Slashdot Log In
Lawyers Would Rather Fly Than Download PGP
Posted by
kdawson
on Mon Apr 28, 2008 07:19 PM
from the fly-once-to-exchange-keys dept.
from the fly-once-to-exchange-keys dept.
An anonymous reader writes "The NYTimes is running a front-page story about lawyers for suspects in terrorism-related cases fearing government monitoring of privileged conversations. But instead of talking about the technological solutions, the lawyers fly halfway across the world to meet with their clients. In fact, nowhere in the article is encryption even mentioned. Is it possible that lawyers don't even know about PGP?" The New Yorker has a detailed piece centering on the Oregon terrorism case discussed by the Times.
Related Stories
Submission: Lawyers would rather fly than download PGP by Anonymous Coward
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Security not just about encryption. (Score:5, Insightful)
Is it possible that the submitter doesn't even know about keyloggers, passive listening devices (for phones), compromised encryption binaries, vulnerabilities in protocols, etc?
If the goddamn NSA can't snoop on an encrypted conversation between a lawyer & client, then frankly, they're not doing their job
Re:Security not just about encryption. (Score:4, Insightful)
Parent
Re:Security not just about encryption. (Score:5, Insightful)
It's got to be decrypted at one end of the other - there's not much PGP can do about a compromised terminal, keyloggers, passive listening devices (reconstructing passwords from the sound of keyboard tapping), etc.
Basically, a well-resourced, determined attacked doesn't have to crack PGP itself.
Parent
Re:Security not just about encryption. (Score:5, Insightful)
Parent
Re: (Score:3, Insightful)
Re: (Score:3, Insightful)
Remember that we are talking about private discussions between lawyers and clients.
Thats supposed to be highly confidential to start with.
Re: (Score:3, Informative)
Re:Security not just about encryption. (Score:5, Insightful)
Do US courts seriously consider these issues any longer? The majority of the constitution is at best nod and wink territory these days. They tap whoever they want; they jail whoever they want; and as for admissible in court, who says it'll even get to court? Who says you'll even get a phone call? This isn't your father's USA.
Parent
Re: (Score:3, Interesting)
Anyway, who says the NSA can't crack PGP? Some crypto-fanboy showing off how much smarterer he is than lawyers who make no claim of security expertise and have a professional obligation to err on the side of caution?
Re:Security not just about encryption. (Score:4, Insightful)
Parent
Re: (Score:3, Funny)
Re: (Score:3, Funny)
Re:Security not just about encryption. (Score:5, Funny)
You can try mine if you like: 192.168.1.1
Parent
Re:Security not just about encryption. (Score:5, Funny)
Now I'll just change your router settings so you can't access the inter...
Parent
Re: (Score:3, Funny)
Re: (Score:3, Funny)
Try hacking my IPv6 only machine at ::1
Re:Security not just about encryption. (Score:5, Insightful)
Parent
Re:Security not just about encryption. (Score:4, Interesting)
If someone has a 12-character password alpha-numeric password the keyspace is about 104^12. If you can determine when the shift key is pressed and which of the 4 rows of keys each character is in, you can make that 13^12, which is 36 bits less keyspace -- almost a 50% reduction over the original 80 bits.
Parent
Re:Security not just about encryption. (Score:4, Informative)
However, the FBI (and by loan or extension, the NSA) has some very good black bag people, and they are much more likely to add in a hardware keylogger or currently-undetectable rootkit nowadays. That's how the FBI got crucial evidence against Nicodemo Scarfo, Jr., son of former mob boss Little Nicky Scarfo, adding a hardware keylogger to grab his PGP password to allow them to decrypt his messages in concert with his private key, also copied at the time.
Parent
Re:Security not just about encryption. (Score:5, Insightful)
"Is it possible that lawyers don't even know about PGP?"
