Download to read offline
Uploaded byWendy Knox Everette
BSidesPDX "An update from the crypto wars 2.0"
Wendy Knox Everette provides a summary of the history of encryption regulation and debates around law enforcement access to encrypted data. She discusses key cases like Bernstein v. United States and Apple v. FBI. Everette notes ongoing tensions between law enforcement desires for access and technology companies' stance that weakened encryption harms all users. Recent events like attempts to force Facebook to wiretap Messenger and Attorney General Barr's calls for lawful access are also summarized.
Law◦
More Related Content
Similar to BSidesPDX "An update from the crypto wars 2.0"
BSidesPDX "An update from the crypto wars 2.0"
- 1. An Update fromthe Crypto Wars 2.0 BSidesPDX - October 25, 2019 Wendy Knox Everette @wendyck
- 2. Who am I?Wendy Knox Everette @wendyck Hacker lawyer. Has handled law enforcement requests for companies. I am a lawyer. I am very much not your lawyer.
- 3. Some history: 1993 ClipperChip 1995-1997 Bernstein v. United States 2015 Apple v. FBI
- 6. Daniel J. Bernsteinet al., v. United States Department of State, 922 F. Supp. 1426 (April 15, 1996) Daniel J. Bernstein et al., v. United States Department of State, 945 F. Supp. 1279 (December 9, 1996) Daniel J. Bernstein et al., v. United States Department of State, 176 F.3d 1132 (August 25, 1997) Encryption regulations prevented export of software code. Court finds that software code is speech & receives First Amendment protections
- 8. Law enforcement arguesthat encryption of iCloud backups prevented them from investigating the San Bernardino shooting. February 16, 2016, a C.D. Cal. magistrate judge issued an order requiring Apple to assist the FBI with extracting data.
- 9. Apple replies thatbuilding any custom iOS software to circumvent the encryption raises unacceptable implications for all iOS customers.
- 10.
- 12. 4th Amendment createsthe groundwork for this area ● Based on the “reasonable expectation of privacy” standard ● Most 4th Amendment law is case law
- 13. Wiretaps are covered byTitle III
- 14. Electronic Communications PrivacyAct & Stored Communications Act
- 15.
- 16.
- 20. Great, so thegovernment has ways to request data from software companies and service providers so that they can investigate crimes. Except
- 21. Sometimes new systemsare built and the old ways of wiretapping, etc., don’t work anymore
- 22.
- 23. Courts may issueall writs necessary or appropriate in aid of their respective jurisdictions and agreeable to the usages and principles of law
- 24. United States v.New York Telephone Co., 434 U.S. 159 (1977)
- 25. “We agree thatthe power of federal courts to impose duties upon third parties is not without limits; unreasonable burdens may not be imposed.”
- 26. So now wehave CALEA
- 27. CALEA ● telecom providersare required to assist law enforcement ● fuzzy applicability to internet service companies
- 28. The All WritsAct was used in Apple v. FBI
- 29. What was theoutcome in Apple v. FBI? The FBI used a vulnerability to hack into the phone - to date, bugs have been providing a form of pressure release
- 30.
- 31. “According to Reutersand The Washington Post, the Justice Department sought an order from a federal court to force Facebook to wiretap encrypted voice conversations on Facebook Messenger as part of an investigation into the MS- 13 gang” https://www.aclu.org/blog/privacy- technology/internet-privacy/aclu-seeks-secret- ruling-stopped-feds-hacking-facebook
- 32. Facebook refuses, sayingwould need to re-write Messenger app’s code & undermine security for all users. DOJ tries to hold Facebook in contempt of court, but lost. ACLU filed a motion to unseal judicial rulings associated with the attempt to make Facebook decrypt Messenger calls. https://www.aclu.org/blog/privacy- technology/internet-privacy/aclu-seeks-secret- ruling-stopped-feds-hacking-facebook
- 33.
- 34.
- 35. Can we havemessaging systems that are engineered to deal with child porn and law enforcement access, without building tech that gets used for censorship and copyright enforcement?
- 36. Forced signing of “malicious”updates by a government?
- 37.
