FBI Withholds 69 Pages of TrueCrypt-Related Documents, Most Of Which Can Already Be Found Online

from the DEFAULT:-HIDE dept

Weird TrueCrypt-related things keep happening. Over the past few years, TrueCrypt has gone from "recommended by Snowden!" to a service of questionable trustworthiness. To begin with, it was never clear who exactly was behind TrueCrypt and the lack of a recent security audit wasn't winning it many new converts.

Things went from somewhat bad to disturbingly worse when, shortly after the first phase of the audit was completed, a post went up at SourceForge declaring the software insecure and that all development had been halted. The post pushed users towards BitLocker. Further development was left to the public and more testing seemed to indicate it was still trustworthy, even though it relied on possibly predictable random number generator.

Whether or not TrueCrypt can fully be trusted remains up in the air. But there's some indication that the FBI has taken an interest (probably an unhealthy one) in TrueCrypt's inner workings.

Techdirt reader dfed sends in a tweet from security researcher Runa Sandvik, along with a link to her FOIA request to the FBI for TrueCrypt-related documents. What has been "returned" to her has been completely withheld, all 69 pages of it. The FBI cites FOIA exemption b(4) which covers "trade secrets and commercial and financial information."

The documents that won't be making their way to Sandvik appear to be three technical articles not written by FBI personnel and ones that have appeared elsewhere in unredacted form.

In further explanation of the withholding, the material consists of three, copyrighted articles: Easy to Crack USB Thumbdrives, March 12, 2008 by Daniel Bachfeld; EEEP Net: "FOUO Network", April 2014 by Greg Fulk; Techno Forensics Conference, October 2007 at NIST by Dave Reiser, and a training slide presentation, Anti-Forensics, November 2, 2007 by Secure Computing.
The 2008 article may be somewhat related to the FBI's failed attempt to crack TrueCrypt encryption protecting hard drives owned by Brazilian banker Daniel Dantas, who was suspected of several financial crimes. The Brazilian government asked for the FBI's help after spending five months of its own attempting the same thing. A year later, the drives remained intact.

The thing is, Daniel Bachfeld's article on crackable USB drives can be found online. And it was previously published in a German tech magazine. Once again, we see a government agency withholding publicly-available information simply because that's its natural tendency: to keep requesters and requested documents as far away from each other as possible.

The presentation by Dave Reiser was given at a conference that is open to members of the public, as well as the law enforcement community, so there's no reason for secrecy there. And Paul A. Henry's anti-forensics presentation, which discusses TrueCrypt, can be found online as well.

So, why is the FBI holding these back? Nothing in these papers discusses anything that could possibly be considered a "trade secret." If these are secrets, they're pretty open. Searching for "anti-forensics" turns up a wealth of scholarly papers and presentations that discuss both encryption and TrueCrypt.

This is just the FBI obfuscating for obfuscation's sake. But its knee-jerk reaction to withhold everything in its entirety also suggests something slightly more troubling. Either the intelligence/investigative arms of the US government have found a way in (by obtaining keys or compromising the RNG) or they're still very actively involved in trying to do so. Neither bodes particularly well for TrueCrypt users.


Reader Comments

Subscribe: RSS

View by: Time | Thread


  • icon
    MDT (profile), 10 Jul 2015 @ 6:23am

    Copyright?

    I wonder if they redacted them due to them being Copyrighted by some other entity, and used the wrong reason out of habit? That at least I could see as a legitimate reason to not distribute them, despite them already being in the wild. As whacky as CR law is nowdays, they could be liable for CR infringement for responding to a FOIA request.

    reply to this | link to this | view in chronology ]

  • icon
    Mason Wheeler (profile), 10 Jul 2015 @ 6:44am

    Over the past few years, TrueCrypt has gone from "recommended by Snowden!" to a service of questionable trustworthiness.
    ...
    Either the intelligence/investigative arms of the US government have found a way in (by obtaining keys or compromising the RNG) or they're still very actively involved in trying to do so. Neither bodes particularly well for TrueCrypt users.

    I can't help but wonder if there might not be a causal relationship at work here?

    reply to this | link to this | view in chronology ]

  • identicon
    Anonymous Coward, 10 Jul 2015 @ 6:52am

    What's the problem?

    The point of open source is that anyone is allowed to look at the code, even people with whom you may disagree. I agree that much of the redaction is needless, but the idea that the FBI is studying software it encounters is not surprising or alarming.

    reply to this | link to this | view in chronology ]

    • identicon
      Anonymous Coward, 10 Jul 2015 @ 9:05am

      Re: What's the problem?

      I agree... the whole idea behind good crypto is that it is good crypto no matter how many eyeballs look at it. More exposure (even to those who you don't want finding flaws) is a GOOD thing.

      What's troubling to me is that the FBI might be spending government funds on this... when the NSA and NIST BOTH have a mandate in this area, and the FBI doesn't. Why not just let the NSA and/or NIST do the TC audits, and then the FBI can ask them for the results? If there's that much separation between departments, we have other really troubling issues that have nothing to do with the FBI attempting to crack TrueCrypt.

      reply to this | link to this | view in chronology ]

  • identicon
    Anonymous Coward, 10 Jul 2015 @ 7:07am

    Has been Audited

    reply to this | link to this | view in chronology ]

    • icon
      The Groove Tiger (profile), 10 Jul 2015 @ 7:54am

      Re: Has been Audited

      Also, the fork named VeraCrypt supposedly added somewhat stronger encryption (or larger keys or whatever). Not backward compatible tho, so you need to move all your stuff to new volumes.

      reply to this | link to this | view in chronology ]

