Encryption: Privacy vs. security

[bernorange 8348]

Some of you might recall the discussion on the old site when Apple was wrangling with the FBI over encryption technology in the iphone.  The FBI (and other security services like the NSA) want Apple (and other tech companies) to provide backdoors to any encryption schemas that allow them to access and search devices.  The issue is far from settled:

Quote

FBI Director Christopher Wray said Wednesday that unless the U.S. government and private industry are able to come to a compromise on the issue of default encryption on consumer devices, legislation may be how the debate is ultimately decided.

“I think there should be [room for compromise],” Wray said Wednesday night at a national security conference in Aspen, Colorado. “I don’t want to characterize private conversations we’re having with people in the industry. We’re not there yet for sure. And if we can’t get there, there may be other remedies, like legislation, that would have to come to bear.”
...
Apple recently introduced a new security feature popularly known as ‘USB Restricted Mode’ that restricts data access via USB devices, exactly the kind of tools mobile forensics companies use to break into iPhones. A workaround to Apple’s new feature was quickly found; a back and forth that highlights the ongoing arms race for protection and exploitation of mobile encryption security.

“But I really do believe that if people come at it with a goal that I think we all share of having both strong cybersecurity and protecting flesh-and-blood Americans — again, there’s a way to do this,” Wray said on Wednesday. “We’re a country that has unbelievable innovation. We put a man on thermion. We have autonomous vehicles. The number of things that are created every day in this country really defies imagination sometimes. And so the idea that we can’t solve this problem as a society — I just don’t buy it.”

In April, CyberScoop reported that the Senate Judiciary Committee was in the early stages of writing encryption legislation, having already spoken with multiple large American tech companies through their policy teams in D.C..

https://www.cyberscoop.com/fbi-director-without-compromise-encryption-legislation-may-remedy/

[atomheartbevo 89409]

Apple’s job is not to help the FBI, it’s to try and keep my fappening photos safe.

[Nice Guy Eddie 13410]

I understand that law enforcement want methods to gather evidence about criminals, terrorists, etc.  However we have laws in place for a reason to protect people from self-incrimination and unreasonable searches.  If the police cannot make their case without illegal searches, then they can't make their case.  Guilty people walk sometimes.  It's the system that best protects our privacy.

One troubling scenario are cops taking phones to funeral homes in an attempt to unlock using a deceased's fingerprint.   Since dead people have few rights, it's legal.  

 

[bernorange 8348]

Information is power.

With open communications technology, the NSA's data collection farms are an immensely powerful tool for tyranny.

[Hugo Stiglitz 23356]

9 minutes ago, bernorange said:

Information is power.

With open communications technology, the NSA's data collection farms are an immensely powerful tool for tyranny.

The corporate surveillance ability is just as tyrannical and they are much more competent than the government. 

In other words, we're fucked either way when it comes to privacy.  

Edited July 20, 2018 by Hugo Stiglitz

[bernorange 8348]

Assuming there was a firewall between corporations and govco (which there doesn't appear to be), govco's total information net is vastly more odious as it (can be/is) a political weapon.  Corporations by and large aren't interested in coercing customers for political purposes.

[JBJ 3648]

I followed this loosely on the other site.

If there's a warrant, Apple should assist in providing access. If not, Apple should protect Atom's fappers to their best ability.

[Nice Guy Eddie 13410]

24 minutes ago, JBJ said:

I followed this loosely on the other site.

If there's a warrant, Apple should assist in providing access. If not, Apple should protect Atom's fappers to their best ability.

I believe Apple wants to add security/encryption so that even they can't open the phone.    Can a federal judge order Apple to make their phones hackable?

 

[F250 28680]

42 minutes ago, Hugo Stiglitz said:

The corporate surveillance ability is just as tyrannical and they are much more competent than the government. 

In other words, we're fucked either way when it comes to privacy.  

The state has a monopoly on violence. Corporations do not have the power to arrest people but just manipulate them with marketing. I'll take my chances with marketers rather than the people that can shoot me or throw me in jail.