- 38. Barr’s remarks “But thedigital world that has proven such a boon in many ways has also empowered criminals. Like everybody else, criminals of all stripes increasingly rely on wireless communications, hand-held devices, and the internet. In today’s world, evidence of crime is increasingly digital evidence. As we work to secure our data and communications from hackers, we must recognize that our citizens face a far broader array of threats...While we should not hesitate to deploy encryption to protect ourselves from cybercriminals, this should not be done in a way that eviscerates society’s ability to defend itself against other types of criminal threats.”
- 39. Barr’s remarks “What ishappening here is that some companies want to say to the individual, “Hey, we can make you invisible to law enforcement.” But do we want to live in a society where everyone is invisible to law enforcement?”
- 40. Barr’s remarks “These considerationsapply to privacy. That right has never been absolute. The Fourth Amendment strikes a balance between the individual citizen’s interest in conducting certain affairs in private and the general public’s interest in subjecting possible criminal activity to investigation.”
- 41. But weakening encryption isnot like a 4th Amendment balancing test
- 42. Backdoored encryption standards areencryption algorithms that have been intentionally weakened
- 43.
- 44. How would we protectescrowed keys? Does only the FBI get them? How do local law enforcement use them?
- 45. How does this evenwork with the global Internet?
- 46.
- 47. Can’t we justcompel people to provide decryption keys? 1. This doesn’t work so well in the investigative stage 2. The Fifth Amendment can be invoked by the defendant to resist providing their encryption keys
- 48. Sources ● Clipping Clipperhttps://www.wired.com/1994/09/clipping-clipper-matt-blaze/ & https://www.mattblaze.org/papers/eesproto.pdf ● EFF’s Bernstein summaryhttps://www.eff.org/cases/bernstein-v-us-dept-justice ● Apple v FBI timeline: https://www.usatoday.com/story/tech/news/2016/03/15/apple-v-fbi-timeline/81827400/ ● Software Alliance paper https://www.bsa.org/policy-filings/us-encryption-and-law-enforcement-access-to-data ● Video of DOJ’s Lawful Access Summit https://www.justice.gov/opa/video/lawful-access-summit ● https://freedom-to-tinker.com/2019/10/06/content-moderation-for-end-to-end-encrypted-messaging/ and Barr’s remarks: https://www.justice.gov/opa/speech/attorney-general-william-p-barr-delivers-remarks-lawful-access-summit ● https://cyberlaw.stanford.edu/blog/2019/10/william-barr-and-winnie-pooh ● Content Moderation for End-to-End Encrypted Messaging by Jonathan Mayer, https://freedom-to- tinker.com/2019/10/06/content-moderation-for-end-to-end-encrypted-messaging/ ● US Attorney’s Manual, Section 9-7.000 - Electronic Surveillance, https://www.justice.gov/usam/usam-9-7000- electronic-surveillance ● FBI Domestic Investigations and Operations Guide https://vault.fbi.gov/FBI%20Domestic%20Investigations%20and%20Operations%20Guide%20%28DIOG%29/FBI%2 0Domestic%20Investigations%20and%20Operations%20Guide%20%28DIOG%29%202016%20Version ● Lawfare blog, https://www.lawfareblog.com
Editor's Notes
- #2 https://flickr.com/photos/drbillydude/37337740262/
- #5 Feb 1994, NSA wanted to test Clipper chip as a replacement to current standard, DES Used hardware; had “Law Enforcement Access Field (LEAF)” that can read data encoded with the chip; information was held in separate secret digital vaults by two government agencies
- #6 The LEAF is protected by a 16-bit checksum, But any random sequence of 16 bits has a 1-in-65,000 shot at passing that checksum test & we can script that. Matt Blaze found it took about 42 minutes to make a fake one that was good enough that law enforcement officials can't tell if they have a valid or bogus LEAF -- the bogus number strings he generated could pass the checksum July 20, 1994 - govt abandons clipper chip
- #7 In the Bernstein case, a professor challenged the ITAR restrictions on software encryption, arguing that they infringed his first amendment rights. He developed an encryption algorithm & wanted to publish a math paper & source code with the algorithm. ITAR requirements at the time required him to register as an arms dealer & have the software reviewed by the government. Software still can be covered by ITAR or EAR restrictions, but they aren’t as restrictive as they used to be, and the courts did recognize software as speech, and found that restrictions on some software could have first amendment implications.
