Irreal

Regarding the San Bernardino iPhone 5C, Daniel Kahn Gillmor over at the ACLU blog writes about something I’ve pondered myself: why doesn’t the FBI simply attack the hardware itself? Specifically, why not back up the phone’s NAND memory, which contains the encryption key, so that they can simply restore the key even if it gets erased by making 10 incorrect guesses.

As Gillmor says, desoldering the NAND chip and making a copy of its contents is a routine operation requiring very a modest set of equipment. There are, in fact, commercial enterprises that provide this service. There is, then, no real reason to force Apple to unlock the phone. No reason, that is, to accomplish what the FBI is claiming they want. But the FBI is being less than honest. What’s really at stake here is setting a precedent that the government can force Apple and other tech companies to sign arbitrary updates. This would have disastrous results in our already fragile security ecosystem because people would become suspicious of updates and refuse to install them. That, in turn, means that devices would continue running software with known vulnerabilities.

When Judge Orenstein asked the FBI—in the New York case—whether there was any way they could get the data themselves the FBI equivocated and basically refused to answer the question. Judge Orenstein called them out for that in his opinion but given that applications for a warrant are made under oath, why isn’t someone facing perjury charges?

A related question is why should we believe anything the FBI says on this or any other matter. By pushing so hard on this and lying at every stage of the proceedings—we’re only interested in this one phone; we have no other way of getting the data; and so on—the FBI, and by extension the DOJ and even the government itself, is squandering what little trust the public has left in them.

UPDATE: know → known

The House Judiciary Committee recently held hearings on encryption and what should be our policy concerning disputes such as those between Apple and the FBI. If the committee reaches the wrong decisions it won’t be because they didn’t have expert and thoughtful testimony.

Susan Landau, a Professor of Cybersecurity Policy at Worcester Polytechnic Institute, testified March 1, 2016 on security threats, encryption, and securing smartphones. She explained to the committee in careful detail that the issues are not as simple as they seem and that our security is (much) better served by having unbreakable security on our devices—especially on our smartphones. ‘Especially’ because our smart phones are already our access to personal, financial, and proprietary commercial information both through data held on the phones themselves and through access credentials held on the phones. Landau says this situation is accelerating and that it is crucial that these devices be secure if we as a nation are going to defend against the increasing cyber attacks from criminals and unfriendly nation states.

Sadly, this debate has been mischaracterized by a lazy and ignorant press as a fight between security and privacy. The goal, they say, is to balance privacy and security. Landau makes the point that the choice is not between privacy and security, although that tension is also present, but between security and less security. That’s a point that’s been mostly missed by those commenting on the issue.

Landau says that the FBI is stuck with a 20^th century view of investigative techniques and that they need to let go of their agent-centric view and adopt one that realizes that most crimes today have a cyber component. She says that it is possible to do effective investigations even with unbreakable smartphones but the FBI needs to upgrade their technical capabilities. They are, she says, where the NSA was in 1999. As the NSA has shown, it is still possible to perform effective surveillance even in the face of encryption.

The testimony is a bit long but it’s an interesting and informed read. It’s a great place to point someone who is undecided about the debate but still has an open mind.

No, but don’t let that stop you from asking.

FBI v. Encryption hearings tl;dr

The ignoranti: Can we have our cake and eat it too?

(No.)

— Kontra (@counternotions) March 1, 2016

This is why my “Note to journalists” in today’s earlier post was necessary:

State of tech coverage: published AFTER the FBI Director corrects his earlier lie about not seeking a precedent: pic.twitter.com/mVkXT4P3eL

— Kontra (@counternotions) March 2, 2016