FBI Back To Complaining About Encryption Making It Difficult To Scrape All Data From A Dead Person’s Phone

Privacy

from the can-it,-chris dept

It’s 2016 all over again. The FBI can’t get everything it wants from a dead person’s phone, so it has decided to start revving up its anti-encryption engine. The DOJ took Apple to court in hopes of securing precedent compelling tech companies to crack encrypted devices for it after it recovered the San Bernardino shooter’s iPhone. That attempt failed. But that hasn’t stopped the complaining.

Before we get into the latest bout of whining to Congress, let’s take a look back at another date: May 29, 2018. That’s the date the FBI acknowledged it had seriously overstated the number of uncracked encrypted devices in its possession. That was the same day it promised to deliver an updated, far more accurate tally of these devices. It has been 2,246 days since that promise was made — 6 years, 1 month, and 23 days. That number still has not been updated.

However, that six years has been filled with FBI Director Chris Wray’s intermittent bad faith attacks on encryption. If nothing else, no one should allow the FBI to push anti-encryption arguments until it hands over the updated number of devices so everyone has the same facts available to gauge exactly how big the “problem” is.

But the latest round of complaints sound like the ones made in 2016. Even though the FBI was able to break into the Trump rally shooter’s device thanks to unreleased software provided by Cellebrite, Chris Wray is telling Congress that being able to break into a phone simply isn’t enough. All encryption must go, not just that protecting the device itself.

Wray said the bureau is facing challenges with getting into “encrypted messaging applications” used by Thomas Matthew Crooks, who was killed by a Secret Service counter-sniper team after firing at least eight shots toward the stage at the July 13 rally in Butler, Pennsylvania. Reports said officials have identified at least three such accounts.

Speaking to the House Judiciary Committee, Wray said that in some cases, the FBI is waiting on “legal process returns” to get into the accounts. He did not specify what companies or services host them.

Wray is presenting the reality of all criminal investigations like it’s evidence that the criminals are constantly one step ahead of the feds, even when said criminal is dead and neither facing prosecution nor capable of committing more crime. It’s not a great test case for anti-encryption legal battles or legislation, much like the last time the FBI made a lot of noise about not being able to get into a dead person’s phone.

But that’s not all Wray said. This part is even worse and a whole lot stupider.

“This has unfortunately become very commonplace,” he said. “It’s a real challenge not just for the FBI but for state and local law enforcement all over the country.” Even with access to a user’s phone, the end-to-end encryption used in many apps would make messages and other data inaccessible even to the app developer.

“Some places we’ve been able to look, some places we will be able to look, some places we may never be able to see, no matter how good our legal process is,” Wray said.

First off, there’s no way of telling how “commonplace” this is because, as noted above, the FBI’s encrypted device numbers have been wrong for more than six years and have yet to be corrected. We can assume it’s more commonplace now that more services are offering end-to-end encryption, but we should not automatically assume it’s enough to be referred to casually as “commonplace” and a persistent threat to successful criminal investigations. If it were, one would expect to hear more about it from other law enforcement officials. Instead, most of what we hear about the supposed evil of encryption has come from the mouths of consecutive FBI directors.

As for the second paragraph, that’s something that’s always been true about criminal investigations, dating back to long before devices or device encryption existed. No investigation will ever uncover all existing evidence. It’s an impossibility. Some evidence will be destroyed. Some evidence simply won’t be where investigators are looking for it. And some evidence is ethereal, gone as soon as it’s uttered via untapped phone calls or in-person conversations.

Pretending that this reality of criminal investigations is somehow new is intellectual dishonesty. Claiming that it’s somehow more common due to encrypted devices and communication services is meaningless if the FBI’s not willing to give the public — or at least its congressional oversight — accurate information detailing just how often the FBI runs into this particular problem.

Until the FBI can be honest about the problem its directors claim is omnipresent, its anti-encryption agitation should be ignored. And it should certainly be ignored when the FBI is doing nothing more than complaining about a lack of access to a dead person’s phone contents and communications.

Filed Under: chris wray, encryption, fbi, lawful access
Companies: cellebrite

FBI Director Admits Agency Rarely Has Probable Cause When It Performs Backdoor Searches Of NSA Collections

Legal Issues

from the just-laying-it-right-out-there-like-it-doesn't-mean-anything dept

After years of continuous, unrepentant abuse of surveillance powers, the FBI is facing the real possibility of seeing Section 702 curtailed, if not scuttled entirely.

Section 702 allows the NSA to gather foreign communications in bulk. The FBI benefits from this collection by being allowed to perform “backdoor” searches of NSA collections to obtain communications originating from US citizens and residents.

There are rules to follow, of course. But the FBI has shown little interest in adhering to these rules, just as much as the NSA has shown little interest in curtailing the amount of US persons’ communications “incidentally” collected by its dragnet.

In recent months, several Republicans have argued against a clean re-authorization of Section 702 powers, citing the FBI’s backdoor snooping on Trump administration figures, as well as certain Republicans who have outlasted Trump’s four-year stint as the supposed leader of the free world.

On top of this opposition, there’s something more bipartisan. Every time surveillance powers are up for renewal, Senator Ron Wyden and other privacy focused legislators have offered up comprehensive surveillance reform packages.

The latest effort by Wyden would create a warrant requirement for these backdoor searches by the FBI. Senate leaders tried to dodge this by slapping a clean re-auth rider on a “must pass” budget bill, but legislators found a way to keep the government funded for a little bit longer while they continue to argue over who gets what and how much of it.

Faced with the real possibility of seeing this surveillance authority heavily altered, if not discarded completely, the FBI is making its case for a year-end approval of status quo continuation. But it’s making some really bad arguments.

FBI director Chris Wray took time out his busy “everything is going dark” schedule to speak to House representatives on behalf of his agency and its desire to continue to abuse this access to NSA collections. Unfortunately for Wray, the statements he made inadvertently exposed the lack of legal basis for FBI access to communications collected by the NSA.

