FBI outed in attempt to obtain SSL certificate

N&P: Discuss governments, nations, politics and recent related news here.

Moderators: Alyrium Denryle, Edi, K. A. Pital

User avatar
NettiWelho
Youngling
Posts: 91
Joined: 2009-11-14 01:33pm
Location: Finland

Re: FBI outed in attempt to obtain SSL certificate

Post by NettiWelho »

TheHammer wrote:Actually MITM is the only way to do it using the SSL keys. Each SSL session generates a random key between the client and the server. You can't just take an SSL key and listen in to web traffic like a telephone conversation. Instead with the SSL key you are able to fool the client into thinking that you ARE the server.

There are other ways to try and attack SSL, but they are far more difficult, less effective, and do not use the SSL key anyway.
http://security.stackexchange.com/quest ... -web-admin
If an attacker uncovers your SSL private key, you are minimally vulnerable to the following attacks:

1) Traffic Eavesdropping

To the attacker, everything being sent over SSL can be decrypted and should consequently be thought of as cleartext. This means passwords, credit card numbers, and other Personal and Private Information is vulnerable to being either harvested or leveraged against you as the attack escalates.

2) Man-In-The-Middle

Part of the reason to use an SSL certificate is to uniquely authenticate yourself to the clients connecting to your server. If the private key is stolen, a hacker can create a Man-In-the-Middle attack where data flowing either from the server-to-client or client-to-server is modified in-transit. This could be done to ask a user to reauthenticate (and thereby surrender their password), ask for a credit card number, or implant malware into file downloads.

As you can see, if someone has compromised your SSL certificate, they can quickly escalate the attack to either gain unauthorized access to your system or attack you or your users.
http://security.stackexchange.com/quest ... ertificate
"DHE" stands for "Diffie-Hellman Ephemeral". This allows Perfect Forward Secrecy. PFS means that if an attacker steals the server private key (the one which is stored in a file, hence plausibly vulnerable to ulterior theft), he will still not be able to decrypt past recorded transactions. This is a desirable property, especially when you want your system to look good during an audit.
User avatar
phongn
Rebel Leader
Posts: 18487
Joined: 2002-07-03 11:11pm

Re: FBI outed in attempt to obtain SSL certificate

Post by phongn »

Perfect forward secrecy is fairly uncommon in TLS configurations, unfortunately.
User avatar
aerius
Charismatic Cult Leader
Posts: 14801
Joined: 2002-08-18 07:27pm

Re: FBI outed in attempt to obtain SSL certificate

Post by aerius »

phongn wrote:Perfect forward secrecy is fairly uncommon in TLS configurations, unfortunately.
Let's just say that most e-commerce, online banking, brokerages, government, and many other such "secure" sites which you'd think would use PFS, don't.
Image
aerius: I'll vote for you if you sleep with me. :)
Lusankya: Deal!
Say, do you want it to be a threesome with your wife? Or a foursome with your wife and sister-in-law? I'm up for either. :P
User avatar
phongn
Rebel Leader
Posts: 18487
Joined: 2002-07-03 11:11pm

Re: FBI outed in attempt to obtain SSL certificate

Post by phongn »

aerius wrote:
phongn wrote:Perfect forward secrecy is fairly uncommon in TLS configurations, unfortunately.
Let's just say that most e-commerce, online banking, brokerages, government, and many other such "secure" sites which you'd think would use PFS, don't.
DHE is computationally expensive and ECDHE is patent encumbered (and not widely implemented). There's also the issue where TLS 1.0 needs to die but too much relies on it (like the hordes of people running XP).
Simon_Jester
Emperor's Hand
Posts: 30165
Joined: 2009-05-23 07:29pm

Re: FBI outed in attempt to obtain SSL certificate

Post by Simon_Jester »

TheHammer wrote:You're sliding down that slippery slope to Tinfoilhat-ville Simon... Your hypothetical is so far out of bounds for reality that I really can't even think of a way to respond to it. So I'm going to circle back to this particular real life example as to why this notion of "no limits" isn't grounded in reality...
OK, I keep forgetting you don't think like a physicist. Sorry.

Let me make it clear: the reason this is of interest or concern is that we are looking at the FBI's decision to indiscriminately search or confiscate the property of lots of people. This was the issue with Megaupload, this is the issue with Lavabit. Many people store property on a single data service's computer- and when the FBI believes a crime has been committed, it seizes the computer, and all the data belonging to all the people, to do with as it pleases.

In the extreme limiting case, taking the trend to its most extreme possible conclusion, we can imagine an (absurd) case where a single computer contains property of all the people. This leads to four logical questions:

1) Would the FBI then be entitled to indiscriminately search this computer to find the property of one man?