 

[Hugo Stiglitz 23356]

1 minute ago, F250 said:

The state has a monopoly on violence. Corporations do not have the power to arrest people but just manipulate them with marketing. I'll take my chances with marketers rather than the people that can shoot me or throw me in jail.

 

Makes you wonder how the State gets so many people to shoot up schools in this country.

[JBJ 3648]

13 minutes ago, Nice Guy Eddie said:

I believe Apple wants to add security/encryption so that even they can't open the phone.    Can a federal judge order Apple to make their phones hackable?

I don't think so.  I'd just rather have Apple crack individual phones with a court warrant than make it necessary for the police to develop the technology to do it anytime.

Edited July 20, 2018 by JBJ

[Nice Guy Eddie 13410]

37 minutes ago, JBJ said:

I don't think so.  I'd just rather have Apple crack individual phones with a court warrant than make it necessary for the police to develop the technology to do it anytime.

If Apple can crack the phone, anyone can. 

Apple also has to decide what to do when another govt (China, Russia) give them a warrant to search a citizens phone. 

The best solution is for Apple to lock it down for everyone but the owner. 

[Hugo Stiglitz 23356]

39 minutes ago, F250 said:

The state has a monopoly on violence. Corporations do not have the power to arrest people but just manipulate them with marketing. I'll take my chances with marketers rather than the people that can shoot me or throw me in jail.

 

How about when the corporations control the State? Because you know, that’s not too far off from where we are now. 

This is a hard topic and worthy of debate...I just find it interesting people only seem to care about how the US government is abusing their power and invading the privacy rights of citizens.

Meanwhile Facebook is selling all your personal information to the Chinese government so they can exploit you better.

[F250 28680]

15 minutes ago, Hugo Stiglitz said:

How about when the corporations control the State? Because you know, that’s not too far off from where we are now. 

This is a hard topic and worthy of debate...I just find it interesting people only seem to care about how the US government is abusing their power and invading the privacy rights of citizens.

Meanwhile Facebook is selling all your personal information to the Chinese government so they can exploit you better.

It's not that people only care about the government violating data privacy, it's just that the government is the only one doing it that has a legitimate right to use force against people. There is also a long history of the U.S. government using information to coerce citizens, J Edgar Hoover and all that shit.

Think about it, Facebook and Google aren't the ones throwing kids in jail. That would be the U.S. government.

 

 

[scottsins 1953]

I don't think so.  I'd just rather have Apple crack individual phones with a court warrant than make it necessary for the police to develop the technology to do it anytime.

The FBI wants Apple to “reconfigure” their software so that law enforcement can access locked phones. They want the change implemented broadly, NOT on some “as needed” individual basis.

[bernorange 8348]

32 minutes ago, Hugo Stiglitz said:

...I just find it interesting people only seem to care about how the US government is abusing their power and invading the privacy rights of citizens. ...

I know from past discussions that you are not really familiar with my posting history over the years, but I can assure you that I've had plenty to say about Google, Facebook, et al.  But that's not the subject of this thread.

[Fudge Nuggets 19146]

2 hours ago, Nice Guy Eddie said:

I understand that law enforcement want methods to gather evidence about criminals, terrorists, etc.  However we have laws in place for a reason to protect people from self-incrimination and unreasonable searches.  If the police cannot make their case without illegal searches, then they can't make their case.  Guilty people walk sometimes.  It's the system that best protects our privacy.

One troubling scenario are cops taking phones to funeral homes in an attempt to unlock using a deceased's fingerprint.   Since dead people have few rights, it's legal.  

 

This is my position on the matter.  Now if Johnny Law develops his own way of cracking the encryption and gains access to the device in a legal manner... well I guess Mr. Criminal is fucked as he should be.  But absolutely, positively no on the device manufacturer being required to install ways for Big Brother to gain automatic access to your shit.

[F250 28680]

1 hour ago, Hugo Stiglitz said:

Makes you wonder how the State gets so many people to shoot up schools in this country.

Do you understand what a "monopoly on violence" means?