First though, he pretended he cared whether or not Americans were subject to unconstitutional spying, as Jessica Hardcastle reports for The Register.

He did address the FBI’s earlier abuses of Section 702 to spy on protesters, campaign donors, and even elected officials.

“To be sure, no one more deeply shares Members’ concerns regarding past FBI compliance violations related to FISA, including the rules for querying Section 702 collection using US person identifiers, than I do,” Wray said. 

That can’t possibly be true. If it were, Wray’s concern would surpass the concern expressed by any number of rights and privacy groups, as well as legislators who have worked for years to curtail this abuse, only to see their reform efforts shot down by the lawmakers who care even less about the FBI’s violations than the FBI itself.

If this statement were even remotely true, Wray wouldn’t be trying to talk legislators into dumping Wyden’s reform bill, much less advocating for continued warrantless access to US persons’ communications.

Wray’s argument for continued warrantless access was somehow even worse than his pretending to care about surveillance abuses. Somehow, the FBI director managed to blurt out what everyone was already thinking: that the FBI needs this backdoor access because it almost never has the probable cause to support the search warrant normally needed to access the content of US persons’ communications.

“A warrant requirement would amount to a de facto ban, because query applications either would not meet the legal standard to win court approval; or because, when the standard could be met, it would be so only after the expenditure of scarce resources, the submission and review of a lengthy legal filing, and the passage of significant time — which, in the world of rapidly evolving threats, the government often does not have,” Wray said. 

Holy shit. He just flat-out admitted it: a majority of FBI searches of US persons’ communications via Section 702 are unsupported by probable cause. That alone should be enough to, if nothing else, forbid the FBI from using this back door. This is on top of the years of continuous abuse of these surveillance powers by the FBI — something so egregious even the FISA court has considered shutting down the FBI’s access. And that’s with the FISA court’s unwavering ability to both forgive and forget the FBI’s constant trespasses.

If Wray is to be believed — and there’s no reason not to, since he’s arguing in self-interest — probable cause either doesn’t exist or takes too long. This is the same guy who, moments earlier, claimed he was the most concerned about FBI abuse of this surveillance power. Yet, moments later, he’s telling legislators his agency is incapable of complying with the Fourth Amendment, or simply just unwilling to do so.

While I’m less than thrilled certain Republicans have decided Section 702 is bad only when it hurts them, I’m happy to see this power face the real possibility of meaningful reform, if not actual extinction. It’s been a long time coming. Unfortunately, both the FBI and the current administration are united in their desire to keep this executive authority intact. Both Wray and the Biden administration call the warrant requirement a “red line.” So, even if the House decides it needs to go (for mostly political reasons) and/or Wyden’s reform bill lands on the President’s desk, odds are the FBI will get its wish: warrantless access to domestic communications for the foreseeable future.

Filed Under: 4th amendment, backdoor searches, chris wray, fbi, section 702, warrantless search, warrants

FBI Director Chris Wray Turns On The Charm, Tries To Convince Tech Companies He’s Not Their Enemy

Say That Again

from the swoon-for-me,-said-the-G-Man dept

After years of portraying tech companies as havens for nerd antagonists, FBI Director Chris Wray is trying to build a few extremely belated bridges.

The rift between FBI and tech companies started with the rollout of default encryption for phones. Apple was the first to market with by-default encryption, something that became the focus of FBI lawyering while investigating the San Bernardino shooting. The FBI had private sector options to crack the shooter’s iPhone, but instead spent weeks trying to obtain favorable precedent that would force tech companies to undermine device encryption.

Since then, anti-encryption FBI director James Comey gave way to anti-encryption FBI director Chris Wray (following the rejection of President Trump’s clumsy late night pass). But the party line never changed: the world of criminal investigation was “going dark” and only the nerds at tech companies could prevent this.

The nerds at tech companies reminded the FBI director multiple times that undermining encryption means encryption no longer works. Chris Wray insisted they just weren’t thinking hard enough about the FBI’s demands. In the background, the FBI’s inability to correctly tally physical devices in its possession generated more inconvenient headlines for Wray and his anti-encryption agitating.

And the agitation has continued non-stop, with Wray accusing companies of being purposefully antagonistic by offering security and privacy to their users while using nonsensical loaded terms like “warrant-proof encryption.”

The FBI also got into the cybersecurity business during this period of time, presenting itself as an ally while asking companies to share anything of use with an agency that has repeatedly shown it has little respect for anyone in the private sector that isn’t automating the licking of boots.

The FBI — at least as personified by its directors — appears to believe respect should be commanded, rather than earned. Tech companies don’t really need the FBI, so the deference the FBI feels is owed it hasn’t materialized.

After years of failing to move the dial, the FBI director finally appears to have recognized that a softer touch is needed. The FBI has actually done some good stuff on the cybersecurity front. It has compromised malicious entities to obtain decryption keys from ransomware purveyors, allowing victims to regain access for free.

“Not 100% shitty” is the sales pitch. And that’s the sales pitch Chris Wray is now making (albeit only to certain listeners), as Aruna Viswanatha reports for the Wall Street Journal.

“I’m glad you’re here, in every sense of the word,” Mr. Wray told a gathering of Fortune 500 executives last year, urging them to work with the FBI. The agency’s top cyber official, Bryan Vorndran, frequently tells cybersecurity experts that the FBI is trying to offer “Ritz Carlton-level customer service” to companies that report to the bureau when they are victims of a cyberattack, offering to fight with regulators and deal with the media on their behalf. Only through such cooperation, the bureau says, including trusting the FBI with sensitive corporate information, can the agency marshal an effective response. 

The velvet gloves are on. But let’s not kid ourselves: the government should be providing “Ritz Carlton-level service” to everyone already. I mean, we’re paying for it. And in the FBI’s cases, we’re paying top dollar. High-level service should be the baseline. The government has obligations. It should fulfill them, and it should do it without insinuating its level of service will vary based on the cooperation of private entities.