2) If they would be entitled to do that, do we need any unusual safeguards to ensure that this enormous search is not abused, by the FBI or by third parties?

3) Is it safe to let them do this in secret, without telling anyone they've done it, and without telling anyone who they have or have not shared the fruits of the search with?

4) If they are not entitled to do that, if the warrant to search for one person's belongings does NOT provide a blank check to search everyone's belongings indiscriminately... then where's the dividing line?

I don't think I'm out of line in asking you to answer the damn questions. They are hypothetical, but they are important, because we really should be able to get a straight answer to "do hundreds of thousands innocent people have any rights when the FBI comes to search a data service's computers for the files of a single random person accused of a crime?"
Is there an analogous 'no limits' condition in physical space? Can the FBI search adjacent properties not owned by the person named in the warrant, on the grounds that he might have hidden things there? Can they search a whole apartment building because they can't be bothered to find the accused's address? Can they search a whole city, the property of 400000 people, for the personal effects of one man?

What is the limit to a search warrant?
I don't know what your technical background is, but I'll try to adapt your analogy to explain. The FBI is not asking for the right to search 400,000 people's property. The FBI has asked for, and has been granted the right to search one man's property. They know where he lives. However this man happens to live in an extremely secure "appartment building" with 400,000 other people. This apartment building has just one master key to get in to the building. The FBI can not get in to this building without that key, and the building management has refused all requests for cooperation. Thus they have asked a judge to order that key be given to them, with the explicit understanding that once inside the building they are only to search the appartment they are entitled to search. They will be on the lookout for anyone going to and from the one apartment they are watching, however the remaining 399,999 people will be allowed to come and go as they please without search or interruption.
Given the FBI's track record, why do you feel that they can be trusted with power of this scope?

This is a persistent issue I have with you. You take for granted that state security organs will always do exactly what they promise. This has been proven false repeatedly in the past. Even if it hadn't...

At some point, it defeats the purpose of even having constitutional rights, if whenever someone asks for a license to bend or ignore them, that license is granted, because the person asking is just So Damn Trustworthy.

As far as I can tell, in Hammermerica, I have a right to privacy, due process, and so forth... but only until it becomes inconvenient for the state to allow me those rights. Which means I don't really have any rights at all.
The word "capture" is a bit of a misnomer here. The data actually passes through the device. Essentially, in our hypothetical apartment building scenario, the FBI has replaced Lavabits as the "doorman". While this doorman is on the lookout for and will intercept its target, for everyone else it merely opens the door and nothing else.
Will any neutral party be examining the function of this device? If it works as advertised, then "the innocent have nothing to fear-" in this case, the innocent being the FBI.
This space dedicated to Vasily Arkhipov
User avatar
Gaidin
Sith Devotee
Posts: 2646
Joined: 2004-06-19 12:27am
Contact:

Re: FBI outed in attempt to obtain SSL certificate

Post by Gaidin »

Simon_Jester wrote:Given the FBI's track record, why do you feel that they can be trusted with power of this scope?
I don't want to comment directly since it's been established that in this case there are particulars that I dislike enough on both sides that I'm either fairly indifferent on who gets fucked over more or whatever, but this statement's fairly disingenuous. Give us the right crime or the right suspect they're trying to track down on this forum and everyone's cheering bravo. It's not the FBI, it's more the case, as Lagmonster noted in an earlier post in this thread, but nobody really responded to.
User avatar
White Haven
Sith Acolyte
Posts: 6360
Joined: 2004-05-17 03:14pm
Location: The North Remembers, When It Can Be Bothered

Re: FBI outed in attempt to obtain SSL certificate

Post by White Haven »

I most definitely did respond to it directly. Please hang up and try again.
Image
Image
Chronological Incontinence: Time warps around the poster. The thread topic winks out of existence and reappears in 1d10 posts.

Out of Context Theatre, this week starring Darth Nostril.
-'If you really want to fuck with these idiots tell them that there is a vaccine for chemtrails.'

Fiction!: The Final War (Bolo/Lovecraft) (Ch 7 9/15/11), Living (D&D, Complete)Image
User avatar
Gaidin
Sith Devotee
Posts: 2646
Joined: 2004-06-19 12:27am
Contact:

Re: FBI outed in attempt to obtain SSL certificate

Post by Gaidin »

Yea and you think the FBI are defending the NSA to boot. I already explained that one to you quite neutrally. I'm not at all sure why you'd expect an intelligence agency to investigate federal crimes but whatever. The FBI investigates federal level crimes unless it's in the specialized areas of the DEA and other law enforcement agencies, period, full stop.
TheHammer
Jedi Master
Posts: 1472
Joined: 2011-02-15 04:16pm

Re: FBI outed in attempt to obtain SSL certificate

Post by TheHammer »

Simon_Jester wrote:
TheHammer wrote:You're sliding down that slippery slope to Tinfoilhat-ville Simon... Your hypothetical is so far out of bounds for reality that I really can't even think of a way to respond to it. So I'm going to circle back to this particular real life example as to why this notion of "no limits" isn't grounded in reality...
OK, I keep forgetting you don't think like a physicist. Sorry.