      • icon
        R.H. (profile), 10 Jul 2015 @ 2:58pm

        Re: Re: Has been Audited

        Actually, starting with version 1.0f, it is backwards compatible. In order to get the new strengthened encryption you have to move to new volumes but, I switched over to VeraCrypt a few months ago and was able to seamlessly change my headers to the new format without having to store everything in the clear, create new volumes, and move it back across.

        reply to this | link to this | view in chronology ]

  • icon
    The Groove Tiger (profile), 10 Jul 2015 @ 7:51am

    Step 1: Send FOIA request to FBI to get these "secret" documents.
    Step 2: Laugh as the FBI sends these documents fully redacted with black ink.
    Step 3: Download the unredacted documents from their original sources or any other uncesored source.
    Step 4: Reply to the FBI, saying that their document was unreadable, so you did them a favor and removed all of the black ink for them. Attach said unredacted document.
    Step 5: Hilarity.

    reply to this | link to this | view in chronology ]

    • identicon
      Anonymous Coward, 10 Jul 2015 @ 7:58am

      Re:

      Step 6: Humorless FBI agents burst through your doors with machine guns drawn to arrest you for hacking and terrorism.

      reply to this | link to this | view in chronology ]

  • identicon
    Anonymous Coward, 10 Jul 2015 @ 8:51am

    I think the FBI is trying to tell us something with the number of redacted pages.

    reply to this | link to this | view in chronology ]

  • identicon
    Mike Graham, 10 Jul 2015 @ 9:35am

    FBI FUD

    The gubment is trying to sully truecrypt because they don't want it in use. Probably because they cannot crack it.

    reply to this | link to this | view in chronology ]

  • icon
    Adam (profile), 10 Jul 2015 @ 10:01am

    How hypocritical of them

    It's not redacted! It's encrypted! Funny how FOIA requests about encryption related subjects come back redacted. I mean, what? There's something they don't was us to see there?

    reply to this | link to this | view in chronology ]

  • identicon
    Anonymous Coward, 10 Jul 2015 @ 6:16pm

    HT used it/TC's seppuku

    In the HT document dump there's a TC volume. So HT obviously trusted it.

    That was a rather poor write up on the end history of TC, Tim. Actually, that's an understatment, but I'll just leave it at that.

    Most educated people came to the conclusion that the wierd, 'canary' like message from TC's anon dev, which included the conspicuous phrase "Not Secure As", along with the completely absurd bitlocker suggestion (amoung others), was indicative of mounting advasarial pressure, and a potential/probable future compromise. If anything it gave us more reason to trust TC. A strong case can be made that the devs words/actions where a form of digital seppuku, and very clever speech under some duress.

    As others have mentioned, TC has now been fully audited and found to be without any serious flaws. I hope veracrypt will be (is being?) given the same treatment- until then I'll stick with the original.

    reply to this | link to this | view in chronology ]

  • identicon
    Anonymous Coward, 10 Jul 2015 @ 10:45pm

    I still wonder why the TrueCrypt developers decided to suddenly stop maintaining their encryption software. The timing of them closing up shop shortly after the audit announcement is beyond coincidence.

    I personally believe the auditors somehow offended the TrueCrypt developers. Maybe something was said that rubbed them the wrong way. I think the TrueCrypt developers decided it's not worth their time and effort to continue maintaining software for a bunch of ungrateful people who keeps insulting them.

    Maybe they just decided they have better, more fun, things to do with their free time. I don't blame them.

    reply to this | link to this | view in chronology ]

    • identicon
      Anonymous Coward, 11 Jul 2015 @ 2:46pm

      Re:

      What?

      reply to this | link to this | view in chronology ]

      • identicon
        Anonymous Coward, 12 Jul 2015 @ 11:06am

        Re: Re:

        Oh come on. It makes perfect sense. Why else would the Truecrypt developers totally take down the website and all documentation on Truecrypt. They basically nuked the whole project in a day.

        Doesn't that seem like an emotion reaction to you and like sticking one's middle finger at the auditors?

        reply to this | link to this | view in chronology ]

  • identicon
    Anonymous Coward, 11 Jul 2015 @ 2:45pm

    Uh what? I actually re-installed the last working version on my linux partition. Because the audit team has had 2 phases of its audit (or w/e, not an expert). All I know is that things had changed from step 1 showing no holes, step 2 memo saying no danger found yet.

    I'd find links but i'm a very lazy dopped up to my eyes on Demerol because of an open fracture of the foot.

    reply to this | link to this | view in chronology ]

  • identicon
    Anonymous Coward, 2 Aug 2015 @ 8:19am

    Reasonable Suspicion versus Reactive Stupidity

    I'm prepared to dive into the juiciest government conspiracy theory as much as the next guy, but going paranoiac because the FBI refused to provide you copyrighted documents is a tad unreasonable. The documents were copyrighted, the FBI did not have the right to distribute them.

    The FBI referenced the articles. You found them. That the FBI didn't violate the authors' or publishers' copyrights by serving them up to you, for copying costs, on a platter doesn't appear to (reasonably) point to some sinister intent.

    Let's not dilute the valid indications of bad acts by government by getting hysterical about the reasonable, and lawful, acts.

    reply to this | link to this | view in chronology ]


Add Your Comment

Have a Techdirt Account? Sign in now. Want one? Register here
Get Techdirt’s Daily Email
Use markdown for basic formatting. HTML is no longer supported.
  Save me a cookie
Follow Techdirt
Techdirt Gear
Show Now: Takedown
Advertisement
Report this ad  |  Hide Techdirt ads
Essential Reading
Techdirt Deals
Report this ad  |  Hide Techdirt ads
Techdirt Insider Chat
Advertisement
Report this ad  |  Hide Techdirt ads
Recent Stories
Advertisement
Report this ad  |  Hide Techdirt ads

Close

Email This

This feature is only available to registered users. Register or sign in to use it.