But this is the voice of the FBI, as enunciated at none other than Davos, the annual meeting of the most powerful businesses in the world. What may look like concessions and offerings of help and support need to be considered in this context. The FBI may be presenting itself as Big Business’s best friend, but that’s the sort of message one would expect it to deliver during a road game attended by plenty of rich people that don’t have a particular need for any of the FBI’s services.

Tailoring content for an audience is smart. But even the FBI knows its belated sales pitch will be seen as insincere and untimely. So, it is, again, trying to hint that not working with the FBI will result in some sort of private sector chaos by using loaded language to compare cyberthreats to terrorist attacks that killed thousands.

FBI officials say they can’t put a dent in cybercrime or economic espionage by focusing primarily on after-the-fact indictments, and they have pushed deeper into other offensive and defensive operations that rely on the private sector’s willingness to participate. 

Current and former officials have likened the approach to the bureau’s mission after the Sept. 11, 2001, attacks to disrupt terrorism plots before they can be carried out. 

The FBI can be useful. But it needs to get out of its own way. And it definitely needs to stop talking about device and communication encryption. It has spent years lying about the scope of the threat posed by encryption. And it has spent even more years ignoring specific questions about the alleged problems it has witnessed firsthand.

Until the FBI is willing to be honest about all the issues faced by tech companies, it shouldn’t be showing up at business conferences with “we’re all in this together” business cards. The FBI’s years of antagonism can’t be waved away with a couple of pro-cooperation statements. If the FBI wants the trust of tech companies, it will have to earn it — something it still seems uninterested in doing.

Filed Under: chris wray, cybersecurity, encryption, fbi, going dark, security

FBI Director Gets Back On His Anti-Encryption Bullshit In Statement To Homeland Security Committee

Overhype

from the just-shut-the-fuck-up dept

We’ll get to Chris Wray in a moment, but first let’s do a throwback to May 29, 2018 — the date the FBI first promised to correct its miscount (estimated to be off by as much as 4,000 devices) of uncrackable devices in its possession. Multiple statements utilizing the FBI’s bad stats were edited, with the erroneous number replaced with footnotes like this:

** Due to an error in the FBI’s methodology, an earlier version of this speech incorrectly stated that the FBI had been unable to access 7,800 devices. The correct number will be substantially lower.

This promise to deliver accurate numbers debuted 1,642 days ago. To put that in perspective, we’ve had two national elections and three different presidents (Obama, Trump, Biden) since the FBI promised to perform a recount. That number will continue to increase because it appears the FBI has no intention of telling the truth about how much of a problem device encryption actually poses.

FBI Director Chris Wray apparently has no shame. Despite spending more than a half-decade basically lying about the encryption “problem” the FBI faces, Chris Wray (like James Comey before him) continues to use every opportunity he has to claim encryption that can’t be bypassed at will by law enforcement is a threat to public safety and, in this case, national security.

Speaking to the Senate Homeland Security Committee, Wray again made a pitch for an impossibility he likes to call “lawful access.”

Protecting data and privacy in a digitally connected world is a top priority for the FBI, and we believe that promoting encryption is a vital part of that mission. Encryption without lawful access, though, does have a negative effect on law enforcement’s ability to protect the public. As I have testified previously, when the FBI discusses lawful access, we mean putting providers who manage encrypted data in a position to decrypt it and provide it to us in response to a legal process. We do not mean for encryption to be weakened or compromised so that it can be defeated from the outside by law enforcement or anyone else. 

The last two sentences contradict each other: you cannot have encryption that can be broken on demand that will still be secure when the bad guys come for it. Asking device manufacturers to become apartment complex managers who hold onto everyone’s keys just in case law enforcement needs to get in isn’t any better. It just centralizes the attack vector, giving malicious hackers fewer targets, but ones housing much bigger payloads.

So, when Chris Wray says he’s not asking for “backdoored” encryption, he’s technically telling the truth. He just wants to be let in the front door whenever he asks. You don’t need a back door when the front door is no longer an obstacle. The FBI Director is playing word games, referring to fully functioning encryption as “warrant-proof” and compromised end-to-end encryption as “lawful access.” That makes this assertion extremely disingenuous.

Unfortunately, too much of the debate over lawful access has revolved around discussions of this concept that the FBI would not support.

Nah. That ain’t it. The discussion revolves around what Wray himself has asked for. Wray won’t provide specifics or technical details because that would make it too easy for critics to poke holes in his plans. So, he makes up new phrases like “warrant-proof” and “lawful access” to avoid being pinned down on what it is he actually wants and then he claims everyone else is misconstruing the things he won’t be intellectually honest about.

What Wray wants is one-stop shopping for evidence — something agents can accomplish by doing little more than plugging a seized phone or laptop into a third-party box that grabs every bit of data residing on the devices for the FBI to search through at its leisure. The average phone can contain more evidence than an entire house, depending on the crime being investigated. But that doesn’t mean the government should have at-will access just because the alternative is inaccessible evidence.

Since the inception of law enforcement agencies, there has always been evidence investigators can’t access. Incriminating documents get burned. Murder weapons get tossed into rivers and lakes. Criminals use stash houses to keep their own houses free of incriminating evidence. Criminal conspirators speak in person outdoors, rather than risk interception via phone lines or bugged rooms. And yet, no FBI director has repeatedly called for the private sector and government to work together to prevent the exploitation of matchbooks, open bodies of water, outdoor conversations, and real estate purchases.

This is increasingly dumb shit. And it’s made worse because the FBI won’t be honest about the problem it says it has on its hands. Chris Wray shouldn’t be considered a credible speaker on the subject of encryption — at least not until he stops being vague about what it is he really wants. And definitely not until he provides the updated encrypted device numbers his agency promised almost a half-decade ago.

