Lawyers Would Rather Fly Than Download PGP 426
An anonymous reader writes "The NYTimes is running a front-page story about lawyers for suspects in terrorism-related cases fearing government monitoring of privileged conversations. But instead of talking about the technological solutions, the lawyers fly halfway across the world to meet with their clients. In fact, nowhere in the article is encryption even mentioned. Is it possible that lawyers don't even know about PGP?" The New Yorker has a detailed piece centering on the Oregon terrorism case discussed by the Times.
Security not just about encryption. (Score:5, Insightful)
Is it possible that the submitter doesn't even know about keyloggers, passive listening devices (for phones), compromised encryption binaries, vulnerabilities in protocols, etc?
If the goddamn NSA can't snoop on an encrypted conversation between a lawyer & client, then frankly, they're not doing their job
Re:Security not just about encryption. (Score:4, Insightful)
Re:Security not just about encryption. (Score:5, Insightful)
It's got to be decrypted at one end of the other - there's not much PGP can do about a compromised terminal, keyloggers, passive listening devices (reconstructing passwords from the sound of keyboard tapping), etc.
Basically, a well-resourced, determined attacked doesn't have to crack PGP itself.
Re:Security not just about encryption. (Score:5, Insightful)
Re: (Score:3, Insightful)
Re: (Score:2)
Re: (Score:2)
Re: (Score:3, Insightful)
Remember that we are talking about private discussions between lawyers and clients.
Thats supposed to be highly confidential to start with.
Re: (Score:3, Informative)
Re: (Score:3, Insightful)
Re:Security not just about encryption. (Score:5, Insightful)
Do US courts seriously consider these issues any longer? The majority of the constitution is at best nod and wink territory these days. They tap whoever they want; they jail whoever they want; and as for admissible in court, who says it'll even get to court? Who says you'll even get a phone call? This isn't your father's USA.
Re: (Score:3, Interesting)
Anyway, who says the NSA can't crack PGP? Some crypto-fanboy showing off how much smarterer he is than lawyers who make no claim of security expertise and have a professional obligation to err on the side of caution?
Re: (Score:2)
If its running on MS, you are in with a click.
This is not the Enigma or Crypto AG days where the spooks need to think about a unique 'box'.
No need to get into PGP, when the OS is wide open.
Face to face you are in the lawyers world.
They can read a face like the NSA/CIA/FBI/DHS can read MS.
Re: (Score:3, Funny)
Re: (Score:3, Funny)
Re:Security not just about encryption. (Score:5, Funny)
You can try mine if you like: 192.168.1.1
Re:Security not just about encryption. (Score:5, Funny)
Now I'll just change your router settings so you can't access the inter...
Re: (Score:3, Funny)
Re: (Score:3, Funny)
Try hacking my IPv6 only machine at ::1
Re: (Score:2)
Re:Security not just about encryption. (Score:4, Insightful)
Re: (Score:3, Interesting)
Is PGP breakable by brute force on current hardware? even with NSAs resources this is unlikely.
Has PGP been broken in the crytpographic sense, well given that mathmaticians cant get the maths sorted, unless you belive the NSA has a secret lab of mathmaticians that are years ahead of the rest of them, Hell no.
Can 2GB (or whatever the upper limit is for a key) encryption be broken, again unless the NSA dedicate a
Re: (Score:3, Interesting)
I think it's funny how willing some people are to speculate that US Intelligence agencies have superhuman powers. Haven't their obvious limitations dispelled the
Re:Security not just about encryption. (Score:5, Insightful)
Re:Security not just about encryption. (Score:4, Interesting)
If someone has a 12-character password alpha-numeric password the keyspace is about 104^12. If you can determine when the shift key is pressed and which of the 4 rows of keys each character is in, you can make that 13^12, which is 36 bits less keyspace -- almost a 50% reduction over the original 80 bits.
Re: (Score:3, Insightful)
Re: (Score:2, Insightful)
Re: (Score:2)
Re:Security not just about encryption. (Score:4, Informative)
However, the FBI (and by loan or extension, the NSA) has some very good black bag people, and they are much more likely to add in a hardware keylogger or currently-undetectable rootkit nowadays. That's how the FBI got crucial evidence against Nicodemo Scarfo, Jr., son of former mob boss Little Nicky Scarfo, adding a hardware keylogger to grab his PGP password to allow them to decrypt his messages in concert with his private key, also copied at the time.
