Change You Can Believe In! (online wiretaps)

[aerius]

AFP link via Google

US rights group concerned by Web wiretap plans

(AFP) – 3 hours ago

WASHINGTON — A digital rights group expressed concern on Monday over reports that the Obama administration is drawing up legislation to make it easier for US intelligence services to eavesdrop on the Internet.

The New York Times reported Monday that the White House intends to submit a bill to Congress next year that would require all online services that enable communications to be technically capable of complying with a wiretap order.

The Times said it would require encrypted email transmitters like BlackBerry, social networks like Facebook and services like Skype to provide the capability to intercept and unscramble encrypted messages.

Seth Schoen, staff technologist at the San Francisco-based Electronic Frontier Foundation (EFF), said requiring "government-mandated back doors" in communications systems would be a "recipe for disaster."

"Throughout the 1990s, EFF and others fought the 'crypto wars' to ensure that the public would have the right to strong encryption tools that protect our privacy and security -- with no back doors and no intentional weaknesses," Schoen said in a blog post.

"We fought in court and in Congress to protect privacy rights and challenge restrictions on encryption, and to make sure the public could use encryption to protect itself," he said.

"For a decade, the government backed off of attempts to force encryption developers to weaken their products and include back doors, and the crypto wars seemed to have been won," Schoen said.

"Now the government is again proposing to do so, following in the footsteps of regimes like the United Arab Emirates that have recently said some privacy tools are too secure and must be kept out of civilian hands," he said.

"Intentionally weakening security and including back doors is a recipe for disaster," Schoen said. "'Lawful intercept' systems built under current laws have already been abused for unlawful spying by governments and criminals.

"Trying to force technology developers to include back doors is a recipe for disaster for our already-fragile online security and privacy," Schoen said.

"It takes a page from the world's most repressive regimes' Internet-control playbook. This is exactly the wrong message for the US government to be sending to the rest of the world," he said.

The Times said federal law enforcement and national security officials are seeking the new regulations because extremists and criminals are increasingly communicating online rather than using phones.

"We're talking about lawfully authorized intercepts," Federal Bureau of Investigation general counsel Valerie Caproni told the newspaper.

Copyright © 2010 AFP. All rights reserved

How y'all liking that hope & change? Trying to enforce this will be such a fucking nightmare that it won't even be funny, and it's just asking for heavy privacy rights violations & abuse by law enforcement and government agencies.

[Resinence]

Encryption doesn't work like the legislators seem to think... you can't simply demand that it be "unscrambled", the companies involved would either have to snoop and log hashes and keys (making that encryption completely fucking worthless in practice), or build in intentional weakness (same result). Why not just legislate that civilians using data encryption is illegal? Same functional result, just as ethically bankrupt.

Yet another example of out-of-touch people treating the internet like old media, arguments that it's "just the same as wiretapping" and "but they can only do it with a court order just like phones" in 3...2...1 oh wait, too late

[Ryan Thunder]

We wouldn't be able to hide our personal things that nobody gives a shit about from certain people we'll never meet unless those personal things prove that we've done something dreadfully illegal. How awful and draconian!

Am I missing something here...?

[Resinence]

The point is it's NOT like telephone, you can't eavesdrop on encryption without breaking it.

PS Encryption may be used to protect corporate secrets and oh stuff like peoples private and or financial information over unsecure networks. But hey, IF YOU HAVE NOTHING TO HIDE WHY DO YOU NEED IT .

[Ryan Thunder]

The point is it's NOT like telephone, you can't eavesdrop on encryption without breaking it.

Right, which means they'd need the keys and what not used to decrypt it at the other end, if it still works that way. If its not possible at all, well, I guess that's a problem.

PS Encryption may be used to protect corporate secrets and oh stuff like peoples private and or financial information over unsecure networks. But hey, IF YOU HAVE NOTHING TO HIDE WHY DO YOU NEED IT .

From other people, yes. Why do we need to hide it from the government?

[Resinence]

Well if someone has a database of encryption keys then it essentially renders encrypted data much less secure simply by the key copy's existing. Thats the complaint, the possibility for abuse of power is tremendous. Also the possibility of built in backdoors in encryption software for the government which will NEVER be found by crackers no-sir.

From other people, yes. Why do we need to hide it from the government?

Yes, well this argument comes up in every single thread complaining about government intrusion into privacy, some people just want privacy for privacy's sake, some think the government should see everything. It's really not worth rehashing. I happen to think the right to privacy should extend to those who are your government.

EDIT: I realise this law would not be a data free-for-all, only used with a court order etc, however digital wiretapping is a slippery slope, hence crypto wars mentioned. And the US doesn't have a great track record with this stuff.

[Alyeska]

From other people, yes. Why do we need to hide it from the government?

In order to hide it from other people you have to hide it from the Government. There is absolutely no way for the Government to have a special back door that is immune. Any backdoor into encryption will be abused. It can and WILL be used by criminals to intercept information.