Filed Under: chris wray, doj, encryption, lawful access

Docs Freed With FOIA Lawsuit Show FBI Misled Congress About Plans For Deploying NSO Spyware

(Mis)Uses of Technology

from the thwarting-oversight-yet-again dept

Thanks to a steady stream of reports of abusive uses of its powerful Pegasus malware, Israel’s NSO Group saw its reputational stock drop precipitously as it became more and more apparent the company didn’t really care who it sold its products to. The list of customers included several notorious human rights abusers and leaked data suggested NSO’s customers were deploying phone malware against journalists, lawyers, religious leaders, political opponents, and government critics.

This resulted in the US Commerce Department blacklisting NSO Group, preventing it from doing business with American tech companies. Around this same time, information came to light showing the FBI had courted NSO, hoping to deploy Pegasus against investigation targets and whoever else the agency felt was worth keeping an eye on.

According to the FBI’s own statements, this was nothing more than a trial run to determine the malware’s capabilities. After the test run, the FBI claimed it thought the malware would result in too many constitutional violations to be useful in investigations. This report was followed by another report — one based on FOIA requests — that showed the FBI had purchased Pegasus licenses nearly a year before NSO Group showed up to demonstrate a bespoke malware product that bypassed built-in restrictions that prevented it from being used to target US phone numbers.

Throughout this, the FBI has maintained it never seriously considered using NSO’s powerful malware. According to statements made to congressional oversight, the FBI was merely curious about the malware’s capabilities.

But those assertions were, at best, misleading. According to documents obtained by the New York Times following its FOIA lawsuit against the FBI, the agency was very interested in using the malware in its own investigations — an option it continued to pursue even as NSO made headline after headline for its lax oversight of its customers and its customers repeated, abusive deployments of its Pegasus malware.

During a closed-door session with lawmakers last December, Christopher A. Wray, the director of the F.B.I., was asked whether the bureau had ever purchased and used Pegasus, the hacking tool that penetrates mobile phones and extracts their contents.

Mr. Wray acknowledged that the F.B.I. had bought a license for Pegasus, but only for research and development. “To be able to figure out how bad guys could use it, for example,” he told Senator Ron Wyden, Democrat of Oregon, according to a transcript of the hearing that was recently declassified.

But dozens of internal F.B.I. documents and court records tell a different story. The documents, produced in response to a Freedom of Information Act lawsuit brought by The New York Times against the bureau, show that F.B.I. officials made a push in late 2020 and the first half of 2021 to deploy the hacking tools — made by the Israeli spyware firm NSO — in its own criminal investigations. The officials developed advanced plans to brief the bureau’s leadership, and drew up guidelines for federal prosecutors about how the F.B.I.’s use of hacking tools would need to be disclosed during criminal proceedings.

Not exactly the “just idle curiosity” assertions made by agency officials last year. While the end result — the abandonment of Pegasus malware as a viable investigative option — may be the same, the path taken by the agency to reach this point apparently diverged from the narrative delivered to congressional oversight.

That this plan was abandoned following months of reporting on NSO’s sketchy actions and customer base shows the FBI was at least capable of reading the room. But the documents show the FBI may just be waiting for the uproar to die down. It still wants to acquire and deploy a Pegasus-like product, even if this option would still present the same difficult constitutional issues.

“Just because the F.B.I. ultimately decided not to deploy the tool in support of criminal investigations does not mean it would not test, evaluate and potentially deploy other similar tools for gaining access to encrypted communications used by criminals,” stated a legal brief submitted on behalf of the F.B.I. late last month.

And while the FBI would like to give itself a pass on its inability to tell the whole truth during congressional testimony, Senator Ron Wyden’s isn’t willing to cut the agency any slack.

In a statement, Mr. Wyden said “it is totally unacceptable for the F.B.I. director to provide misleading testimony about the bureau’s acquisition of powerful hacking tools and then wait months to give the full story to Congress and the American people.”

Wyden is right. This isn’t acceptable. It certainly seems acceptable to the FBI, which has repeatedly given the impression the public has no business asking what it’s up to. And its willingness to stiff arm its own oversight suggests it believes no one inside the government has any business asking questions either. The FBI has too much power to be allowed to shrug off oversight and mislead congressional leaders. But without any meaningful discipline being applied internally or externally, it really has no reason to embrace the accountability that’s supposed to come with the job.

Filed Under: chris wray, congress, fbi, foia, malware, pegasus, ron wyden, spyware, surveillance
Companies: nso group

FBI Director Chris Wray Still Won’t Shut The Fuck Up (Or Be Honest) About Phone Encryption

Say That Again

from the it's-just-that-I-don't-want-him-to-go-on-any-longer dept

The FBI needs to shut the fuck up about phone encryption.

This isn’t just profane hyperbole. Shut. The. Fuck. Up.

The FBI has continued — via consecutive directors — to agitate for encryption backdoors. And these directors have done this by delivering a false narrative, aided and abetted by the FBI’s refusal to correct its miscount of uncrackable devices in its possession.

For years, FBI Director James Comey made anti-encryption hay by citing escalating numbers of devices the FBI simply couldn’t break. But the numbers were bogus, the FBI finally admitted. But not before Comey was able to wield these false numbers as evidence the federal government needed to legislate backdoors.

Here’s what happened while Comey was still the FBI director:

The FBI has repeatedly provided grossly inflated statistics to Congress and the public about the extent of problems posed by encrypted cellphones, claiming investigators were locked out of nearly 7,800 devices connected to crimes last year when the correct number was much smaller, probably between 1,000 and 2,000, The Washington Post has learned.

Here’s how this number expanded while Comey still had the FBI helm:

This number aligns more with reality than the frequent claims the number of locked phones was nearing 8,000 devices. In 2016, the FBI reported it was only locked out of around 880 devices. Less than two years later, it was stating it had 7,800 impregnable devices in its possession.

A few days later, the FBI promised to provide the public with an accurate number of devices in its possession. References to the ~8,000 devices made by FBI directors and DOJ officials were replaced with footnotes acknowledging the mistake.

** Due to an error in the FBI’s methodology, an earlier version of this speech incorrectly stated that the FBI had been unable to access 7,800 devices. The correct number will be substantially lower.