Re:Security not just about encryption. (Score:5, Insightful)
"Is it possible that lawyers don't even know about PGP?"
Communication more than just writing (Score:5, Insightful)
If you take into consideration that communication (as we are told) is 70% non-verbal, then any half decent lawyer will make sure he/she is able to see the client face to face. It is impossible to take a good history from a person if you can't see them, let alone hear their voice.
Given this fact, it is not a surprise that lawyers want to meet their clients. Yes and there are limitations to PGP that won't ensure privacy especially when you are opening lines of communication in an already hostile environment. There are things you just can't know unless you are physically there.
Re:Communication more than just writing (Score:4, Informative)
PORTLAND, Ore. Thomas Nelson, an Oregon lawyer, has lived in a state of perpetual jet lag for the last two years. Every few weeks, he boards a plane in Portland and flies to the Middle East to meet with a high-profile Saudi client who cannot enter the United States because he faces charges here of financing terrorism.
Mr. Nelson says he does not dare to phone this client or send him e-mail messages because of what many prominent criminal defense lawyers say is a well-founded fear that all of their contacts are being monitored by the United States government.
Re: (Score:2)
What makes you think they are permitted to encrypt (Score:5, Insightful)
Even if they knew this for sure, the jailer is under no obligation to provide access to PGP or even a computer, and he would likely be an idiot if he did provide PGP to the inmates.
Re:What makes you think they are permitted to encr (Score:2)
Re:Security not just about encryption. (Score:5, Insightful)
If the government is tapping your phone lines, what makes you think they aren't intercepting your e-mail? I'm sure PGP would avoid problems like the U.S. government installing a keylogger on your system, or just sending a national security letter demanding access to your e-mails on pain of imprisonment as an accomplice to terror. Oh wait, it doesn't.
I'd rather take the airplane flight be more sure that I'm not getting bugged.
Re:Security not just about encryption. (Score:4, Funny)
And then the bastards will install a 3 year-old to kick your seat from behind, an incessant talker who loves chatting about lolcats next to you and a screaming infant in the seat in front just to bug you. You can't possibly win and they'll all be wearing a wire.
Re: (Score:2)
Re: (Score:2)
Which, in turn, has links...
Re: (Score:2)
What so bad about meeting your lawyer? (Score:2)
Re: (Score:2)
The lawyers travel time and business class airfare are going on your bill.
Re: (Score:2)
Stupid summary ever (Score:2)
So where is the downside? (Score:5, Insightful)
Plus perks (Score:2)
Re: (Score:3, Insightful)
Re: (Score:2)
When you think about it, if you bill by the hour any time efficacy ends up costing you money ( in terms of lost billable hours ).
Now, if you can make up that lost revenue in terms of increased business ( possibly through undercutting the competition on price, although that can't last forever ) then it's worth the effort. If not, then you're cutting your own throat.
Think I'll go throw up now... seems I'm channeling a PHB or something.
Really? (Score:2)
S/MIME, anyone? (Score:5, Interesting)
What is it with the Slashdot crowd and PGP? What's wrong with S/MIME?
I can say with some authority, having been evaluating and testing it for my company for some months now, that it is natively supported by current versions of the 3 major email clients (Outlook, Thunderbird, and Apple Mail), and that their implementations are, by and large, compatible.
So...are there any particular issues with S/MIME that make PGP a significantly more desirable solution?
Dan Aris
Re:S/MIME, anyone? (Score:5, Funny)
Everybody hates a mime.
Re: (Score:2)
Re:S/MIME, anyone? (Score:5, Interesting)
What is it with the Slashdot crowd and PGP? What's wrong with S/MIME?
I can say with some authority, having been evaluating and testing it for my company for some months now, that it is natively supported by current versions of the 3 major email clients (Outlook, Thunderbird, and Apple Mail), and that their implementations are, by and large, compatible.
So...are there any particular issues with S/MIME that make PGP a significantly more desirable solution?
Dan Aris
Re: (Score:2)
Re: (Score:2)
But if I were up against an intelligence agency, I would not trust S/MIME. (Nor PGP, for that matter.)