- #9 FBI didn’t know the passcode to iphone, and the iphone would erase the contents after 10 incorrect passcodes. So they needed a way to bypass this restriction. https://flickr.com/photos/matsuyuki/8444605838
- #10 Apple says that building this custom iOS will cause security problems for all users of iPhones https://flickr.com/photos/151234415@N07/32480841316
- #11 Apple published a letter to their customers explaining why they weren’t complying with the order
- #12 Once this tool was created, how would Apple restrict who could use it? Would every cellphone taken from someone arrested for a drug misdemeanor charge be subject to this type of unlocking and search? There are some rules in this area, but it turns out that they tend to silent on a lot of topics relevant to the search of digital devices
- #13 The 4th Amendment still applies here, though. It guarantees protection from unreasonable government intrusion, and is largely case law. Ask-> statutes v case law Common law Judge made law www.flickr.com/photos/ianafotog/6903741624
- #14 Title III prohibits private citizens from using electronic surveillance techniques and sets up rules for law enforcement to use wiretaps and record calls, but it requires compliance with specific requirements www.flickr.com/photos/jcphotolog/5592963392
- #15 ECPA passed in 1986-Specifically, Congress added "electronic communications" as a new category of communications whose interception is covered by Title III. Electronic communications are non-voice communications made over a network in or affecting interstate commerce, and include text messages, electronic mail ("email"), facsimiles ("faxes"), other non-voice Internet traffic, and communications over digital-display pagers
- #16 Network Investigative Technique - rules around them changed with Rule 41 of Fed Rules of Crim Pro that took effect Dec 2016 www.flickr.com/photos/thomashawk/7117207093
- #17 Warrant from a NIT from https://motherboard.vice.com/en_us/article/d3b3xk/the-fbi-created-a-fake-fedex-website-to-unmask-a-cybercriminal
- #18 Location to be searched here is an email address
- #22 Turns out that law enforcement having trouble getting evidence isn’t a new problem https://flickr.com/photos/tigerplish/250835499
- #23 passed as part of the Judiciary Act of 1789 - this is what was used in the NY Telephone & in Apple v FBI. But it was also used in an earlier case as well https://www.flickr.com/photos/thomashawk/11028266054/
- #24 Usually this is really boring stuff to help make the court system run https://www.flickr.com/photos/wiechert/6441071577/
- #25 court used the authority of the All Writs Act to order the phone company to lend the FBI a telephone line and to help them install the monitoring device at the phone company The old methods of clipping into wires for PRTTs and wiretaps didn’t work anymore with the new phone company infrastructure
- #26 This still leaves us with questions about what’s an unreasonable burden under the AWA, applicability to information services, and post-CALEA holdings
- #27 https://www.flickr.com/photos/mccun934/4112187713/
- #28 1994: Communications Assistance for Law Enforcement Act to require phone service providers to assist law enforcement with wiretaps Treats internet services differently from communication services Internet services were explicitly excluded from being required to build their systems in a way that could be easily wiretapped www.flickr.com/photos/nic1/17262200550
- #30 https://flickr.com/photos/smemon/8039833659/
- #31 At least 10:00 - 15:00
- #33 -FB refused, saying they’d need to rewrite the messenger code -DOJ tried to hold FB in contempt -ACLU filed a motion to unseal; no updates since November 2018 https://flickr.com/photos/jason_ff/1455514845
- #37 Australia’s law
- #38 Held on October 4 in DC https://www.justice.gov/opa/video/lawful-access-summit
- #39 -criminals are using mobile phones and the internet! And Law Enforcement can’t access some of the content of their messages
- #40 You say invisible to law enforcement, I say TLS and end to end encryption protect my data from data breaches
- #42 https://flickr.com/photos/jbedrina/27514581535
- #45 How do we write a system that can only be used by the government and is impervious to being hacked? It is unreasonable to assume that any such system won’t be probed and investigated, and the entire history of software suggests that someone will find an exploit that works against the system https://flickr.com/photos/94132145@N04/16039293156/
- #46 How do you keep US citizens from just installing non-backdoored messaging apps made in other countries? https://flickr.com/photos/klubmoozak/8231390644
- #47 And how do you keep repressive regimes from demanding the use of these backdoors as well?