Tag Archives: freedom

Encryption/Decryption Race

Posted on by
Reply

The political one I mean, not the technological one.  Recall, for instance the San Bernardino terrorist attack, the FBI’s capture of one of the terrorists’ encrypted iPhones, Apple’s refusal to decrypt it (they couldn’t, by their design of the iPhone’s OS), then-FBI Director James Comey’s (yes, that Comey) cynically tear-jerking demand for future such personal device encryption back doors to decrypt at Government convenience, and Apple’s refusal to support development of that.

An expert on the subject—a technological expert I mean, not a political one—thinks he’s solved the problem.  His solution is described in a Wired article.  This expert thinks he has a way of providing Government “exceptional access” to a private person’s (or private enterprise’s) encrypted cell phone (for instance).  His solution, Clear, works this way:

The vendor—say it’s Apple in this case, but it could be Google or any other tech company—starts by generating a pair of complementary keys. One, called the vendor’s “public key,” is stored in every iPhone and iPad. The other vendor key is its “private key.” That one is stored with Apple, protected with the same maniacal care that Apple uses to protect the secret keys that certify its operating system updates. These safety measures typically involve a tamper­proof machine (known as an HSM or hardware security module) that lives in a vault in a specially protected building under biometric lock and smartcard key.

That public and private key pair can be used to encrypt and decrypt a secret PIN that each user’s device automatically generates upon activation. Think of it as an extra password to unlock the device. This secret PIN is stored on the device, and it’s protected by encrypting it with the vendor’s public key. Once this is done, no one can decode it and use the PIN to unlock the phone except the vendor, using that highly protected private key.

So, say the FBI needs the contents of an iPhone. First the Feds have to actually get the device and the proper court authorization to access the information it contains—Ozzie’s system does not allow the authorities to remotely snatch information. With the phone in its possession, they could then access, through the lock screen, the encrypted PIN and send it to Apple. Armed with that information, Apple would send highly trusted employees into the vault where they could use the private key to unlock the PIN. Apple could then send that no-longer-secret PIN back to the government, who can use it to unlock the device.

Included in the procedure is the requirement to send a judge’s search warrant to Apple along with the encrypted PIN, and Apple would first verify the warrant before sending anyone to the vault.

Hmm….

In a landmark 2015 paper called Keys Under Doormats, a group of 15 cryptographers and computer security experts argued that, while law enforcement has reasons to argue for access to encrypted data, “a careful scientific analysis of the likely impact of such demands must distinguish what might be desirable from what is technically possible.” Their analysis claimed that there was no foreseeable way to do this. If the government tried to implement exceptional access, they wrote, it would “open doors through which criminals and malicious nation-states can attack the very individuals law enforcement seeks to defend.”

Exceptional access is not desirable.  All Clear would do is add to the hackers’/criminals’/malicious nation-states’—and malicious network entities’—target lists the men and women running the companies “storing” the back doors, now working in cahoots with Government men through the screen of a Government-issue search warrant.

It’s true enough that

Using that same system to provide exceptional access…introduces no new security weaknesses that vendors don’t already deal with.

The “same system” is the various ways software developers and vendors encrypt keys that then are used, for instance, to verify the veracity of this or that application a user just downloaded or an OS update being offered—or pushed—to a user.  It’s also true that things like Clear add no new security weaknesses (assuming, arguendo, that the software of the Clears of this potential brave new world is well implemented).  But spreading those existing weaknesses around, putting them explicitly in the hands of Government and out of the hands of individuals using the devices solves nothing.  It’s still men and women who are the weak link in this politically-driven solution, however elegant and simple to execute the technological proposal.

No, it’s not so much a matter that exceptional access is a “crime against science,” Wired‘s phrasing in its misunderstanding of the proposal.  It’s that exceptional access is a crime against individual liberty.  Even against group liberty.

In another cynical representation, current FBI Director Christopher Wray, noting that his FBI “was locked out of 7,775 devices in 2017,” said

I reject this notion that there could be such a place that no matter what kind of lawful authority you have, it’s utterly beyond reach to protect innocent citizens.

Stipulate that Wray is pure as the driven snow with motives beyond reproach.  He’s a man.  So will be his successors.  So are all of the men and women of government and of industry.  So will be their successors.

Thus, a question for those of you to the left of center and beyond, politically: would you really want a Donald Trump’s FBI via his selection of judges to have exceptional access to your secrets?

And a question for those of you to the right of center and beyond, politically: would you really want a Hillary Clinton’s FBI via her selection of judges to have exceptional access to your secrets?  A Bernie Sanders’?

Who among you are willing to trust a James Comey FBI with any of this?  A J Edgar Hoover FBI?

Or the titans of industry, the evil 1%?  Even Tim Cook, who resisted FBI demands in the San Bernardino case, is accommodating to the demands of the People’s Republic of China government.

What the sort of solution that is Clear does is force us to trust the good offices of the men and women running a manufacturer in addition to the good offices of the men and women of government.