Parent
Communication more than just writing (Score:5, Insightful)
If you take into consideration that communication (as we are told) is 70% non-verbal, then any half decent lawyer will make sure he/she is able to see the client face to face. It is impossible to take a good history from a person if you can't see them, let alone hear their voice.
Given this fact, it is not a surprise that lawyers want to meet their clients. Yes and there are limitations to PGP that won't ensure privacy especially when you are opening lines of communication in an already hostile environment. There are things you just can't know unless you are physically there.
Parent
Re:Communication more than just writing (Score:4, Informative)
PORTLAND, Ore. Thomas Nelson, an Oregon lawyer, has lived in a state of perpetual jet lag for the last two years. Every few weeks, he boards a plane in Portland and flies to the Middle East to meet with a high-profile Saudi client who cannot enter the United States because he faces charges here of financing terrorism.
Mr. Nelson says he does not dare to phone this client or send him e-mail messages because of what many prominent criminal defense lawyers say is a well-founded fear that all of their contacts are being monitored by the United States government.
Parent
What makes you think they are permitted to encrypt (Score:5, Insightful)
Even if they knew this for sure, the jailer is under no obligation to provide access to PGP or even a computer, and he would likely be an idiot if he did provide PGP to the inmates.
Parent
Re:Security not just about encryption. (Score:5, Insightful)
If the government is tapping your phone lines, what makes you think they aren't intercepting your e-mail? I'm sure PGP would avoid problems like the U.S. government installing a keylogger on your system, or just sending a national security letter demanding access to your e-mails on pain of imprisonment as an accomplice to terror. Oh wait, it doesn't.
I'd rather take the airplane flight be more sure that I'm not getting bugged.
Parent
Re:Security not just about encryption. (Score:4, Funny)
And then the bastards will install a 3 year-old to kick your seat from behind, an incessant talker who loves chatting about lolcats next to you and a screaming infant in the seat in front just to bug you. You can't possibly win and they'll all be wearing a wire.
Parent
So where is the downside? (Score:5, Insightful)
Re: (Score:3, Insightful)
S/MIME, anyone? (Score:5, Interesting)
What is it with the Slashdot crowd and PGP? What's wrong with S/MIME?
I can say with some authority, having been evaluating and testing it for my company for some months now, that it is natively supported by current versions of the 3 major email clients (Outlook, Thunderbird, and Apple Mail), and that their implementations are, by and large, compatible.
So...are there any particular issues with S/MIME that make PGP a significantly more desirable solution?
Dan Aris
Re:S/MIME, anyone? (Score:5, Funny)
Everybody hates a mime.
Parent
Re:S/MIME, anyone? (Score:5, Interesting)
What is it with the Slashdot crowd and PGP? What's wrong with S/MIME?
I can say with some authority, having been evaluating and testing it for my company for some months now, that it is natively supported by current versions of the 3 major email clients (Outlook, Thunderbird, and Apple Mail), and that their implementations are, by and large, compatible.
So...are there any particular issues with S/MIME that make PGP a significantly more desirable solution?
Dan Aris
Parent
Re: (Score:3, Funny)
Re:S/MIME, anyone? (Score:5, Interesting)
OpenPGP software allows you to easily self-generate valid keys. Doing the same with S/MIME (self-signing certificates) is really obnoxious. Further, OpenPGP clients tend to support a web-of-trust introduction model which is strictly better for actual security than the centralized commercial PKI model that S/MIME software tries to force on users.
For sending secure messages within a medium to large sized organization there is some argument for S/MIME using a local CA, but even then simply emulating the same effect with a organization PGP key signer and key server is probably cleaner.
Parent
Re: (Score:3, Insightful)
The Web of Trust of PGP doesn't give anyone else your private key. It only gives attestation to your identity. Even if one of your contacts was wretched villainous scum he can't compromise your key, the worst he can do is issue transitive trust (ab)using your trust of him.
Re:S/MIME, anyone? (Score:4, Informative)
If the NSA compromises your CA, the best they can do is create another certificate which pretends to be yours. If the destination already had your certificate, then the public key they have won't match your private key.
