I don't think hiding your ssn is remotely possible anymore. But you know they still get IRS contracts so it's all good.

      --
      Sorry, teleporters just kill you and then make a copy. A perfect, soul-less copy.
    4. Re:The benefit of the doubt by suutar · · Score: 4, Informative

      Actually, the IRS cancelled that contract and went with Experian. How much better that is is up for debate, of course :)

      Apparently they suspended the contract on 10/12, Equifax protested, and the GAO denied the protest.

    5. Re:The benefit of the doubt by amiga3D · · Score: 4, Insightful

      The real safety issue is the lack of respect our government has for the Constitution. I for one am not happy with the whole secret court, secret warrant and other "Patriot Act" nonsense. The government has immense power and only wants more and more. The most dangerous thing in any society is a government that forgets it rules for the people and not OVER them.

    6. Re:The benefit of the doubt by pr0fessor · · Score: 1

      That's true however there are still plenty of scams looking for access to things that the equifax breach didn't give them.

  5. I'm not sure it is by H3lldr0p · · Score: 5, Insightful

    I don't see it all that short term thinking. This is definitely part of a larger picture, a longer termed plan.

    Get this wedge in now, this idea that some authority should have all the keys to the encryption kingdom, and it should be easier to keep it there when the next privacy scheme comes along. Otherwise it's a doubly hard fight the next time. You have to convince more people that the authorities are correct to want it. Do it now, when it is of less concern.

    1. Re:I'm not sure it is by 110010001000 · · Score: 4, Insightful

      Exactly. Once the plan is in place it is very hard to repeal. After all, the plan was keeping us safe. Why would you want to repeal it? Do you want the terrorists to win?

    2. Re:I'm not sure it is by Archtech · · Score: 4, Interesting

      In fact the story goes back to 1975 (at least). That's when Diffie and Hellman found themselves battling the NSA, which wanted DES to be accepted as the encryption standard simply because NSA could crack it.

      --
      I am sure that there are many other solipsists out there.
    3. Re:I'm not sure it is by ebyrob · · Score: 4, Insightful

      It's sad.

      Breakable encryption is no encryption at all. I guess the 3 letter agencies want to back-door themselves to indeterminism along with the whole world just because they think it'll give them that last 2% of control. Perhaps they don't realize what an asymptote maximizing control is. (With an emphasis on the as)

    4. Re:I'm not sure it is by bluefoxlucid · · Score: 3, Insightful

      I strongly oppose government efforts to weaken our protections. I'm relying on unbreakable encryption in my own campaign, notably in my plans to end identity theft and increase voter participation. The most-powerful encryption ever used has been the spoken word, in closed quarters, with a soft noise generator to prevent electronic surveillance: no record of communications. Written and then pulped notes. Anything that destroys the data.

      I haven't translated these plans to my new site yet. I need to, but I've been working alone. My political competitor, Elijah Cummings, has expressed no interest in protecting our privacy from domestic spying.

    5. Re:I'm not sure it is by nine-times · · Score: 5, Insightful

      To be honest, I don't think he's exactly wrong to say that unbreakable encryption is a public safety issue. It's an issue. It's an issue we can debate and think about and talk about. If encryption is unbreakable, then it makes it harder for law enforcement to do certain things that they might validly want to do.

      On the other hand, if people can't encrypt their data (or that encryption is breakable), then it creates an entirely different set of problems. People can't safeguard their data or protect their systems. It increases the vulnerability of our infrastructure. It increases the chances that criminals and terrorists can gain access to important and private information.

      There are going to be real valid problems either way. There should be open discussions about what all of those problems are, and how we can mitigate them. But ultimately, I don't think breakable encryption (or backdoored encryption) is a viable long-term option, even if we were willing to live in a police state. The ability to break or circumvent encryption will inevitably fall into the hands of criminals.

    6. Re:I'm not sure it is by sdinfoserv · · Score: 4, Insightful

      My biggest problem with "them" having the keys to the entire kingdom is "they" have repeatedly demonstrated a lack of accountability, complete disregard to law when not being immediately scrutinized, and just the basic ability to keep the keys they already have, safe.
      Other than that, what's the problem?

    7. Re:I'm not sure it is by dgatwood · · Score: 2

      Even if you assume that they'll do their jobs perfectly, there would still the problem that any back door is essentially guaranteed to eventually be discovered by bad actors and used against the public at large. If the NSA gets their way, we won't be able to do banking online, because it won't be possible to secure the transactions. We won't be able to use credit cards at stores, because it won't be possible to secure the transactions. Basically, imagine a global information apocalypse, and then multiply by 1,000, and you're still not scared enough. Their proposal would be a ticking time bomb that at some arbitrary point in the future would quite literally bring about the end of modern civilization as we know it.

      And it would only affect the good guys—the people who have nothing to hide. The bad guys—the people who are actually trying to hide things from law enforcement—would still use unbreakable encryption. After all, the punishment for breaking a crypto law can't practically exceed the punishment they would get if they handed over proof of two decades of drug smuggling, contract murders, etc. Better to go to jail on that minor charge for a year or two than for the rest of your life. So there's absolutely no incentive for the bad guys to follow the law, which means they won't.

      This isn't even one of those situations where you can justify it by secondary effects. Folks scream about gun control even though reducing the number of weapons in the hands of the good guys does reduce the number of weapons in the hands of bad guys by reducing the number of weapons out there in the world that can easily be stolen, de-serialed, and sold on the black market. This doesn't even have that advantage, because you don't have to steal crypto software. It costs nothing to make a copy of a piece of software (assuming it isn't commercial software), so the bad guys won't have any trouble getting real crypto even if they take away everyone else's access.

      And even if somehow they could magically fix all of those problems with a crypto system based on rainbows and unicorn farts, breaking everyone's crypto still wouldn't buy them much. At best, in the hypothetical situation where someone committed a terrorist attack, they might be able to determine whether the people that person contacted were terrorists or not, instead of having to investigate all of them. So it would save a relatively small amount of investigative effort. And in exchange for that tiny savings by our government, they want us all to give up every shred of privacy—every shred of information security—and send us hurtling headlong towards the end of the world as we know it.

      No, what they are proposing is approximately the single most stupid thing ever to come out of any branch of government. This tops the ban on carrying soft drinks through airport security. This tops the ban on pocketknives. This tops the California cities that limit the number of electric vehicle parking places at businesses in the hopes that somehow it will magically reduce road congestion by making people drive their gas guzzlers. It is completely unjustifiable through any logic, no matter how far you try to stretch it—completely and utterly bonkers. Sad.

      Their idea is bad, and they should feel bad.

      --

      Check out my sci-fi/humor trilogy at PatriotsBooks.

    8. Re:I'm not sure it is by geekmux · · Score: 4, Insightful

      To be honest, I don't think he's exactly wrong to say that unbreakable encryption is a public safety issue. It's an issue. It's an issue we can debate and think about and talk about. If encryption is unbreakable, then it makes it harder for law enforcement to do certain things that they might validly want to do.

      On the other hand, if people can't encrypt their data (or that encryption is breakable), then it creates an entirely different set of problems. People can't safeguard their data or protect their systems. It increases the vulnerability of our infrastructure. It increases the chances that criminals and terrorists can gain access to important and private information.

      There are going to be real valid problems either way. There should be open discussions about what all of those problems are, and how we can mitigate them. But ultimately, I don't think breakable encryption (or backdoored encryption) is a viable long-term option, even if we were willing to live in a police state. The ability to break or circumvent encryption will inevitably fall into the hands of criminals.

      You want to have open discussions? Fine. We'll start with dismantling the FISA court system that seeks to hide Unconstitutional activity.

      I agree, there are issues on both sides. No one is debating the existence of a Catch-22 here. The real problem is those who are asking for the keys to the kingdom cannot be trusted to respect The People or their Constitutional Rights. THAT is the real issue to address.

    9. Re:I'm not sure it is by Trailer+Trash · · Score: 4, Informative

      To be honest, I don't think he's exactly wrong to say that unbreakable encryption is a public safety issue. It's an issue.

      He's absolutely correct that it's a public safety issue. The last century taught us (those who were paying attention, at least) that authoritarian government is the biggest public safety issue that has ever existed, save for maybe the bubonic plague. So, sorry FBI, the bottom line is that we have bigger fish to fry than "encryption".

    10. Re: I'm not sure it is by houghi · · Score: 1

      That is like saying that me not being allowed to take money from other people is an issue. So, it is NOT an issue. At most it is a subject you can discuss with friends over a nice beer. But certainly not an issue.

      --
      Don't fight for your country, if your country does not fight for you.
    11. Re:I'm not sure it is by CrimsonAvenger · · Score: 1, Flamebait

      even though reducing the number of weapons in the hands of the good guys does reduce the number of weapons in the hands of bad guys by reducing the number of weapons out there in the world that can easily be stolen, de-serialed, and sold on the black market.

      Off topic, but you do realize that repeating firearms could be manufactured with the technology available 150 years ago, right? Yes, they were making repeating firearms 150+ years ago. Yes, even cartridge weapons (as opposed to revolvers loaded with loose powder and ball, which they also made then).

      So, no, taking guns out of the hands of the good guys doesn't really reduce the ability of the bad guys to get guns, if they really want them....

      --

      "I do not agree with what you say, but I will defend to the death your right to say it"
    12. Re:I'm not sure it is by VeryFluffyBunny · · Score: 4, Insightful

      And the FBI doesn't see weakened, back-doored, or no encryption as a threat to national security? Just think, Russia or North Korea could interfere with US elections!

      --
      Debate is a form of harassment. Do not question my truth.
    13. Re:I'm not sure it is by HornWumpus · · Score: 4, Insightful

      We don't get much data on the FISA courts. What we get shows the promises made to be pure, unmitigated bullshit.

      The FISA judges are supposed to be holding the government to standards. They are FAILING, based on 100% FISA court warrant issue rate reported for the initial years of operation.

      Rubber stamp court should be abolished immediately, all warrants quashed. All records publicly reviewed and any perjury by feds (or anybody else) prosecuted to _full_ extent of law (after a period of a few years).

      I can dream can't I? Not a crime to dream of justice for the justice department, at least not yet.

      --
      John McAfee 'It was like that time I hired that Bangkok prostitute; to do my taxes, while I fucked my accountant'
    14. Re:I'm not sure it is by infolation · · Score: 4, Interesting

      Their meltdown backdoor's unavailable so it's time to legislate on front doors again.

    15. Re:I'm not sure it is by arth1 · · Score: 1

      But ultimately, I don't think breakable encryption (or backdoored encryption) is a viable long-term option, even if we were willing to live in a police state. The ability to break or circumvent encryption will inevitably fall into the hands of criminals.

      And as well, the ability to have unbreakable encryption will inevitably fall into the hands of criminals. Then we get a situation where criminals can protect their data, while law-abiding people and companies cannot.
      I think it is better to have a situation where law-abiding people and companies aren't put at a disadvantage, and where law enforcement accepts that they cannot get to all data, and adjust their investigations correspondingly. Encryption isn't going to go away.

    16. Re:I'm not sure it is by ewibble · · Score: 1

      You are right that there are issues either way, but my view is that the government can collect more data on us than ever before. From being able to put camera with facial recognition on every street corner to monitoring and storing your conversations phones and social media.

      I have heard the FBI chief talk about this and compared it with uncrackable safes and how they never existed, so they are losing the ability to access some evidence. The reality is that this data was never stored 50 years ago, so by definition it was inaccessible.

      There is always more information that the authorities will want to keep us safe, I don't think they want it out of malice, but a genuine desire to do a better job. However the fact is we are safer now than we have ever been throughout history, apart from some leader starting a nuclear war and access to private individuals data will not help that. The goal of absolute safety will never, and should never be attained, even if the government new absolutely everything everyone was thinking, because as we head towards that we open up ourselves to people in power taking advantage of that..

      That and the fact that it will never work, even if you managed to keep the backdoor keys secret forever. Would the US accept China or any other country for that matter putting back doors in products? So how can the US expect that it is acceptable for them to do so.

      There is also nothing stopping criminals from writing/downloading there own open source encryption.
       

    17. Re:I'm not sure it is by HornWumpus · · Score: 4, Interesting

      Because they are cops and that's what cops do? Adversarial system and all, they're supposed to reach (just not perjure themselves in the process).

      It's not a big assumption at all. Assuming that all the applications were good is a HUGE assumption.

      A public review (and prosecution for lying cops/prosecutors) is the only remedy at this point. Like I say, give them a couple of years to 'cool down', then it's off to jail for at least a few feds.

      Lying to a fed is a crime. Feds lying to themselves _should_ be prosecuted.

      --
      John McAfee 'It was like that time I hired that Bangkok prostitute; to do my taxes, while I fucked my accountant'
    18. Re: I'm not sure it is by nine-times · · Score: 1

      That is like saying that me not being allowed to take money from other people is an issue.

      Not exactly. It'd be like saying... maybe something like, "Facebook presents some mental health issues." Yeah, there are issues. They're worth talking about. If you're going to jump straight to the conclusion that the government should make Facebook illegal, then you don't understand the issues, and your solution is impractical. But that doesn't mean you're wrong to identify it as an issue.

      Similarly, law enforcement being unable to crack encryption is an issue. That doesn't mean that we should compromise encryption or build backdoors. If you think we should do that, then you don't understand the issue and your solution is impractical. But we should still be able to talk about the issue.

    19. Re:I'm not sure it is by ewhenn · · Score: 4, Insightful

      I'd also wager that the 1st amendment protects encryption. I can communicate using any language I wish. In this case, I communicate in AES256. If you don't understand it, that's on you to figure out and not up to me to explain it to you. Also, I agree 100%, unbreakable encryption is not going to go away - the genie is already out of the bottle.

    20. Re:I'm not sure it is by Anonymous Coward · · Score: 2

      And the FBI doesn't see weakened, back-doored, or no encryption as a threat to national security? Just think, Russia or North Korea could interfere with US elections!

      They don't.

      They view themselves as primarily tasked with controlling the law-abiding.

      They don't consider following the Constitution, upholding the law, or protecting US citizens as what they do.

      They are a political attack-dog for the deep state cabal. Nothing more. (And they have ALWAYS been this.)

    21. Re:I'm not sure it is by cayenne8 · · Score: 2
      Hell, on the other hand, they may already actually really have it all broken, and the TLA's are doing a very smart thing...bitching that they can't get into devices to give everyone a false sense of security.

      Or...am I giving them too much credit?

      --
      Light travels faster than sound. This is why some people appear bright until you hear them speak.........
    22. Re:I'm not sure it is by cayenne8 · · Score: 1

      If the NSA gets their way, we won't be able to do banking online, because it won't be possible to secure the transactions. We won't be able to use credit cards at stores, because it won't be possible to secure the transactions.

      Well, to be fair....

      There was a LOT of banking going on before it was online, I mean, online banking is a very new concept and implementation relatively speaking.

      And with regard to credit cards....again, there was a LONG history of credit card usage before the internet.

      Perhaps moving many of these things back to analog and more low tech methods might be a good thing in some ways?

      But that's a different argument, but a secure internet certainly isn't necessary for banking and CC usage, as that that worked quite well in the many, many years before the internet.

      --
      Light travels faster than sound. This is why some people appear bright until you hear them speak.........
    23. Re:I'm not sure it is by networkBoy · · Score: 1

      Different TLAs have different access levels.
      I would fully expect the NSA/CIA to have access to break much higher encryption than the FBI, and to hide that fact from them.

      Afterall, if you can break iPhone crypto, you *don't* want Apple or foreign agents to know this, and allowing the FBI to know means they'd use is it on (relatively) trivial targets and let the cat out of the bag.

      --
      whois gawk date unzip strip find touch finger mount join nice man top fsck grep eject more yes exit umount sleep dump
    24. Re:I'm not sure it is by networkBoy · · Score: 1

      After all, the punishment for breaking a crypto law can't practically exceed the punishment they would get if they handed over proof of two decades of drug smuggling, contract murders, etc. Better to go to jail on that minor charge for a year or two than for the rest of your life.