 

[Hugo Stiglitz 23356]

1 minute ago, F250 said:

Do you understand what a "monopoly on violence" means?

 

Yes, that post was trollish. apologies. 

[F250 28680]

32 minutes ago, Hugo Stiglitz said:

Yes, that post was trollish. apologies. 

[kopp0e 1135]

On 7/20/2018 at 11:23 AM, Nice Guy Eddie said:

I understand that law enforcement want methods to gather evidence about criminals, terrorists, etc.  However we have laws in place for a reason to protect people from self-incrimination and unreasonable searches.  If the police cannot make their case without illegal searches, then they can't make their case.  Guilty people walk sometimes.  It's the system that best protects our privacy.

One troubling scenario are cops taking phones to funeral homes in an attempt to unlock using a deceased's fingerprint.   Since dead people have few rights, it's legal.  

 

But why would law enforcement need the phone after the person is dead..?

 

[relapse98 634]

7 hours ago, kopp0e said:

But why would law enforcement need the phone after the person is dead..?

I'm not entirely sure what he's referring to, but I could see them using it for an investigation against another person, not the deceased.

They want info on text between the 2 parties or something. Can't get it from the living guy, could get it from the dead guy.

[Nice Guy Eddie 13410]

6 minutes ago, relapse98 said:

I'm not entirely sure what he's referring to, but I could see them using it for an investigation against another person, not the deceased.

They want info on text between the 2 parties or something. Can't get it from the living guy, could get it from the dead guy.

I was referring to the practice that cops try to get the living and the dead to open their phones using their fingerprint.  Of course, the deceased can't be charged with a crime but that doesn't prevent cops from wanting to see what is on the phone.  If it can lead to closing cases, even one committed by the deceased, detectives would be all over that.  Cops would even prefer to close a case by concluding that a dead person did it.   Less trouble and paperwork.

Overall I'm pointing out that the biometric (fingerprint, face recognition) locks on phones are troublesome for privacy.  We've all seen the stories or fake comedy commercials where the girlfriend is trying to use the iPhone facial recognition to unlock the sleeping boyfriend's phone.

[Captainant 27442]

Ultimately this boils down to whether or not you think the state has unlimited and ultimate access to your information. I don't agree that the state should be able to outlaw encryption. It's literally just math that's encrypting and decrypting. You can't outlaw an idea and a concept like PGP (which has since been proven to have flaws, but I digress), despite the government's best efforts to do so.

If you believe the people have a right to privacy from each other and from the government, then you believe in encryption for all.

[Hugo Stiglitz 23356]

3 minutes ago, Captainant said:

Ultimately this boils down to whether or not you think the state has unlimited and ultimate access to your information.

Or to put it another way, should people that commit crimes have the right to be beyond the law via encryption.

It’s a complicated issue. 

[F250 28680]

1 minute ago, Hugo Stiglitz said:

Or to put it another way, should people that commit crimes have the right to be beyond the law via encryption.

It’s a complicated issue. 

People that commit crimes shouldn't be able to hide behind the 4th and 5th amendments either.

It's a complicated issue.

 

[Captainant 27442]

Just now, Hugo Stiglitz said:

Or to put it another way, should people that commit crimes have the right to be beyond the law via encryption.

It’s a complicated issue. 

If you commit a crime, you still have your 5th amendment right along with all of your other rights, including the 4th amendment right to privacy. Encryption that is meant purely to destroy evidence through obfuscation is no different from tossing paper records into an incinerator. The government can get a warrant to try and crack your encryption, and they are welcome to try. But they absolutely should not be able to compel you to decrypt files that may incriminate you. And they should not be able to prevent you from having basic info security just for the sake of making law enforcement easier. The state works for the people, not the other way around.

[Hugo Stiglitz 23356]

9 minutes ago, Captainant said:

If you commit a crime, you still have your 5th amendment right along with all of your other rights, including the 4th amendment right to privacy. Encryption that is meant purely to destroy evidence through obfuscation is no different from tossing paper records into an incinerator. The government can get a warrant to try and crack your encryption, and they are welcome to try. But they absolutely should not be able to compel you to decrypt files that may incriminate you. And they should not be able to prevent you from having basic info security just for the sake of making law enforcement easier. The state works for the people, not the other way around.