The grandparent needs to review PKI.
Parent
Re: (Score:3, Interesting)
Who controls the certificate authority that issues the certificates?
In our case, me :-)
We're just using Microsoft's PKI (yeah, I'd rather use something OSS, but requirement #1 is that it work well with Outlook, and I wasn't able, with my limited experience, to get anything else set up to do so...), so the certificate authority is one of our servers. Naturally, it means that anyone who wants to be able to use & trust our user certificates is going to have to install our CA certificate, but that's the price of getting it all for free...
Dan Aris
Other considerations (Score:5, Funny)
Encryption not the answer here... (Score:3, Insightful)
Are you dumb? (Score:4, Insightful)
Hell, they could just torture the password out of the prisoner - turns out that the Land of the Free and the Home of the Brave does that kind of thing now.
Extra: Lawyers don't want to go to jail... (Score:3, Insightful)
An e-mail:
Attn Client,
Please download PGP in violation of US export control laws.
Your accomplice,
your lawyer
Or maybe tell them in person, and then use PGP to communicate, indicating that you knew and ex post facto helped them pay off their violataion US export laws.
Fact of the matter is, is is illegal to get encryption software to some parties as individuals, and some countries in mass. And I'm sure the clients referenced in the article are on the verboten list.
Re: (Score:3, Interesting)
Zimmermann challenged these regulations in a curious way. He published the entire source code of PGP in a hardback book, via MIT Press, which was distributed and sold widely. Anybody wishing to build their own copy of PGP could buy the $60 book, cut off the covers, separate the pages, and scan them using an OCR program, creating a set of source code text files. One could then build the application using the freely available GNU C Compiler. PGP would thus be available anywhere in the world. The claimed principle was simple: export of munitionsâ"guns, bombs, planes, and softwareâ"was (and remains) restricted; but the export of books is protected by the First Amendment. The question was never tested in court in respect to PGP, but had been established by the Supreme Court in the Bernstein case.
More worryingly why do you agree with the spirit of the law? are foreigners not allowed privacy? DO you consider privacy as US ONLY, right?
Summary is flamebait. (Score:3, Insightful)
Between hardware keyloggers, low-level virtualization, and good old fashion espionage, it would be difficult to impossible to keep data hidden from the feds if they had the timeframe needed to run a case through the courts.
How my conversation went... (Score:4, Interesting)
"Hey I just finished setting up an encryption system for the e-mail system"
"A what?"
"Encryption, you know to keep your corrispondence confidential..."
"A what what?"
Then about 5 years later I rolled out an automated encryption system that uses lexicons to detect patterns and auto encrypt e-mails if they trip the filters. That conversation with the attorney's went like this.
"You put in a what and why?"
A lengthy explanation later filled with examples of when they should be using it. Finally the lawyer who had just spent a few days at a HIPPA conference sees the light. DING DING DING Clueless I swear.
Re:How my conversation went... (Score:5, Interesting)
Don't confuse your specialized knowledge with common knowledge. Your phrasing assumes that encryption, as a word, conjures up images as it would in a geek's mind (and more than five years earlier than now, when it was less well known.) Obviously they explained it better at the HIPPA conference.
Really, I doubt had I not already know what encryption, or the ease of e-mails being read by third-parties, I would have gained nothing from your explaination.
A possible alternative: It is easy for any third party to read your e-mails. Encryption uses a password (or automatic process) on both ends to make sure that only you and your recipients can read the e-mail. It also verifies that the person who claims to have sent the e-mail did, since falisifying the sender of an e-mail is also very easy.
Parent
typical geek mindset (Score:4, Insightful)
However, if I were a lawyer, I would stick with the time-tested method of ensuring privacy, rather than risk my client's confidentiality with some new-fangled technology that I don't understand. Do I have it installed right? What if it gets hacked?