That’s the stuff of a socialist’s wet dream.

The “Muslim Travel” Moratorium Case

Posted on by
Reply

The Supreme Court is hearing this case as it pertains to the current Executive Order that imposes a moratorium on entry into the US by persons coming from certain specified nations.  (In aside, I emphasize that calling the EO a “Muslim ban” is dishonest. It presents an impermanent moratorium on entry from nations representing a bare 10% of the world’s Muslims, and it presents the same impermanent moratorium on non-Muslim countries, like northern Korea.)

Lower courts have invoked campaign rhetoric, the clumsiness of the rollout of the first EO on the matter, a made-up permanence of the moratorium, and on and on, to create a court-manufactured policy determination that the EO was somehow prejudiced in some way.  With that fantasy, those lower courts have struck the EOs, one after another.

The lower courts have been imposing their own prejudices.

What’s in the text of the Executive Order? Is the EO itself legal? These are the only questions legitimately before the Justices. Campaign rhetoric is not in the EO, and so cannot be considered. The clumsiness of the rollout of the first EO had nothing to do with the EO—or with the one presently before the Justices—and so cannot be considered by the Justices.  The duration of the moratorium is a political decision, and so cannot be considered.

In Connecticut National Bank v Germain, the Supremes held

…time and again that courts must presume that a legislature says in a statute what it means and means in a statute what it says there.

The concept plainly holds for EOs as well.  If it’s not in the EO, the EO doesn’t say it.

Whether the EO’s moratorium on entry into the US from a selected set of nations is good or bad policy is certainly worthy of debate, but it’s strictly and solely a political debate to be had by We the People, and through us, our elected representatives. Politics and associated policy decisions are beyond the ken of courts.

Foolishness of Zero Tolerance

Posted on by
Reply

…or of intolerance; the two are interchangeable terms in this context.  This context is the overreaction of school management and local police departments to remarks concerning “threats” to schools.

Gina Gobert’s 12-year-old daughter was detained overnight at a police station in Oakdale, LA, after allegedly talking to schoolmates about a social-media post she said she received that threatened violence against the school.

School management, it seems, decided the girl had received no such threat and turned her over to the police, who decided to charge the child with “terrorizing.”

And this:

“You can’t joke about this stuff. It’s just unacceptable behavior in today’s world,” said Sheriff Craig DuMond in Delaware County in New York, where an 8-year-old was arrested in March on a felony charge of terroristic threat for allegedly threatening to burn down his school in Davenport, NY.

With adults, maybe.  But with children?  This is ridiculous, not least because, as minors, they are by definition incapable of making their own calls on such matters.  As a practical matter, though, they’re just too inexperienced—they literally haven’t lived long enough—to be able to form such judgments or to reason through the associated implications.  And: it’s the nature of children to push boundaries as they seek out their places in the world—and to change those places.

And this:

“If you threaten a school, you are going to be charged,” said Eric Smith, a prosecutor in Macomb County in Michigan, where 54 students have been charged in school-threat cases in the two months since Parkland, up from 17 in all of last year. “We get a lot of kids saying they were just joking, wanted attention, were acting out against bullies. Law enforcement doesn’t know if it’s real or not.”

Don’t know, therefor it’s OK to arrest them, lock them up, then do the investigation.  Guilt by accusation, guilt by dislike of what’s being said.  Jokes are no joke.

Even with adults, though, the matter is contextual; blanket bans are just the inflexibility of intolerance, and it suffocates even legitimate interactions.

My usual question, this time for school management and the police: what’s your limiting principle? Where will this naturally stop, and joking around—including dark humor joking—be successfully discriminated from actual threat?

And: is the “zero” tolerance foolish, or is it dangerous to our liberty?

Irony Meter

Posted on by
Reply

Mine has been getting a workout lately.  It’s pegged again.

Russian lawmakers visited Syrian President Bashar al-Assad in the aftermath of the US-UK-French strikes on the center of al-Assad’s chemical weapons production facilities and before the Organization for the Prohibition of Chemical Weapons “inspects” the site of al-Assad’s chemical attack on women and children that prompted the allied response.  Among other things,

[t]he Syrian president also reportedly accepted an invitation to visit Siberia….

I recall an earlier time of invitations to visit Siberia.

Equal Protection Under Law

Posted on by
Reply

Harmeet Dhillon, a trial lawyer and California Republican National Committeewoman, has a tweet up regarding equal protection, San Jose, CA, style:

From the 9th Circuit argument Monday morning in Hernandez v. San Jose—City attorney says SJPD should not be held responsible for forcing Trump supporters to walk through a violent mob, because attending a Trump rally is an inherently dangerous act! Did they ask for it?

Play the video, and listen especially to the exchange between the San Jose lawyer and the judge (you may have to crank up the volume to hear the judge).  San Jose is utterly disingenuous in this case.  Equal protection applies, in SJ, only to SJ-approved groups of people.