The FBI Is Breaking into Encrypted Devices – We’re Suing

https://www.aclu.org/news/privacy-technology/the-fbi-is-secretly-breaking-into-encrypted-devices-were-suing

by clutchdude • 6 years ago

254 62 6 years ago

Well, to be clear about the story, it's that they're suing to find out what the FBI is doing, and what methods/equipment they use.

They're not suing to stop it. (edit: yet)

7e• 6 years ago

If they’re not suing to stop it, that means it’s likely legal.

Taniwha• 6 years ago

well they don't know if it's legal because the FBI wont tell them what they're doing - that's the whole point here.

Citizen oversight of government is an important thing in a real democracy, the FOIA is an important part of that. Remember the FBI must not only act legally but also be seen to be acting legally in order to be trusted by the citizens.

bawolff4• 6 years ago

IANAL, but naively it seems to me like the method doesn't matter so much in terms of legality, as how they use it.

E.g. the fbi knowing how to break into someone's house is fine. Actually breaking into someone's house, less fine without a warrant.

Clubber2• 6 years ago

If they’re not suing to stop it, that means it’s likely legal.

Pre-9/11, I would totally agree with you. The last 20 years, all that is necessary is the law enforcement agency needs a lawyer that has a somewhat convincing argument or technicality that they could argue is legal. Think "enhanced interrogation techniques," which has been argued is not torture, which would be illegal.

https://en.wikipedia.org/wiki/Enhanced_interrogation_techniq...

It helps if there is a technique that keeps it out of courts altogether, like civil forfeiture which charges the property with a crime and not the person. To get back property, the owner must prove their innocence rather than the state proving their guilt.

https://en.wikipedia.org/wiki/Civil_forfeiture_in_the_United...

tbrownaw3• 6 years ago

I'd think that getting them to confirm what methods they're using would shorted the shelf-life of those methods a fair bit. Which I suppose fits with them pushing back as hard as they can.

DubiousPusher3• 6 years ago

The later is contingent upon the former. You have to know how they might be breaking into your phone to assertain the evidence that they are so you can sue for relief.

i.e. you must be able to show harm to sue for relief.

7174n6• 6 years ago

If law enforcement has a valid search warrant to access the data stored on a device then the "how" is irrelevant. It doesn't matter how they bypass the encryption, self created forensic tools or vodoo encantation, the action is legal. The lawsuit will go nowhere and they know it. It is a fundraising ploy.

What the ACLU should be demanding is "show us the warrants".

bawolff4• 6 years ago

According to the article, they are suing related to FOIA record requests. Whether or not the fbi is doing something illegal with encryption sounds pretty unrelated to whether their response to the foia request was legal.

Ianal

mminer237• 6 years ago

I don't see how that has any legal merit. There's a FOIA exemption for "Information compiled for law enforcement purposes that . . . Would disclose techniques and procedures for law enforcement investigations or prosecutions, or would disclose guidelines for law enforcement investigations or prosecutions if such disclosure could reasonably be expected to risk circumvention of the law".

mijoharas• 6 years ago

What the ACLU should be demanding is "show us the warrants".

Before the ACLU can ask that, they need to see that the FBI are breaking encryption. This is shown in some court documents (where there are warrants).

So the ACLU asked the FBI, hey, are you breaking into phones, as these court documents say? (probably so they can ask the follow up, "show us the warrants").

The FBI then responded. I'm not saying a damn thing! not gonna even confirm whether we've broken into anything. NOPE.

At which point, how can the ACLU ask to see warrants. The fbi need to say that they are breaking into phones (as court documents state) which they won't even do, so the ACLU are suing to say "hey that's not fair, you definitely are doing that, don't deny it."

glenstein• 6 years ago

Could someone ELI5 how this is even conceptually possible? I suppose that is exactly what the ACLU was trying to find out, but I thought something like AES-256 should be impossible in principle to break.

So what type of thing is most likely happening? Are hardware vendors secretly installing back doors? is there some sort of software encryption standard that's compromised? Or some kind of secret breakthrough in computation theory that easily "solves" encryption? Or maybe, bolstered by NSA surveillance, they just know passwords and unlock codes to devices?

Again, I understand that that is the exact mystery here, but I would appreciate knowing if one or more of the possibilities is conceptually more likely than the others.

wmf• 6 years ago

Most PINs or passwords are so short that they would be easy to brute-force but phones have anti-brute-force mechanisms. So maybe there's a tool that does that.

bawolff4• 6 years ago

Usually the weakest link in any crypto system is the code surounding it. AES-256 is very solid, but using it correctly can be hard. Apple knows what they are doing but they are still human.