That promise debuted May 29, 2018. The FBI has yet to provide an updated number. That was 1,538 days ago. Or, to put in layman’s terms, more than four years ago. The FBI has spent four years and 76 days refusing to provide an accurate count.

Since then, James Comey has exited the public sphere, fired by then-president Donald Trump and riding off into the sunset, hailed as a savior by idiotic “Comey is my homey” people who apparently forgot Comey reopened an investigation into presidential candidate Hillary Clinton’s private email server only days before the 2016 election.

Comey was replaced by Christopher Wray. His replacement was no better. As the FBI continued to refuse to update this number, Wray leveraged the agency’s lack of honesty to argue against encryption. No longer able to use an inflated number to justify his agitation, Wray relied on unknown unknowns to make his case for backdoored encryption.

And, despite four years of FBI silence on the actual encryption problem, Wray continues to claim the US would be safer if encryption was easily breakable. Director Chris “Horseshit” Wray — delivering a statement to the House oversight committee — continues to claim encryption can be safely broken and that no one should be allowed to call this a backdoor.

Under a section misleadingly titled “Lawful Access,” Wray says this:

The problems caused by law enforcement agencies’ inability to access electronic evidence continue to grow.

We’ll stop on his first sentence because what even the fuck. This is citing facts not in evidence. And these facts are not in evidence because the FBI — over the course of 4+ years — has refused to provide them. We can’t possibly verify the “problem” (which was overstated for years) has “grown” because the FBI refuses to provide an accurate baseline or current count of encrypted devices in its possession.

It has also refused to provide any information about the phones in its “uncrackable” stash — information like how often encryption has terminated investigations or how often the FBI has obtained evidence supporting criminal charges through other means that don’t involve cracking a seized device. We don’t know how big the problem is because the FBI would obviously like us to believe it’s incredibly large. And it can do this by refusing to honestly discuss the issue by providing accurate stats and other information about criminal investigations.

That fact makes the rest of Wray’s whining irrelevant. None of the following should be granted credence without additional transparency by the FBI:

Increasingly, commercial device manufacturers have employed encryption in such a manner that only the device users can access the content of the devices. This is commonly referred to as “user-only-access” device encryption. Similarly, more and more communications service providers are designing their platforms and apps such that only the parties to the communication can access the content. This is generally known as “end-to-end” encryption. The proliferation of end-to-end and user-only-access encryption is a serious issue that increasingly limits law enforcement’s ability, even after obtaining a lawful warrant or court order, to access critical evidence and information needed to disrupt threats, protect the public, and bring perpetrators to justice.

Wray claims the proliferation of encryption is hampering law enforcement. But he provides no evidence of that. All he provides is assertions he believes to be unassailable. Bullshit. [Presses “ASSAIL” button repeatedly.] All we know for sure is that more entities are offering encryption. What we don’t know (because the FBI has refused to address this) is how often encryption derails investigations. The FBI continues to lie (by conspicuous omission) about this. For that reason, neither it or its front mouth can be trusted to address this issue honestly.

And when someone with all access to every possible resource available, that would assist in him getting the facts right, continues to make bullshit claims like these, there’s even less reason to believe Chris Wray knows what he’s talking about.

The FBI remains a strong advocate for the wide and consistent use of responsibly managed encryption. Protecting data and privacy in a digitally connected world is a top priority for the FBI, and we believe that promoting encryption is a vital part of that mission. Encryption without lawful access, though, does have a negative effect on law enforcement’s ability to protect the public. As I have testified previously, when the FBI discusses lawful access we mean putting providers who manage encrypted data in a position to decrypt it and provide it to us in response to legal process. We do not mean a “backdoor,” that is, for encryption to be weakened or compromised so that it can be defeated from the outside by law enforcement or anyone else.

End-to-end encryption that can be broken on demand isn’t actually end-to-end encryption. Putting processes in place that allow providers to break encryption when they’re asked to is the very definition of a “backdoor,” no matter how much Director Wray pretends it isn’t. Providers don’t know which of their users law enforcement will express an interest in thanks to encryption. So, to comply with “lawful access” demands, they would need to create an entry point that works with all accounts, rather than just those targeted by law enforcement. An entryway that did not previously exist is a backdoor. And this previously nonexistent entry point can never be considered exclusive to law enforcement. If the weakness exists, it can be exploited by anyone, even malicious hackers.

But, even if Chris Wray was correct about everything else, he still should be considered dis-invited from encryption discussions. If he’s not willing to force the FBI to cough up the corrected device count, he should keep his fucking mouth shut until he has these numbers in hand.

Filed Under: chris wray, encryption, fbi, lawful access

FBI Cites Guidelines That Don't Actually Forbid Social Media Monitoring As The Reason It Was Blindsided By The January 6 Attack

Legal Issues

from the some-monitoring-is-more-equal-than-others dept

The FBI has spent thousands on social media monitoring software. These contracts are public, making it literally unbelievable the agency has managed to stave off FOIA requests by handing out “neither confirm nor deny” non-answers. A court didn’t buy the FBI’s excuse for its Glomar, pointing out that confirming public information would not give criminals a heads-up on surveillance software the FBI is currently using.

The FBI’s inability to honestly discuss its social media monitoring programs continues. The January 6th raid on the US Capitol building has resulted in hundreds of arrests. A lot of the evidence for these prosecutions has come from social media posts by members of the ad hoc raiding party.

The FBI continues to provide contradictory responses when questioned about its social media monitoring programs. Its Congressional testimony has kind of eluded direct questions about the FBI’s incursions into First Amendment territory — something the FBI is now using to explain why it wasn’t more aware of the impending threat prior to January 6th.

Quinta Jurecic’s post for Lawfare points out the FBI lack of awareness was somewhat stunning, given the vast amount of publicly available information circulating social media prior to the Capitol raid.

