US Secret Service Prefers Belt Sanders And Third-Party Vendors To Cell Phone Encryption Backdoors

from the 80-grit-backdoor dept

The Christian Science Monitor has posted an interesting article detailing some (but certainly not all) of the ways the US Secret Service can obtain data from locked phones. In all the cases discussed in the article, the data itself wasn’t encrypted, but was otherwise inaccessible without the password.

In addition to using third-party forensic software and hardware (like that of recently-hacked Cellebrite), the Secret Service also engages in a lot of manual labor to recover phone data. In one instance, the Secret Service was able to pull out the phone’s flash memory and grab data from it — although this process took it nearly a week.

A Huawei phone obtained by the agency called for a very unique brute force approach.

In another case, involving a password-locked Huawei H883G phone, agents bought multiple copies of the same model and practiced carefully polishing off material from the back of the device with an automated sander.

Often, agents can apply heat to phones to open them up. But Huawei built this particular model in a way that applying too much heat could damage its memory. So, agents sanded off material from the back of the Huawei H883G device to excise sexually explicit images for a case involving a different New Hampshire man.

What’s not contained in the article are complaints about encryption. Either the Secret Service doesn’t encounter that much of it, or it just doesn’t find it to be that much of an obstacle when it does. Dave Aitel, a former NSA research scientist, is the only person quoted in the article who says anything about encryption — and even he believes the Secret Service’s combination of hardware and software is a better approach than giving government agencies encryption backdoors.

Watering down encryption on phones is “not a good path,” says Dave Aitel, a former National Security Agency research scientist who currently runs the cybersecurity firm Immunity. “The path of hacking is much nicer – from a policy perspective.”

[…]

“If a device is using encryption at rest … that could be problematic, especially if the implementation of the encryption is good,” he said.

It could be problematic, but encryption keeps bad guys out the same way it keeps the good guys out. And there’s nothing covered here that suggests the Secret Service is as opposed to encryption as FBI Director James Comey is. Granted, the Secret Service probably runs into fewer encrypted phones than the FBI does, but even in its more-limited selection, it seems to be making the progress it needs without suggesting the government force companies to give them all-access backdoor keys.

One other somewhat surprising revelation contained in the piece is the fact that small phone manufacturers might (inadvertently) be making more secure phones than the Apples and Samsungs of the world. Why? Because the limited market draws less interest from government contractors who develop cell phone-cracking tools. If there are fewer government buyers interested in cracking Brand X, no company is going to expend research resources trying to find a way around the phone’s built-in protections.

“A cheaper phone that might be less popular, it seems like it’d be easier for the vendors to get into it,” says [James] Darnell of the Secret Service phone lab. “But it’s actually quite the opposite.”

What’s covered here indicates James Comey’s “sky is falling darkening” proclamations are pretty much his alone. Law enforcement at large isn’t demanding encryption backdoors. It’s just the same handful of holdouts, albeit ones with inordinately-large soapboxes.

Filed Under: , , , ,

Rate this comment as insightful
Rate this comment as funny
You have rated this comment as insightful
You have rated this comment as funny
Flag this comment as abusive/trolling/spam
You have flagged this comment
The first word has already been claimed
The last word has already been claimed
Insightful Lightbulb icon Funny Laughing icon Abusive/trolling/spam Flag icon Insightful badge Lightbulb icon Funny badge Laughing icon Comments icon

Comments on “US Secret Service Prefers Belt Sanders And Third-Party Vendors To Cell Phone Encryption Backdoors”

Subscribe: RSS Leave a comment
10 Comments
Richard (profile) says:

Re: Re:

Security through obscurity does work – but not if you are a big target.

To be secure you just need enough security to make it not worth the while of the attacker.

Provided you are not an important target being different from everyone else helps because it means that the effort spent on breaking your security is specific to you.

Add Your Comment

Your email address will not be published.

Have a Techdirt Account? Sign in now. Want one? Register here

Comment Options:

Make this the or (get credits or sign in to see balance) what's this?

What's this?

Techdirt community members with Techdirt Credits can spotlight a comment as either the "First Word" or "Last Word" on a particular comment thread. Credits can be purchased at the Techdirt Insider Shop »

Follow Techdirt

Techdirt Daily Newsletter

Techdirt Deals
Techdirt Insider Discord
The latest chatter on the Techdirt Insider Discord channel...
Loading...