Let me make it clear: the reason this is of interest or concern is that we are looking at the FBI's decision to indiscriminately search or confiscate the property of lots of people. This was the issue with Megaupload, this is the issue with Lavabit. Many people store property on a single data service's computer- and when the FBI believes a crime has been committed, it seizes the computer, and all the data belonging to all the people, to do with as it pleases.
Its not that I "dont think like a physicist" its that I expect "what-if" scenarios to be semi-plausible if I'm supposed to respond to them.
I'm not familiar with the specifics of the megaupload case so I can't speak to that, however in this case no one's property was searched or confiscated aside from the target of the search warrant. It wasn't "doing as it pleases" it was doing a search with a very narrow scope.
In the extreme limiting case, taking the trend to its most extreme possible conclusion, we can imagine an (absurd) case where a single computer contains property of all the people. This leads to four logical questions:

1) Would the FBI then be entitled to indiscriminately search this computer to find the property of one man?
Not indescriminantly no. They are not doing that in this case either. In fact, their search is very descriminant - the account for one person in question, and even then only the metadata for that one account.
2) If they would be entitled to do that, do we need any unusual safeguards to ensure that this enormous search is not abused, by the FBI or by third parties?
As noted, they aren't entitled. The FBI sought a warrant for a search with a specific scope and were given that warrant. By technical neccessity, they would be given physical access to everyone's property, but would be forbidden from accessing anything outside of the scope of their warrant. Doing so would be a crime.
3) Is it safe to let them do this in secret, without telling anyone they've done it, and without telling anyone who they have or have not shared the fruits of the search with?
They've told the court what they have been doing, and what they intend to do. That's why they were given a warrant. It would be as safe as any other search law enforcement conducts. If you're concerned that your law enforcement agency is breaking the law itself, then why stop your concerns with forcing lavabits to legally turn over the key? They could just as easily "beat it out of him", or send in agents to steal it.

Law enforcement agencies have internal affairs divisions specifically to protect against them committing crimes themselves, but I suspect anyone who doesn't trust the FBI to begin with isn't going to trust their internal affairds. Again, these "who watches the watchman" scenarios have no end. Even if you set up an agency, then "who watches the people who watch the watchman" and so on and so forth. And you still are dealing with "government agencies".
4) If they are not entitled to do that, if the warrant to search for one person's belongings does NOT provide a blank check to search everyone's belongings indiscriminately... then where's the dividing line?
There is nothing indescriminate about the search. They are looking for traffic bound for one particular destination. That traffic happens to be travelling the same "highway" that other traffic is also travelling, but they are not allowed to look at that other traffic.
I don't think I'm out of line in asking you to answer the damn questions. They are hypothetical, but they are important, because we really should be able to get a straight answer to "do hundreds of thousands innocent people have any rights when the FBI comes to search a data service's computers for the files of a single random person accused of a crime?"
I have no problem answering the question. Yes they have rights. And those rights are being protected by virtue of the fact that the FBI is using software/devices that specifically excludes looking at the data of anyone except the target they are looking for. From a technical standpoint, it is an absolutely trivial thing to do. It seems your main issue is that you don't trust them. I'm afraid I can't help you with that.
SJ wrote:
Is there an analogous 'no limits' condition in physical space? Can the FBI search adjacent properties not owned by the person named in the warrant, on the grounds that he might have hidden things there? Can they search a whole apartment building because they can't be bothered to find the accused's address? Can they search a whole city, the property of 400000 people, for the personal effects of one man?

What is the limit to a search warrant?
TheHammer wrote:I don't know what your technical background is, but I'll try to adapt your analogy to explain. The FBI is not asking for the right to search 400,000 people's property. The FBI has asked for, and has been granted the right to search one man's property. They know where he lives. However this man happens to live in an extremely secure "appartment building" with 400,000 other people. This apartment building has just one master key to get in to the building. The FBI can not get in to this building without that key, and the building management has refused all requests for cooperation. Thus they have asked a judge to order that key be given to them, with the explicit understanding that once inside the building they are only to search the appartment they are entitled to search. They will be on the lookout for anyone going to and from the one apartment they are watching, however the remaining 399,999 people will be allowed to come and go as they please without search or interruption.
Given the FBI's track record, why do you feel that they can be trusted with power of this scope?
I don't view government agencies as unchanging monoliths. Lessons are learned, personnel change. Are we talking about the track record from the Hoover days of the FBI, or are we talking more recently? Are we lumping the FBI in with the NSA?