      DGATWOOD: you are hereby in contempt of court, you are to be held in jail until such time as you decide to produce the decryption keys for these flash drives found in your possession that are encrypted with an unapproved system.

      In another vein, I see a market for custom flash drive firmware that reports a nominal capacity (like 8 gig) while actually being much larger (128 gig) and having the additional capacity (120 gig) locked away without a specific command being sent to the device.

      --
      whois gawk date unzip strip find touch finger mount join nice man top fsck grep eject more yes exit umount sleep dump
    25. Re:I'm not sure it is by farble1670 · · Score: 1

      Get this wedge in now, this idea that some authority should have all the keys to the encryption kingdom, and it should be easier to keep it there when the next privacy scheme comes along.

      When encryption is illegal, only criminals will employ encryption.

    26. Re:I'm not sure it is by Bob+the+Super+Hamste · · Score: 2

      I have always viewed the issue around encryption and law enforcement as one of, does someone have to assist prosecutes in prosecuting them? So do I have to interpret data for those who want to use it against me as that is what one is doing? They have the data, just because they can't figure it out doesn't mean I have to help them.

      --
      Time to offend someone
    27. Re:I'm not sure it is by dgatwood · · Score: 1

      The impossibility defense becomes practical at some point, as in, "I can't produce the decryption keys, because I have been in jail too long and don't remember them."

      Besides, at least at the federal level, there's an 18-month maximum for contempt of court. (Some state laws allow for longer durations.)

      --

      Check out my sci-fi/humor trilogy at PatriotsBooks.

    28. Re:I'm not sure it is by networkBoy · · Score: 1

      unfortunately that won't work:
      https://www.theregister.co.uk/...

      and here's the order that says

      [...]be remanded to the custody of the United States Marshals to be incarcerated until such time that he fully complies with Judge Reuter's Order[...]

      http://arstechnica.com/wp-cont...

      E.g.: *FOREVER*

      --
      whois gawk date unzip strip find touch finger mount join nice man top fsck grep eject more yes exit umount sleep dump
    29. Re:I'm not sure it is by grantspassalan · · Score: 1

      Is there anybody on earth who could be trusted with the encryption keys? As soon as two or more people know a “secret”, then it is no longer a secret.

      --
      A sufficiently advanced simulation is indistinguishable from reality.
    30. Re:I'm not sure it is by runningduck · · Score: 1

      If he were really thinking long term then all encryption is breakable.

      --
      -rd
    31. Re:I'm not sure it is by fafalone · · Score: 1

      That's not a FISA Court problem, that's an American justice system problem. All levels of courts warrants are approved 99%+ of the time. It's actually a bigger problem in the lower courts, because that is what the police busting down your door or camping outside your house are going for most of the time. That's what always vexes me about all these big arguments about whether the cops should or should not need a warrant to do x. It's just a rubber stamp from the local courthouse right up through FISA court. Fix the entire system; start with the fact that judges are almost always former prosecutors or elected by people demanding tough on crime without any regard for rights of the accused, and thus squarely in the corner of the police and unwilling to say no, no matter how egregiously defective the warrant is, such as the warrant approved to force administer a child drugs to give him an erection and photograph his penis.

    32. Re:I'm not sure it is by grantspassalan · · Score: 1

      If we are not careful, at some point law enforcement will persuade the politicians to pass a law to make it illegal to communicate in AES256. If you are caught doing that or teaching others to speak that language, they will put you in prison. Then 10 years later the Supreme Court MAY decide that such a law was unconstitutional.

      --
      A sufficiently advanced simulation is indistinguishable from reality.
    33. Re: I'm not sure it is by sound+vision · · Score: 1

      I think you got the FBI mixed up with the CIA.
      The FBI is basically the national police department. So, plenty of self-righteous assholes willing to bend the rules, and often get sidetracked trying to make themselves look good. But they don't really mess with things that have nothing to do with law enforcement or their own vanity.
      The CIA on the other hand, is a spy agency. Lots more deep-state spookery going on there. International men of mystery.

    34. Re:I'm not sure it is by dgatwood · · Score: 1

      That's quite bizarre. The federal maximum duration for contempt is, by law, only 18 months, and the Pennsylvania statute allows for only a maximum of 90 days, so if he is being held longer than 90 days + 18 months, then he needs to hire better lawyers.

      --

      Check out my sci-fi/humor trilogy at PatriotsBooks.

    35. Re:I'm not sure it is by Trailer+Trash · · Score: 1

      Yeah, 'cause Hillary would have totally reigned the FBI in.

      LOL!

      (By the way, I voted for neither of them)

    36. Re:I'm not sure it is by nine-times · · Score: 1

      does someone have to assist prosecutes in prosecuting them?

      No. The 5th amendment generally says they do not. It's complicated, however, by the fact that people still need to comply with search warrants and subpoenas, and they're not permitted to destroy evidence.

      So if you can be compelled to provide access to your apartment, can you be compelled to provide access to an encrypted drive? If you can be required to produce documents in your possession, can you be required to unencrypt those documents? If you're not allowed to burn documents, can you erase the unencryption key for those encrypted documents?

    37. Re:I'm not sure it is by networkBoy · · Score: 1

      they're using the all writs act. Total abuse of power, yes, but...

      --
      whois gawk date unzip strip find touch finger mount join nice man top fsck grep eject more yes exit umount sleep dump
    38. Re:I'm not sure it is by HornWumpus · · Score: 1

      Let them have secret courts, but only secret for x years. Give them 1, 50 year secret warrant _application_ a year, 4, 20 year, 10, 10 year the rest 5 year.

      Nobody has yet to figure out how to break _single_ use pads. A technology that's so old, it's age is an estimate.

      Hell, I'm thinking of setting up a few of lava lamps and a camera, offering a service: Flash drives full of truly random identical data, shipped to any two addresses from different retail shipping sites. Air gapped hardware, of course.

      How long would I stay in business?

      --
      John McAfee 'It was like that time I hired that Bangkok prostitute; to do my taxes, while I fucked my accountant'
    39. Re:I'm not sure it is by sdinfoserv · · Score: 1

      I agree with most of what you say - especially in stating that back doors, will, given enough time, be discovered and exploited by nefarious actors. As far as gun control - lack of sharing existing information and/or failure to enforce existing rules account for the vast amount of bad activity. disclaimer, I'm an avid hunter and CPL holder. Firearms can legally be manufactured in the home, aka ghost guns, and as 3d printing technology matures, this will only complicate the issue.

    40. Re:I'm not sure it is by david_thornley · · Score: 1

      Do you realize what banning strong encryption does to commerce? How about banning entire classes of phones? iPhones have AES-256 encryption, and from the 5S on have special silicon to make it secure. It's not going to happen.

      --
      "When you have eliminated the unacceptable, whatever is left, however improbable, must be the truthiness" - Holmes
    41. Re:I'm not sure it is by david_thornley · · Score: 1

      Lots of countries have restrictions on gun ownership, and have dramatically less firearms crime than we do. It works, but it has to be applied in a reasonably restricted system. A city banning handguns, for example, isn't going to do more than inconvenience the bad guys, who can get guns outside the city.

      --
      "When you have eliminated the unacceptable, whatever is left, however improbable, must be the truthiness" - Holmes
    42. Re:I'm not sure it is by Agripa · · Score: 1

      I'd also wager that the 1st amendment protects encryption. I can communicate using any language I wish. In this case, I communicate in AES256. If you don't understand it, that's on you to figure out and not up to me to explain it to you. Also, I agree 100%, unbreakable encryption is not going to go away - the genie is already out of the bottle.

      It would be an interesting legal fight. Are there any other "national security" secrets which the 1st amendment does not protect? They could certainly make it unlawful to export products using unapproved encryption and based on jurisprudence of the interstate commerce clause, make it unlawful to use or posses unapproved encryption products for use across state lines or within a state.

    43. Re:I'm not sure it is by Agripa · · Score: 1

      If the NSA gets their way, we won't be able to do banking online, because it won't be possible to secure the transactions.

      Just to elucidate on this point, any secure authentication scheme can also be used for secure encryption so weakening encryption means also weakening authentication allowing the government and bad actors to forge authentication.

    44. Re:I'm not sure it is by geekmux · · Score: 1

      Let them have secret courts, but only secret for x years. Give them 1, 50 year secret warrant _application_ a year, 4, 20 year, 10, 10 year the rest 5 year.

      And what do you think they would do with the "one" 50-year secret warrant? The same damn thing they do passing laws in Congress; shove 50 pounds worth of illegal/immoral shit in a 5-pound bag of legislation and pass it. No one will be alive to answer for their actions 50 years from now when it's declassified. Hell, it wouldn't even matter then. If the government themselves stood up tomorrow and confirmed that the conspiracies surrounding JFKs death were all true, no one would give a shit. Citizens don't care anymore. That is what allows abuse to thrive as much as it does today.

    45. Re:I'm not sure it is by geekmux · · Score: 1

      Is there anybody on earth who could be trusted with the encryption keys? As soon as two or more people know a “secret”, then it is no longer a secret.

      When you say encryption "keys", remember we're actually talking about decryption master keys.

      Two people sharing a secret is one thing. Backdoors to circumvent encryption that millions of people use is another matter entirely.

  6. There is no middle choice here by DontBeAMoran · · Score: 5, Insightful

    Either encryption works for everyone, or it works for no one.

    In the end, calling unbreakable encryption an "urgent public safety issue" is pointless.

    Why are cars lacking security features against terrorists?
    Why are guns lacking security features against terrorists?
    Why is cash lacking security features against terrorists?

    The FBI/CIA/NSA does not only want to access the devices thieves/killers/terrorists, they want to spy on EVERYONE.

    --
    #DeleteFacebook
    1. Re:There is no middle choice here by 110010001000 · · Score: 5, Insightful

      Exactly. Think of the children. How many children could have been found if only there were no encryption? Why aren't you thinking of the children? You must want the kidnappers to win.

    2. Re:There is no middle choice here by DontBeAMoran · · Score: 1

      I'd settle for that option.

      --
      #DeleteFacebook
    3. Re:There is no middle choice here by Scarred+Intellect · · Score: 1

      This has got to be the most reasonable argument I've heard for disabling encryption by default.

    4. Re:There is no middle choice here by 110010001000 · · Score: 1

      It makes sense to me too. That way, people with encryption must either be 1) The smart ones 2) Have something to hide. Are you thinking of the children, yet?

    5. Re:There is no middle choice here by 110010001000 · · Score: 1

      I think a better option is just to monitor people. Oh just the dumb ones of course. Everyone else (the smart ones like the OP) could just flip a switch to "not monitored".

    6. Re:There is no middle choice here by TheDarkMaster · · Score: 1

      The problem is that I doubt very much that the FBI/CIA/NSA will someday use this skill for any lawful reason, it is much, much more likely that it will use this ability to steal my industrial secrets (and sell them to some north-american firm) and spying on other nations.

      --
      Religion: The greatest weapon of mass destruction of all time
    7. Re:There is no middle choice here by Opportunist · · Score: 4, Insightful

      How many children could we have found if torture had been an option so we could make the kidnapper talk?

      How many children could we have found if that whole search warrant thing wasn't a problem and we could simply break into every home with impunity and pry the house apart?

      How many children could we have found if every person would get chipped at birth, like a dog, so we can track there whereabouts at every moment of their life?

      How many...

      tell me when it's getting close to home, ok?

      --
      We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
    8. Re:There is no middle choice here by guruevi · · Score: 1

      What do you think is on these phones that is so important?
      - The last few numbers you dialed? They could easily get that from the phone provider
      - The last few locations you were at? Again, the phone provider can give that to you
      - The last few emails or text messages you sent? Again, providers will cooperate with a legitimate investigation

      Criminals that are smart enough will not get caught by anything on their phone regardless of encryption. The only thing that they could want on these phones is in the pursuit of an easy warrant, hence the 4th and 5th amendments.

      --
      Custom electronics and digital signage for your business: www.evcircuits.com
    9. Re:There is no middle choice here by Opportunist · · Score: 1

      And encryption has one called private key. No terrorist on the planet can read my email. Not even that goofball calling this an urgent public safety issue.

      --
      We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
    10. Re:There is no middle choice here by Kierthos · · Score: 1

      Welcome to the slippery slope. Here's your ski pass.

      --
      Mr. Hu is not a ninja.
    11. Re:There is no middle choice here by suutar · · Score: 2

      so we're going to be selecting for smarter criminals, yes? Nothing could possibly go wrong with that.

    12. Re:There is no middle choice here by Metabolife · · Score: 2

      How about you drop the blanket sarcasm shield and put some rationale behind your opinions?

      If 30% of the population enable optional encryption, and 70% do not. That's 70% of potential "dumb" criminals to be caught. 30% is still enough to prevent targeted monitoring, privacy channels remain intact and effective, and more crimes get solved. Over time, the news will spread, and the majority of people will consciously choose to enable encryption on their devices.

      Having an informed population helps the long-term fight for encryption.

    13. Re:There is no middle choice here by apoc.famine · · Score: 4, Informative

      No downvotes for you at the moment, so I'll have to settle for pointing out how stupid your argument is.

      First, "think of the children" is a shitty, fear-mongering argument designed to play to people's base instincts, and trap them in a corner so they can't produce a good argument against you. How do you argue against protecting children without seeming like a monster?

      Second, if there is a switch to flip, that can and will be abused. Between nation states and malware, if you want it on there's the chance that it will get turned off without your notice, and if you want it off there's a chance it will get turned on without your notice.

      Third, enabling authorities to invisibly snoop on anyone not smart enough to turn on their encryption is stupid and wrong. It sets up an expectation that they can check in on anyone when they want to, and creates the "why are you encrypting if you have nothing to hide" line of thought.

      Last, technology isn't some magic shit that prevents law enforcement from doing it's job. It's the opposite, actually. Not only can they can do the same damn job the same damn way as they always have, we now live in a world with cameras everywhere, face identification, cell phone tracking, OnStar and other car tracking and remote control abilities, etc., etc., etc.

      Law enforcement already has orders of magnitude more tools with which to catch bad guys than they had even a decade ago. There is absolutely no reason to allow them invisibly monitor every facet of a large percentage of people's lives, data mine and machine learn, heuristically profile, and otherwise pry into their lives without a trace because there's a vanishingly small chance they might be up to something. I don't care how bad or stupid those people are - that's abusive fascist secret police shit right there.

      --
      Velociraptor = Distiraptor / Timeraptor
    14. Re:There is no middle choice here by AcidPenguin9873 · · Score: 1

      The last few emails or text messages you sent? Again, providers will cooperate with a legitimate investigation

      No, they can't, not if you're using strong end-to-end encryption, like WhatsApp or iMessage or Facebook messenger. The provider only has the encrypted data. This is the exact scenario that is of interest in this case.

    15. Re:There is no middle choice here by AcidPenguin9873 · · Score: 1

      None of your scenarios are relevant. The FBI director isn't asking for easier warrants or torture or GPS tracking (though phones do give you that). These are legal warrant-based searches, the same thing that 20 years ago would have been possible by rummaging through your little black book or your notebook and by wiretapping a particular phone line, but is no longer possible because of math and the miniaturization of computer technology.

    16. Re:There is no middle choice here by king+neckbeard · · Score: 1

      I'll let you in on a little secret: Competent investigators save more lives. The way you get competent investigators is by having them follow the rules instead of taking shortcuts. When it comes to being exposed, human problems are the weak links far more often than tech problems.

      There's not anything close to a reasonable tradeoff here. It's not going to make criminals easier to catch, and it will enable a massive amount of crime.

      --
      This is my signature. There are many like it, but this one is mine.
    17. Re:There is no middle choice here by DickBreath · · Score: 2

      Encryption can be either secure or insecure. You can't have it both ways.