Re: (Score:3, Funny)
Re:S/MIME, anyone? (Score:5, Interesting)
OpenPGP software allows you to easily self-generate valid keys. Doing the same with S/MIME (self-signing certificates) is really obnoxious. Further, OpenPGP clients tend to support a web-of-trust introduction model which is strictly better for actual security than the centralized commercial PKI model that S/MIME software tries to force on users.
For sending secure messages within a medium to large sized organization there is some argument for S/MIME using a local CA, but even then simply emulating the same effect with a organization PGP key signer and key server is probably cleaner.
Re: (Score:3, Insightful)
The Web of Trust of PGP doesn't give anyone else your private key. It only gives attestation to your identity. Even if one of your contacts was wretched villainous scum he can't compromise your key, the worst he can do is issue transitive trust (ab)using your trust of him.
Re:S/MIME, anyone? (Score:4, Informative)
If the NSA compromises your CA, the best they can do is create another certificate which pretends to be yours. If the destination already had your certificate, then the public key they have won't match your private key.
The grandparent needs to review PKI.
Re: (Score:3, Interesting)
Who controls the certificate authority that issues the certificates?
In our case, me :-)
We're just using Microsoft's PKI (yeah, I'd rather use something OSS, but requirement #1 is that it work well with Outlook, and I wasn't able, with my limited experience, to get anything else set up to do so...), so the certificate authority is one of our servers. Naturally, it means that anyone who wants to be able to use & trust our user certificates is going to have to install our CA certificate, but that's the price of getting it all for free...
Dan Aris
Other considerations (Score:5, Funny)
Err... (Score:2)
Has the submitter not heard about billable hours?
Perceived Security vs Actual Security (Score:2)
Perceived security is a lot easier to sell and profit from then actual security.
Unless their clients are nerds themselves, they are not going to understand, let alone trust what PGP does.
Every client understands how much harder it is to listen in on a face to face talk. They appreciate that, and that kind of appreciation is also billable.
LOL (Score:2)
No, they probably do. They just ALSO know the amount of billable hours it takes to "fly half way across the world" to meet their clients.
Erm... (Score:2)
\me adjusts tinfoil hat
Slow to adopt (Score:2)
That doesn't mean all lawyers by any stretch, but many really do seem to be a bit hidebound with regards to adopting technology.
Re: (Score:2)
Encryption not the answer here... (Score:3, Insightful)
Face to face means something (Score:2)
Are you dumb? (Score:4, Insightful)
Hell, they could just torture the password out of the prisoner - turns out that the Land of the Free and the Home of the Brave does that kind of thing now.
Re: (Score:2)
Where I work (Score:2, Informative)
I work at a law firm that is considered in the top 25 as far as firms go. We are also ranked in the top 10 in terms of providing technology to the lawyers.
We have probably 3 out of 1000 lawyers that have used PGP for business purposes. For those 3, it was because the client requested it. PGP is a PITA in a law firm environment. Lawyers get paid to practice law, not to use technology. Communications between lawyers and the client is not between Joe Client and Jim
Mod this story troll (Score:2)
The type of security that you need to ensure a very interested US government from monitoring you is not affordable in this case.
PGP would make the government's job a great deal more difficult, but the physical security needed to prevent the feds from inserting some sort of eavesdropping device on either end of the communications channel is not affordable to your average terror suspect.
Extra: Lawyers don't want to go to jail... (Score:3, Insightful)
An e-mail:
Attn Client,
Please download PGP in violation of US export control laws.
Your accomplice,
your lawyer
Or maybe tell them in person, and then use PGP to communicate, indicating that you knew and ex post facto helped them pay off their violataion US export laws.
Fact of the matter is, is is illegal to get encryption software to some parties as individuals, and some countries in mass. And I'm sure the clients referenced in the article are on the verboten list.
Re: (Score:2)
Re: (Score:2)
But PGP still is subject to those laws. Interestingly, I read somewhere where a textbook on cryptography was exported to a forbidden country. The CD with the binaries was confescated, but the book, with compliable source written out, was allowed.
I agree with the spirit of the law, but it seems unenforcable.
