Tag Archives: ethics

Encryption/Decryption Race

Posted on by
Reply

The political one I mean, not the technological one.  Recall, for instance the San Bernardino terrorist attack, the FBI’s capture of one of the terrorists’ encrypted iPhones, Apple’s refusal to decrypt it (they couldn’t, by their design of the iPhone’s OS), then-FBI Director James Comey’s (yes, that Comey) cynically tear-jerking demand for future such personal device encryption back doors to decrypt at Government convenience, and Apple’s refusal to support development of that.

An expert on the subject—a technological expert I mean, not a political one—thinks he’s solved the problem.  His solution is described in a Wired article.  This expert thinks he has a way of providing Government “exceptional access” to a private person’s (or private enterprise’s) encrypted cell phone (for instance).  His solution, Clear, works this way:

The vendor—say it’s Apple in this case, but it could be Google or any other tech company—starts by generating a pair of complementary keys. One, called the vendor’s “public key,” is stored in every iPhone and iPad. The other vendor key is its “private key.” That one is stored with Apple, protected with the same maniacal care that Apple uses to protect the secret keys that certify its operating system updates. These safety measures typically involve a tamper­proof machine (known as an HSM or hardware security module) that lives in a vault in a specially protected building under biometric lock and smartcard key.

That public and private key pair can be used to encrypt and decrypt a secret PIN that each user’s device automatically generates upon activation. Think of it as an extra password to unlock the device. This secret PIN is stored on the device, and it’s protected by encrypting it with the vendor’s public key. Once this is done, no one can decode it and use the PIN to unlock the phone except the vendor, using that highly protected private key.

So, say the FBI needs the contents of an iPhone. First the Feds have to actually get the device and the proper court authorization to access the information it contains—Ozzie’s system does not allow the authorities to remotely snatch information. With the phone in its possession, they could then access, through the lock screen, the encrypted PIN and send it to Apple. Armed with that information, Apple would send highly trusted employees into the vault where they could use the private key to unlock the PIN. Apple could then send that no-longer-secret PIN back to the government, who can use it to unlock the device.

Included in the procedure is the requirement to send a judge’s search warrant to Apple along with the encrypted PIN, and Apple would first verify the warrant before sending anyone to the vault.

Hmm….

In a landmark 2015 paper called Keys Under Doormats, a group of 15 cryptographers and computer security experts argued that, while law enforcement has reasons to argue for access to encrypted data, “a careful scientific analysis of the likely impact of such demands must distinguish what might be desirable from what is technically possible.” Their analysis claimed that there was no foreseeable way to do this. If the government tried to implement exceptional access, they wrote, it would “open doors through which criminals and malicious nation-states can attack the very individuals law enforcement seeks to defend.”

Exceptional access is not desirable.  All Clear would do is add to the hackers’/criminals’/malicious nation-states’—and malicious network entities’—target lists the men and women running the companies “storing” the back doors, now working in cahoots with Government men through the screen of a Government-issue search warrant.

It’s true enough that

Using that same system to provide exceptional access…introduces no new security weaknesses that vendors don’t already deal with.

The “same system” is the various ways software developers and vendors encrypt keys that then are used, for instance, to verify the veracity of this or that application a user just downloaded or an OS update being offered—or pushed—to a user.  It’s also true that things like Clear add no new security weaknesses (assuming, arguendo, that the software of the Clears of this potential brave new world is well implemented).  But spreading those existing weaknesses around, putting them explicitly in the hands of Government and out of the hands of individuals using the devices solves nothing.  It’s still men and women who are the weak link in this politically-driven solution, however elegant and simple to execute the technological proposal.

No, it’s not so much a matter that exceptional access is a “crime against science,” Wired‘s phrasing in its misunderstanding of the proposal.  It’s that exceptional access is a crime against individual liberty.  Even against group liberty.

In another cynical representation, current FBI Director Christopher Wray, noting that his FBI “was locked out of 7,775 devices in 2017,” said

I reject this notion that there could be such a place that no matter what kind of lawful authority you have, it’s utterly beyond reach to protect innocent citizens.

Stipulate that Wray is pure as the driven snow with motives beyond reproach.  He’s a man.  So will be his successors.  So are all of the men and women of government and of industry.  So will be their successors.

Thus, a question for those of you to the left of center and beyond, politically: would you really want a Donald Trump’s FBI via his selection of judges to have exceptional access to your secrets?

And a question for those of you to the right of center and beyond, politically: would you really want a Hillary Clinton’s FBI via her selection of judges to have exceptional access to your secrets?  A Bernie Sanders’?

Who among you are willing to trust a James Comey FBI with any of this?  A J Edgar Hoover FBI?

Or the titans of industry, the evil 1%?  Even Tim Cook, who resisted FBI demands in the San Bernardino case, is accommodating to the demands of the People’s Republic of China government.

What the sort of solution that is Clear does is force us to trust the good offices of the men and women running a manufacturer in addition to the good offices of the men and women of government.

That’s the stuff of a socialist’s wet dream.

Foolishness of Zero Tolerance

Posted on by
Reply

…or of intolerance; the two are interchangeable terms in this context.  This context is the overreaction of school management and local police departments to remarks concerning “threats” to schools.

Gina Gobert’s 12-year-old daughter was detained overnight at a police station in Oakdale, LA, after allegedly talking to schoolmates about a social-media post she said she received that threatened violence against the school.

School management, it seems, decided the girl had received no such threat and turned her over to the police, who decided to charge the child with “terrorizing.”

And this:

“You can’t joke about this stuff. It’s just unacceptable behavior in today’s world,” said Sheriff Craig DuMond in Delaware County in New York, where an 8-year-old was arrested in March on a felony charge of terroristic threat for allegedly threatening to burn down his school in Davenport, NY.