      If secure, then the hackers can't break it, but neither can the government.

      If insecure, then the government can read your data, but so can the hackers.

      If US made products are known to have mandated weak encryption, the rest of the world will take note of that. It will put US products at a competitive disadvantage relative to other products not subject to mandatory weak encryption. US travelers abroad can have their valuable trade secrets stolen because: think of the children!

      --

      I'll see your senator, and I'll raise you two judges.
    18. Re:There is no middle choice here by 110010001000 · · Score: 1

      You are right. Disabling encryption helps the long-term fight for encryption.

    19. Re:There is no middle choice here by 110010001000 · · Score: 1

      Oh, but you missed his point: only the DUMB ones would be susceptible to all that. They smart ones wouldn't. You need to think of the children, and the dumb ones, and the dumb children.

    20. Re:There is no middle choice here by 110010001000 · · Score: 2

      Yeah, but think of all the dumb ones that will be caught! We could also do something to make the smart ones dumb. Like put stuff in their water. Or make them read the comments on Slashdot. That way we will catch them all. Because they will be dumb. It will be like Idiocracy, but real.

    21. Re:There is no middle choice here by SirGarlon · · Score: 1

      He's complaining about the hypothetical situation where the encrypted phone would have made a damn bit of difference in the case. I do not grant that a single one of those "what ifs" is more than a scare tactic. It's as urgent a public safety risk as all those Japanese spies in WWII -- oh wait there weren't any and the government interned 100K people without legal basis. Because, what if.

      --
      [Sir Garlon] is the marvellest knight that is now living, for he destroyeth many good knights, for he goeth invisible.
    22. Re:There is no middle choice here by swb · · Score: 1

      Hasn't there long been an ability to build a safe that self-destructs its contents if forcibly opened? And prior to electronic communications, wiretaps weren't even possible -- you had to intercept the messenger (with risk that the interception would be known) or eavesdrop physically. Even with wiretaps, criminals have beaten in various ways -- random payphones, burner cell phones, not talking on phones at all, etc.

      I think encryption really just reverts policing back to more of a historical mean. Today's senior FBI people are all of a generation where "get a warrant" and the cooperation of telecom carriers or online providers easily gave them access to most communications. They didn't do policing when there were no cell phones, no computers and a bribe (or threat) to a telco employee could get you an off-the-record landline, possibly even associated with another business or residential customer.

      Worse, the FBI's demands basically line up with a surveillance state, relying on their good will to not violate privacy or constitutional rights.

    23. Re:There is no middle choice here by MachineShedFred · · Score: 1

      You're acting like murders and kidnappings were unsolvable previous to smartphones being a thing, and that's hilarious. By far, most murders are solved through forensics, canvassing the neighborhood, identifying and interviewing witnesses, and good old fashioned policework that can be banged out on a typewriter. And did you just literally make a "think of the children" argument in favor of hobbled encryption?

      Seriously?

      Also, how would breaking encryption move the needle AT ALL on your average kidnapping case? In order to have something to decrypt, you would have already had to know who the kidnapper is and be at the very least attempting to wiretap, if not already holding someone in custody. That all requires warrants and court orders that themselves require probable cause whether encryption is in use or not - and it's not like you can encrypt the kid who's been taken. Unless it's some conspiracy Hollywood-esque "Taken" type affair, the use of cryptography in a kidnapping case would be tangental at best, unless the kidnappers themselves are fucking idiots that deserve to be caught and locked up because they are using Whatsapp or some shit to send ransom demands. In which case there is still likely metadata that actually can be obtained under subpoena and acted upon that isn't encrypted such as originating IP address, geo-location, ISP billing data, etc. Even if they are going through a VPN provider, that VPN provider would have records that are subject to subpoena.

      I just don't see it.

      --
      Slashdot still doesnâ(TM)t support Unicode after it was added to the HTML standard in 1997.
    24. Re:There is no middle choice here by lgw · · Score: 2

      Encryption is nothing new. All that's changed is that now ordinary people are using it too - not just people with something to hide. Odd that it's suddenly a problem - it's almost like the FBI has some ulterior motive.

      --
      Socialism: a lie told by totalitarians and believed by fools.
    25. Re:There is no middle choice here by AcidPenguin9873 · · Score: 1

      Hasn't there long been an ability to build a safe that self-destructs its contents if forcibly opened?

      Absolutely. Acquiring or building one was pretty difficult though, and in either case, criminals probably had ample opportunities to screw something up.

      And prior to electronic communications, wiretaps weren't even possible -- you had to intercept the messenger (with risk that the interception would be known) or eavesdrop physically. Even with wiretaps, criminals have beaten in various ways -- random payphones, burner cell phones, not talking on phones at all, etc.

      Sure. None of what you listed is impossible to beat, though.

      I think encryption really just reverts policing back to more of a historical mean.

      This is where I disagree completely. The historical mean was that these things were possible, but "human-hard" - for example, the agen had to avoid getting caught eavesdropping, you had to bring in a master lock-breaker to pick a lock or disarm a safe, etc.. You were also limited in how many police actions of this type (eavesdropping or searching) you could carry out by money and manpower. But these things did happen, and with a focused-enough effort, it was possible. And because absolute security was pretty difficult (the self-destructing safe for example), most people couldn't or wouldn't do that, so it often didn't come down to a Herculean effort to perform a legal search anyway.

      Today, with enabled-by-default end-to-end strong encryption on $20 phones from Walmart, it is mathematically impossible for these types of searches to be done at all. Absolute security, without anyone having to do anything difficult, at all. That is a massive balance tip away from law enforcement being able to do their jobs.

    26. Re:There is no middle choice here by MachineShedFred · · Score: 1

      Spoiler alert: it's always been possible to use undecipherable encryption to communicate with co-conspirators without law enforcement being able to do jack shit about it. It's just easier now. So why don't we need laws against the use of pen-and-paper substitution ciphers, again? Guess what, that's worked to keep people from being able to read stuff since the middle ages, and still works just as good today. Also, we should probably ban envelopes, because they really get in the way.

      --
      Slashdot still doesnâ(TM)t support Unicode after it was added to the HTML standard in 1997.
    27. Re:There is no middle choice here by MachineShedFred · · Score: 1

      And if you have the phone to decrypt, you likely already have a suspect in custody based on other evidence and probable cause. You can make an argument that decrypting the phone's contents may identify co-conspirators, but it's weak.

      may identify. Possibly. Maybe.

      They're going to need more than that weak shit argument to justify putting some slip-shod patchwork hack nonsense into the same encryption that protects literally billions of dollars of financial transfers and transactions every day. Besides, we saw what a bang-up job the government did with protecting those TSA keys that can unlock literally anyone's luggage, didn't we? Why the fuck would you trust them with something that could be used to unlock entire networks, databases, etc. in real time?

      If it exists, it will get out. See: all the NSA disclosures and leaks. And when it does, we're all fucked.

      --
      Slashdot still doesnâ(TM)t support Unicode after it was added to the HTML standard in 1997.
    28. Re:There is no middle choice here by Opportunist · · Score: 1

      He's basically asking for warrantless wiretapping. Because with a warrant you already do have pretty much anything you need to get stuff decrypted. Arrest the person 'til they talk.

      This is of course not an option if you want to take a look "just in case"...

      --
      We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
    29. Re: There is no middle choice here by outlander · · Score: 1

      Sadly, this is true only to the extent that the source of fire from the AK can be rapidly identified. When it's hard to identify (or bursts are fired and then the shooter stops), it's far more difficult for even the most powerful of weapons to ID a valid target. This is (essentially) the same problem as the situation presented to police during the recent Vegas shootings - it was night, it wasn't clear where the fire was coming from for a while.

      --
      "Truth is what works" -- William James "It works!!" -- o-dark-AM comment
    30. Re:There is no middle choice here by david_thornley · · Score: 1

      Actually, there were Japanese spies in the US in WWII, and at least one of them was quite effective in keeping track of Pearl Harbor. The FBI knew who these spies were, or at least could pick out a fairly small group that would contain the spies. The internment was specifically racist.

      --
      "When you have eliminated the unacceptable, whatever is left, however improbable, must be the truthiness" - Holmes
    31. Re:There is no middle choice here by Opportunist · · Score: 1

      Hey, think of the dumb children and their feelings. They're "special" now.

      --
      We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
  7. The cold war is over by Anonymous Coward · · Score: 1

    Big brother doesn't need the ability to paw through all my records without just cause.

    1. Re:The cold war is over by Opportunist · · Score: 1

      Big brother also doesn't have to play nice and pretend he's the good guy anymore.

      The Soviet Union protected our rights by its mere existence. At least as long as you didn't live there, of course, but as long as they existed, our regime had to act as if the Reds are the only ones who would ever do something like this to their population.

      --
      We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
  8. Exactly, how urgent is this problem? by Anonymous Coward · · Score: 1

    Can you give a figure of the impact (in lost human lives or property) of not resolving this issue?
    Thanks.

    1. Re: Exactly, how urgent is this problem? by HannethCom · · Score: 1

      Yes, resolving this issue would result in thousands to millions of people killed and an increase in property theft measured better in multiplication than percentage.

      --
      Microsoft, Apple, Google, Amazon what's the difference? All steal money from devs and control with walled gardens.
    2. Re:Exactly, how urgent is this problem? by DickBreath · · Score: 1

      The government thinks it might, somehow, be able to stop terrorists by snooping through all our papers and effects.

      We have the TSA groping and disrobing everyone at airports. Nail clippers are a major threat. Hey, I've got a pair of nail clippers and I'm going to take over the plane! And nobody can overpower my nail clippers!

      The worst attack on US soil, 9/11, only cost a few thousand lives. That is horrible. But it is not an existential threat to the US.

      --

      I'll see your senator, and I'll raise you two judges.
  9. Where is the mass danger? by Arzaboa · · Score: 2

    An urgent public safety issue? Talk about first world problems. Even if one person gets through and kills 50 people, Its a sad day, but certainly not the end of the world.

    --
    We had every right to shoot him. - G. Gordon Liddy

  10. Legal authority to pry them open by nctritech · · Score: 5, Insightful

    You have the legal authority to pry them open. Get prying. Having the authority to try to open something doesn't give you the entitlement to open it. Unfortunately, it seems the top dog at the FBI does not understand this concept. It's also entirely the fault of the FBI and other government agencies with police powers that this encryption situation has gone in this direction. They made this bed and they must lie in it. No law can change the fundamental properties of mathematical operations, and good luck outlawing consumer encryption since every CPU being made nowadays (even Celerons and Atoms) has hardware AES and such strong encryption is ubiquitous. Combined with the epic failure and subsequent revelations of major flaws in the government's key escrow Clipper Chip, there is no way the FBI is killing off the spread of encryption.

    1. Re:Legal authority to pry them open by Anonymous Coward · · Score: 1

      He has the legal authority to perform his search.

      He has no god-given right to *understand* what he is seeing. If I arrange quarters in stacks on my counter that so happens to encode secret meanings, his search allows him to see the stacks and does *not* give him the right to force me to explain what those stacks of quarters mean to him.

      He got his search, he couldn't understand it's contents. Sorry charlie, your part of the law is over.

    2. Re:Legal authority to pry them open by Anonymous Coward · · Score: 3, Funny

      I prefer a less.. unusual example. A search warrant grants them the right to seize my physical, paper, spiral-bound notebook. It does not grant them the right to force me to teach them how to read it.

    3. Re:Legal authority to pry them open by Rick+Schumann · · Score: 2

      It's not a matter of whether they understand the technology or not. They just don't give a damn. They want access to EVERYTHING, ALL THE TIME, and Constitional rights be damned. This is the true nature of the mind of your average law-enforcement type. Your 'rights', to them, are more like 'privileges, which can be granted and revoked at their will and whim, because they have guns.' This is why we're supposed to have checks and balances built into our criminal legal system, and this is why it's important to preserve and enforce those checks and balances, to preserve our Constitutional rights. Otherwise we're no better than some country like Russia or North Korea. We must always be vigilant against the rise of the Police State.

    4. Re:Legal authority to pry them open by Kamiza+Ikioi · · Score: 1

      Interesting legal take. Similar to "You have the right to search my house with a warrant... you don't have a warrant to make me tell you where the drugs are hidden." But it doesn't actually work that way.

      Unfortunately, the courts have ruled that like a search warrant, if you have a key to the front door, you must hand that key over, and that such a key to the front door is not self-incrimination.

      I certainly get the arguments here about privacy and security, but for all the chest beating, that's NOT how the law actually works. In the case where the subject of a warrant is alive, you can and will sit in jail until you rot until you unlock that laptop.

      The problem here is that while courts come down on some basic rights WITHOUT a warrant, courts have consistently said that WITH a warrant, the police (but really the court by extension) can do whatever the hell they please. So long as there is a warrant.

      And the reason courts will say this, and continue to beat anyone over the head who disagrees is that courts actually have relatively little power. Besides contempt charges, the warrant is an extension of the court's power to not only control police, but to control and enforce the law on citizens.

      The moment you think you're going to tell any court that they can't do what they want with a warrant, thereby asking them to reduce their own power even further, you've lost your ever loving mind.

      This is why things like the All Writs Act matter so much to courts. As the arguably weakest branch, they are going to defend the use of their tools most of all.

      And all the brash /. comments in the world won't get you out of prison short of a presidential pardon. Just ask Joe Arpaio about that. And the public jumped all over that because even the public generally sides with NOT removing power from courts.

      And forget arguments against FISA. For all the correct arguments about a rubber stamp, the fact that they even bothered to include a court makes the courts themselves tickled pink.

      Legislatures can cut funding. Executive branches have guns, bullets, and bombs. Courts only have "Please do what we say... pretty please?"

      --
      I8-D
    5. Re:Legal authority to pry them open by nctritech · · Score: 2

      Revealing an encryption password in your head is testimony and forcing that disclosure violates the Fifth Amendment; never mind other issues such as if the person legitimately forgot the password and so has no password to hand over. So yes, for encryption it works that way. I have yet to see anything to the contrary in the US.

      Also, there is absolutely nothing I have ever seen anywhere that says you must hand over the keys to your house if someone has a search warrant. You may choose to do so instead of having them bust down your door, but a search warrant cannot be used to force you to assist the police in executing it, nor should it be. Note that you even said "the police can do what they want with a warrant" which is not the same thing as the police forcibly conscripting the subject whose effects are being searched to assist in the search in any way.

      Are you in the legal profession? If so, and I'm wrong, I'd like some citations that point to the case law or statutory language that makes it so. It would be appreciated.

    6. Re:Legal authority to pry them open by nctritech · · Score: 1

      It won't happen. I have tons of devices that do encryption without law enforcement backdoor weakening or key escrow. In the worst case I can easily implement my own, with soldered-together transistors or a wall of abacuses if I really had to. It will be very hard for them to force us to use their compromised-by-definition encryption ideas and making encryption illegal would burn the modern internet to the ground.

    7. Re:Legal authority to pry them open by DigiShaman · · Score: 1

      It will go to SCOTUS. Encryption, and the knowledge to unlock the data is in your head; it's an extension of the mind. The Gov can can attempt to crack it all they want, so long as it's not a part of **you, or in your possession. But they can't make you violate the 5th.

      **at some point, we will have cybernetics embedded in the human brain. Augmented enhancements. Being that hardware is a part of you, does that give the Gov right to hack your brain to get the knowledge.

      This is why I've always held the paradigm that encryption is an EXTENSION OF THE MIND!

      --
      Life is not for the lazy.
    8. Re:Legal authority to pry them open by david_thornley · · Score: 1

      There have been rulings both ways (here's the Wikipedia entry). Some courts have held that divulging a key is not testimonial, as long as the government already knows what's encrypted. One US circuit court (the 11th) has ruled that forcing the divulging of a key is against the Fifth. I've seen case law quoted that seems to imply that forced divulging of a safe combination is against the Fifth, and a crypto key is similar.