For example if this is a lock screen bypass (and not a bypass of say the start up process before the key is entered), maybe some memory corruption issue allows you to bypass the password check. Or another example, many people use short numeric pins to encrypt their phones. Apple then does a lot of complex stuff to take that and turn it into a high entropy key. Maybe this is an exploit in that part, allowing for a bruteforce attack.

These are all just wild gueses, i have no idea what these capabilities are or for that matter, i dont really know very much about how iphone FDE works.

aborsy4• 6 years ago

You can’t turn a low entropy key to a high entropy one by deterministic operations. It’s theoretically impossible.

_kbh_2• 6 years ago

They are likely using GreyShift or Cellbrites UFED or similar products. Most of them leverage exploits in the phone that are usable on the lock screen to either enable you to bypass the lock screen or to allow you to have unlimited password guesses then brute force the password.

Thats my guess at least.

_kbh_2• 6 years ago

Im pretty sure its this now.

https://twitter.com/matthew_d_green/status/13417461712205373...

aborsy4• 6 years ago

The algorithms are secure.

* The hdd in a phone that is not powered off is mounted. It takes an exploit in OS to pass the Lock Screen or read the RAM.

* The vast majority of people don’t have long alphanumerical passwords. The short pins can be broken.

* Some manufacturing companies don’t handle encryption keys properly. Synology NAS stores the keys next to the encrypted data for automatic access upon boot (unless you change the default and store the keys on an encrypted USB or enter keys manually upon boot).

* There are sometimes bugs in algorithm implementations, especially if a company roles its own crypto with closed source software.

* Sometimes encryption keys are not properly generated. Bad RNGs were a thing for a long time.

* And of course there could be back doors for law enforcement.

chirus3• 6 years ago

The RNG is the backdoor always. And as said above, how you criple the entropy.

BrandoElFollito• 6 years ago

Except for obvious pins, they cannot be brute forced due to the throttling built-into the hw vault.

jmnicolas3• 6 years ago

people don’t have long alphanumerical passwords

Do you know how long is enough? Of course 64 chars would be dope but I'm not good at memorizing things. I know it's trainable but I'm lazy too :)

My current password is a bit longer than 10 chars and I wonder if I should upgrade it.

K0balt• 6 years ago

It is known in some cases and highly probable in others that randomness is compromised systemically in many products and therefore services.

lazulicurio• 6 years ago

According to this[1] Twitter thread, it's a matter of convenience outweighing security. Phones keep the encryption keys used for most apps in memory so the apps can do background work while the phone is locked.

[1] https://twitter.com/matthew_d_green/status/13417461712205373...

kirbysnacks• 6 years ago

So, to be clear, they're suing the FBI with a request to teach them how to be .. umm .. l33t?

This is silly.

fakename11• 6 years ago

What is next, suing for military secrets?

ranguna• 6 years ago

Humm.. If they endanger citizens, yes.

chirus3• 6 years ago

Yes, but this leads to corporate "contractors" and the secrets become intellectual property/trade secrets and there is nothing under the sun to FOIA those, even if that corporation has more 11 star generals than call of duty

hkai• 6 years ago

In the last 10-15 years ACLU has moved away from being politically neutral (and has publicly stated so), so one might easily see this action as an attempt to undermine the government's capabilities rather than to legitimately protect the freedoms of Americans.

rjbwork• 6 years ago

Being pro civil liberties can't be politically neutral when there are those attempting to take them away via political means.

paul_f3• 6 years ago

The ACLU was always a staunch defender of free-speech rights, but that is no longer the case. They now only defend the free speech rights of people on the left side of the political spectrum. For example, they will not defend religious speech, the accused in title IX cases, pro-life groups, etc.

throwaway1892622• 6 years ago

Consumer privacy has been politicized as it entered the public consciousness. Parties have taken sides.

I don't see another choice for them. The populist authoritarian streak taking hold in many country's right wing parties goes against much of what the ACLU stands for.

tbrownaw3• 6 years ago

"I may not agree with what you say, but I will defend to the death your right to say it."

Part of the reason their name has weight, is their history of defending anyone including in at least one case actual neo-nazis.

tbrownaw3• 6 years ago

The timing seems odd for that, given that their preferred side seems rather likely to be largely in control for the next couple years.

bawolff4• 6 years ago

Believing that americans should have freedom is not a politically neutral position.

Y'all literally fought a war over that very question back in the 1700s.