Re: (Score:3, Interesting)
Zimmermann challenged these regulations in a curious way. He published the entire source code of PGP in a hardback book, via MIT Press, which was distributed and sold widely. Anybody wishing to build their own copy of PGP could buy the $60 book, cut off the covers, separate the pages, and scan them using an OCR program, creating a set of source code text files. One could then build the application using the freely available GNU C Compiler. PGP would thus be available anywhere in the world. The claimed principle was simple: export of munitionsâ"guns, bombs, planes, and softwareâ"was (and remains) restricted; but the export of books is protected by the First Amendment. The question was never tested in court in respect to PGP, but had been established by the Supreme Court in the Bernstein case.
More worryingly why do you agree with the spirit of the law? are foreigners not allowed privacy? DO you consider privacy as US ONLY, right?
Summary is flamebait. (Score:3, Insightful)
Between hardware keyloggers, low-level virtualization, and good old fashion espionage, it would be difficult to impossible to keep data hidden from the feds if they had the timeframe needed to run a case through the courts.
You can't expense a PGP file in email (Score:2)
(all of the following above has been sarcasm)
A face to face meeting is just as insecure. (Score:2)
It's the money, stupid (Score:2)
Re: (Score:2)
Of course they thought about it. Not good enough. (Score:2)
When you're up against the FBI, CIA, and NSA - which he presumably is - even PGP is not good enough. S/MIME? Forget it*.
PGP is a great way to protect messages in transit. But the problem here is not the security of the message in transit, it's the security of the me
Re: (Score:2)
Very nicely put. I find it touching how much faith computer-oriented people tend to have in their machines and software. The plain fact of the matter is that most security breaches and failures of confidentiality occur as the result of good, old-fashioned sneakiness and duplicity, coupled with misplaced trust and human error.
Re: (Score:2)
Barring the laptop remaining in his sight at every moment from the time he took the case until this moment, there's the possibility that a sneak-n-peek has compromised his private keys, or that someone has even installed a keylogger.
That's actually pretty reasonable to guard against, and given that the laptop would presumably be locked, someone would need to be alone with it for an extended period of time.
And did you notice that even the Ninth Circuit has now allowed laptops to be searched by border guards without evidence of a crime?
A laptop can be had for less than that plane ticket, so you don't have to take that particular one overseas.
Now consider that the lawyer's own laptop is probably the more secure end of the connection.
If so, you have to assume that the other end of the connection is probably much more thoroughly bugged physically than either of their computers are electronically.
Re: (Score:3, Interesting)
Oh, I dunno. Unless you're using an encrypting drive, worst case - for the attacker - is long enough alone with it to physically pull the hard drive, clone it, and button the case back up. A couple hours tops, for a well-rehearsed operation. (How good is the laptop's security while you're asleep?) A better case is to boot it in fire
Re:Of course they thought about it. Not good enoug (Score:2)
And this from the most liberal federal circuit.]
Eh. Probably true, but easily overstated. The Ninth Circuit has 28 judges from places as far-flung as Hawaii and Idaho. It takes only three judges to make up a panel, so you can end up with some extremely conservative permutations. Really, the most noteworthy aspect of Ninth Circuit jurisprudence is how politically unpredictable it is, since so much can turn on which three judges you draw. It makes for extremely fractured jurisprudence, as each panel tries to distinguish the facts of its case from those of
How my conversation went... (Score:4, Interesting)
"Hey I just finished setting up an encryption system for the e-mail system"
"A what?"
"Encryption, you know to keep your corrispondence confidential..."
"A what what?"
Then about 5 years later I rolled out an automated encryption system that uses lexicons to detect patterns and auto encrypt e-mails if they trip the filters. That conversation with the attorney's went like this.
"You put in a what and why?"
A lengthy explanation later filled with examples of when they should be using it. Finally the lawyer who had just spent a few days at a HIPPA conference sees the light. DING DING DING Clueless I swear.
Re:How my conversation went... (Score:5, Interesting)
Don't confuse your specialized knowledge with common knowledge. Your phrasing assumes that encryption, as a word, conjures up images as it would in a geek's mind (and more than five years earlier than now, when it was less well known.) Obviously they explained it better at the HIPPA conference.
Really, I doubt had I not already know what encryption, or the ease of e-mails being read by third-parties, I would have gained nothing from your explaination.