      One thing is clear: if a device can be connected to a crime but not necessarily to you, admitting that you know the key is testifying against yourself, so you may not be forced to divulge it.

      --
      "When you have eliminated the unacceptable, whatever is left, however improbable, must be the truthiness" - Holmes
  11. 'Urgent Public Safety Issue' by Anonymous Coward · · Score: 2, Insightful

    It is an 'Urgent Public Safety Issue', but not in the way they are suggesting...

  12. Another encryption ... by CaptainDork · · Score: 3, Interesting

    ... is our fucking brains.

    "Our inability to get inside people's heads is an "urgent public safety issue."

    --
    It little behooves the best of us to comment on the rest of us.
    1. Re:Another encryption ... by 110010001000 · · Score: 1, Funny

      I am pretty sure they are already in our heads. I hear them talking to me all the time.

    2. Re:Another encryption ... by NicknameUnavailable · · Score: 1

      I am pretty sure they are already in our heads. I hear them talking to me all the time.

      Just tell your dentist to stop using metal fillings and studs (if you have crowns.) You should be able to scan your face with a metal detector and not get any hits, it's the only way to ensure the government isn't beaming messages into your brain.

    3. Re:Another encryption ... by CaptainDork · · Score: 1

      I talk to them. They don't answer, like they ain't even there.

      --
      It little behooves the best of us to comment on the rest of us.
    4. Re:Another encryption ... by Opportunist · · Score: 1

      Government agencies throughout the ages had no problem with cracking skulls open.

      Granted, it wasn't usually done when they wanted to get information out of said skulls. More if they wanted said information to cease existing.

      --
      We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
  13. The FBI Chief by cmaurand · · Score: 2

    Apparently doesn't know what the first, fourth and fourteenth amendments are or that they are supposed to protect us from him.

  14. send mulder and scully to the apple spaceship! by Joe_Dragon · · Score: 1

    send mulder and scully to the apple spaceship!

  15. Know what else is a public safety issue? by Narcocide · · Score: 1

    The fact the director of the FBI can be this stupid.

    1. Re:Know what else is a public safety issue? by DickBreath · · Score: 1

      I laugh that you say this given the current administration.

      --

      I'll see your senator, and I'll raise you two judges.
    2. Re:Know what else is a public safety issue? by dgatwood · · Score: 1

      The director is not stupid. He is, however, responsible for doing his job, and part of that job is to articulate the argument that encryption makes his job (and the job of his staff) more difficult and to indirectly provide cover when the next attack (and there will always be a next attack) succeeds due to lack of access to some data.

      Of course, the thing is, they can have all the data in the world, and there's still no plausible way to sift through it. The flow of information exceeds what can be feasibly checked for terrorist intent by tens of orders of magnitude. It isn't just a little bit impossible. In a hundred years, we won't have computers that could sift through all the data we produce today. Thus, in the real world, breaking crypto can never prevent the next attack. All it can do is tell you more about the people who committed the last one.

      That matters because of the difference between theory and practice:

      • In theory, if decrypting someone's data somehow could lead you to people who were going to commit the next attack, then arresting them could break the next attack.
      • In practice, you already know who someone was communicating with even without breaking the crypto on the actual messages, so the act of breaking the crypto can never lead you to the people who were going to commit the next attack.

      At best, the only thing breakimg crypto can do is save you from having to investigate all the other people that the person was communicating with who weren't going to commit the next attack. And while that's useful from a cost-cutting point of view, a national security issue it ain't.

      --

      Check out my sci-fi/humor trilogy at PatriotsBooks.

  16. GOOD! My data is PRIVATE by p51d007 · · Score: 1

    I remember back in the 90's or early 2000's someone said the CIA was intercepting ALL email in the USA, and running it through a program that would look for key words or some such garbage. I went into my signature file, using a WHITE FONT and put in my sig file about 20-30 words that should have triggered something, just to hopefully screw with their program. Probably didn't work, but it made me feel better. Hey, I'm as law and order as the next guy, but MY PRIVACY IS MINE. You THINK I'm doing something illegal? Get the probable cause and get a warrant!

    1. Re: GOOD! My data is PRIVATE by HannethCom · · Score: 1

      You mean project Echelon. Which the CIA director admitted before congress that it was illegally capturing US citizens phone calls and emails. I'm still baffled why nothing happened to him. Under the US CIA mandate, spying on a US citizen without cause is an act of treason.
      The FBI had Carnivore running at the same time, but their mandate at the time was to spy on all US citizens. A role that now falls to the Department of Homeland Security.

      --
      Microsoft, Apple, Google, Amazon what's the difference? All steal money from devs and control with walled gardens.
  17. Re:Wrong Way to Solve the Problem by 110010001000 · · Score: 1

    NOW you are thinking of the children!

  18. Evil Math by Tulsa_Time · · Score: 1

    So math is a public safety issue?

    --
    5 out of 6 people enjoy Russian Roulette & 6 out of 7 Dwarfs are not Happy
    1. Re:Evil Math by Opportunist · · Score: 1

      Now the way our schools are heading makes a lot more sense.

      --
      We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
    2. Re:Evil Math by AHuxley · · Score: 1

      The FBI wants in on all the cell phones. Not just the fact they are wondering around an city looking for a cell tower.
      Data, voice prints, images, files, GPS, live mic on/off, live camera on/off.
      A next gen Domain Awareness System https://en.wikipedia.org/wiki/... beyond just a face, a bag and a real time cell phone location.

      What the USA wants domestically is the Greek wiretapping case 2004–05 https://en.wikipedia.org/wiki/...–05 and the
      Italian SISMI-Telecom scandal https://en.wikipedia.org/wiki/... ability to look down over any cell network.
      From the NSA ANT catalog https://en.wikipedia.org/wiki/... something like a domestic DROPOUTJEEP to push, pull files from any phone in the USA.

      What to do about activist lawyers and human rights lawyers who will demand the right to see the parallel construction of a person walking down a street and having all their cell phone data examined?

      --
      Domestic spying is now "Benign Information Gathering"
  19. Sure by HornyBastard · · Score: 4, Interesting

    I will use any encryption that you want me to use.
    As long as you can prove to me that you use the same encryption for everything at the FBI.
    If you are not willing to do that. GO FUCK YOURSELF

    --
    Death has been proven to be 99% fatal in lab rats.
    1. Re:Sure by Kamiza+Ikioi · · Score: 1

      I will use any encryption that you want me to use.

      As long as you can prove to me that you use the same encryption for everything at the FBI.

      If you are not willing to do that. GO FUCK YOURSELF

      Don't get too cocky... the NSA has played around with that offer before. Use our encryption, that we use (so it MUST be good, riiiiight?), and to which only we have all the secret backdoor keys to. Only, they sorta left that last part out.

      If you aren't careful, you will get what you wish for.

      --
      I8-D
  20. Dumb and arrogant by Archtech · · Score: 1

    What those people are overlooking is that if encryption is weak enough (or subverted) that NSA can crack it, it is weak enough for other government agencies and criminals to do likewise.

    They may still believe that good ol' American know-how leads the world - but if so, they are just plain wrong. Mathematics is international.

    --
    I am sure that there are many other solipsists out there.
  21. Cry me a river by nehumanuscrede · · Score: 1

    To be honest, Law Enforcement and their " kill everyone who doesn't comply with our demands " is an urgent Public Safety Issue.

    Encryption, on the other hand, hasn't killed any innocent people as far as I know so I think their priorities are a bit skewed.

    Back on topic:

    Encryption, when properly inplemented, does exactly what it's supposed to do. It keeps unauthorized eyes off of private data. Just because you wear a badge doesn't give you the right to spy on everyone.

    If our government could be trusted, we wouldn't need such things. However, they've shown us time and time again why they can't be trusted, thus we end up where we are today.

    Once you mandate backdoors, the folks that LE is interested in will simply cease utilizing the product and you're right back to square one. ( With the bonus you get to spy on everyone else now, which is likely the true goal anyway. )

    Quit being so fucking lazy and actually DO some real police work for a change lest you be known as the Federal Bureau of Incompetence.

  22. Why Not Try? by bartle · · Score: 4, Interesting

    What puzzles me is, with all of the resources that the US federal government has at their disposal, why aren't they actually trying to crack encrypted phones?

    As I understand it, the older iPhones could likely be cracked by desoldering a chio and interrogating it. The newer ones have their entire security apparatus encased in a single chip but I don't see why the chip couldn't be removed, disassembled, and its partial private key extracted. It's probably not something that could be done by hand and would probably involve contracting with a chip-fabricating outfit. The outlay costs would be enormous but once a "Federal Bureau of Device Recovery" was established and operational, they could make back money by cracking phones for state and local law enforcement.

    It's just so strange because it seems likely that eventually other countries will have this capability, if they don't already. My guess is that if the FBI hasn't figured out how to crack encrypted iPhones themselves in the next 5 years, they'll be a company in Israel that will be happy to do it for them.

    1. Re:Why Not Try? by ledow · · Score: 4, Informative

      Decapping a chip is difficult, expensive and not guaranteed. Most TPMs and security-chips are almost impossible to open without damage.

      Go look at the arcade-ROM decapping efforts. Even 30-year-old ROMs have protections that mean some games are now permanently lost forever, and the ones that are successful rely on "seeing" (via X-Ray etc.) the data as a visible effect on the image. That doesn't work for anything modern at all, you'd need new kinds of instruments or something to measure the individual charge on an individual transistor from billions of them on a tiny sliver of silicon.

      Modern chips, especially those designed to be secure and avoid tampering? Not a chance. Nobody has yet demonstrated an attack on a modern TPM chip like that, and the private keys aren't exactly just sitting there in plain-text even if you could.

      And then updating for EVERY technology change, nm-advancement, etc.? Cost would not just be prohibitive but astronomical.

      Do you believe that those 7800 devices a year are all just one read away from stopping a terrorist attack each? Highly unlikely. If anything one arrest could result in 20-30 devices, not even worrying about whether it was a drug-deal or a telecoms violation or whatever else the FBI might deal with.

      The value just isn't there, even if the technology could exist.

      To my knowledge, literally NO-ONE in the world has read a key from a physical iPhone security chip, for instance. There have been software flaws, and things found in publicly available firmware that are quickly patched out but even those don't cause the processor to magically give up all its private keys. That's not how those chips work. Even Apple themselves may not be able to do it (only replace the device in question and reset it, not bring across the private keys).

      This is part of the "problem". The system is secure. And that means secure from all attackers, including the people who want access to the devices for legitimate reasons (e.g. the owners in some cases!). If it wasn't, it would be insecure, against both those categories of people, and thus not be fit for purpose.

      Sure, at some point, someone will find a hole. And then the next round will devices will counter that. But the FBI expecting to have something that nobody else in the world has, possibly even the manufacturer, which can only be given by weakening the whole purpose of the system for everyone, and for it to be cost-effective, to handle a boat load of enquiries that they presumably have NO OTHER evidence for? That's just silly.

      I'm sure if it was "go to war or not" territory, someone would find a way. But there, no expense is spared. As a run of the mill "let's see what this terrorist suspect texted via WhatsApp" enquiry? Not a chance.

      If they COULD do this, they would be. And they'd be keeping very quiet about it. Because the second it was public, every new phone, chip and computer would be redesigned to stop it in the future.

    2. Re:Why Not Try? by guruevi · · Score: 1

      Lack of warrants. If they had the warrants to do that to these phones, they would've done it. The reason they want easy access is so that they can get arrests made without getting in trouble about breaking the phone. Right now, the phones are just bricks with potential damaging information on a presumably innocent suspect.

      Although a well designed security chip won't be easy to break, they self-destruct when attempts are made to get physical access.

      --
      Custom electronics and digital signage for your business: www.evcircuits.com
    3. Re:Why Not Try? by hduff · · Score: 1

      If they COULD do this, they would be. And they'd be keeping very quiet about it. Because the second it was public, every new phone, chip and computer would be redesigned to stop it in the future.

      Unless the government made thwarting these exploits or any kind of new crypto technology illegal. Don't think it can't happen in the US.

      --
      "I believe in Karma. That means I can do bad things to people all day long and I assume they deserve it." : Dogbert
    4. Re:Why Not Try? by DickBreath · · Score: 3, Insightful

      Because. What they REALLY want is different. They want unsupervised, unmonitored, warrantless access to all your data, any time. All the time. That is what this is actually about. Even if they need secret gag orders imposed upon tech companies. They want unmonitored access.

      We now have:
      Secret Laws
      Secret Interpretations of Laws
      Secret Courts
      Secret Warrants
      Secret Court Orders
      Secret Arrests
      Secret Trials
      Secret Evidence (not made available to the defense)
      Secret Convictions
      Secret Prisons
      Secret "enhanced interrogation" programs


      Gee, it sounds like we've become everything we were fighting against in the previous century.

      --

      I'll see your senator, and I'll raise you two judges.
    5. Re:Why Not Try? by wyHunter · · Score: 1

      You have no idea whether this is actually happening - and this other whining is merely a smokescreen.

    6. Re:Why Not Try? by AHuxley · · Score: 1

      Re "What puzzles me is, with all of the resources that the US federal government has at their disposal, why aren't they actually trying to crack encrypted phones?"
      The FBI is slowly learning from the advanced and very productive GCHQ methods in 1980s'-90's Ireland and the way MI5 works in parts of Ireland now.
      Never tell lawyers, human rights lawyers, city/state police, courts, court workers about methods.
      Keep them all guessing and tell them everything went back to an informant, information given rather than US domestic collect it all.
      The FBI cannot trust its new citizens, their faiths, their cults, their total loyalty to their faith, other nations, criminals and party political operatives, contractors within the FBI.
      Too many faith and political traitors deep within the courts, police, media, gov, legal system, telcos reporting methods and altering criminals and members of their faith. Interesting people escape the USA as the FBI gets tech support to log the cell phone moments.
      The FBI cannot trust its own requests to telcos support. The cleared dual citizens and people of faith are more supportive of criminals than federal US law enforcement.
      So the FBI has to keep everything related to the FBI police methods well away from city/state police, lawyer, telco and media discovery.
      The FBI was people to trust and enjoy using their cell tower products as it gets voice prints, location, live mic, camera, files but never wants to alert people that its all going to be collected on in real time.
      Thats the skill set the GCHQ skill the FBI understands. Dont be like the NSA and talk about global, domestic collect it all and the budget and methods.
      Be like the GCHQ and say nothing for generations and many decades. Let all the interesting people keep guessing.
      Re the ""Federal Bureau of Device Recovery"" . The UK did than under a Government Technical Assistance Centre, National Technical Assistance Centre to hide the role of the GCHQ from having to be seen doing decryption. It looked like police finding files on unencrypted computers and nobody was to understand the mil grade decryption computer power in hours, days, weeks, years given police to counter junk consumer encryption.
      The USA has that "capability" federally they have just finally learned not be the NSA and never tell anyone about methods.

      The other really neat side to all this confusion about decryption is to keep corrupt criminal city/state police, telco workers and state/city/federal politicians using their "trusted" cell phone. Trusting their big brand US cell phone to keep their crimes hidden. Voice prints, all files are wonderful for the FBI in real time.

      If the interesting people int he USA ever worked out what the GCHQ and now MI5 did to the Irish telco system they would never us a phone, cell phone, network computer again.
      So public relations like this keep trust in US big brands junk encryption and allows the FBI to collect globally. The FBI keeps looking at interesting people who go on holiday. The FBI will not trust the CIA, NSA and other agencies to do international collection anymore for them due to the staff and contractors used for global collection.
      If that digital consumer trust stops, the FBI would need informants in every police station, political, faith and criminal meeting again.
      The other aspect is who does FBI collection. The FBI is going direct to the US mil for upgrades to its more advanced aircraft to collect on entire cities. No more light planes with a 2 mile collection ability over a city. No more easy to map circles over a city for hours, landing at the same airport. No more registering LETC upgrades on FBI light aircraft front companies.
      The FBI is going US mil grade fly over, collect it all in one pass, one direction, nothing for anyone to map on low, no more circle flight paths. No front companies to find in open databases, no flight plans to and from the same airport.