  I was just trying to add a little different perspective.  Here’s Comey’s take on this issue:

 

[Captainant 27442]

Thing is though - the same techniques used for basic fucking e-commerce and payment processing are what terrorists and bad actors would use for their communications. Should we disallow encrypting our bank records and sensitive legal and personal and business communications just because bad guys could be doing something bad? The position you're "just adding perspective" for is advocating that the state control all communication and that everything always be transparent to them. Nope, no way that could ever turn tyrannical.

[Hugo Stiglitz 23356]

I’m not advocating anything.

dont pressume to know where I stand on this issue 

[Nice Guy Eddie 13410]

17 minutes ago, F250 said:

People that commit crimes shouldn't be able to hide behind the 4th and 5th amendments either.

It's a complicated issue.

 

Innocent until proven guilty.  I understand that a locked phone may have information that can prevent a terrorist attack or bring a child back home to their mother, but we see too many examples where some law enforcement agencies have abused their powers in the past.    Give them the power and they will use it to stop the terrorist but they will also try to use it for personal reasons.  

And where does a company like Apple or Google draw the line.  There are 195 countries in the world with different levels of citizen protections.  Does Apple leave it up to the citizens/leaders to decide the privacy rights in those countries, evaluate each individual case, or just give the power to consumers to lock down the data.    This isn't a question of the US Constitution but rather deciding for the entire world.   

[JBJ 3648]

On 7/20/2018 at 1:42 PM, scottsins said:

The FBI wants Apple to “reconfigure” their software so that law enforcement can access locked phones. They want the change implemented broadly, NOT on some “as needed” individual basis.

 

Oh, I get that.  And I don't think Apple should be required to do so. 

It might not be easy to replicate with digital encryption, but the best corollary I can come up for what I envision as ideal is with firearm registration.  A national register is repulsive for a number of reasons, but an investigator walking into a store with a warrant and asking to review sales records of 9mm handguns over the past 6 months is much less so.

Having the ability to access an individual phone through a key held by Apple - when presented with a warrant - seems like a good balance of privacy and law enforcement.  However, I can't speak to how plausible that might be in the digital realm.  And there's always the problem that where two digital keys exist, hacking becomes twice as easy.

[relapse98 634]

So, what do you do when a private person, say Daniel J. Bernstein (nut),  creates their own encryption, and won't hand over the key? Throw them in jail until they do?

[Nice Guy Eddie 13410]

2 minutes ago, relapse98 said:

So, what do you do when a private person, say Daniel J. Bernstein (nut),  creates their own encryption, and won't hand over the key? Throw them in jail until they do?

What happens today when a judge orders you to turn over some documents and you refuse to do so?  

[TwiceHorn 31265]

The problem here is that people can place things beyond the reach of the law, but outside electronic devices, pretty easily, as in burying them in the woods somewhere, subject to accidental discovery.

Here, John Law knows where it might be, he just can't get there.  It must be frustrating for John Law, but, in the final analysis, fuck him.

Also, I frequently question the absolute need for encrypted data.  It will be rare indeed that encrypted data is the only evidence of a crime.  It might be the best evidence, but it isn't the only evidence.  This becomes somewhat akin to giving truth serum or forcing confession by more brutal means.

Edited July 25, 2018 by TwiceHorn

[relapse98 634]

23 minutes ago, Nice Guy Eddie said:

What happens today when a judge orders you to turn over some documents and you refuse to do so?  

True

[Captainant 27442]

8 hours ago, Nice Guy Eddie said:

What happens today when a judge orders you to turn over some documents and you refuse to do so?  

The difference is that encrypted data can be stored behind a password that only you know and have never written down. The data is gibberish without it. Should the government be able to compel you to self incriminate?