A possible alternative: It is easy for any third party to read your e-mails. Encryption uses a password (or automatic process) on both ends to make sure that only you and your recipients can read the e-mail. It also verifies that the person who claims to have sent the e-mail did, since falisifying the sender of an e-mail is also very easy.
So would I (Score:2)
typical geek mindset (Score:4, Insightful)
However, if I were a lawyer, I would stick with the time-tested method of ensuring privacy, rather than risk my client's confidentiality with some new-fangled technology that I don't understand. Do I have it installed right? What if it gets hacked?
Heck, I'm a computer guy and I don't understand PGP. I do in the biggest sense; but not enough to pass my own judgment on how well it works. I have to rely on the opinions of people who are smarter than me. Suppose they discover a new kind of math tomorrow that renders PGP useless?
Re: (Score:2)
PGP is 17 years old. GnuPG is 9 years old. This is pretty mature stuff.
It's all fair game (Score:3, Informative)
These would probably be the first guys on the NSA's list of folks to snoop on.
You can bet the lawyers handling these cases are, however, aware of the implications of a violation of attorney-client privilege, and would appeal if concrete records of such monitoring ever came out.
Clients Do Not Trust Computers (Score:5, Insightful)
The lack of internet security is not why attorneys visit their clients in person. It is because their client will tell them things face to face that they would never say over a telephone or video conference, no matter how secure. Assuming that the lawyer trusted the technology, do you think the client is going to? I've had corporate clients practically whisper things to me in perfectly secure conference rooms when it is clear that nobody is listening in. Why? It's human nature. Now take a terrorism suspect, who likely is not that well educated and has a legitimate fear of being spied on, and tell him to speak clearly into the microphone. Do you seriously think that is going to work?
Moreover, lawyers -- the good ones anyway -- are half poker player. When we interview clients, we are looking for "tells" and evaluating everything the client says. Not only to determine if their client is telling the truth (sometimes it doesn't matter), but to determine if their client _looks like_ they are telling the truth. There is no way that you could ever evaluate whether to put a witness on the stand without seeing them in person. (Not that it matters in these cases where a jury trial is exceedingly unlikely, but still.) These human factors are every bit as important to properly representing your clients as knowing the law.
NSA and law-abiding Lawyers... (Score:2)
IANAL, but... (Score:5, Insightful)
Until PGP becomes widely adopted outside the legal context (and it hasn't), lawyers are not going to be the first to adopt it. The reasons proffered above--that the government can break PGP or tap into the end-users' computers--may be true, but I doubt they are the reasons lawyers don't use PGP.
Also, while I would concur with most of the comments about lawyers padding billable hours, in these cases it's probably not about that. Suspected terrorists likely don't have the kind of cash that typical corporate clients do. Many of these lawyers are working for suspected terrorists (especially those in Gitmo) on a pro-bono basis. Ahkmed from a tent in Afghanistan probably couldn't afford a lawyer in his country, much less one from the United States.
Re: (Score:3, Insightful)
Re: (Score:3, Interesting)
PGP in the legal field (Score:3, Insightful)
1) Not all attorneys are technically inclined. Many do not even use technology outside of the scope of a cell phone or PDA. There are usually support staff available to law firms to do the typing and technological heavy-lifting. There are attorneys who have done things a certain way their entire career, and are reluctant to change their ways quickly. Unfortunately, software and training costs may be viewed as expenses rather than assets to the firm. After all, it is the legal staff bringing in the revenue, not the I.T. department.
2) Not only do the attorneys and legal staff need to be aware of technologies such as PGP, but clients would also have to be aware of such technologies to take full advantage of them. Training both legal and support staff on such technologies is time consuming, and may not fit into a busy attorney's schedule. Even if the legal and support staff are up to speed, you still have the hurdle of training clients on such technologies. How do you go about training clients in your firm's privacy policies in respect to e-mail?
3) Billable hours... Resources and time spent on a case can be billed to the client. That means a firm can bill more time on paper for traveling/flying than sending an e-mail.
I think PGP will see more common adoption in the legal world, eventually. As far as I know, attorneys have to do continuing education credits to maintain their state bar status, so training is certainly encouraged. Privacy becomes a major issue when one of the parties, in a CC'ed e-mail, blindly hits reply-all to a sensitive e-mail. It is only a matter of time before more firms adopt more stringent communication policies.
Re: (Score:2)