Cloud Hosting

This morning the Senate Judiciary Committee held ahearing on encryption and lawful access. Thats the fanciful idea that encryption providers can somehow allow law enforcement access to users encrypted data while otherwise preventing the bad guys from accessing this very same data.

But the hearing was not inspired by some new engineering breakthrough that might make it possible for Apple or Facebook to build a secure law enforcement backdoor into their encrypted devices and messaging applications. Instead, it followedspeeches, open letters, and other public pressure by law enforcement officials in the U.S. and elsewhere to prevent Facebook from encrypting its messaging applications, and more generally to portray encryption as a tool used in serious crimes, including child exploitation. Facebook has signaled it wont bow to that pressure. And more than 100 organizations including EFFhave called on these law enforcement officials to reverse course and avoid gutting one of the most powerful privacy and security tools available to users in an increasingly insecure world.

Many of the committee members seemed to arrive at the hearing convinced that they could legislate secure backdoors. Among others, Senators Graham and Feinstein told representatives from Apple and Facebook that they had a responsibility to find a solution to enable government access to encrypted data. Senator Grahamcommented, My advice to you is to get on with it, because this time next year, if we haven't found a way that you can live with, we will impose our will on you.

But when it came to questioning witnesses, the senators had trouble establishing the need for or the feasibility of blanket law enforcement access to encrypted data. As all of the witnesses pointed out,even a basic discussion of encryption requires differentiating between encrypting data on a smartphone, also called encryption at rest, and end-to-end encryption of private chats, for example.

As a result, the committees questioning actually revealed several points that undercut the apocalyptic vision painted by law enforcement officials in recent months. Here are some of our takeaways:

The first witness was Manhattan District Attorney Cyrus Vance, Jr., who has called for Apple and Google to roll back encryption in their mobile operating systems. Yet by his own statistics, the DAs office is able to access the contents of a majority of devices it encounters in its investigations each year. Even for those phones that are locked and encrypted, Vance reported that half could be accessed using in-house forensic tools or services from outside vendors. Although he stressed both the high cost and the uncertainty of these tools, the fact remains that device encryption is far from an insurmountable barrier to law enforcement.

As we saw when the FBIdramatically lowered its own estimate of unhackable phones in 2017, the level of security of these devices is not static. Even as Apple and Google patch vulnerabilities that might allow access, vendors like Cellebrite and Grayshift discover new means of bypassing security features in mobile operating systems. Of course, no investigative technique will be completely effective, which is why law enforcement has always worked every angle it can. The cost of forensic tools may be a concern, but they are clearly part of a variety of tools law enforcement use to successfully pursue investigations in a world with widespread encryption.

Meanwhile, even as Vance focused on the cost of forensic tools to access encrypted phones, he repeatedly ignored why companies like Apple began fully encrypting their devices in their first place. In a colloquy with Senator Mike Lee, Apples manager of user privacy Erik Neuenschwander explained that the companys introduction of full disk encryption in iOS in 2014 was aresponse to threats from hackers and criminals who could otherwise access a wealth of sensitive, unencrypted data on users phones. On this point, Neuenschwander explained that Vance was simply misinformed: Apple has never held a key capable of decrypting encrypted data on users phones.

Neuenschwander explained that he could think of only two approaches to accomplishing Vances call for lawful access, both of which would dramatically increase the risks to consumers. Either Apple could simply roll back encryption on its devices, leaving users exposed to increasingly sophisticated threats from bad actors, or it could attempt to engineer a system where it did hold a master key to every iPhone in the world. Regarding the second approach, Neuenschwander said as a technologist, I am extremely fearful of the security properties of such a system. His fear is well-founded;years of research by technologists and cryptographers confirm that key escrow and related systems are highly insecure at the scale and complexity of Apples mobile ecosystem.

Finally, despite the heated rhetoric directed by Attorney General Barr and others at end-to-end encryption in messaging applications, the committee found little consensus. Both Vance and Professor Matt Tait suggested that they did not believe that Congress should mandate backdoors in end-to-end encrypted messaging platforms. Meanwhile, Senators Coons, Cornyn, and others expressed concerns that doing so would simply push bad actors to applications hosted outside of the United States, and also aid authoritarian states who want to spy on Facebook users within their own borders. Facebooks director for messaging privacy Jay Sullivan discussed ways that the company will root out abuse on its platforms while removing its own ability to read users messages. As weve written before,an encrypted Facebook Messenger is a good thing, but the proof will be in the pudding.

Ultimately, while the Senate Judiciary Committee hearing offered worrying posturing on the necessity of backdoors, were hopeful that Congress will recognize what a dangerous idea legislation would be in this area.

Read more:
The Senate Judiciary Committee Wants Everyone to Know It's Concerned About Encryption - EFF

On Tuesday, Congress warned technology companies that lawmakers will take action to regulate encryption if they dont cooperate more openly with law enforcement. The announcement has reinvigorated an ongoing debate between big tech and the U.S. government.

Government officials argue that encryption will hinder criminal investigations. Tighter security is preventing access to critical information exchanged via devices and messaging apps. Big tech, on the other hand, believes encryption is essential for protecting individuals from bad actors and authoritarian governments.