[Nice Guy Eddie 13410]

7 hours ago, Captainant said:

The difference is that encrypted data can be stored behind a password that only you know and have never written down. The data is gibberish without it. Should the government be able to compel you to self incriminate?

A court can order you to produce documents (data) for a wide variety of reasons.  So yes, if that data is encrypted, you still need to produce it.  You have the ability to fight such an order and your right to avoid self-incrimination is a very good defense.  If a judge agrees with you, you won’t need to produce it.

I’m on the side that Apple shouldn’t create a process for them to decrypt anything even with a court order.  However that doesn’t mean that govt can’t order you to decrypt it and you could be in trouble if you refuse.  

[TwiceHorn 31265]

15 hours ago, Nice Guy Eddie said:

What happens today when a judge orders you to turn over some documents and you refuse to do so?  

In a civil case, documents are identified with reasonable specificity and sometimes a judge will order their production to the other side, over privilege objections or relevance or what have you.  Refusal to comply with that order results in civil contempt (fines, jail, other measures designed to obtain compliance with the order) and eventually criminal contempt, which is more in the nature of a crime and the "remedy" would be in the nature of punishment.  There is no 5th Amendment privilege in civil litigation, so that doesn't come into play.

Because there is not ongoing "discovery" of evidence in a criminal case, I think it's fairly rare for a judge to order production during the case.  The state is supposed to have gathered all its evidence prior to indicting.  But I suppose it could happen.

The more usual case in criminal litigation is that a judge signs a search warrant for reasonably identified materials, based on probable cause of commission of a crime, which permits law enforcement to go where one otherwise has an expectation of privacy to obtain and retrieve documents and other things identified in the warrant.  This usually occurs before indictment and the evidence is used to support the indictment and the eventual trial.

As currently conceived, there is no absolute expectation of privacy, but I am not sure there is any mechanism for forcing a defendant or the target of an investigation to disclose where things may be buried, to use my above analogy.  The data itself I don't believe is testimony protected by the 5th Amendment, but I am not sure about the password or the way in.

 

 

[Captainant 27442]

4 hours ago, Nice Guy Eddie said:

A court can order you to produce documents (data) for a wide variety of reasons.  So yes, if that data is encrypted, you still need to produce it.  You have the ability to fight such an order and your right to avoid self-incrimination is a very good defense.  If a judge agrees with you, you won’t need to produce it.

I’m on the side that Apple shouldn’t create a process for them to decrypt anything even with a court order.  However that doesn’t mean that govt can’t order you to decrypt it and you could be in trouble if you refuse.  

What I'm saying is that you can turn the data over that's encrypted. But you absolutely should not be legally compelled to decrypt it if the data was/has always been encrypted. I grasp the argument and valid concern that yall are making - that anyone could just encrypt data and then hand it over to the government and say "nah nah na boo boo" - but I think we're talking about different things.

I'm arguing that if something only ever existed as encrypted, or was encrypted long before there was valid or warranted legal interest in it, the government has no place to tell you to incriminate yourself by forcing you to disclose what's in it. If a party encrypts data in response with being served a warrant or subpoena and refuses to comply, then I agree there should be punishments and sanctions for that behavior, as they're essentially destroying evidence.

This is the sort of thing where it's critical and important to have nuance and subtlety of understanding in policy. These small, minute details have breathtakingly broad consequences and repercussions as cryptography and encryption literally make the digital world go round. Fuck, even the wifi signal you're getting all the surly shitposting from is encrypted, and rightfully should be.

Edited July 26, 2018 by Captainant

[TwiceHorn 31265]

11 minutes ago, Captainant said:

What I'm saying is that you can turn the data over that's encrypted. But you absolutely should not be legally compelled to decrypt it if the data was/has always been encrypted. I grasp the argument and valid concern that yall are making - that anyone could just encrypt data and then hand it over to the government and say "nah nah na boo boo" - but I think we're talking about different things.