The only document the FBI produced warning about Jan. 6 was a single bulletin issued by the bureau’s Norfolk, Virginia, field office. This absence of warning is particularly striking given that a significant amount of the planning for the Jan. 6 riot took place in public on social media platforms like Facebook, Gab and Parler. Anyone with a Twitter account and an hour of time to kill could have warned about the potential for violence on Jan. 6—and many did.

FBI Director Chris Wray has been questioned about the FBI’s lack of preparedness. And his responses haven’t cleared much up. According to Wray, FBI guidelines forbid agents from camping out on social media and searching for evidence of potential criminal activity.

“We’re not allowed to … just sit and monitor social media and look at one person’s posts … just in case,” Wray told the House Judiciary Committee recently.

But that’s not strictly true. The agency’s guidelines do not strictly forbid this activity. The FBI can monitor social media platforms. It just usually doesn’t. Wray says guidelines prevent agents from “collecting First Amendment activities,” but there’s nothing in the rules that says the FBI can’t monitor open-source information like public posts.

This has been Wray’s line through several hearings this year. But the guidelines say something completely different.

[A]ssessments may be undertaken proactively with such objectives as detecting criminal activities; obtaining information on individuals, groups, or organizations of possible investigative interest, either because they may be involved in criminal or national security-threatening activities or because they may be targeted for attack or victimization by such activities; and identifying and assessing individuals who may have value as human sources. For example, assessment activities may involve proactively surfing the Internet to find publicly accessible websites and services through which recruitment by terrorist organizations and promotion of terrorist crimes is openly taking place…

So, perhaps the problem was the January 6th raid was carried out by the wrong kind of terrorists. The FBI is certainly proactive when it comes to monitoring the Muslim community “just in case.” When it comes to white insurrectionists, the agency apparently just hangs back and lets things take their course until it becomes imperative for the FBI to get involved.

Wray, at best, is only partly right.

In other words, Wray is correct that the bureau needs an authorized purpose to review social media, and that First Amendment considerations are involved. But his testimony leaves out the fact that the DIOG specifically authorizes FBI employees to review social media posts potentially protected by the First Amendment under certain circumstances—circumstances that could well have been met in the case of the soon-to-be Capitol rioters. After all, wouldn’t Facebook posts announcing plans to invade a government building raise criminal or national security concerns under the FBI’s definition of “authorized purpose”?

It’s not that we should be encouraging the FBI to engage in more proactive monitoring of social media — something that’s sure to raise some First Amendment issues. It’s that the FBI has never been shy about focusing this attention on certain kinds of people while appearing to ignore others who haven’t historically been considered a threat to national security by the agency.

Perhaps this take isn’t accurate and the FBI takes a similar hands-off approach when keeping an eye on other potential threats involving less-white people. But given the FBI’s long history of utilizing social media to radicalize local adherents of Islam into attempting to commit criminal acts, it hardly seems likely the FBI follows these guidelines (the ones that don’t say what the FBI Director says they do) consistently. It has experienced this sort of colorblindness in the past. And the conclusion one can easily draw — especially when the FBI hasn’t offered up a better explanation for why it missed the warning signs for the January 6th attack — is that the agency largely feels white people are nothing to worry about.

Filed Under: chris wray, fbi, insurrection, january 6th, public information, social media, social media monitoring

FBI Director Ignores More Than 500 Ongoing Capitol Raid Prosecutions To Complain That Encryption Is Keeping Criminals From Being Caught

(Mis)Uses of Technology

from the why-are-all-these-trees-blocking-my-view-of-the-forest? dept

FBI Director Chris Wray needs to shut the fuck up about encryption.

It has been 1,112 days since the FBI promised to perform a recount of encrypted devices in its possession, after overstating it by thousands for months in service of former director Jim Comey’s “going dark” haymaking.

As of November 2016, the number in the FBI’s possession was only around 880 devices. It suddenly jumped to 3,000 six months later. Then it doubled to 6,000 in less than five months. By the end of that fiscal year, four months later, the FBI had added another 1,775 uncrackable devices to its total.

That brought the alleged total to nearly 8,000 devices. The actual number — should the FBI ever get around to releasing it — is expected to be under 2,000.

Add to this the fact that the FBI doesn’t seem to be having much trouble hunting down criminals and terrorists. The FBI ran its own backdoored encrypted chat software for months, leading to dozens of arrests around the world. It ran seized child porn servers in order to deliver malware that coughed up identifying info about visitors to illicit dark web sites. Its crack team of undercover agents and informants have put a large number of terrorists behind bars, even though these successes are tainted by the agency’s willingness to radicalize people just so it can bust them. And it has obtained all sorts of evidence to use against more than 500 defendants in the January 6th Capitol raid cases.

Despite all of this, Chris Wray is still complaining about encryption’s supposed ability to render the FBI (and other law enforcement agencies) blind and useless. His recent testimony before the House Judiciary Committee takes time to highlight all the FBI’s successes. But it also allows Wray to show off the latest in dead horse-beating rhetorical devices.

The proliferation of end-to-end and user-only-access encryption is a serious issue that increasingly limits law enforcement’s ability, even after obtaining a lawful warrant or court order, to access critical evidence and information needed to disrupt threats, protect the public, and bring perpetrators to justice.

If this were true, the FBI wouldn’t have nearly as many success stories to entertain its Congressional oversight with. The FBI appears to be doing just fine, despite Wray’s protestations otherwise.

And he’s preaching to a choir that remains unconverted. The FBI has been complaining for the better part of a half-decade and it’s no closer to obtaining favorable legal precedent or encryption-breaking legislation than it was back then. The FBI’s directors have only one record. And it’s broken. Enjoy this supremely shitty tune you’ve all heard too many times before.

The FBI remains a strong advocate for the wide and consistent use of responsibly-managed encryption—encryption that providers can decrypt and provide to law enforcement when served with a legal order.

Ah, yes. “Responsibly-managed encryption.” Apparently allowing the government on-demand access through built-in flaws or storage of encryption keys where anyone — even criminals — can access them is more “responsible” than what’s being offered to the public now. The only acceptable encryption is broken encryption, according to the FBI. Backdoors, keys under the doormat, keys behind the counter at the front desk that can be obtained by request… all of these euphemisms fit the FBI’s encryption ideal, which is obviously far from ideal and anything but a net gain for public safety.