I see pissing and moaning all the time about "warrantless NSA searches", and yet when the FBI goes to court, gets a judge to sign off on the warrant - a process that allows the owner of the buisness his day in court to make counter arguments, what more do you expect? Do you have a recent example (in the last 10 years) of the FBI abusing a search warrant? If not, then why are you so quick to presume they will?
This is a persistent issue I have with you. You take for granted that state security organs will always do exactly what they promise. This has been proven false repeatedly in the past. Even if it hadn't...

At some point, it defeats the purpose of even having constitutional rights, if whenever someone asks for a license to bend or ignore them, that license is granted, because the person asking is just So Damn Trustworthy.
I take nothing for granted. I give people the benefit of the doubt until they have proven they don't deserve it. That's the same stance that these judges are taking when granting these warrants. If it comes to light that these agencies are commiting falsehoods, or going well outside the scope of their mandate, then there certainly should be severe consequences. But I'm not going to get caught up in the "Well they could do this, they could do that" scenarios without something substantial to show me that they would do this or that.
As far as I can tell, in Hammermerica, I have a right to privacy, due process, and so forth... but only until it becomes inconvenient for the state to allow me those rights. Which means I don't really have any rights at all.
Actually, in Hammermerica, aka the real world, you absolutely have your right to privacy and due process. But when that due process has been done, you've had your day in court and lost, then you don't have the right to throw up your hands and scream "GOVERNMENT OPPRESSION!".
The word "capture" is a bit of a misnomer here. The data actually passes through the device. Essentially, in our hypothetical apartment building scenario, the FBI has replaced Lavabits as the "doorman". While this doorman is on the lookout for and will intercept its target, for everyone else it merely opens the door and nothing else.
Will any neutral party be examining the function of this device? If it works as advertised, then "the innocent have nothing to fear-" in this case, the innocent being the FBI.
Who would this hypothetical neutral entity be? Would you like some sort of technical representative from the courts? That would be reasonable, but still part of the "government" so to speak. If that's not good enough, then again I really can't help you with your trust issues Simon... Like I said earlier, these "who watches the watchmen" scenarios are bottomless pits. Ultimately, if the government is "up to no good" your only real oversight is in the form of conscientious whistle blowers.
User avatar
Gaidin
Sith Devotee
Posts: 2646
Joined: 2004-06-19 12:27am
Contact:

Re: FBI outed in attempt to obtain SSL certificate

Post by Gaidin »

Let's just give the NSA law enforcement power and kill White Haven's "FBI is defending the NSA" argument(even though that's not what's really happening) and watch him panic over that.
User avatar
Thanas
Magister
Magister
Posts: 30779
Joined: 2004-06-26 07:49pm

Re: FBI outed in attempt to obtain SSL certificate

Post by Thanas »

Gaidin wrote:
Simon_Jester wrote:Given the FBI's track record, why do you feel that they can be trusted with power of this scope?
I don't want to comment directly since it's been established that in this case there are particulars that I dislike enough on both sides that I'm either fairly indifferent on who gets fucked over more or whatever, but this statement's fairly disingenuous. Give us the right crime or the right suspect they're trying to track down on this forum and everyone's cheering bravo.
That is a bad claim to make, especially considering you have nothing to show that this is true.
Whoever says "education does not matter" can try ignorance
------------
A decision must be made in the life of every nation at the very moment when the grasp of the enemy is at its throat. Then, it seems that the only way to survive is to use the means of the enemy, to rest survival upon what is expedient, to look the other way. Well, the answer to that is 'survival as what'? A country isn't a rock. It's not an extension of one's self. It's what it stands for. It's what it stands for when standing for something is the most difficult! - Chief Judge Haywood
------------
My LPs
User avatar
White Haven
Sith Acolyte
Posts: 6360
Joined: 2004-05-17 03:14pm
Location: The North Remembers, When It Can Be Bothered

Re: FBI outed in attempt to obtain SSL certificate

Post by White Haven »

They are totally defending the NSA; I don't see how that's even in question. The NSA was attacked, rightly or wrongly, by Edward Snowden, and the FBI are attempting to attack Edward Snowden on their behalf, because the FBI is legally empowered to do so and the NSA is not. That means they're defending the NSA. You keep fixating on that point as if it's somehow dubious, when it's quite, quite literally the truth. The fact that the NSA doesn't have jurisdiction to go after Snowden directly is why the FBI is doing it.