      Everything is been done to keep new FBI methods away from criminals, faith groups, courts, police, telco workers, dual citizens. Some disinformation every year about total collection is just part of that.

      --
      Domestic spying is now "Benign Information Gathering"
    7. Re:Why Not Try? by duke_cheetah2003 · · Score: 1

      Gee, it sounds like we've become everything we were fighting against in the previous century.

      Mmm. I don't think we became anything we weren't already. As more of the USA's secrets are revealed, and the full story of what the hell we've been up to for the last 100 years... I'm pretty convinced we were and still are the evil ones. Sure we stopped the Nazis, but just because we stopped a greater evil doesn't suddenly make us the good guys. It's a illusion we enjoyed for a long time, and now the fog is lifting, we're not such good guys after all.

      Every single day reveals more about the USA that reinforces my belief that we are indeed the bad guys. We support terrorism and dictators. Our military is killing people every day. We claim we're defending freedom, but are we? Really? Who's freedom are we defending, exactly? And from what? The terrorists we created and are creating every day by bombing them endlessly and making more really pissed off people who have nothing more to lose?

      Face it. Americans are nasty evil people who fuck with everything and everyone. Freedom is an illusion. Freedom to Americans means do what we say, or we'll bomb you, sanction you, support rebels in your country and generally just make your life miserable and wreck your country until you do what we say.

  23. Meanwhile at the NSA by Hal_Porter · · Score: 2

    The director paged through the packet logs from the FBI director's machine and smiled to himself.

    --
    echo -e 'global _start\n _start:\n mov eax, 2\n int 80h\n jmp _start' > a.asm; nasm a.asm -f elf; ld a.o -o a;
  24. Re:Wrong Way to Solve the Problem by TheGratefulNet · · Score: 1

    some bama guy lost an election because he was thinking TOO MUCH about the children....

    --

    --
    "It is now safe to switch off your computer."
  25. Trojan by Rande · · Score: 1

    If they've got a wiretap warrant, then they can put a trojan on the suspects phone _before_ the arrest to gather evidence.
    Just send a 'copy all data to FBI server' command when you're ready to make the arrest so that even if the phone is locked/destroyed they've got the data.

  26. Adversarial Justice by huckamania · · Score: 1

    The justice system in the US is for the most part adversarial. The prosecutors and police are on one side and the alleged criminals and their lawyers on the other. I think this works well in some cases. In other cases I think it doesn't work at all. In France and other places, there are no sides and what matters to the courts is that the truth gets out.

    There are many cases where I think the French way is a better solution, such as organized crimes. Mafiosos, gangs, paedophile rings, etc should not be afforded the same protections that an individual currently gets in the US justice system. It is simply too easy for groups to thwart justice in the US system.

    1. Re:Adversarial Justice by CrimsonAvenger · · Score: 1

      Mafiosos, gangs, paedophile rings, etc should not be afforded the same protections that an individual currently gets in the US justice system.

      So, how do you know they're "Mafiosos, gangs, paedophile rings, etc"? Just pick someone, make the claim that they're a member of a gang, and remove what legal protections they have?

      Yeah, I can guarantee that that will NEVER (pinky swear!) be abused....

      --

      "I do not agree with what you say, but I will defend to the death your right to say it"
    2. Re:Adversarial Justice by lgw · · Score: 1

      There are many cases where I think the French way is a better solution, such as organized crimes. Mafiosos, gangs, paedophile rings, etc should not be afforded the same protections that an individual currently gets in the US justice system. It is simply too easy for groups to thwart justice in the US system.

      How very convenient for the government! Whenever they want to get rid of someone inconvenient for them, they just call them a Mafioso, gang member, or pedophile. Problem solved!

      Oddly enough, the current system does manage to jail Mafiosos and pedophile rings, despite giving full rights to those accused of crimes.

      --
      Socialism: a lie told by totalitarians and believed by fools.
  27. The real issue... by bradley13 · · Score: 1

    The inability of law enforcement authorities to gain convictions due to legal rights is an “urgent public safety issue,” FBI Director Christopher Wray said on Tuesday in remarks that sought to renew a contentious debate over privacy and security.

    The FBI was unable to force convictions of nearly data from nearly 7% of the accused in the fiscal year that ended Sept. 30, despite possessing proper legal authority to lie, trick, and deceive, a figure that impacts every area of the agency's work, Wray said during a speech at a cyber security conference in New York.

    “This is an urgent public safety issue,” Wray added, while saying that a solution is “not so clear cut.”

    --
    Enjoy life! This is not a dress rehearsal.
  28. Crooks...of what magnitude? by Impy+the+Impiuos+Imp · · Score: 5, Insightful

    They want to catch crooks. Meanwhile, billions in dictatorships are kept down with the assistance of breaking crypto.

    Are we to sacrifice them so a prosecutor can get a notch or two on his belt once in a great while?

    And what are those hundreds of millions of children living with a boot on their face...forever...worth?

    Torture and murder some, you are a nasty criminal. Torture and murder hundreds of thousands, and people in free countries say you are practicing self-rule.

    --
    (-1: Post disagrees with my already-settled worldview) is not a valid mod option.
  29. Oh really? by Anonymous Coward · · Score: 1

    You're telling me that the only evidence that crimes are committed is always hidden by encryption? If this is the case, then when did this begin? I find it very hard to believe that a murderer can successfully encrypt his victim's corpse. And the weapon. And the fingerprints. And the fibers. And the motive.

    What happens when criminals start using one-time-pads? Are we going to outlaw pen and paper at that point?

    FBI, get better at your job.

    1. Re:Oh really? by mishehu · · Score: 1

      Every time they whine about encryption, two words immediately come to mind: parallel construction.

  30. And what happened? by PPH · · Score: 2

    7800 terrorists went free? 7800 deals for pot were consummated? Or 7800 sets of hot nude pics were not drooled over by FBI agents?

    --
    Have gnu, will travel.
  31. Hey, nobody said... by dark.nebulae · · Score: 2

    Nobody said your job was going to be easy.

    No one has granted you carte blanche to access our data, our lives, our thoughts.

    The big problem here is the effort to prevent a crime vs solving a crime.

    The government, the police, the feds, etc. want access to prevent a crime, but that in itself is quite fluid because, as Trump is demonstrating, it can be a "crime" just to say he is a foolish, petulant child. So they want access to everything to "prevent" this kind of thing.

    While I might support cracking something open for additional evidence to solve a crime, where at least one or more judges agree that a crime has been committed and where the courts can be used to argue whether or not to force the opening, I would never consent to allowing any so-called authority a pass key to dig around in my stuff in a preventative fishing expedition.

    1. Re:Hey, nobody said... by david_thornley · · Score: 1

      Preventing crimes is difficult anyway.

      Remember the Boston marathon bombing? The Russians warned us about the Tsarnaevs, telling us to watch them carefully. The Miami nightclub mass shooting? The shooter was known to law enforcement to be dangerous. However, since the shooter hadn't actually violated the law up until then, there were no grounds to hold him.

      I'd like to see examples of serious crimes that were thwarted before I start believing that more electronic intelligence will prevent crimes.

      --
      "When you have eliminated the unacceptable, whatever is left, however improbable, must be the truthiness" - Holmes
  32. How many Children Would Have Been Saved? by HannethCom · · Score: 1

    I was going to say that if encryption had a backdoor between 0 and 0 children would have been saved, but then I thought about all the IoT devices that have been hacked recently. The truth is, with backdoor we would be putting thousands, tens of thousands, possibly even hundreds of thousands of children at risk.
    Just ask Cisco how the government mandatedo backdoors worked for them and how much it cost them?

    --
    Microsoft, Apple, Google, Amazon what's the difference? All steal money from devs and control with walled gardens.
  33. Studies show ... by CaptainDork · · Score: 1

    ... that crime has increased exponentially in sync with the exponential rise in smart device sales.

    Just kidding and stuff.

    Today, the FBI released its annual compilation of crimes reported to its Uniform Crime Reporting (UCR) Program by law enforcement agencies from around the nation. Crime in the United States, 2015 reveals a 3.9 percent increase in the estimated number of violent crimes and a 2.6 percent decrease in the estimated number of property crimes last year when compared to 2014 data.

    According to the report, there were an estimated 1,197,704 violent crimes committed around the nation. While that was an increase from 2014 figures, the 2015 violent crime total was 0.7 percent lower than the 2011 level and 16.5 percent below the 2006 level.

    --
    It little behooves the best of us to comment on the rest of us.
  34. Down with the Fourth Amendment! by mi · · Score: 3, Interesting

    this idea that some authority should have all the keys to the encryption kingdom

    Much as I don't like this idea myself, it is not new.

    The Fourth Amendment explicitly allows the Executive Branch — after securiing Judicial Branch's approval — to access all of our possessions and "effects". They have a right to do that, which no one seems to seriously dispute.

    The strong encryption has given us the means to lock things up so that even the government can't get them — this part is new. Although they still have the right to read your data, they no longer have the ability to do it.

    While this is something we individually celebrate, you can not denounce police complaints about this situation without also denouncing their well-established — and generally accepted — power to search all your other stuff.

    --
    In Soviet Washington the swamp drains you.
    1. Re:Down with the Fourth Amendment! by hierofalcon · · Score: 4, Interesting

      While correct, you're missing the point. Ciphers have been around for a very, very long time. They weren't used as extensively in the past as they are today. But they've been around throughout history. A quick wikipedia search references Egyptian hieroglyphs for example. The technology progressed over time and the cost to break the encrypted text increased over time to what we have today.

      Nonetheless, encrypted communications were available when the constitution was written and they were in use. Yet the constitution makes no mention of preventing the citizens from using encrypted communications or in forcing the users to decrypt the documents on demand.

      The federal government gave itself the rights mentioned, but did not choose to worry about the technology of the day providing documents that they could see, but couldn't decrypt without a lot of work or the help of one of the parties on either end of the transmission. They had just fought a revolution against a government that employed big brother tactics (like garrisoning soldiers in people's homes). They didn't want the government doing any of that type of crap anymore.

      The FBI and others might really wish today that the writers had considered encryption, but they didn't choose to. The writer's generation relied on spies and good old footwork to figure things out. They didn't rely solely on documents. Good for them.

    2. Re:Down with the Fourth Amendment! by sexconker · · Score: 1

      The government doesn't have rights. The government has powers and authority.
      When the government abuses those powers / that authority, the people should take it away.

      Further the constitution protects us explicitly in this regard. We're to be secure against unreasonable searches and seizures. Breakable encryption is by definition insecure. If the government has a special set of keys, it's only a matter of time before they get stolen (for examples, see every fucking thing the government does).

      Implementing this program, even with perfect accountability and due process, violates the constitution as the very mechanism removes the ability of people to be secure against unreasonable searches and seizures.

    3. Re:Down with the Fourth Amendment! by HornWumpus · · Score: 1

      Nothing has really changed. Modern encryption is just more convenient than single use pads. Not really more secure.

      A judge could always order you to 'produce the pad/password'. You could always say: 'Whaaat?'. Bendigo judge could always hold you in contempt.

      --
      John McAfee 'It was like that time I hired that Bangkok prostitute; to do my taxes, while I fucked my accountant'
    4. Re:Down with the Fourth Amendment! by arth1 · · Score: 1

      The strong encryption has given us the means to lock things up so that even the government can't get them â" this part is new. Although they still have the right to read your data, they no longer have the ability to do it.

      No, this part is not new. Encryption and one-time pads existed back then too, and safes that auto-destruct the contents upon tampering (like acid filled glass walls) are not new either.
      The writers of the constitution were well aware of encryption - they used it themselves. And did not authorize the government to break encryption. Instead, the fifth amendment was added to further protect people from being compelled to disclose what is hidden.

      This goes against everything the constitution and its amendments stand for. It's interpreting the letter of the law and finding loopholes, and not in any way honoring the spirit of the law, which puts the individual's right to feel secure over the government's wishes to intrude.

    5. Re:Down with the Fourth Amendment! by mi · · Score: 1

      Breakable encryption is by definition insecure.

      That's true — and is, indeed, the problem. My point was, we should not denounce the government's attempts to do the job we are paying them for doing. It is not wrong for them to seek a solution...

      violates the constitution as the very mechanism removes the ability of people to be secure against unreasonable searches and seizures.

      The ability you speak of is underpinned by laws of men — such as the Constitution — not Math or Nature. It is not "removed" by the government's ability to get your data legally. Not any more, than your not having an unbreakable safe violates the same rights.

      It is perfectly valid and legal for police to secure cooperation of a safe manufacturer to open up yours. Indeed, TSA-compatible luggage locks are all the rage. It is just as valid for them to seek similar cooperation and assistance from software-makers.

      We are attacking the FBI for threatening our ability to protect our data — by pointing out, that, if we allow the FBI to get it legally, some day it will be accessed illegally as well harming our Fourth Amendment rights. That's a valid concern, but just as valid is the government's complaint about the other side of the same Amendment — when they have all the necessary warrants, but still can not read what they need.

      Back to the title of this sub-thread, I put forth the following self-evident statement: whether or not the government can search your data, should not depend on the means you employ to protect it. If we don't want them to read it — out of (well-founded) fear, they will sometimes read more than they should — we should simply disallow them to do it, ever, warrant or not. Are you prepared to do that?

      --
      In Soviet Washington the swamp drains you.
    6. Re:Down with the Fourth Amendment! by infolation · · Score: 1

      The UK has laws that provide for this right to search encrypted digital data. The Regulation of Investigatory Powers Act 2000, Part III. In the UK, strong encryption is permitted, but if the police demand that a defendent decrypts a file then either the passcode/phrase or plaintext must be handed over. If the defendent doesn't do this and is convicted under RIPA they can be sentenced to 2 years imprisonment, or 5 years if the data is believed to involve child abuse or terrorism.

      There is some dispute over whether this law has been applied fairly in the UK (eg some people convicted of refusing to decrypt data have been diagnosed with Aspergers Syndrome), there are no legal provisions for people who forget a password/phrase (reversal of the presumption of innocence), and the law is ambiguous regarding what exactly constitutes a provably encrypted file vs random data. But this law exists in parallel with the right to encrypt.

      To be clear, I believe RIPA is bad legislation. But it is an example of what a government concocts after six years of deliberation into the problem.

    7. Re:Down with the Fourth Amendment! by Anonymous Coward · · Score: 1

      i agree with you. ciphers and encryption were around to protect tombs, doorways, and during the civil war, north and south, even the cold war.. for good reason ciphers were used in communications.

      i can use the encryption to protect my data from prying eyes. and for good reason to decrypt it to prove my innocence. yet, there better be a good reason why I am asked to decrypt something for no apparent reason than snooping government power hungry zealots.

      even the cops i know wish they had a master key to ever door in the city, but that would only create danger. this is not mayberry we live in, and most of the cops i know will cross the line easily to get their work done because they are not in charge. they are ordered to get this done, and do so without regularly being cross checked at the door.

      i do like local law enforcement for other reasons.

    8. Re:Down with the Fourth Amendment! by hierofalcon · · Score: 2

      You're still missing my point. An encrypted document in and of itself didn't make you a criminal in those days. The government may or may not have been able to decrypt it eventually, but the most it could do if intercepted was mark you as a person of interest for more resources to be allocated to. Then, if you actually broke the law, they could handle that within the limits of the rest of the amendments. The existence and contents of the original document weren't directly actionable.