This proposal would destroy the internet economy. My bank does a ton of work through the internet. These rules? We would be forced to stop using the internet for any information transmission. We HAVE to have robust encryption to protect our customers information. Internet banking would effectively cease to exist in the United States under this proposal.

[Resinence]

Hope I am not spamming but crypto is something I am actively involved in, this stuff is all a rehash of the original battle when it moved into the consumer and corporate space over 10 years ago. See for yourself.

1998

[Tanasinn]

There is absolutely no way for the Government to have a special back door that is immune.

The government, rife with corporate corruption, is not trustworthy besides. See international copyright law dickery. Or the Supreme Court's ruling that infinite corporate bribery - er, I mean "campaign funding" - is legal.

[fgalkin]

From other people, yes. Why do we need to hide it from the government?

What's to prevent some civil servant from selling or losing the data? Especially when there's millions of dollars involved?

Have a very nice day.
-fgalkin

[Alyrium Denryle]

From other people, yes. Why do we need to hide it from the government?

What's to prevent some civil servant from selling or losing the data? Especially when there's millions of dollars involved?

Have a very nice day.
-fgalkin

Or worse...

What happens when we have something like the Nixon administration spying on everyone? Someone of such a bent could use this system to dig up dirt on political detractors, or even just arrest them. Afterall, the Executive Branch can now, on their say say only, label someone a terrorist and then invoke state secrets and executive privilege to prevent having to actually justify it.

[Ariphaos]

Right, which means they'd need the keys and what not used to decrypt it at the other end, if it still works that way. If its not possible at all, well, I guess that's a problem.

You guess?

I'd like to see you explain how you expect this to work with public-private key schemes.

From other people, yes. Why do we need to hide it from the government?

Which is why the government has subpoena power. Against what this bill is intended for, it is utterly useless versus someone who knows what they are doing. It just creates additional risks for transactions that the government has no particular need to observe in transit in order to obtain the desired information.

[Uraniun235]

How y'all liking that hope & change?

Well I've long since given up hope on any electable Presidential candidate actually being willing to voluntarily curtail the power and authority of the Executive, let alone pass up an opportunity to expand it, so it comes as no surprise to me. Don't worry, I'm sure your day is coming too, given your own government's deep lust for becoming more like America.

That said:

The New York Times reported Monday that the White House intends to submit a bill to Congress next year that would require all online services that enable communications to be technically capable of complying with a wiretap order.

The Times said it would require encrypted email transmitters like BlackBerry, social networks like Facebook and services like Skype to provide the capability to intercept and unscramble encrypted messages.

Really? So if I build a chat program the feds expect me to put in extra work to give them an easier time of snooping? Fucking greedy.

[PeZook]

Is...there a reason the government can't just get a warrant and then install snooping programs on computers it needs to spy on? Why go to all this ridiculous lenghts to implement a bloated and unnecessary solution?

[Aaron]

Is...there a reason the government can't just get a warrant and then install snooping programs on computers it needs to spy on? Why go to all this ridiculous lenghts to implement a bloated and unnecessary solution?

Yeah, they have to prove why they need it. With this they can do whatever they want. If the last 10 years have proven anything its that the US government wants to be able to spy on its citizens at will.

[Andrew J.]

Is...there a reason the government can't just get a warrant and then install snooping programs on computers it needs to spy on? Why go to all this ridiculous lenghts to implement a bloated and unnecessary solution?

Time may be critically short in emergency situations, and speed is pretty important the rest of the time, too. The government wants to be able to begin surveillance as soon as possible after it gets the go-ahead.

[Ryan Thunder]

Right, which means they'd need the keys and what not used to decrypt it at the other end, if it still works that way. If its not possible at all, well, I guess that's a problem.

You guess?

I'd like to see you explain how you expect this to work with public-private key schemes.

I've forgotten exactly how those work. If that's impossible to do without totally compromising everything for everybody, then I'll agree that it's a bad idea.

[PeZook]

Time may be critically short in emergency situations, and speed is pretty important the rest of the time, too. The government wants to be able to begin surveillance as soon as possible after it gets the go-ahead.

I don't see how this is in any way relevant. Time is short - so what? You get a warrant, the next day your break into the house and install trackers on the suspect's computers and tap the phones.

So far, the world didn't end because there's always been a slight delay between getting the warrant and installing the actual taps. It's not like a potential terrorist will be sitting at his keyboard going "YES I AM PLANNING TO DESTROY AMERICA" all the time, so I don't see how taking a day or so to begin listening in will somehow lose PRECIOUS INTELLIGENCE ABOUT A TICKING NUKE ABOUT TO GO OFF OMG WE MUST TORTURE THE SUSPECT!!!

Hell, 90% of all actual intelligence will probably be gained by simply raiding the suspect's hard drives, rather than listening to his Facebook chats in real time.