It appears there is no simple solution as both sides believe they are acting in the best possible manner for the American people. As internet use and global communication increases, its likely the topic isnt going to die down any time soon.

Advertisement

Regulated encryption has been a hot topic for several years. In 2016, the FBI ordered Apple to unlock the iPhone of one primary suspect in a San Bernardino, California shooting. Apple refused to help, even after receiving an order from a federal judge. Tim Cook was alarmed by the request, citing that doing so would leave millions of devices vulnerable.

The battle between Apple and the FBI kicked off a controversial discussion around data privacy and how much the government should be able to access. In a recent meeting, Apples Manager of User Privacy, Erik Neuenschwander, explained why weakening encryption across the board is not the answer.

At this time, weve been unable to identify any way to create a backdoor that would work only for the good guys, said Neuenschwander. When we have weaknesses in our system, theyre exploited by nefarious entities as well.

The encryption topic retook center stage this fall when the Justice Department asked Facebook to delay its plans to encrypt its messaging services. Legislators are concerned that encryption would prevent law enforcement from identifying and prosecuting child predators.

Last year, Facebook reported nearly 17 million cases to the U.S. National Center for Missing and Exploited Children. Congress is concerned Facebook wouldnt be able to provide adequate evidence for cases going forward if the social media giant moves forward with encryption.

Like Apple in 2016, Facebook is holding steady against the government in this area. The company sent a letter to Attorney General William Barr refusing to weaken encryption for WhatsApp. Facebook leadership also believes that regulating encryption would not work over the long term. Criminals will simply switch over to unregulated, international platforms to get what they want.

U.S. Lawmakers seem to be sticking to their guns. Many believe there is no better way to protect Americans than to regulate how tech companies encrypt devices and user data. Also, other countries overseas have already paved the way on regulated encryption.

There are many serious cases where we cant access the device in the time period where it is most important for us to access it, said Manhattan District Attorney Cy Vance Jr. Without moving toward legislation, were not going to solve this problem.

Some lawmakers are hopeful that big tech will respond amicably in 2020. Otherwise, by this time next year, there may be a legal movement and much bigger fight ahead. Stay tuned.

See original here:
Congress wants to regulate encryption for big tech - The Burn-In

There is a thin line between hypocrisy and stupidity, as the US Congress ably demonstrated this week when it locked horns with Facebook and Apple over encryption.

A group of lawmakers on the Senate Judiciary Committee Hearing on Encryption argued passionately that end-to-end encryption used by messaging services like WhatsApp and iMessage is brilliant if you're a goodie, but it also helps baddies. Ergo, law enforcement must be given some kind of backdoor access so they can get a warrant and gather evidence.

The Committee is chaired by Lindsey Graham, Republican Senator for South Carolina. The same Lindsey Graham who has spent a fair amount of time this year warning everyone that the Chinese government could easily force Huawei to provide backdoor access to its networks.

"I'm not about to create a safe haven for criminals where they can plan their misdeeds and have information stored in a fashion [so] that law enforcement can never be allowed to access it. That is a bridge too far for me," he said during this week's hearing, adding that the authorities equipped with the appropriate warrant must be able to access encrypted messages. "How we do this, I don't know. I hope the tech community working with law enforcement can find a way to do it."

Doing his best scary headmaster impression, he warned: "If y'all don't; we will."

Watch the video here. He really did say "y'all."

Graham would probably argue there's a difference between using backdoor access to prevent crime and using it for espionage. But it's two sides of the same coin, and Graham's track record suggests he's not that bothered about spying on innocent civilians in the name of national security. He has previously branded NSA whistleblower Edward Snowden a traitor, and called on Russia to return him to the US so he could face prosecution. Last month he called for the identity of the whistleblower that kick-started the impeachment inquiry into Trump to be made public.

On this evidence, if you were to ask Facebook and Apple why they rolled out end-to-end encryption in the first place, they could just point at people like Lindsey Graham.

Instead though, they highlighted that any backdoor access into their messaging services intended to help law enforcement could also help criminals.

"We do not know of a way to deploy encryption that provides access only for the good guys without making it easier for the bad guys to break in," testified Erik Neuenschwander, director of user privacy at Apple.

"Every day, over a trillion transactions from financial transactions to the exchange of healthcare records occur safely over the Internet because of encrypted communications. Utilising 5G networks, connected devices will play an even larger role in the operation and maintenance of our critical infrastructure, running our electric grids, transportation networks, and healthcare and financial systems," he continued. "Encryption is needed to protect from malicious actors whose attacks are growing exponentially in scope, frequency, and sophistication."

Jay Sullivan, Facebook's product management director for privacy and integrity in Facebook Messenger, went a little further, putting on record that encryption also protects dissidents from authoritarian regimes. He also warned that if US-based platforms like WhatsApp and iMessage can't guarantee their services are secure, then users will flock to one that is.

"If the United States rolls back its support for privacy and encryption, foreign application providers including those who may be outside the reach of our legal system and not nearly as committed to or capable of preventing, detecting, and responding to bad behaviour will fill the vacuum and provide the private and secure communications that people expect and demand," he said.

See original here:
Encryption spat sees backdoor back-and-forth between tech firms, Congress - TelecomTV