      With a master key, this changes. The government can read the document (and every document in an automated environment) and then decide whether or not you are of interest. This falls much closer to the garrisoned soldier situation than just having solidiers near the town. The contempt citation is accurate if you actually do end up breaking a law, but the whole due process is different now that what was originally intended, and I believe the founding fathers would be against what is being proposed. Personal privacy won out in that day. I think it still would in their minds, regardless of what all is going on.

    9. Re:Down with the Fourth Amendment! by anegg · · Score: 2

      The Fourth Amendment explicitly allows the Executive Branch â" after securiing Judicial Branch's approval â" to access all of our possessions and "effects". They have a right to do that, which no one seems to seriously dispute. The strong encryption has given us the means to lock things up so that even the government can't get them â" this part is new. Although they still have the right to read your data, they no longer have the ability to do it.

      I'm not of the opinion that the U.S. Constitution's Fourth Amendment explicitly allows the Executive Branch to access all of a citizen's possessions and "effects", nor does that confer upon them a "right" to do so. It establishes that no search can take place or things be seized without a warrant that specifies what is to be searched/what is to be seized, nothing more. I supposed there is an implicit assumption there that if they find what they are searching for they can seize it, and use it as evidence, but that is a far cry from a right "to access all possessions and "effects."" For example, if they don't know where to look for something (or even whether it exists) because it has been hidden it/all knowledge of it has been hidden, they obviously can't search/seize it. Strong encryption can be viewed as giving one the ability to hide data so that it can't be seen rather than the ability to lock it up so that it can't be accessed.

      So I don't agree that the police have the well-established or generally accepted power to search all of a citizen's stuff; just that which they can find. And encryption lets one hide it well.

    10. Re:Down with the Fourth Amendment! by HornWumpus · · Score: 1

      The government backdoor isn't going to happen. We might have to import encryption software, but fuck them, right in the electronic ear.

      My point is that strong encryption does not fundamentally change anything. One time use pads are as strong as any algorithm and are very old.

      --
      John McAfee 'It was like that time I hired that Bangkok prostitute; to do my taxes, while I fucked my accountant'
    11. Re:Down with the Fourth Amendment! by Bob+the+Super+Hamste · · Score: 2

      At least one of the founding fathers was well aware of strong cryptography and at the time made a cipher that was thought to be unbreakable by some. By today's standards it is pretty weak but versions of it saw use into WWII where it was used for securely transmitting near real-time info that if cracked a few hours or a day later by the enemy would be of no value.

      --
      Time to offend someone
    12. Re:Down with the Fourth Amendment! by fox171171 · · Score: 1

      It would be simple to encrypt a bunch of random stuff on a drive. Leave it with someone else, and accuse them of having child porn on it, and they go to jail swearing that they can't decrypt and that it isn't theirs.

    13. Re:Down with the Fourth Amendment! by david_thornley · · Score: 1

      whether or not the government can search your data, should not depend on the means you employ to protect it.

      That isn't self-evident at all. Why shouldn't it? Suppose I protect my data by making cryptic notes that need context. Should I be required to supply context? That would be at least a potential violation of my Fifth Amendment rights. Why can't the government just have unlimited physical access?

      --
      "When you have eliminated the unacceptable, whatever is left, however improbable, must be the truthiness" - Holmes
  35. You can just ban it by rsilvergun · · Score: 1

    When AES-256 is a crime only criminals will have AES-256. Make using it a crime and it won't matter that you can't crack it since you can just lock anyone using it up. Problem solved.

    --
    Hi! I make Firefox Plug-ins. Check 'em out @ https://addons.mozilla.org/en-US/firefox/addon/youtube-mp3-podcaster/
    1. Re:You can just ban it by MachineShedFred · · Score: 1

      I'm pretty sure they already do that. It's called "contempt of court."

      --
      Slashdot still doesnâ(TM)t support Unicode after it was added to the HTML standard in 1997.
  36. FBI Chief Calls Unbreakable Encryption . . . by hduff · · Score: 1

    FBI Chief Calls Unbreakable Encryption . . . "a valuable tool to protect the rights of law-abiding citizens" is how it should read.

    --
    "I believe in Karma. That means I can do bad things to people all day long and I assume they deserve it." : Dogbert
  37. Well, he's right by computational+super · · Score: 1

    lack of unbreakable encryption is an urgent public safety issue.

    --
    Proud neuron in the Slashdot hivemind since 2002.
  38. Re: Wrong Way to Solve the Problem by HannethCom · · Score: 1

    The only problem is the top terrorists country in the world has a large army and lots of nukes. It also doesn't have the most sane president right now. The country is responsible for, or provides funding for an estimated 90% of all terrorist attacks each year.

    --
    Microsoft, Apple, Google, Amazon what's the difference? All steal money from devs and control with walled gardens.
  39. No problem with warrants by mi · · Score: 1

    If they had the warrants to do that to these phones, they would've done it.

    What rock is so comfortable that you were able to hide underneath it for so long as to entirely miss the FBI vs. Apple drama about this?

    Not only did FBI had the necessary warrant(s), a judge explicitly ordered Apple to assist the Bureau.

    And yet, Apple fought it tooth and nail — with popular support...

    --
    In Soviet Washington the swamp drains you.
  40. Re:Wrong Way to Solve the Problem by DickBreath · · Score: 1

    We are always going to have enemies. No matter what other efforts you try. We cannot appease them. Fighting them might be difficult. But it's still worth doing. But that doesn't mean we should compromise our own security and freedom because we are too afraid. Oh, wait. TSA at airports. Even the worst attack, 9/11 only killed a few thousand people. It's horrible. But it is not an existential threat to the US.

    --

    I'll see your senator, and I'll raise you two judges.
  41. Rampant authoritarianism by ArtemaOne · · Score: 1

    Breakable encryption is virtually no better than no encryption at all. There's no reason to fool yourself into thinking that your data is safe. This reminds me of the TSA lock, where there are only 5 or so keys, all of which can be purchased by the general public online. Government wants control, and will use any reason they think will justify it.

    1. Re:Rampant authoritarianism by wyHunter · · Score: 1

      And it forces us not to have data stored anywhere, not to fly on airlines, etc. We are at the 1984 book for its restrictions - we're just not there in terms yet of violent repression. That's coming, thanks to the boomers AND the SJWs, to whom "freedom from" is more important than "Freedom to"

    2. Re:Rampant authoritarianism by ArtemaOne · · Score: 1

      I'm with you up until that. Freedom is both "from" and "to" equally.

    3. Re:Rampant authoritarianism by wyHunter · · Score: 1

      If you're discussing, say 'freedom from being murdered' I agree with you. But for many , in 21st century USA and other western democracies, 'freedom from' is morphing to mean 'Anything I disagree with nobody should be allowed to do.' Don't like guns? Don't own one. Don't like drugs - and I truly despise them but - don't take them. Etc.

    4. Re:Rampant authoritarianism by ArtemaOne · · Score: 1

      That's exactly what freedom is.

    5. Re:Rampant authoritarianism by wyHunter · · Score: 1

      Forcing other people not to do things that do not affect you, because you don't like it , is freedom? That's tyranny, sorry.

    6. Re:Rampant authoritarianism by ArtemaOne · · Score: 1

      What? You're not even following the conversation. Freedom from means no one can force YOU to do it, but they can do it all they want. It's liberty.

    7. Re:Rampant authoritarianism by wyHunter · · Score: 1

      On the contrary, I said: But for many , in 21st century USA and other western democracies, 'freedom from' is morphing to mean 'Anything I disagree with nobody should be allowed to do.' That's tyranny. Certainly my freedom ends where yours begins - I shouldn't be able to impinge on your property, for example, with trash in my yard. But the fact that I choose to build (say) a greenhouse doesn't affect you.

  42. So? by Murdoch5 · · Score: 1

    The fact they can't break the encryption is proof that's effective and a good idea. If I want people to see my traffic and data, I'll let them see it, other wise, forget it.

  43. I agree by spikedvodka · · Score: 1

    There is nothing in his statement that is technically incorrect.
    "The inability of law enforcement authorities to access data from electronic devices due to powerful encryption is an “urgent public safety issue,”" This is very much true. Metadata analysis can only take you so far.
    "while saying that a solution is “not so clear cut.”" Hell yeah, there really is no solution

    Some people use the [flawed] analogy of a safe. the FBI can either crack a safe, or burn through the door to get at the contents if you refuse to open it under judicial order. While this is still technically possible using strong encryption, the heat-death of the universe will probably come first, thus rendering it moot.

    I'm going to simplify his statement: "The inability to access data due to powerful encryption is an urgent public safety issue" the "From electronic devices" muddies the water, and gets people all up-in-arms about "think of the children", or "OMG Terrorists"

    Encryption is a wrapper around data. Much like an envelope, or a diplomatic bag (legally immune from search and seizure by international agreement) Can you imagine the uproar if the US suddenly announced that it reserved the right to open every diplomatic pouch sent to or from the US? or to listen in on every conversation between embassies?

    I'm sure that the NSA, CIA, FBI, FSB, and every other national security agency world-wide is trying to break modern strong encryption. They'd be stupid not to! but what doesn't seem to be understood is that modern encryption is math. Math works for everybody the same way. If a hole is discovered in an encryption system, anybody that uses that system is then vulnerable to having their data read by a third part (authorized or unauthorized - from the legal, warrant has been issued state) This might be someone emailing pictures to their grandmother, it could be a terrorist cell communicating with a handler, or it could be instructions to one of our nuclear missile submarines. The Math doesn't care!

    I'm sure that Mr. Wray would agree if I said that "the inability of the US government to access data from Russian sources due to powerful encryption is an urgent public safety and national security issue" I wonder how much he would agree if I said that "the inability of the Russian government to access data from US sources due to powerful encryption is and urgent safety and national security issue"?

    --
    I will not give in to the terrorists. I will not become fearful.
  44. Pick up the phone by WillAffleckUW · · Score: 1

    And dial the NSA and the other eight "security" organizations the US controls which put the holes in encryption in the first place.

    It's not hard, FBI.

    And stop letting them compromise chip design.

    --
    -- Tigger warning: This post may contain tiggers! --
  45. Accountable Anonymity is Possible by Slicker · · Score: 2

    While we want privacy and anonymity, we don't want it used for nefarious purposes. Such things tend to serve people generally but also terrorists, pedophiles, drug cartels, etc. I strongly believe we need a system that provides accountable anonymity, such as a Reputational Identity Service.

    That is, create an identity that enables others it interacts with to rank its reputations along a rubric. This could be used for determining if the identity is a good citizen on comment boards, doesn't cheat people in business, etc. It could act as a form of credit check... Does the entity have a strong reputation for dependability in paying what it owes? Just like with ordinary credit, an identity would begin with no reputation and slowly build one over time. If the identity has a long history of being a certain way then the risk is low that that will change any time soon. This is true, even if the same person holds two identities--one for good and one for evil. You will know which one is safe to deal with, and how much it is..

    Each person's must have a limit as to how much he/she can give to others, to prevent undue reputation inflation or deflation. So each time you score another, you have a percentage of your total to give and that takes away proportionally from those you have already given to. So one's reputation can build but it will also fade over time. One's reputation score is measured by its average over time... This is LIKES++.

    On message boards, filter and allow privileges based on reputations. Do business based on reputations. Deny certain information based on reputation. Reputation may always be earned or lost.

    1. Re:Accountable Anonymity is Possible by Zof · · Score: 1

      Sounds a hell of a lot like Black Mirror S03E01

  46. It is urgent by fox171171 · · Score: 1

    FBI Chief Calls Unbreakable Encryption 'Urgent Public Safety Issue'

    I agree 100%. For the public's safety, we must all adopt unbreakable encryption immediately.

  47. Encryption is Mathematics by multi+io · · Score: 1

    Forbidding encryption is like forbidding the multiplication of large numbers. In fact, it's largely EXACTLY THE SAME THING. That's what most of government officials who call unbreakable encryption an "Urgent Public Safety Issue" don't get. They're not necessarily evil or corrupt, but they think of encryption as some kind of magic wand, highly advanced technology like guns or nuclear weapons, which you can prevent private citizens from acquiring, when in fact what it really is is -- mathematics.

  48. Why is there no link in the OP? by cyn1c77 · · Score: 1

    Hello? Is this story even true?

  49. Re: Donald Trump is going to prison for TREASON by CaptainDork · · Score: 1

    Apology not accepted.

    --
    It little behooves the best of us to comment on the rest of us.
  50. Breakable encryption != no encryption by davidwr · · Score: 2, Informative

    If encryption is breakable with a large amount of effort, then it does several useful things:

    * It prevents people without the resources from accessing your mail.
    * It may provide short-term security, which may be sufficient.
    * It makes those who do have the resources be selective in whose encryption they break.

    For example, if it takes a minimum of a week to break the encryption on an encrypted web connection that discusses an embargoed news item that will be published in 6 days, that's good enough.

    Another example: If a government wants to crack down on encrypted communications among drug traffickers, but it costs them $10,000,000 for each decryption effort, they will need to pick and choose who they go after.

    There are encryption systems that are provably unbreakable without a key, such as a one-time pad. Unfortunately, they are usually not practical to implement correctly.

    --
    Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
    1. Re:Breakable encryption != no encryption by gnick · · Score: 2

      If encryption is breakable with a large amount of effort, then it does several useful things...

      The definition of a "large amount of effort" regarding computing resources is neither static nor simple. "Large" for LAPD? "Large" for a Chinese bitcoin mine? "Large" for the FBI? "Large" after 5 years of advancements?

      --
      He's getting rather old, but he's a good mouse.
    2. Re:Breakable encryption != no encryption by networkBoy · · Score: 1

      but Parent's point remains valid.
      "Large" needs to be valued at the target's need for privacy.
      Thus if you need something to be secret for a long time, then maybe you need a larger keyspace, or even use an OTP for the primary secret and store said OTP physically securely.

      --
      whois gawk date unzip strip find touch finger mount join nice man top fsck grep eject more yes exit umount sleep dump
    3. Re:Breakable encryption != no encryption by gnick · · Score: 1

      "Large" needs to be valued at the target's need for privacy.
      Thus if you need something to be secret for a long time, then maybe you need a larger keyspace...

      Why would you ever set "large" to be anything other than "a really fucking long time"? It's pretty easy to encrypt something that even nation states will have a hard time cracking in a reasonable time frame. Are you suggesting that we should intentionally encrypt things with weaker protection according to our "need for privacy"?

      --
      He's getting rather old, but he's a good mouse.
    4. Re:Breakable encryption != no encryption by Bob+the+Super+Hamste · · Score: 4, Informative
      Strong encryption is usually measured by the energy requirements on an ideal computer. If those energy requirements are on the order of the total energy released from a star over its entire life then it is strong. If it is something that is a sizeable portion of a nation state's total annual energy usage then it isn't strong. Very smart people are figuring out better ways to crack codes so the energy requirement for any cipher do decrease over time until they are so low that DES was cracked in under a day on a $200,000 machine in 2002.

      Here is a nice little excerpt from Bruce Schneier's book Applied Cryptography that puts things in perspective on how to think about it. As an added bonus there is the phrase "orgy of computation" included:

      One of the consequences of the second law of thermodynamics is that a certain amount of energy is necessary to represent information. To record a single bit by changing the state of a system requires an amount of energy no less than kT, where T is the absolute temperature of the system and k is the Boltzman constant. (Stick with me; the physics lesson is almost over.)

      Given that k = 1.38×10-16 erg/Kelvin, and that the ambient temperature of the universe is 3.2 Kelvin, an ideal computer running at 3.2 K would consume 4.4×10^-16 ergs every time it set or cleared a bit. To run a computer any colder than the cosmic background radiation would require extra energy to run a heat pump.

      Now, the annual energy output of our sun is about 1.21×10^41 ergs. This is enough to power about 2.7×10^56 single bit changes on our ideal computer; enough state changes to put a 187-bit counter through all its values. If we built a Dyson sphere around the sun and captured all its energy for 32 years, without any loss, we could power a computer to count up to 2^192. Of course, it wouldn't have the energy left over to perform any useful calculations with this counter.