Hell, is there any question less political than to what extent individual freedoms should be trumped by the state and the collective "good"? That, in its various forms, is the fundamental political question from which all other political questions follow.

paul_f3• 6 years ago

The ACLU has lost a great deal of moral clarity once they began taking on political positions. They no longer have the clout they once had, in the eyes of many.

suifbwish• 6 years ago

Limiting the governments capabilities is the very essence of what it means to protect freedom of private citizens. Throughout history there is no case of continual government expansion which leads to more freedom of its citizens.

DubiousPusher3• 6 years ago

Feels like this will get kicked on some standing shit. As with Clapper v. Amnesty International.

How I expect this will go.

ACLU: I want to sue because the government is surveiling my clients.

Supreme Court: How do you know they are doing this?

ACLU: We know they are doing it but not specifically how they do it to our clients that's what we're suing to find out.

Supreme Court: But without a specific complaint you don't have standing.

ACLU: The methods are secret so we don't have specifics.

Supreme Court: Come back when you do.

ACLU: But we can't find out without knowing more about how they are doing it which is what we are suing for.

Supreme Court: Yeah but you don't have standing.

ACLU: So 4th amendment rights are at stake but there is no constitutional remedy because of bureaucracy?

Supreme Court: shrugs

roenxi• 6 years ago

Fundamentally, if the Supreme Court took that position I can see how it makes sense. It is unreasonable to sue someone to go on a fishing expedition to see what they might have done wrong.

Realistically, the constitution lost most of its staying power a long time ago. The judiciary can't actually stop the rest of the government if it is united on launching a mass surveillance program - and the evidence suggests there is bipartisan support for it both between parties and between the executive and legislative branches.

eganist• 6 years ago

Pretty much.

If the ACLU wants any measure of success, encouraging whistleblowers might be the way to go.

DubiousPusher3• 6 years ago

I totally disagree. The Supreme Court has it within their power to determine that Amnesty or the ACLU is likely enough representing an effected party and therefore grant them standing.

There is some popular idea that everything the court does is abstract or must be categorical and that's simply not true. They make decisions all the time in which they draw a line through a gray area. They have been using the standing to avoid ruling on these 4th amendment issues because the issues are thorny and frankly because they believe, as they have made it clear in many other cases, that they believe in the national security state apparatus but aren't quite sure how to justify it.

Edit: There are other possibilities too. If the court isn't comfortable imposing a remedy for 4th amendment violations they can mandate the legislature to do so and fine the administration until the legislature acts. This often happens in state governments.

bassrattle• 6 years ago

What about Wikileaks' "vault 7"?

chirus3• 6 years ago

Fallacy of encryption: the algorithms are secure, it is the random numbers that are backdoored, but you cannot ever prove that. --> How? The random numbers that servers use are chosen from a list if you will as opposed to true zener diode type shit. You cannot prove this, but this is how I would do it if asked, and I am pretty sure RSA does this if not mistaken.

unnouinceput2• 6 years ago

This will achieve nothing. Only another whistleblower like Snowden will achieve anything. Though I think we get a Snowden only once per generation :)

LinuxBender2• 6 years ago

In my opinion, if they want a few shortcuts and hints they need to first talk to the wireless switch engineers and ask them if they've directly received any gag orders from the feds, or indirectly threats from their management. Back in the 90's, we used to update the firmware over the air. We could rewrite anything anywhere on the phone. Officially we did not do this, not because of any secrets or conspiracy... The fear was that if customers found out we could do this, it would be a support nightmare and not cost sustainable. We made the business decision to not update the phones over the air to avoid the risk of bricking any of them. This was only done for really bad firmware bugs and only to specific phones. As a result the phones would become out of date and people would eventually buy new ones. The reason I mention this is that if you can rewrite the firmware and reboot the phone, then you can intercept anything related to encryption, keys, passwords, etc... I have no idea what capabilities are in place now, but I would be very surprised if they regressed from what we could do in the 90's.

gbasin• 6 years ago

Does the carrier have that much control over a modern iPhone's firmware? Seems odd

LinuxBender2• 6 years ago

This was the case for every phone prior to the iPhone and is certainly the case for Android, as past bugs were patched by some wireless carriers and not by others. Getting an answer to this may prove difficult, as Apple are very litigious and people know this. If engineers received a gag order, I suspect they probably won't risk violating it.

rmrfstar• 6 years ago

There are rumors of recent-model iPhones receiving "carrier setting" updates not documented on the carrier's website (they should be), occasionally followed by instability (crash, refusal to boot, refusal to reboot on battery power alone).

The FBI Is Breaking into Encrypted Devices – We’re Suing

Related Stories