I'm arguing that if something only ever existed as encrypted, or was encrypted long before there was valid or warranted legal interest in it, the government has no place to tell you to incriminate yourself by forcing you to disclose what's in it. If a party encrypts data in response with being served a warrant or subpoena and refuses to comply, then I agree there should be punishments and sanctions for that behavior, as they're essentially destroying evidence.

This is the sort of thing where it's critical and important to have nuance and subtlety of understanding in policy. These small, minute details have breathtakingly broad consequences and repercussions as cryptography and encryption literally make the digital world go round. Fuck, even the wifi signal you're getting all the surly shitposting from is encrypted, and rightfully should be.

Interesting spin.  Yes, I was assuming that whatever was there was encrypted from jump.  I don't know, but is there a signature that tells when something was encrypted that can be accessed without the encryption?

 

Yes encryption assists criminals in hiding their activities.  But so do a lot of other things.  We still catch em with fair regularity and even convict the right ones from time to time.  I am not convinced that there is a more than superficial argument that the government really NEEDS this stuff and believe that I am fairly comfortable creating an oasis of privacy here.

 

My animus for John Comey arose long before he became infamous because of some of the facially idiotic things he said about encryption and terrorism prosecutions.

Edited July 26, 2018 by TwiceHorn

[F250 28680]

2 hours ago, TwiceHorn said:

My animus for John Comey arose long before he became infamous because of some of the facially idiotic things he said about encryption and terrorism prosecutions.

[Nice Guy Eddie 13410]

4 hours ago, Captainant said:

What I'm saying is that you can turn the data over that's encrypted. But you absolutely should not be legally compelled to decrypt it if the data was/has always been encrypted. I grasp the argument and valid concern that yall are making - that anyone could just encrypt data and then hand it over to the government and say "nah nah na boo boo" - but I think we're talking about different things.

I'm arguing that if something only ever existed as encrypted, or was encrypted long before there was valid or warranted legal interest in it, the government has no place to tell you to incriminate yourself by forcing you to disclose what's in it. If a party encrypts data in response with being served a warrant or subpoena and refuses to comply, then I agree there should be punishments and sanctions for that behavior, as they're essentially destroying evidence.

This is the sort of thing where it's critical and important to have nuance and subtlety of understanding in policy. These small, minute details have breathtakingly broad consequences and repercussions as cryptography and encryption literally make the digital world go round. Fuck, even the wifi signal you're getting all the surly shitposting from is encrypted, and rightfully should be.

Yes, the govt should have the right to make a request for you to decrypt an encrypted document.  You have the right to fight it.  If a judge agrees with the govt request, you should decrypt.  Obviously you tell the judge to f-off, but that's another issue.    If you've encrypted or it's just sitting there printed out on your desk, the request is the same.  Produce the document.  

Encryption doesn't give someone extra protection against LEGAL govt searches.   Encryption is used to stop illegal or unwarranted searches.

the point of this thread is saying that Apple shouldn't be the one decrypting your data without your approval or even knowledge.  

[F250 28680]

2 hours ago, Nice Guy Eddie said:

Yes, the govt should have the right to make a request for you to decrypt an encrypted document.  You have the right to fight it.  If a judge agrees with the govt request, you should decrypt.  Obviously you tell the judge to f-off, but that's another issue.

Everyone should just follow Lavabit's lead when a court ordered their encryption keys to be handed over. They printed out the key on paper in 4 point font.

[TwiceHorn 31265]

7 minutes ago, F250 said:

Everyone should just follow Lavabit's lead when a court ordered their encryption keys to be handed over. They printed out the key on paper in 4 point font.

Hahaha.  Remember how Paradigm and those note taking services used to print/mimeo their product in green ink and stuff to prevent reproduction?  I seem to recall some on red paper in black ink, too.

 

Apparently, during the tobacco wars, a number of tobacco companies produced documents to State AGs that they didn't want distributed among plaintiffs lawyers in a similar fashion.  And apparently, when you have hundreds of bankers boxes of documents printed that way, they give off an eye-watering and nauseating stench.  They were accused of producing poisonous documents.  It was pretty lulzy in a lawdog sort of way.