Chris Wray refuses to move past the “denial” stage of his self-inflicted grief.

What we mean when we talk about lawful access is putting providers who manage encrypted data in a position to decrypt it and provide it to us in response to the legal process. We are not asking for, and do not want, any “backdoor,” that is, for encryption to be weakened or compromised so that it can be defeated from the outside by law enforcement or anyone else.

It’s a backdoor. Providers holding keys presents an opening for others… you know, “law enforcement or anyone else.” It may present itself as a front door with a doorman willing to oblige visiting cops, but it’s still an entrance that isn’t there presently, when providers allow users to hold their own encryption keys. To meet Wray halfway, it’s a door. But it’s a door whose presence exists solely because law enforcement desires it and which will present an enticing target for enterprising cybercriminals and state-sponsored hackers.

As I was saying, Chris Wray can fuck right off.

Unfortunately, too much of the debate over lawful access has revolved around discussions of this “backdoor” straw man instead of what we really want and need.

Hey, it’s your straw man, dude. While other people present the facts — that encryption cannot be “safely” broken — Wray and his DOJ/FBI ilk continue to insist this common sense response is nothing more than a straw man offered up by people arguing in bad faith.

But it’s the FBI that’s been arguing in bad faith for years. It also insists encryption is zero sum: either law enforcement has access or the criminals win. This willfully ignores the FBI’s numerous options for obtaining communications and data that do not require forcing its way through the front of someone’s seized phone. And since the FBI won’t be honest about the extent of the problem it claims it faces — i.e., not updating the number of locked devices in its possession for more than THREE YEARS — no one should feel obliged to meet it halfway, much less engage in an “adult conversation” with a bunch of children who have misrepresented the facts for years.

Filed Under: backdoors, chris wray, encryption, fbi, going dark

FBI Director Uses January 6 Insurrection To, Once Again, Ask For Encryption Backdoors

Say That Again

from the FBI-really-needs-to-write-some-new-material dept

FBI Director Chris Wray needs to shut the fuck up about encryption.

Let me explain sum up:

For years, consecutive FBI Directors have claimed encryption is preventing law enforcement from doing law enforcement. And for years, public records, efforts by researchers, and court documents have shown encryption isn’t much of an impediment to investigations.

Most importantly — in the FBI’s case — the agency overstated the amount of locked devices in its possession for years while agitating for encryption backdoors. It turns out the FBI’s “locked device” spreadsheet performed some faulty math, greatly misstating the number of locked devices in its possession. While the FBI said it has over 8,000 impregnable electronics allegedly preventing law enforcement from investigating crimes, the correct amount is expected to be less than a quarter of that.

That discovery was made in May 2018. The FBI has yet to provide an accurate count of these devices.

So. Shut. The fuck. Up.

Wray is shameless and incapable of shutting the fuck up, even after the agency admitted to Congressional oversight it really didn’t know how many locked devices it had or how often encryption actually prevented investigators from investigating.

And yet, here’s Chris Wray, leveraging the January 6th insurrection to complain about encryption yet again.

There doesn’t appear to be any lack of open source data capable of aiding the FBI in its investigation of this event. Hundreds have already been charged for their participation in the raid on the US Capitol building.

This event has forced US law enforcement to admit domestic terrorism is an actual threat — a threat propelled mainly by white extremists and others aligned with the pathetic ideal that white makes right. This threat includes far too many law enforcement officers, who have also aligned themselves with the same ideals. That’s why it’s been ignored for so long and that’s why it’s a much bigger problem now than it should be.

But here’s what Chris Wray has chosen to focus on with his allotted testimonial time before the Senate: encryption. Wray says it’s a “lawful access” problem. And he begins with what can only be considered an overstatement of the threat, considering the FBI has done nothing but overstate the problem for years.

The problems caused by law enforcement agencies’ inability to access electronic evidence continue to grow. Increasingly, commercial device manufacturers have employed encryption in such a manner that only the device users can access the content of the devices. This is commonly referred to as “user-only-access” device encryption. Similarly, more and more communications service providers are designing their platforms and apps such that only the parties to the communication can access the content. This is generally known as “end-to-end” encryption. The proliferation of end-to-end and user-only-access encryption is a serious issue that increasingly limits law enforcement’s ability, even after obtaining a lawful warrant or court order, to access critical evidence and information needed to disrupt threats, protect the public, and bring perpetrators to justice.

Yes, encryption can prevent “easy” investigative efforts. But it doesn’t prevent investigations. Lots of data and communications can be obtained from service providers and cloud services that store copies of their own. There are at least a couple of vendors providing law enforcement with forensic tools that appear capable of pulling vast amounts of data from “locked” devices. And while it may be accurate to say the “problem” continues to “grow” given the increased deployment of encryption, the FBI has yet to honestly depict the problem it’s already facing, so there’s no way of quantifying this “growth” to judge its impact on investigations.

And Wray continues to be dishonest about what he wants. He wants encryption backdoors. But when asked directly, he’ll claim he doesn’t want backdoors. Instead, he wants a mythical form of encryption that is capable of protecting users from malicious threats but not government entities armed with a warrant.

The FBI remains a strong advocate for the wide and consistent use of responsibly managed encryption, encryption that providers can decrypt and provide to law enforcement when served with a legal order.

This sure sounds like a backdoor, but Chris Wray is in permanent denial.

We are not asking for, and do not want, any “backdoor,” that is, for encryption to be weakened or compromised so that it can be defeated from the outside by law enforcement or anyone else.

It’s the everyone else who is wrong.

Unfortunately, too much of the debate over lawful access has revolved around discussions of this “backdoor” straw man instead of what we really want and need.