Let me put it to you this way. When you're acting in direct support and defense of an organization or person that is both secretive and hugely problematic from an ethical standpoint, you take on a lot of the suspicion aimed at that organization or person. If you want to counteract that and for people to take your investigation seriously, it would behoove you to avoid anything like a gray area, and certainly to blow secrecy and gag-orders out the airlock. The NSA has claimed, repeatedly, that it does not do all manner of blatantly-illegal things that it has then been demonstrated to actually do by actual documentation. These things are very heavily tied to security violation and privacy violation. Accordingly, when the FBI does something in secret that has the potential to violate the privacy and security of a large number of third parties, I don't give its claims of 'but we're totally being legit with this, guys' any more credence than I would similar assertions by the NSA itself.

Sorry guys, but you've cried wolf a few too many times by now. 'Trust, but verify' starts to break down when that trust has been demonstrated to be misplaced enough times. Then it becomes 'prove I can trust you,' and secrecy is a really, really bad first step.

EDIT: And yes, I'd be less suspicious of the FBI acting in defense of the Red Cross than in defense of the NSA. The Red Cross doesn't have the same history of both deep secrecy and massive breaches of trust that the NSA does.
Image
Image
Chronological Incontinence: Time warps around the poster. The thread topic winks out of existence and reappears in 1d10 posts.

Out of Context Theatre, this week starring Darth Nostril.
-'If you really want to fuck with these idiots tell them that there is a vaccine for chemtrails.'

Fiction!: The Final War (Bolo/Lovecraft) (Ch 7 9/15/11), Living (D&D, Complete)Image
User avatar
Gaidin
Sith Devotee
Posts: 2646
Joined: 2004-06-19 12:27am
Contact:

Re: FBI outed in attempt to obtain SSL certificate

Post by Gaidin »

Thanas wrote: That is a bad claim to make, especially considering you have nothing to show that this is true.
This investigation is pretty much where the internet has a soap box, I'm pretty sure I can make an open statement about that based on this thread alone. But I'm not at all sure what the hell their "track record", as Simon puts it, is given how wide of a swath of of investigations the FBI handles. Child pornography/rape? Criminal organizations(believe we might even have a thread on this one opened just recently)? Public corruption? White collar crime?

What is their track record? I'd say their track record is pretty good. Just because you have one person who leaked information and is charged with a crime that happens to be in the Espionage Act(and yes, the wording of the crime fits exactly what he did so the investigation is legitimate), doesn't in any way detract from about 99.9% of, well, everything else they do. I'd like to hear from Simon about their track record before I have to defend it actually, since he made the claim on it.
User avatar
Thanas
Magister
Magister
Posts: 30779
Joined: 2004-06-26 07:49pm

Re: FBI outed in attempt to obtain SSL certificate

Post by Thanas »

Gaidin wrote:
Thanas wrote: That is a bad claim to make, especially considering you have nothing to show that this is true.
This investigation is pretty much where the internet has a soap box, I'm pretty sure I can make an open statement about that based on this thread alone. But I'm not at all sure what the hell their "track record", as Simon puts it, is given how wide of a swath of of investigations the FBI handles. Child pornography/rape? Criminal organizations(believe we might even have a thread on this one opened just recently)? Public corruption? White collar crime?

What is their track record? I'd say their track record is pretty good. Just because you have one person who leaked information and is charged with a crime that happens to be in the Espionage Act(and yes, the wording of the crime fits exactly what he did so the investigation is legitimate), doesn't in any way detract from about 99.9% of, well, everything else they do. I'd like to hear from Simon about their track record before I have to defend it actually, since he made the claim on it.
You made the claim nobody would be outraged if they used similar methods to snatch some other criminals. Which is blatantly false. I also find your insistence on "spotless track record lol" pretty misleading, considering the NSA was illegally spying on other americans with the collusion of the entire security apparatus.
Whoever says "education does not matter" can try ignorance
------------
A decision must be made in the life of every nation at the very moment when the grasp of the enemy is at its throat. Then, it seems that the only way to survive is to use the means of the enemy, to rest survival upon what is expedient, to look the other way. Well, the answer to that is 'survival as what'? A country isn't a rock. It's not an extension of one's self. It's what it stands for. It's what it stands for when standing for something is the most difficult! - Chief Judge Haywood
------------
My LPs
User avatar
Gaidin
Sith Devotee
Posts: 2646
Joined: 2004-06-19 12:27am
Contact:

Re: FBI outed in attempt to obtain SSL certificate

Post by Gaidin »

I'm not even responding to the NSA's track record here since this is about the FBI's warrant. The thing is this is about the FBI's warrant and their execution of it. You can say what you want about their warrant. When their warrant comes out for a trial, and it will, theoretically, they've got to be very careful, or anything that comes from that warrant gets thrown out as evidence. The NSA messing with their secret warrants has a record for being messier because as an intelligence agency, their information doesn't come out to public light. There's a very damn big difference between the two agencies, and not even White Haven and his soap box can deny that one.
User avatar
Thanas
Magister
Magister
Posts: 30779
Joined: 2004-06-26 07:49pm