[Jaepheth]

With public key encryption you use one-way functions to create a method of communicating securely even if a third party can monitor all the communications between the two of you. So basically, you generate an encryption function which anyone can look up and use to send you messages, but only you know the inverse function so only you can read the encrypted messages. You then use the senders public encryption function to send replies.

For example, if I give you two numbers A and B you can easily tell me what A*B is, but If I give you some 200 digit number you'd be hard pressed to tell me what its factors are.


You could also use a one time pad for encryption, which is just a list of passwords each of which is only used once. These are unbreakable, but require prior collaboration to set up.

Long story short: If the criminals have any idea what they're doing, eavesdropping on their internet communications is a waste of time (unless the government has groundbreaking algorithms that they're keeping secret). This law would be used to go after your petty criminals who don't know what they're doing and just send unencrypted messages. In my mind this makes it more likely they'll be catching more scapegoats than actual viable threats.


EDIT: Well, maybe not a complete waste of time. You could still know frequency of communications and maybe trace locations.

[Gil Hamilton]

Things are changing rapidly nowadays, than even I'm feeling sluggish on the issue. I'm 28 and even I'm somewhat surprised at the sheer amount of information that we can instantly bring to our phones and computers from ANYWHERE. I didn't even have a cellphone until college; I used to plan meeting my friends in advance with locations and if necessary payphones because it took a long time for me to shed my parent's conceit that cellphones were "electronic leashes that let people bother you from anywhere" rather than indispensible tools for functioning in society.

Nowadays, modern society is entirely dependent on the innerconnectivity allowed by the internet. The only bill I pay by actually mailing a check is my rent (it's quicker via post, even still). I shop online and have the products arrive a few days later (in my youth it was "please allow six to eight weeks for delivery"), both aspects of which are highly governed by secure encryption, both by the financial transactions and the functioning of the post office which is highly electronic now.

I'm 28 and I find myself having trouble keeping up. My parents are terrible at using anything electronic and my grandmother thought it was some sort of weird voodoo before she passed. If I'm having trouble getting a full grip on these issues and technology is changing so rapidly that my mode of thinking is lagging behind, how the fuck can we trust the elderly farts in Congress to possibly keep up in order to make any form of informed decision. The mean age of the members of the US Senate is sixty and the house 55. They are all in the same boat as my parents, trying to handle technology that virtually came into existence overnight that requires an entirely different way of thinking about things. Why the hell should they even be allowed to make laws on something they are virtually guaranteed to not really get and rely on the dumbed down cliff notes of aides or the propaganda of lobbyists?

In this case, they are trying to form policy based on a dumbed down metaphor of how the internet works. They honestly don't know that you can't deliberately introduce a weakness in encryption without rendering it useless, that this isn't merely like a wiretap on a phone. How could they? Yet they make policy. That's completely nuts.

[Uraniun235]

Is...there a reason the government can't just get a warrant and then install snooping programs on computers it needs to spy on? Why go to all this ridiculous lenghts to implement a bloated and unnecessary solution?

Entering someone's home could inadvertently leave evidence that would tip them off that someone had tampered with their computer... or worse, present the risk that they come home while you're tampering with their computer. (That's an interesting question: if I come home and find some g-men installing a keylogger on my computer, can I throw them out? Would I be committing a crime by removing the keylogger?)

But more importantly, it's more common for people to have laptops that they take with them while they're away from home, which makes it much harder to get covert access to their computer. Couple that with someone who might hop around different locations with internet access, and it could be very difficult to intercept data in transmission.

The idea behind this initiative is that no matter where you are, no matter what hardware you use, the data can still be intercepted by the government.

[bilateralrope]

If this passes, how much will it screw over the US economy by forcing any company that relies on encryption to move overseas or close down ?

[Phantasee]

Why are you so hopelessly naive, Ryan? I've never seen anyone actually make the "if you've got nothing to hide" argument seriously.

The US is founded on a basic mistrust of authority. Why would the people who keep guns in case of tyranny be okay with this shit?

[General Zod]

Why are you so hopelessly naive, Ryan? I've never seen anyone actually make the "if you've got nothing to hide" argument seriously.

The US is founded on a basic mistrust of authority. Why would the people who keep guns in case of tyranny be okay with this shit?

I guess corruption doesn't exist in Ryan's world. I'm sure government employees would never use that power to shut down political dissent after receiving proper bribes donations from various corporations.

[Coyote]

How y'all liking that hope & change?

I may be whistling past the graveyard, but considering what kind of wonderful "anti-terror" policies we'd be facing with Vice-President Palin, I'll continue taking my chances.

Trying to enforce this will be such a fucking nightmare that it won't even be funny, and it's just asking for heavy privacy rights violations & abuse by law enforcement and government agencies.

Definitely, but I'm sure there are thousands of police officers lying around doing nothing with time on their hands to surf the net looking for subversives. I don't see this surviving too long; privacy advocates and anti-big-government types will be all over it. The sheer magnitude of what would be needed to actually enforce this will be... well, too big to do.

....of course, we do still have the USA Patriot Act...