With adults, maybe.  But with children?  This is ridiculous, not least because, as minors, they are by definition incapable of making their own calls on such matters.  As a practical matter, though, they’re just too inexperienced—they literally haven’t lived long enough—to be able to form such judgments or to reason through the associated implications.  And: it’s the nature of children to push boundaries as they seek out their places in the world—and to change those places.

And this:

“If you threaten a school, you are going to be charged,” said Eric Smith, a prosecutor in Macomb County in Michigan, where 54 students have been charged in school-threat cases in the two months since Parkland, up from 17 in all of last year. “We get a lot of kids saying they were just joking, wanted attention, were acting out against bullies. Law enforcement doesn’t know if it’s real or not.”

Don’t know, therefor it’s OK to arrest them, lock them up, then do the investigation.  Guilt by accusation, guilt by dislike of what’s being said.  Jokes are no joke.

Even with adults, though, the matter is contextual; blanket bans are just the inflexibility of intolerance, and it suffocates even legitimate interactions.

My usual question, this time for school management and the police: what’s your limiting principle? Where will this naturally stop, and joking around—including dark humor joking—be successfully discriminated from actual threat?

And: is the “zero” tolerance foolish, or is it dangerous to our liberty?

“Special Prosecutor”

Posted on by
Reply

The 9th Circuit has appointed one to “investigate” President Donald Trump’s pardon of ex-Sheriff Joe Arpaio last summer.  This was done in response to the fiction offered the court by the Perkins Coie law firm that the pardon, an explicitly named power of the President under Article II, Section 2, is somehow unconstitutional and a violation of due process.

Never mind that the due process—to the extent this…claim…is relevant to the matter of pardons—was supplied by the prior trial and conviction of Arpaio, a trial without which there would be no pardon to grant.

9th Circuit judges William Fletcher and Wallace Tashima, making their own claim that their Circuit “needs ‘the benefit of full briefing and argument’,” of the legitimacy of a President’s Constitutionally authorized pardon, appointed their “special prosecutor.”

Two things must flow from this usurpation of Executive Branch power.  One is that the Senate must get off its collective duff and confirm Trump’s nominees to fill the 9th Circuit vacancies.

Separately, judges William Fletcher and Wallace Tashima have violated their oaths of office, which include a promise to support and defend the Constitution. As they’re no longer hold[ing] their Offices during good Behavior, they need to be removed from the bench.

From the DNC’s Lawsuit

Posted on by
Reply

Recall that the Democratic National Committee is suing the Trump campaign, the Russian Federation, Wikileaks, and several of their brothers and uncles over the hack of DNC emails and the DNC’s loss of the 2016 elections.

Here, via The Wall Street Journal, is a brief excerpt to the DNC’s filing along with my perhaps rude comments.

V. THE SIGNIFICANT HARM INFLICTED UPON PLAINTIFF

135. The illegal conspiracy inflicted profound damage upon the DNC. The timing and selective release of the stolen materials prevented the DNC from communicating with the electorate on its own terms. These selective releases of stolen material reach a peak immediately before the Democratic National Convention and continued through the general election.

This is bogus.  The release (the timing of which is wholly irrelevant) went alongside DNC communications “with the electorate;” it did not prevent anything.  The DNC easily could have refuted the claims in the release, point by point.  Oh, wait—how does one refute claimed statements, when the statements are plain for all to see?

It’s also highly suspicious that, when the FBI sought access to the hacked servers, from which the “stolen materials” were stolen, the DNC denied the access.  Why would the DNC not want the cops to investigate the crime it claims was committed, and the hackers caught and prosecuted?

136. The timing and selective release of stolen materials was designed to and had the effect of driving a wedge between the DNC and Democratic voters. The release of stolen materials also impaired the DNC’s ability to support Democratic candidates in the general election.

See above.  In addition, the wedge was driven by the DNC leadership, who were busily stacking the race against one of the candidates—a stack against which “Democratic voters” would have demurred from the jump had they been permitted to know the bias was being acted on before the hack and release.

A question the DNC, even now, has declined to address: had Bernie Sanders won the Party nomination despite the leadership’s best efforts, would they have supported him with the same level of effort and zeal they did the candidate they had designated as the Party nominee before the primary campaigns?

137. The public release of stolen DNC materials was enormously disruptive to the convention, undermining the party’s ability to achieve unity and rally members around their shared values. The release cast a cloud over the convention’s activities, interfering with the party’s opportunity to communicate its vision to the electorate.

Again, bogus.  What was disruptive and undermining was the plain dishonesty of DNC leadership and its having been caught in its attempt to fix the election.  Besides, Sanders worked very hard, and successfully, to bring the Party together for the general election, despite the leadership’s having so thoroughly cheated him.  This beef has no actual damage done.

A DNC Lawsuit

Posted on by
Reply

The Tom Perez and Keith Ellison-led Democratic National Committee is suing the Russian government, the Trump campaign, and WikiLeaks, claiming the three acted to mess with the 2016 elections.

Bring it.

I have two comments on the suit.  One is, admittedly, purely cynical.  The Trump party should refuse any attempt to settle the suit.  Instead, they should force the thing into court and through all appeals brought by the DNC, and they should use every hour of any time periods allowed to produce this or that document, brief, what-have-you for the court.  Use up the DNC’s money.

The other comment is more serious and more straightforward.  Discovery should be fun.  Let the Trump party have all of the DNC’s servers and contents for inspection pursuant to this suit so they can look for evidence of the interference.  Included in that discovery must be those DNC servers and contents that the DNC claims were hacked and which the DNC refused to allow the FBI to inspect at the time in the FBI’s search for evidence.  In addition to the servers and contents, the DNC should be required to provide all the steps it took to preserve that evidence from the time of the hack.