Re: FBI outed in attempt to obtain SSL certificate

Post by Thanas »

Gaidin wrote:I'm not even responding to the NSA's track record here since this is about the FBI's warrant. The thing is this is about the FBI's warrant and their execution of it. You can say what you want about their warrant. When their warrant comes out for a trial, and it will, theoretically, they've got to be very careful, or anything that comes from that warrant gets thrown out as evidence. The NSA messing with their secret warrants has a record for being messier because as an intelligence agency, their information doesn't come out to public light. There's a very damn big difference between the two agencies, and not even White Haven and his soap box can deny that one.
Is the FBI evidence gathering public record?
Whoever says "education does not matter" can try ignorance
------------
A decision must be made in the life of every nation at the very moment when the grasp of the enemy is at its throat. Then, it seems that the only way to survive is to use the means of the enemy, to rest survival upon what is expedient, to look the other way. Well, the answer to that is 'survival as what'? A country isn't a rock. It's not an extension of one's self. It's what it stands for. It's what it stands for when standing for something is the most difficult! - Chief Judge Haywood
------------
My LPs
User avatar
Gaidin
Sith Devotee
Posts: 2646
Joined: 2004-06-19 12:27am
Contact:

Re: FBI outed in attempt to obtain SSL certificate

Post by Gaidin »

Thanas wrote:
Gaidin wrote:I'm not even responding to the NSA's track record here since this is about the FBI's warrant. The thing is this is about the FBI's warrant and their execution of it. You can say what you want about their warrant. When their warrant comes out for a trial, and it will, theoretically, they've got to be very careful, or anything that comes from that warrant gets thrown out as evidence. The NSA messing with their secret warrants has a record for being messier because as an intelligence agency, their information doesn't come out to public light. There's a very damn big difference between the two agencies, and not even White Haven and his soap box can deny that one.
Is the FBI evidence gathering public record?
Sure it is. Granted I say theoretically at the moment. The FBI for cases that involve the intelligence community(as it is part of the IC) can use the secret courts for warrants in certain cases, but their evidence has to come out in trial unless you get weird cases like when they caught the Russian spies and a diplomatic deal followed. The accused gets to see the evidence. I say theoretically right now, because the endgame accused(Snowden) is sitting in Russia.
Simon_Jester
Emperor's Hand
Posts: 30165
Joined: 2009-05-23 07:29pm

Re: FBI outed in attempt to obtain SSL certificate

Post by Simon_Jester »

There are historical precedents for US federal law enforcement being actively used, in secret, to suppress and dismantle political organizations it doesn't like. Such as the 1919 Red Scare, or COINTELPRO. Those instances are many decades in the past- roughly 100 and 50 years ago, respectively. But it is hardly unrealistic for us to worry about the possibility that's it's happening again.


TheHammer wrote:Its not that I "dont think like a physicist" its that I expect "what-if" scenarios to be semi-plausible if I'm supposed to respond to them.
Why?

The whole point of a hypothetical scenario is to explore what the rules are, by creating a test case. In this case, my concern is that the FBI is claiming that a warrant gives them the right to search an arbitrarily large pile of stuff to find what they're looking for, and that they can be trusted to do this in an honest fashion.
2) If they would be entitled to do that, do we need any unusual safeguards to ensure that this enormous search is not abused, by the FBI or by third parties?
As noted, they aren't entitled. The FBI sought a warrant for a search with a specific scope and were given that warrant. By technical neccessity, they would be given physical access to everyone's property, but would be forbidden from accessing anything outside of the scope of their warrant. Doing so would be a crime.
Are any special safeguards required to ensure that this crime is not committed? The temptation to use this massively powerful access tool is high, because the potential to use it to identify other criminals is large, if nothing else.

This kind of surveillance power borders on the legal equivalent of weapons of mass destruction- having all this knowledge would give you so many leads, potentially. Even if you don't want to become a totalitarian surveillance state, it's still tempting.

When you hand someone a weapon that powerful, you take precautions to ensure that it is not used carelessly, that no one person can abuse it easily, and so on.

What are the precautions here? Is it enough to say "no, the FBI wouldn't do that, because that would be a crime!"
They've told the court what they have been doing, and what they intend to do. That's why they were given a warrant. It would be as safe as any other search law enforcement conducts. If you're concerned that your law enforcement agency is breaking the law itself, then why stop your concerns with forcing lavabits to legally turn over the key? They could just as easily "beat it out of him", or send in agents to steal it.
If a guy gets beaten up, or a physical place is burgled and stolen, there's physical evidence afterwards. There is a place to begin investigating the possibility of the FBI committing a crime- just as there is if drugs disappear from an evidence locker, or in any other form of law enforcement misconduct.