      But that's just one star, and a measly one at that. A typical supernova releases something like 10^51 ergs. (About a hundred times as much energy would be released in the form of neutrinos, but let them go for now.) If all of this energy could be channeled into a single orgy of computation, a 219-bit counter could be cycled through all of its states.

      These numbers have nothing to do with the technology of the devices; they are the maximums that thermodynamics will allow. And they strongly imply that brute-force attacks against 256-bit keys will be infeasible until computers are built from something other than matter and occupy something other than space.

      --
      Time to offend someone
    5. Re:Breakable encryption != no encryption by BronsCon · · Score: 1

      If I need to keep the present I bought my wife a secret until her birthday in April, "large" needn't be longer than 4 months. Using too big of a value for "large" adds complexity which, in turn, increases the potential for errors which may divulge your secret.

      A system should be just as complex as necessary, and no more so. There's a reason engineers tout that saying, and it's a damned good one.

      --
      APK quotes people (including myself) without context and should not be trusted. Just thought you should know.
    6. Re: Breakable encryption != no encryption by Monster_user · · Score: 1

      We're not talking about the system, but the difficulty in bypassing the system. The system is relatively equal for encryption methodologies. It is usually the cipher length which determines how "large" the computing power needs to be to break it, due to the levels of entropy as I understand it.

      Longer ciphers require more computing power to encrypt, and have a noticeable impact on performance after a certain level, but the difference in power needed to encrypt vs decrypt is exponential.

    7. Re: Breakable encryption != no encryption by Monster_user · · Score: 1

      There is no such thing as unbreakable encryption. There is only the time required to break the encryption, which can be measured in hours, days, millenia, or even eons, with each generation of computer reducing the time required to break it.

    8. Re:Breakable encryption != no encryption by gnick · · Score: 1

      If I need to keep the present I bought my wife a secret until her birthday in April, "large" needn't be longer than 4 months.

      You could keep it in your car. After all, she hardly ever drives your car. Or you could keep it at work. She's never visited work. If there's no advantage to keeping it in your car, keep it at work. Why opt for risk without reward?

      Using too big of a value for "large" adds complexity which, in turn, increases the potential for errors which may divulge your secret.

      I'm really curious about these "errors" that will cause your file to decrypt itself if the encryption's too strong. When I leave the house, I have the option of setting the latch lock and/or the deadbolt. The latch lock may be plenty for the threat I'm anticipating, but setting the deadbolt too isn't going to cause my door to spring open.

      A system should be just as complex as necessary, and no more so.

      Are you suggesting we all use DES? After all, you'll probably be fine and AES is SO much more complicated.

      --
      He's getting rather old, but he's a good mouse.
    9. Re: Breakable encryption != no encryption by gnick · · Score: 1

      There is no such thing as unbreakable encryption.

      Referencing Bob's quote above, if the energy required to break it exceeds what you could ideally extract from a large star, let's call it unbreakable.

      --
      He's getting rather old, but he's a good mouse.
    10. Re: Breakable encryption != no encryption by BronsCon · · Score: 1

      Yet a simpler cipher might take my wife 4 months to figure out. If that's all I need, well, that's all I should use.

      --
      APK quotes people (including myself) without context and should not be trusted. Just thought you should know.
    11. Re:Breakable encryption != no encryption by BronsCon · · Score: 1

      You could keep it in your car. After all, she hardly ever drives your car. Or you could keep it at work. She's never visited work. If there's no advantage to keeping it in your car, keep it at work. Why opt for risk without reward?

      Is it worth the risk of someone at work stealing it? I'd love to believe I can trust my coworkers, but maybe they're nosy fucks, like most people's coworkers? Plus that's additional work, why would I do that if I don't need to? Beyond that, the real world answer to both questions is that my wife and I share a car and I work from home.

      I'm really curious about these "errors" that will cause your file to decrypt itself if the encryption's too strong.

      You're thinking from the wrong angle. Too complex of an algorithm may have errors which allow it to be attacked in various ways. Think MD5, or any of the myriad crypto algorithms which have been broken over the years.

      When I leave the house, I have the option of setting the latch lock and/or the deadbolt. The latch lock may be plenty for the threat I'm anticipating, but setting the deadbolt too isn't going to cause my door to spring open.

      But it could cause someone to break your window (an alternate attack) rather than slipping the door latch with a credit card. Now they've gotten into your house, stolen your stuff, and you have to replace a window.

      Are you suggesting we all use DES? After all, you'll probably be fine and AES is SO much more complicated.

      Well, considering that DES is broken, it clearly was not complex enough. However, AES, being more complex, provides a larger attack surface; do you know that the implementation you're using isn't vulnerable to alternate attacks? Do the 20 locks on your front door really stop someone from coming in through the window?

      --
      APK quotes people (including myself) without context and should not be trusted. Just thought you should know.
    12. Re:Breakable encryption != no encryption by networkBoy · · Score: 1

      here's a more practical example:

      I'm playing a game and the engine encrypts my traffic so I can't sniff the location of other player data in real time (radar problem).
      The overhead of "age of universe" encryption would impact game performance *and* as long as the data is 5-10 min old before I can decrypt it, then my radar app is worthless...

      So, a simple DH with 256bit keys renegotiated every 5-10 min is plenty of security for this application without impacting performance.

      If, OTOH, I am doing banking and stock account management I want those login credentials and account codes to be secured for at least my lifetime.

      --
      whois gawk date unzip strip find touch finger mount join nice man top fsck grep eject more yes exit umount sleep dump
    13. Re:Breakable encryption != no encryption by gnick · · Score: 1

      ...the real world answer to both questions is that my wife and I share a car and I work from home.

      I think you missed the point. It was an analogy, not a suggestion. Sorry.

      When I leave the house, I have the option of setting the latch lock and/or the deadbolt. The latch lock may be plenty for the threat I'm anticipating, but setting the deadbolt too isn't going to cause my door to spring open.

      But it could cause someone to break your window (an alternate attack) rather than slipping the door latch with a credit card. Now they've gotten into your house, stolen your stuff, and you have to replace a window.

      By that logic we should all leave our doors unlocked. Save the windows! I fail to see how this relates to cryptography.

      Do the 20 locks on your front door really stop someone from coming in through the window?

      You seem to like this analogy, but you've got me stumped. What's the "window" the attacker's going to break through on my AES encrypted file?

      --
      He's getting rather old, but he's a good mouse.
    14. Re:Breakable encryption != no encryption by BronsCon · · Score: 1

      I think you missed the point. It was an analogy, not a suggestion. Sorry.

      Everything before what you chose to quote was answering to that analogy, so yeah, I got it. I just so happened to have a real-world answer, so I also gave that.

      By that logic we should all leave our doors unlocked. Save the windows!

      Nah, we can't make it too easy, and that's kind of the point.

      I fail to see how this relates to cryptography.

      It was your analogy in the first place...

      You seem to like this analogy, but you've got me stumped.

      Again, it was your analogy to being with.

      What's the "window" the attacker's going to break through on my AES encrypted file?

      Why don't you audit the source of whatever AES library you're using and find out for yourself? Maybe that library's implementation is flawless, maybe it's not.

      --
      APK quotes people (including myself) without context and should not be trusted. Just thought you should know.
    15. Re:Breakable encryption != no encryption by gnick · · Score: 1

      Everything before what you chose to quote was answering to that analogy, so yeah, I got it.

      I didn't mean to quote you out of context. But I don't see how everything before what I quoted was related to the analogy. Let's review so we don't have to scroll up.

      Is it worth the risk of someone at work stealing it? I'd love to believe I can trust my coworkers, but maybe they're nosy fucks, like most people's coworkers? Plus that's additional work, why would I do that if I don't need to? Beyond that...

      "The risk of someone stealing it." Huh? If you opt for stronger encryption it's more likely to be stolen? "I'd love to believe I can trust my coworkers, but..." This relates how? ""Plus that's additional work..." There are cases where the additional overhead may be a burden, but those cases are rare and the increase in computational need for encryption pays off in spades compared to the increased difficulty decrypting.

      ...it was your analogy to being with.

      Yes. I was comparing weak cryptography to a latch lock and strong cryptography to the addition of the deadbolt. Then you said, "They'll just go through a window!" My question is WTF is this "window" the thief is going through because my door's too good? As near as I can tell you're saying, "If your encryption is too strong, they'll just hack AES."
      Hacking AES != Breaking a window.

      --
      He's getting rather old, but he's a good mouse.
    16. Re:Breakable encryption != no encryption by BronsCon · · Score: 1

      If you opt for stronger encryption it's more likely to be stolen?

      So leaving it on my desk in the typical open office plan is strong encryption and leaving it locked in the trunk of my car, out of sight, is weak encryption? Again, this was your analogy, not mine. If you're finding this many flaws in it, perhaps you should rewind and try again. Would you like a do-over?

      My question is WTF is this "window" the thief is going through because my door's too good?

      I repeat...

      Why don't you audit the source of whatever AES library you're using and find out for yourself? Maybe that library's implementation is flawless, maybe it's not.

      --
      APK quotes people (including myself) without context and should not be trusted. Just thought you should know.
    17. Re:Breakable encryption != no encryption by gnick · · Score: 1

      So leaving it on my desk in the typical open office plan is strong encryption and leaving it locked in the trunk of my car, out of sight, is weak encryption?

      Let's review. You said that hiding a gift for 4 months would be good enough. I likened that to hiding it in your car - Probably good for 4 months, but not 20 years. I pointed out, "...she hardly ever drives your car." I suggested hiding the gift somewhere that it wouldn't be found in 4 months or otherwise, i.e. the office. I pointed out, "She's never visited work." Weak encryption == will be found eventually == car. Strong encryption == will never be found == office. I thought that was straightforward. I apologize for confusing you. I was making an analogy, not literally addressing your wife, workplace, or habits.
      Gift stolen at work/Untrusted coworkers == ? If you have a workplace where you're worried about being robbed, then I'm sorry, but I don't see how that's relevant. How do untrustworthy coworkers relate to a strongly encrypted file being protected?

      I repeat...

      Why don't you audit the source of whatever AES library you're using and find out for yourself? Maybe that library's implementation is flawless, maybe it's not.

      And I repeat:

      As near as I can tell you're saying, "If your encryption is too strong, they'll just hack AES."

      Nonsense.
      Hacking AES != Breaking a window

      --
      He's getting rather old, but he's a good mouse.
    18. Re:Breakable encryption != no encryption by BronsCon · · Score: 1

      As near as I can tell you're saying, "If your encryption is too strong, they'll just hack AES."

      Finding a flaw in an implementation of an algorithm is fairly different from finding a flaw in the algorithm itself an in no way means the algorithm itself is broken -- thus why I suggested reviewing the implementation and not the algorithm, so you missed that one -- twice.

      Hacking AES != Breaking a window

      Let's see... If, as implied by your lock-and-deadbolt analogy, a longer key is akin to more locks on the door, finding a hole in the algorithm (or the implementation of said algorithm you happen to be using) -- a way around needing the key, regardless of length -- is akin to breaking the window -- a way around the door, regardless of how many locks you have. So yes, actually, cracking AES (or a specific potentially flawed implementation of it) is breaking a window.

      What you're failing to see here, though, is that I'm not attacking your point so much as the analogies you chose to use to express that point. In other words, you're being trolled; I don't normally just come out and say it like this, but I feel sorry for you as you've made it somewhat clear that you'll never figure it out otherwise.

      Trolling aside, you said "There are cases where the additional overhead may be a burden, but those cases are rare and the increase in computational need for encryption pays off in spades compared to the increased difficulty decrypting" and, well, if information loses any and all value (or will become public knowledge anyway) at some point, there is literally zero value to expending additional resources to keep it secure for longer than that. How don't you get that?

      For something you need to keep secure indefinitely, sure, throw everything you've got at it. But, for something you're gonna tell the world next week anyway? Why bother?

      --
      APK quotes people (including myself) without context and should not be trusted. Just thought you should know.
    19. Re: Breakable encryption != no encryption by davidwr · · Score: 2

      There is no such thing as unbreakable encryption.

      A one-time pad, properly implemented, is by definition unbreakable.

      Why? Because any given encrypted text, say,
      DUOvi3daf6234%#GVYdasf

      can be created from any arbitrary same-length input given a specifically crafted key.

      In other words, if I'm a prosecutor trying to convince a naive jury that the message above is "KillPresident..." I can come up with a key that will "prove" my point. Likewise, the defense can come up with a key that makes the same encrypted message say "PrezIsGreat!..."

      --
      Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
    20. Re:Breakable encryption != no encryption by davidwr · · Score: 1

      There was a programming contest at the campus one guy, who won, came up with just 231 bytes implementation of One-Time-Pad.

      231 bytes sounds about right for what amounts to loop with a handful of instructions in it.

      I assume it was either in assembler or he had a very space-efficient compiler/linker and I/O instruction calls were negligible in size.

      --
      Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
    21. Re: Breakable encryption != no encryption by Monster_user · · Score: 1

      While Not EoF stdin1 stdin stdin2 stdin stdin1 * stdin2 print result

    22. Re: Breakable encryption != no encryption by Monster_user · · Score: 1

      I stand corrected.

    23. Re:Breakable encryption != no encryption by gnick · · Score: 1

      In other words, you're being trolled...

      You do a very credible job of mimicking an idiot.

      --
      He's getting rather old, but he's a good mouse.
    24. Re: Breakable encryption != no encryption by Monster_user · · Score: 1

      OTP is largely impractical for most purposes, and isn't commonly used in commercially available devices. I was referring to practical use, not principals. I was also unaware of the OTP.

      I do agree that it is best practice to assume as a matter of principal that there is no "unbreakable" encryption, as any decryption option available can be compromised, even the OTP. Furthermore, most information has a source, which can be compromised, rendering the encryption in vain.

    25. Re:Breakable encryption != no encryption by BronsCon · · Score: 1

      I'm sure that was not meant as a compliment, but thank you anyway. It actually takes a lot more effort than you would think.

      --
      APK quotes people (including myself) without context and should not be trusted. Just thought you should know.
    26. Re:Breakable encryption != no encryption by swamp_ig · · Score: 1

      I'm sorry if I'm going ad-hom, but it's quite clear you don't know how encryption works.

      You'd want a good 1000-10,000x factor of hardness over whatever you think is hard enough, otherwise it just gets easy to farm out the computation for something that would 'normally' take 10 days to a botnet that brings that down to 1 hour. For this reason you'd really you'd want to set the 'normally' to the whole of the earth's computation capacity, which has really exploded recently due to bitcoin.

      Also it's not so easy to tune. The whole reason why we use the encryption algorithms we use is that their difficulty goes up generally at 2^x, where x is the size of the key. If you get an extra 10 bits in the key (bits, not bytes) you end up with a 1,024x harder problem.

    27. Re: Breakable encryption != no encryption by BronsCon · · Score: 1

      No, I get that. I was making a slightly different point: not everything needs to be protected for as long as a 4096 bit key might protect it. If it did, we'd all be using 4096 bit keys (and I certainly do for certain things) for everything. He'll, we damn near had to force website operators to go to 2048 bits by ceasing the issue of 1024 bit certificates because, in all honesty, for most of what those certificates are protecting, even a 1024 bit key is considerable overkill.

      --
      APK quotes people (including myself) without context and should not be trusted. Just thought you should know.
    28. Re:Breakable encryption != no encryption by WorBlux · · Score: 1

      This assumes P != NP, an unproven assumption. Instead of merely guessing a private key, crypto-analysis involves looking at data streams and deterministic transformations. It may actually be the case that all cyrpto schemes can be reversed in polynomial time via algebraic transformation. This technique as definitely been used to decrease the actual effective key length of many crypto schemes.