Heck, I'm a computer guy and I don't understand PGP. I do in the biggest sense; but not enough to pass my own judgment on how well it works. I have to rely on the opinions of people who are smarter than me. Suppose they discover a new kind of math tomorrow that renders PGP useless?
It's all fair game (Score:3, Informative)
These would probably be the first guys on the NSA's list of folks to snoop on.
You can bet the lawyers handling these cases are, however, aware of the implications of a violation of attorney-client privilege, and would appeal if concrete records of such monitoring ever came out.
Clients Do Not Trust Computers (Score:5, Insightful)
The lack of internet security is not why attorneys visit their clients in person. It is because their client will tell them things face to face that they would never say over a telephone or video conference, no matter how secure. Assuming that the lawyer trusted the technology, do you think the client is going to? I've had corporate clients practically whisper things to me in perfectly secure conference rooms when it is clear that nobody is listening in. Why? It's human nature. Now take a terrorism suspect, who likely is not that well educated and has a legitimate fear of being spied on, and tell him to speak clearly into the microphone. Do you seriously think that is going to work?
Moreover, lawyers -- the good ones anyway -- are half poker player. When we interview clients, we are looking for "tells" and evaluating everything the client says. Not only to determine if their client is telling the truth (sometimes it doesn't matter), but to determine if their client _looks like_ they are telling the truth. There is no way that you could ever evaluate whether to put a witness on the stand without seeing them in person. (Not that it matters in these cases where a jury trial is exceedingly unlikely, but still.) These human factors are every bit as important to properly representing your clients as knowing the law.
IANAL, but... (Score:5, Insightful)
Until PGP becomes widely adopted outside the legal context (and it hasn't), lawyers are not going to be the first to adopt it. The reasons proffered above--that the government can break PGP or tap into the end-users' computers--may be true, but I doubt they are the reasons lawyers don't use PGP.
Also, while I would concur with most of the comments about lawyers padding billable hours, in these cases it's probably not about that. Suspected terrorists likely don't have the kind of cash that typical corporate clients do. Many of these lawyers are working for suspected terrorists (especially those in Gitmo) on a pro-bono basis. Ahkmed from a tent in Afghanistan probably couldn't afford a lawyer in his country, much less one from the United States.
Re: (Score:3, Insightful)
PGP in the legal field (Score:3, Insightful)
1) Not all attorneys are technically inclined. Many do not even use technology outside of the scope of a cell phone or PDA. There are usually support staff available to law firms to do the typing and technological heavy-lifting. There are attorneys who have done things a certain way their entire career, and are reluctant to change their ways quickly. Unfortunately, software and training costs may be viewed as expenses rather than assets to the firm. After all, it is the legal staff bringing in the revenue, not the I.T. department.
2) Not only do the attorneys and legal staff need to be aware of technologies such as PGP, but clients would also have to be aware of such technologies to take full advantage of them. Training both legal and support staff on such technologies is time consuming, and may not fit into a busy attorney's schedule. Even if the legal and support staff are up to speed, you still have the hurdle of training clients on such technologies. How do you go about training clients in your firm's privacy policies in respect to e-mail?
3) Billable hours... Resources and time spent on a case can be billed to the client. That means a firm can bill more time on paper for traveling/flying than sending an e-mail.
I think PGP will see more common adoption in the legal world, eventually. As far as I know, attorneys have to do continuing education credits to maintain their state bar status, so training is certainly encouraged. Privacy becomes a major issue when one of the parties, in a CC'ed e-mail, blindly hits reply-all to a sensitive e-mail. It is only a matter of time before more firms adopt more stringent communication policies.
Re: (Score:3, Interesting)
Oh, I dunno. Unless you're using an encrypting drive, worst case - for the attacker - is long enough alone with it to physically pull the hard drive, clone it, and button the case back up. A couple hours tops, for a well-rehearsed operation. (How good is the laptop's security while you're asleep?) A better case is to boot it in fire