Cloud Hosting

A high-ranking Department of Justice official took aim at encryption of consumer products today, saying that encryption creates "law-free zones" and should be scaled back by Apple and other tech companies. Instead of encryption that can't be broken, tech companies should implement "responsible encryption" that allows law enforcement to access data, he said.

"Warrant-proof encryption defeats the constitutional balance by elevating privacy above public safety," Deputy Attorney General Rod Rosenstein said in a speech at the US Naval Academy today (transcript). "Encrypted communications that cannot be intercepted and locked devices that cannot be opened are law-free zones that permit criminals and terrorists to operate without detection by police and without accountability by judges and juries."

Rosenstein was nominated by President Donald Trump to be the DOJ's second-highest-ranking official, after Attorney General Jeff Sessions. He was confirmed by the Senate in April.

Rosenstein's speech makes several references to Apple, continuing a battle over encryption between Apple and the US government that goes back to the Obama administration. Last year, Apple refused to help the government unlock and decrypt the San Bernardino gunman's iPhone, but the FBI ended up paying hackers fora vulnerabilitythat it used to access data on the device.

"Fortunately, the government was able to access data on that iPhone without Apple's assistance," Rosenstein said. "But the problem persists. Today, thousands of seized devices sit in storage, impervious to search warrants."

"If companies are permitted to create law-free zones for their customers, citizens should understand the consequences," he also said. "When police cannot access evidence, crime cannot be solved. Criminals cannot be stopped and punished."

We asked Apple for a response to Rosenstein's speech and will update this story if we get one.

Separately, state lawmakers in New York and California have proposed legislationto prohibit the sale of smartphones with unbreakable encryption.

Despite his goal of giving law enforcement access to encrypted data on consumer products, Rosenstein acknowledged the importance of encryption to the security of computer users. He said that "encryption is a foundational element of data security and authentication," that "it is essential to the growth and flourishing of the digital economy," and that "we in law enforcement have no desire to undermine it."

But Rosenstein complained that "mass-market products and services incorporating warrant-proof encryption are now the norm," that instant-messaging service encryption cannot be broken by police, and that smartphone makers have "engineer[ed] away" the ability to give police access to data.

Apple CEO Tim Cook has argued in the past that the intentional inclusion of vulnerabilities in consumer products wouldn't just help law enforcement solve crimesit would also help criminals hack everyday people who rely on encryption to ensure their digital safety.

Rosenstein claimed that this problem can be solved with "responsible encryption." He said:

Responsible encryption is achievable. Responsible encryption can involve effective, secure encryption that allows access only with judicial authorization. Such encryption already exists. Examples include the central management of security keys and operating system updates; the scanning of content, like your e-mails, for advertising purposes; the simulcast of messages to multiple destinations at once; and key recovery when a user forgets the password to decrypt a laptop.

No one calls any of those functions a "back door." In fact, those capabilities are marketed and sought out by many users.

It's not clear exactly how Rosenstein would implement his desired responsible encryption.

Rosenstein's"key recovery when a user forgets the password to decrypt a laptop" reference seems to refer to Apple and Microsoft providing the ability to store recovery keys in the cloud. But users who encrypt Mac or Windows laptops aren't required to do thisthey can store the keys locally only if they prefer. To guarantee law enforcement access in this scenario, people who encrypt laptops would have to be forced to store their keys in the cloud. Alternatively, Apple and Microsoft would have to change the way their disk encryption systems work, overriding the consumer's preference to have an encrypted system that cannot be accessed by anyone else.

Rosenstein gave some further insight into how "responsible encryption" might work in this section of his speech:

We know from experience that the largest companies have the resources to do what is necessary to promote cybersecurity while protecting public safety. A major hardware provider, for example, reportedly maintains private keys that it can use to sign software updates for each of its devices. That would present a huge potential security problem, if those keys were to leak. But they do not leak, because the company knows how to protect what is important. Companies can protect their ability to respond to lawful court orders with equal diligence.

Of course, there are many examples of companies leaking sensitive data due to errors or serious vulnerabilities. The knowledge that errors will happen at some point explains why technology companies take so many precautions to protect customer data. Maintaining a special system that lets third parties access data that would otherwise only be accessible by its owner increases the risk that sensitive data will get into the wrong hands.

Rosenstein claimed that "responsible encryption can protect privacy and promote security without forfeiting access for legitimate law enforcement needs supported by judicial approval." But he doubts that tech companies will do so unless forced to:

Technology companies almost certainly will not develop responsible encryption if left to their own devices. Competition will fuel a mindset that leads them to produce products that are more and more impregnable. That will give criminals and terrorists more opportunities to cause harm with impunity.

"Allow me to conclude with this thought," Rosenstein said just before wrapping up his speech. "There is no constitutional right to sell warrant-proof encryption. If our society chooses to let businesses sell technologies that shield evidence even from court orders, it should be a fully-informed decision."

Go here to see the original:
Trumps DOJ tries to rebrand weakened encryption as responsible ...