With a big pile of data, the only way to know what's going on is to actively monitor the data transfer itself, and ensure that the device is being used as it's supposed to, and that no unauthorized decryption or copying is going on.
Law enforcement agencies have internal affairs divisions specifically to protect against them committing crimes themselves, but I suspect anyone who doesn't trust the FBI to begin with isn't going to trust their internal affairds.
Is internal affairs willing to audit this project directly and publish results related to it? Or is the whole thing too secret for us to know it's being investigated in the first place?
I don't view government agencies as unchanging monoliths. Lessons are learned, personnel change. Are we talking about the track record from the Hoover days of the FBI, or are we talking more recently? Are we lumping the FBI in with the NSA?

I see pissing and moaning all the time about "warrantless NSA searches", and yet when the FBI goes to court, gets a judge to sign off on the warrant - a process that allows the owner of the buisness his day in court to make counter arguments, what more do you expect? Do you have a recent example (in the last 10 years) of the FBI abusing a search warrant? If not, then why are you so quick to presume they will?
If this were a question of the original "Lavabit decrypts and hands over one person's metadata" scheme, I wouldn't really have a problem. But the much grander "give us access to peer at the traffic of every Lavabit user, without being allowed to contact your attorney or tell your clients this is going on" scheme the FBI escalated to strikes me as troublesome... precisely because it is so broad.

While I can easily imagine the necessity of such a scheme, I'm opposed to treating it like a 'normal' execution of a search warrant. This is the equivalent of giving the FBI the keys to open every safe deposit box in a bank; it's not wrong in and of itself, but I'd really want to make sure there were processes in place to monitor the honesty of the search in real time, not just after the fact when internal affairs gets around to checking up on it.
As far as I can tell, in Hammermerica, I have a right to privacy, due process, and so forth... but only until it becomes inconvenient for the state to allow me those rights. Which means I don't really have any rights at all.
Actually, in Hammermerica, aka the real world, you absolutely have your right to privacy and due process. But when that due process has been done, you've had your day in court and lost, then you don't have the right to throw up your hands and scream "GOVERNMENT OPPRESSION!".
Except when the FBI is telling me not to communicate with my lawyer, in which case I don't have a right to scream at all, and the predictable botch I make of handling a legally touchy situation on my own is entirely my fault.

[Hint: if you don't let people talk to their lawyers, don't be surprised if they react to law enforcement in dramatic and absurd ways that belong in Hollywood instead of the real world. There's a reason being a lawyer is a highly trained profession for people of above-average intelligence and self control.]
Who would this hypothetical neutral entity be? Would you like some sort of technical representative from the courts? That would be reasonable, but still part of the "government" so to speak.
I'd take if if the results could be published in an open-ish fashion (i.e. available on request should the ACLU wind up taking a case on this guy's behalf).

Arguably, my biggest single complaint with government overreach is that so much of it occurs in secret that we can't actually make any confident statements about whether it happens or not. We can't know the decision process for deciding to blow up an American citizen abroad with a drone strike*. We can't know the conditions under which the NSA monitors our personal communications. And in a case like this we may not even know what pressure the FBI is putting on private actors to reveal information about us to the state, because they're under a gag order.

This is the ideal climate for breeding distrust of the government. The problem is not just that the government is doing things that might be questionable. It's not that we assume in advance that all federal security organs are full of bad people. It's that they won't tell us what's going on, and often work very long and hard to punish anyone who does tell us what's going on.

How can you trust someone who won't tell you why they kill and spy on people, and in fact responds to anyone who does tell you that by trying to kill or spy on them?

This is not a reasonable way for a democratic government to behave, unless it wants to rule by nebulous fear of state surveillance.
_______________________

*(something we've discussed in the past that I mention purely as an example; if you wish to say anything about the subject right now I won't contest it because I don't care about arguing it with you).
This space dedicated to Vasily Arkhipov
Grumman
Jedi Council Member
Posts: 2488
Joined: 2011-12-10 09:13am

Re: FBI outed in attempt to obtain SSL certificate

Post by Grumman »

Gaidin wrote:
Thanas wrote:Is the FBI evidence gathering public record?
Sure it is. Granted I say theoretically at the moment. The FBI for cases that involve the intelligence community(as it is part of the IC) can use the secret courts for warrants in certain cases, but their evidence has to come out in trial unless you get weird cases like when they caught the Russian spies and a diplomatic deal followed. The accused gets to see the evidence. I say theoretically right now, because the endgame accused(Snowden) is sitting in Russia.
It's only been two months since we were being told that federal law enforcement agencies were laundering illegally obtained intelligence by "parallel construction". Do you think the FBI is above pulling the same trick here?
User avatar
Gaidin
Sith Devotee
Posts: 2646
Joined: 2004-06-19 12:27am
Contact:

Re: FBI outed in attempt to obtain SSL certificate

Post by Gaidin »

Simon_Jester wrote:There are historical precedents for US federal law enforcement being actively used, in secret, to suppress and dismantle political organizations it doesn't like. Such as the 1919 Red Scare, or COINTELPRO. Those instances are many decades in the past- roughly 100 and 50 years ago, respectively. But it is hardly unrealistic for us to worry about the possibility that's it's happening again.
If you're going to appeal to cases for which the FBI did a 180 in their protocols after the director died and the Congress passed legislation that heavily changed their director's powers and limited his terms, I'm just going to back out now and tell you to have fun.
Simon_Jester
Emperor's Hand
Posts: 30165
Joined: 2009-05-23 07:29pm

Re: FBI outed in attempt to obtain SSL certificate

Post by Simon_Jester »

I wouldn't be worried about that if it weren't for the circumstantial evidence suggesting that in the past 12 years we've seen yet another 180. When Hoover died, the FBI became a much less political and oppressive organization- this happening around the time of the Church Committee.

The Church Committee also got the CIA barred from carrying out assassinations. Which they are now doing again, post-9/11, as a counterterrorism tactic.

We already know 9/11 was the catalyst for a major rollback of civil liberties, a rise in government secrecy and surveillance, and the removal of restraints imposed on the intelligence and security organs in the more liberal times of the 1970s, '80s, and '90s.

It is reasonable to worry that other federal agencies have been driven, or might soon be driven, by the War on Terror to start revisiting the bad old days.

Does this mean that we should default to assuming that the FBI must be abusing its powers? No.

Does it mean we have cause to want some kind of special concession to transparency when the FBI does exactly what it would want to do, if it happened to be abusing its powers anyway? I think so, yes.
This space dedicated to Vasily Arkhipov
User avatar
Gaidin
Sith Devotee
Posts: 2646
Joined: 2004-06-19 12:27am
Contact:

Re: FBI outed in attempt to obtain SSL certificate

Post by Gaidin »

Simon_Jester wrote:I wouldn't be worried about that if it weren't for the circumstantial evidence suggesting that in the past 12 years we've seen yet another 180. When Hoover died, the FBI became a much less political and oppressive organization- this happening around the time of the Church Committee.
Except I'd say the policies of Hoover were as a result of the Power of Hoover(TM). What you may be seeing among certain agencies and wanting to spread to other agencies by proxy(or not, as the case may be at times) is a result of laws passed in the early 2000s. If you want to discuss things, drop the paranoia regarding incidents from the early to mid 20th century regarding the actions and policies of people that have already been addressed via legislation that is still in affect. Reasonable fear is one thing. Paranoia is not.
Grumman
Jedi Council Member
Posts: 2488
Joined: 2011-12-10 09:13am

Re: FBI outed in attempt to obtain SSL certificate

Post by Grumman »

Simon_Jester wrote:Does this mean that we should default to assuming that the FBI must be abusing its powers? No.
We should assume the FBI must be abusing its powers because we know it's abusing its powers. Like actively blocking a terror suspect's constitutionally protected right to counsel for two days before a judge - on her own initiative - forced them to stop.
User avatar
NettiWelho
Youngling
Posts: 91
Joined: 2009-11-14 01:33pm
Location: Finland

Re: FBI outed in attempt to obtain SSL certificate

Post by NettiWelho »

In this scenario it isn't even the FBI that needs to abuse its power for power to be abused; NSA is capable of doing that themselves after they get the keys legally acquired by the FBI and use it for their own purposes.
Replicant
Padawan Learner
Posts: 227
Joined: 2012-10-03 11:11am

Re: FBI outed in attempt to obtain SSL certificate

Post by Replicant »

Quick question here.

Is there some way that having access to the system would give the FBI access to all messages sent over the entire life of Snowden using the email system? Because I would assume that the instant this hit the news Snowden would have completely sanitized his email and moved to an email service run through a country that generally gives the United States the finger when it makes requests.

Which leads to a second question.

Did the FBI really think they were going to learn anything here or was this a fishing expedition from the start with the goal of either acquiring the keys to the kingdom (a complete victory) or getting an inaccessible email service shut down so no one can use it to avoid being spied upon (almost as complete a victory).

To me the FBI, NSA, and the spymongers of the US Government that want to be able to spy on every email on the planet won a huge victory for their side when Lavabit shut down.
Post Reply