LOL. Get fucked, Chris. The reason no serious security professional agrees this is possible is because it isn’t. A hole for law enforcement is a hole for anyone. Once providers start storing encryption keys for law enforcement, those encryption keys are a target for malicious hackers. Criminals who find the keys will do the same thing Wray is asking companies to do, bypassing encryption to obtain communications and personal data.

The only person trotting out straw men is the FBI Director, who appears to believe any counterargument is made in bad faith. His straw men may be uncaptured terrorists or dead kids or whatever, but they’re still straw men, especially considering the FBI still has yet to provide an accurate count of encrypted devices in its possession.

And those are his straw men. Wray cites both terrorist attacks and child sexual exploitation as reasons to eliminate actually secure encryption. This ignores the FBI’s willingness to radicalize people solely for the purpose of arresting them on terrorist charges. And it ignores the fact the FBI has — on more than one occasion — seized and operated servers distributing child porn in order to catch other child porn distributors. Whether or not we agree with the FBI’s actions in these cases, it illustrates breaking encryption isn’t the only way to address these problems.

Wray also claims the rest of the law enforcement community is suffering from the proliferation of end-to-end encryption.

Our state and local law enforcement partners have been consistently advising the FBI that they, too, are experiencing similar end-to-end and user-only-access encryption challenges, which are now being felt across the full range of state and local crime. Many report that even relatively unsophisticated criminal groups, like street gangs, are frequently using user-only-access encrypted smartphones and end-to-end encrypted communications apps to shield their activities from detection or disruption.

But this really hasn’t been observed by anyone else but Wray. (And we know Wray can’t be trusted.) The FBI has made constant noise about encryption. Local agencies — despite having far fewer resources — haven’t said much publicly about encryption or its challenges, outside of the outsized racket whipped up by Manhattan DA Cy Vance. And Vance is no more trustworthy or credible than Chris Wray.

Chris Wray will take any chance given to complain about encryption and a lack of “lawful access.” But he doesn’t have facts or history on his side.

Filed Under: backdoors, chris wray, encryption, fbi, going dark, january 6

Why Is The US Trying To Punish Hackers For Accessing Vaccine Research We Should Be Sharing With The World?

Failures

from the what-a-stupdendous-waste-of-time dept

Back in May, I wondered why the US was trying to hide vaccine data from the Chinese. In fact, it was bizarre that the US government seemed concerned about Chinese hackers trying to access vaccine data, because why would anyone keep such data secret in the first place. This is a global pandemic and the way you solve a global pandemic is with a global solution, and the way to get there faster (and better) is with the open sharing of information. Hoarding and locking up information regarding a potential vaccine makes no sense at all. And yet, this morning, the DOJ made a big showing of how it had indicted Chinese hackers for trying to hack COVID-19 related research.

The Justice Department on Tuesday accused two Chinese hackers of stealing hundreds of millions of dollars of trade secrets from companies across the world and more recently targeting firms developing a vaccine for the coronavirus.

This is totally performative, as those hackers are in China and the US can’t do a damn thing about them, other than allow for Attorney General Bill Barr and FBI Director Chris Wray to grandstand and pretend they’re doing something useful. And, again, the really shameful part is the fact that this research is “secret” in the first place.

And, of course, last week we had a repeat of the story from May, except that this time it wasn’t “Chinese hackers” trying to get vaccine data, but theoretical Russian hackers:

Russian cyber actors are targeting organizations involved in coronavirus vaccine development, according to a new warning by US, UK and Canadian security officials on Thursday that details activity by a Russian hacking group called APT29, which also goes by the name “the Dukes” or “Cozy Bear.”

An advisory published by the UK National Cyber Security Centre (NCSC) details activity by the Russian hacking group and explicitly calls out efforts to target US, UK and Canadian vaccine research and development organizations.

“APT29’s campaign of malicious activity is ongoing, predominantly against government, diplomatic, think tank, healthcare and energy targets to steal valuable intellectual property,” a press release on the advisory said.

I’m sure within a month or two we’ll have another performative press conference from Barr and Wray announcing pointless show charges against Russian hackers as well, because why not?

And, again, rather than recognize that saving and protecting global health is the key priority here, the US government is responding by worrying that others might save the world first. House Minority Leader Rep. Kevin McCarthy is even introducing a bill to “sanction foreign hackers” for trying to get US COVID-19 vaccine information in his somewhat pointless Defend COVID Research from Hackers Act”.

The bill is pointless on multiple levels. Foreign hackers are not subject to US jurisdiction, so this wouldn’t do anything in the first place. Second, given the indictments announced today, it’s not as if law enforcement actually needs greater authority. They seem to have the authority they need to go after hackers. But, (to repeat myself) more importantly, we should be sharing this research widely and getting everyone else to pool their research efforts as well in order to move everyone forward as quickly as possible in order to save as many lives as possible. This isn’t a zero sum game where one country “wins” and another “loses.” This is about stopping a devastating global pandemic.

As even CNN is admitting, there are no good health reasons for keeping this info secret or worrying about hacks, it’s literally a completely wasteful attempt to want to claim bragging rights.

Given the inevitable confusion ahead, getting to the head of the line just does not make sense as an explanation, at least from a financial windfall perspective or a saving lives perspective. But the need to dominate voiced both by Trump and the leader of Russian vaccine efforts, Dmitriev, makes the likely reason for any sneak attack all too clear. It’s less about saving the world with a vaccine than about beating the other guy and taking home the first place medal.

What a stupid, stupid reason. Leadership is about doing the right thing even if it makes you look bad. The right thing here is figuring out how to save as many lives as possible and to end the pandemic as quickly as possible. McCarthy’s bill would do the opposite of that, and is a total waste of time. I get that it’s still driven by the silly belief that everything related to drug discovery must be “owned” and “patented,” but actual lives are on the line right now, and Rep. McCarthy should be ashamed that he’s wasting time and holding back research, instead of encouraging more open sharing of information.

Filed Under: china, chris wray, covid-19, hacking, information sharing, innovation, kevin mccarthy, patents, russia, sharing, vaccines, william barr