    29. Re: Breakable encryption != no encryption by WorBlux · · Score: 1

      It's not breakable with math, but to allow decryption you have to transmit the pad somehow.

    30. Re: Breakable encryption != no encryption by david_thornley · · Score: 1

      Why? Why not just use AES-256 everywhere rather than deliberately weakening your encryption?

      --
      "When you have eliminated the unacceptable, whatever is left, however improbable, must be the truthiness" - Holmes
    31. Re:Breakable encryption != no encryption by david_thornley · · Score: 1

      Finding a flaw in an implementation of an algorithm is fairly different from finding a flaw in the algorithm itself

      In which case, you should take one algorithm and study the heck out of the implementation or use somebody else's evaluation (I'm not really qualified to audit cryptosystem implementations). That one may as well be something strong like AES-256. Using AES-256 when DES would do is a lot better than using DES when you need something strong.

      --
      "When you have eliminated the unacceptable, whatever is left, however improbable, must be the truthiness" - Holmes
    32. Re:Breakable encryption != no encryption by Agripa · · Score: 1

      If encryption is breakable with a large amount of effort, then it does several useful things...

      The definition of a "large amount of effort" regarding computing resources is neither static nor simple. "Large" for LAPD? "Large" for a Chinese bitcoin mine? "Large" for the FBI? "Large" after 5 years of advancements?

      The US Supreme court said that a "limited time" may compass any specifically defined amount of time. We can absolutely calculate how long it will take to brute for any encryption method which is not a one time pad. So it takes only a "limited time" to break any commercially used encryption. What was his complaint again?

    33. Re: Breakable encryption != no encryption by BronsCon · · Score: 1

      Perhaps we're dealing with a mobile device and the more complex algorithm would reduce battery life? Perhaps we're dealing with an embedded device and lack sufficient RAM, CPU, or storage to properly implement the more complex algorithm without making other compromises. Really, the list goes on, but there are two examples; they may or may not matter to you depending on your priorities, but you can rest assured they matter to someone.

      --
      APK quotes people (including myself) without context and should not be trusted. Just thought you should know.
    34. Re: Breakable encryption != no encryption by david_thornley · · Score: 1

      iPhones have their memory encrypted with AES-256. I think they can handle the encryption. One of the reasons Rijndael was chosen for AES was its relatively low computer impact compared to some other algorithms.

      Moreover, you were talking about using different ciphers based on desired security. If you've got AES, why use anything else?

      --
      "When you have eliminated the unacceptable, whatever is left, however improbable, must be the truthiness" - Holmes
    35. Re: Breakable encryption != no encryption by BronsCon · · Score: 1

      If you've got AES, why use anything else?

      I can think of a handful of reasons. An exercise: Why don't we use AES for most encrypted communications?

      --
      APK quotes people (including myself) without context and should not be trusted. Just thought you should know.
    36. Re: Breakable encryption != no encryption by david_thornley · · Score: 1

      Sometimes we need to transmit secure information without a previous secure key exchange. Hence, asymmetric ciphers. One good asymmetric cipher is arguably all we need, but the processing is much slower than AES. We really don't need more than one good asymmetric and one good symmetric cipher.

      --
      "When you have eliminated the unacceptable, whatever is left, however improbable, must be the truthiness" - Holmes
    37. Re:Breakable encryption != no encryption by Sloppy · · Score: 1

      If I need to keep the present I bought my wife a secret until her birthday in April, "large" needn't be longer than 4 months. Using too big of a value for "large" adds complexity which, in turn, increases the potential for errors which may divulge your secret.

      Except it doesn't really add complexity. You just turn a knob from 1024 to 4096 and a machine takes care of all the work, while the lazy human just sits there and drools. And you don't really even have to turn the knob, because the first time you touched the machine you just turned it up to max and left it there forever. It's effortless.

      --
      As copyright owner of this comment, I authorize everyone to defeat any technological measure which limits access to it.
  51. Re:silly man by HornWumpus · · Score: 1

    A single use pad remains the gold standard for unbreakable encryption. It's over a thousand years old.

    --
    John McAfee 'It was like that time I hired that Bangkok prostitute; to do my taxes, while I fucked my accountant'
  52. Re: Donald Trump is going to prison for TREASON by lgw · · Score: 1

    The weak-sauce of that attack is hilarious in hindsight, as prominent lefty after prominent lefty is denounced for one variety of sexual assault or another.

    --
    Socialism: a lie told by totalitarians and believed by fools.
  53. Unrestricted gov is urgent public safety issue by micahraleigh · · Score: 1

    When the IRS, NSA, and other federal departments have been publicly known to read through the political opposition comms what is going to stop us from becoming the next Venezuela or China?

    Ordinary people are not a public safety issue !! Unrestricted government is !!

  54. Re:Notice the Arrogance in the Statement? by MachineShedFred · · Score: 2

    I guess I just wonder how the FBI made any other case, ever, without the ability to post-facto dig through any and all communication from the accused. It's not like secure communications are some new concept - it literally goes back many hundreds of years.

    What did the FBI forget about investigation since the smartphone era began? And why?

    --
    Slashdot still doesnâ(TM)t support Unicode after it was added to the HTML standard in 1997.
  55. Re:USA Law Enforcement has proven to be untrustwor by lgw · · Score: 1

    * the local and state govts are allowed to kill the "papers please" acts - like RealID.

    That example doesn't belong in your list. Preventing fraud and setting standards are both legitimate functions of government, if you're not an outright anarchist. We'd all be better off at this point with some national alternative to SS numbers for every company to use as their database key - something with at least some attempt at fraud prevention.

    --
    Socialism: a lie told by totalitarians and believed by fools.
  56. Good. by bravecanadian · · Score: 1

    At least we can reasonably assume that encryption is doing the job it is meant to.

    As always, law enforcement and politicians calling for a backdoor is pure stupidity. No matter how good the intentions, the details will always fall into the wrong hands eventually. Or more likely (as demonstrated conclusively by law enforcement everywhere) they will end up using it in unwarranted ways.

    Law enforcement needs to get over it and find other ways to do their job. You can't put the math genie back in the bottle.

  57. Very clear cut actually by Anonymous Coward · · Score: 1

    - while saying that a solution is "not so clear cut." -

    The solution is actually VERY clear cut. Stay out of my data, fullstop. And no I don't care what your piece of paper says.

    If I encrypt something it means I consider it an extension of my brain and personality. Nobody is allowed into there, and no rubberstamping judge will ever tell me otherwise...

    And YES, I am absolutely ready to face jailtime, but I will NEVER under ANY circumstances allow access to stuff I encrypt, not even if they use the $5 xkcd wrench. Otherwise I wouldn't have encrypted the data in the first place.

    Private means PRIVATE, it doesn't mean private until the government decides it doesn't suit them.

  58. Historically speaking by Kernel+Kurtz · · Score: 1

    government is the entity people need to be able to keep secrets from MOST OF ALL.

    You would think a country that fought a revolution to escape tyranny would remember that.

  59. Re:Wrong Way to Solve the Problem by lgw · · Score: 1

    Well played, sir!

    --
    Socialism: a lie told by totalitarians and believed by fools.
  60. Go To Hell! by TheFakeTimCook · · Score: 1

    Freedom means accepting certain risks as a society.

    That is all.

  61. Fed proof caps? by TiggertheMad · · Score: 1

    On the other hand, if people can't encrypt their data (or that encryption is breakable), then it creates an entirely different set of problems. People can't safeguard their data or protect their systems. It increases the vulnerability of our infrastructure. It increases the chances that criminals and terrorists can gain access to important and private information.

    Funny, when I first glanced at the deadline that is the angle that I thought the article was going to take, but then I saw that the quote was attributed to the FBI, and I realized that wasn't going to be the case.

    What I really want to know is, what devices were being used in the mentioned 7,800 cases that they couldn't get in? I need to go shopping...

    --

    HA! I just wasted some of your bandwidth with a frivolous sig!
  62. Little problem by farble1670 · · Score: 1

    a solution is "not so clear cut."

    I'll say. There's that little problem of the number of seconds left in the life of the universe.

  63. Put this in perspective by petes_PoV · · Score: 1

    I would expect that an "urgent public safety" issue would be one that has led to the deaths of some hundreds of people. If not in the last fiscal year, then over a period of a few years. I would further expect that there would be a demonstrable upwards trend in that number.

    So where are we? Is there any data on how many people have died as a direct result of the government not being able to gain data that was / is only available on some perp's phone?

    Or is this really about the government wishing to have to power to reinforce its dominance and simply brag about how powerful it is?

    --
    politicians are like babies' nappies: they should both be changed regularly and for the same reasons
  64. Detectorating by jnork · · Score: 1

    "We need access to all these phones to solve cases because we never, ever solved a case before cellphones existed."

    --
    Cleverly disguised as a responsible adult.
  65. They clearly fail to understand one, simple thing by mark-t · · Score: 1

    Leaving aside completely whether or not law enforcement officials can be trusted to have access to our personal information in the first place, people who spout this kind of rhetoric:

    The inability of law enforcement authorities to access data from electronic devices due to powerful encryption is an "urgent public safety issue,"

    ... fail to understand that the inability that they have to access such data is the *EXACT SAME THING* that prevents people with possibly far more nefarious intentions from accessing people's personal and private information as well.

    If legislation is introduced that makes it easier for law enforcement to access such data, then they will also make it correspondingly easier for the bad guys to do likewise, and that will result in an *INCREASE* in law enforcement efforts, not a decrease, as law enforcement would then have to work that much harder to protect innocent people from being exploited by those that access people's private information without authorization.... not to mention that such efforts are unlikely to be 100% successful anyways, so more innocent people will get hurt.

    The bad guys, meanwhile, who aren't going to be interested in following the law in the first place with regards to only using authorized encryption, are going to continue to get away with stuff because you can't necessarily identify a communications packet that has been encrypted using a known mechanism and one that has not unless you already know what the unencrypted packet actually contains in the first place (and in fact, it is completely trivial to invent a custom encrypted communications protocol that can be mathematically proven to guarantee such results).

  66. Re:silly man by Bob+the+Super+Hamste · · Score: 1

    With symmetric key crypto you would need a much bigger quantum computer than that and even there it only makes AES-256 on a quantum computer as difficult to solve as AES-128 currently is on a classical computer. Or to put it another way, it would still require more energy than is consumed by the US over several years.

    --
    Time to offend someone
  67. Re:Public Safety by PPH · · Score: 1

    And by 'public safety' they mean yours. Should you be tempted to hide anything from your government.

    --
    Have gnu, will travel.
  68. Your key my key their key by MoralCharacter · · Score: 1

    'Excuse, Mr. Wray, in what way will our computer systems such as e-voting, national databases and intelligence secrets be protected from adversarial countries and hacker groups when the next NSA leak includes the keys to our encryption?"

  69. Feature, not a bug by jroysdon · · Score: 1

    That's a feature, not a bug. If you want to decrypt someone's data, get a warrant and compel them to turn over the key. No probably cause for a warrant? That too is a feature, not a bug. You don't get to go fishing for evidence to convict people.

  70. What issue? by jwhyche · · Score: 2

    Since there is no such thing as unbreakable encryption, I fail to see the problem here. Sure, it might take you a trillion years but all encryption can eventually be broken. Just takes time.

    --
    I read at +2. If your post doesn't reach that level I will not see or respond to it.
  71. Don't do the math! by Anomalous+Co-worker · · Score: 1

    Clearly the terrorists have won! The basis of encryption is math. Ban math. No more Al-gebra!

  72. It is true, we can't ignore the problem by GuB-42 · · Score: 1

    Yes, unbreakable encryption is a problem for law enforcement. And yes, they need to do something about it, because yes, criminals are using it.

    Of course, unbreakable encryption is extremely valuable for plenty of reasons, it's here to stay but it doesn't mean we should ignore the problem. Police has to do its work, and it means watching people in some way or another, there is a balance with privacy that is not always easy to find. When discussing the police watching you, it is easy to think about cases where you end up arrested because you searched "bomb making" on Google, but that's ignoring the cases where you aren't arrested because the same surveillance has shown that you couldn't be the culprit. And I am not just talking about high profile "think of the children" cases. Finding who stole your car or who scammed grandma also counts.

    Sure I know about government abuse, and that some of the criminals are the ones who are supposed to protect us. I also have things to hide are I don't like being watched any more than you do. However, I think extremism will get us nowhere. We have established that strong encryption is a must have, now what are the solutions to the problem of crime fighting? The better the answer, the more seriously we will be taken by those who want to demonize encryption.

  73. If you have to spy... by AutodidactLabrat · · Score: 1

    it isn't law enforcement, it's political enforcement

  74. It's working! by duke_cheetah2003 · · Score: 1

    Keep encrypting, especially unnecessarily. Obviously our efforts our hitting a nerve. Keep at it, encrypt EVERYTHING!

  75. Maybe he needs a bigger computer. by Blinkin1200 · · Score: 1

    I'm sure there are a number of countries that could help.

  76. Since when are lizard people pedo? by tepples · · Score: 1

    It's the Reptilians. They have a penchant for pederasty.

    I didn't get a pedo vibe from Chris Bucholz's interview with Mr. Malok.

  77. Re:Notice the Arrogance in the Statement? by sjames · · Score: 1

    What did the FBI forget about investigation since the smartphone era began? And why?

    1. An honest day's work.

    2. Work is so haRRRRRRRRRd.

  78. Re:GOOD! My data is PRIVATE by mdhoover · · Score: 1

    We called that "feeding the CARNIVORE"

  79. Re: Wrong Way to Solve the Problem by NicknameUnavailable · · Score: 1

    We have more nukes.

  80. They are correct by Shirley+Marquez · · Score: 1

    Unbreakable encryption IS an urgent public safety issue. It is urgent that we have it to protect people from being hurt by the FBI.

  81. Well, by Hylandr · · Score: 1

    Tough shit.

    --
    ~ People that think they are better than anyone else for any reason are the cause of all the strife in the world.
  82. I call BREAKABLE ENCRYPTION.... by Stubbyfingers · · Score: 1

    The absolute end of Commerce on the Internet.

    If ANY third party can break the encryption then we must assume that, given a few days or weeks, EVERY third party has broken the encryption.

    NO commercial transactions will be safe.

    Back to the 1970s, guys.

  83. Re:USA Law Enforcement has proven to be untrustwor by lgw · · Score: 1

    It's a lot harder to forge a real-ID-compliant DL than an SS card, that doesn't even have a picture!

    --
    Socialism: a lie told by totalitarians and believed by fools.
  84. Re: GOOD! My data is PRIVATE by ahodgson · · Score: 1

    Nothing happened to him because he was also spying on everyone in Congress and could have dished the dirt on anyone who advocated doing something to him. Obviously.

  85. The FBI can suck it by rtfmoz · · Score: 1

    Awww poor big daddy can't decrypt a widdle phone. Suck it up sunshine. My data is mine and you ya thieving snooping law breaking federal wankers can just deal with it.

  86. Envelopes by eric_harris_76 · · Score: 1

    Next up: The FBI takes on the problem of letters inside opaque envelopes.

    --
    There's no time like the present. Well, the past used to be.
  87. consensual crackability by Sloppy · · Score: 1

    You've got a fascinating point, but there's no way you can ever have any idea what all possible adversaries' capabilities are. And you'd have to continuously stay up-to-date on it too, since what costs $10M today is $1M tomorrow.

    I think there's also an assumption that "legitimate" adversaries have more power than illegitimate ones, i.e. your own government happens to have the most, fastest computers. Go ahead and try to tell that to a citizen of a poor country. As a citizen of a rich country, I think it's probably true (i.e. the US government is able to brute force my stuff easier than, say, the Chinese government) but I don't really know that's true, do I? And if it's right for me, then it's wrong for everyone everywhere else!

    --
    As copyright owner of this comment, I authorize everyone to defeat any technological measure which limits access to it.