Please create an account to participate in the Slashdot moderation system

 



Forgot your password?
typodupeerror
Compare cell phone plans using Wirefly's innovative plan comparison tool ×
Security Communications Government United States IT

FBI: Just Don't Call Them Backdoors (networkworld.com) 347

sandbagger writes: The FBI still wants backdoors into encrypted communications, it just doesn't want to call them backdoors, and it doesn't want to dictate what they should look like. Tech companies [says FBI Director James Comey] 'need' to change their business models – by selling only communications gear that enables law enforcement to access communications in unencrypted form, he says, rather than products that only the parties participating in the communication can decrypt. He also says tech companies should just accept that they would be selling less secure products.
This discussion has been archived. No new comments can be posted.

FBI: Just Don't Call Them Backdoors

Comments Filter:
  • Dear Mr FBI (Score:5, Insightful)

    by Snotnose ( 212196 ) on Saturday December 12, 2015 @11:41PM (#51108041)
    Had you not been spying on all of us without warrants we wouldn't be encrypting our stuff. Act like the bad guy, don't be surprised when your treated like a bad guy.
    • Re:Dear Mr FBI (Score:5, Interesting)

      by Anonymous Coward on Saturday December 12, 2015 @11:58PM (#51108101)

      ^This

      I'd like a "rear entry portal" into the Capitol Building, just so I can know how they operate behind closed doors. It should be legal because (a) my tax dollars pay their salary and (b) they're suppossedly not committing any crimes!

      This is all of course in line with the FBI's thought process.

      • by gfxguy ( 98788 )
        I like your style of thinking... but them first.
      • Re:Dear Mr FBI (Score:5, Insightful)

        by Strangely Familiar ( 1071648 ) on Sunday December 13, 2015 @01:44AM (#51108377) Homepage
        And what about Google, Apple, and Facebook? Isn't this just lovely that Comey is telling these companies to make sure there is a way they can read all our communications, even when we try to use encryption? Once the capability is there, the corporate lawyers will simply have us agree in the "end user license" (that we negotiate with them by clicking "I agree") that Google et al. can read and sell ALL our communications regardless of any court order. Nice. I really love where this is headed. Thanks again, FBI. I love you people! You're doing a great job! Always thinking of me! I feel so secure!
        • by swillden ( 191260 ) <shawn-ds@willden.org> on Sunday December 13, 2015 @12:40PM (#51109865) Homepage Journal

          Once the capability is there, the corporate lawyers will simply have us agree in the "end user license" (that we negotiate with them by clicking "I agree") that Google et al. can read and sell ALL our communications regardless of any court order.

          Google doesn't sell user communications, to the government or to anyone else, and Google doesn't provide any data to government that it's not legally compelled to provide.

          (Disclaimer: I work for Google, but I don't speak for Google.)

      • Re:Dear Mr FBI (Score:5, Insightful)

        by drinkypoo ( 153816 ) <martin.espinoza@gmail.com> on Sunday December 13, 2015 @09:02AM (#51109249) Homepage Journal

        Cops regularly brandish weapons without cause which is illegal, point them at people without cause which is assault and illegal, kill people without cause which is murder... In fact, here's a damned great statistic: in 2008, there were about 765,000 "sworn personnel", meaning cops with arrest powers. Today, over eleven million US citizens have a permit to carry a concealed weapon. Even if only ten percent of them make use of it, there are still hundreds of thousands more "ordinary" citizens carrying weapons than cops. In spite of this, cops will wrongfully kill more people even than deliberate mass shooters this year. They are killing people who are proven by the evidence to not have a weapon, they are turning off their body cameras before they kill people, they are killing people who they have incarcerated and they are killing people on their way to incarceration.

        Everywhere you look, the people who are supposed to protect us and keep us from corruption are more dangerous and corrupt than we are.

        • Re: (Score:3, Interesting)

          by KGIII ( 973947 )

          You can add pretty much the entirety of eligible Mainers to that list. You no longer need a permit to conceal carry in Maine provided it is lawful for you to own a firearm. Yup... You may still want a permit if you travel (I do and have mine) because this doesn't extend to other states as of yet. Strangely enough, we don't have a whole bunch of crime, firearm violence, or any need to keep track of who has what in their waistband.

          No, no don't move there. It's terrible and the people are mean. It's cold and n

    • by Etherwalk ( 681268 ) on Sunday December 13, 2015 @12:10AM (#51108131)

      If you want us to trust our intelligence communities with decryption capabilities in case we happen to be criminals, then we need the FBI to put MUCH better accountability in place to ensure that THEY are not doing anything criminal. BEGINNING with a reliable and INDEPENDENT commission that can be approached by whistleblowers without fear of reprisal and that has the independent power to declassify anything they believe is government action in violation of Federal Law.

      Because they do things that are criminal. Like, for example, mass surveillance, parallel construction, and to some extent the entrapment they use as effectively a primary tool for big investigations.

      Right now we don't have the accountability to ensure that our government isn't acting criminally. We just fucking don't. They are mostly a black box saying that nobody else should be a black box.

      • A black box with a known-lousy history of misusing the power they have available; which isn't exactly more encouraging.
      • by Anonymous Coward on Sunday December 13, 2015 @12:39AM (#51108217)

        You mean like putting the split in between the NSA and FBI? The one Bush removed?*

        Removing that split allowed the "Parallel Construction" path, with NSA handing evidence it obtained illegally (or perhaps faked) while getting the DEA & FBI to cover up the true evidence trail from the courts.

        And it also allowed FBI to turn NSLs into mass surveillance devices. FBI turns up with an NSL, insists on putting in a box on the network to only capture 'meta data', the box is run by the NSA, slurps down all the passwords SSL keys and data. NSA hands back to FBI only the meta data it can legally have. Or like they did with Lavabit, demand Lavabit provide the SSL keys so they could decrypt all traffic perhaps? Again only to collect metadata.. honest.... except is the NSA that taps all the networks, so the NSA would get all the keys and all the data.

        The problem here is the FBI which would be required to keep the NSA in check on behalf of Congress and the Judicial branch, has instead become a co-conspirator in many of the NSAs illegal schemes. When NSA pisses all over the constitution who exactly is supposed to march in and raid them? The boy scouts?

        *Bush's company Arbusto Energy was rescued by Saudi Binladin Group. (Yes that Bin Laden). So of course he wouldn't do his job and let FBI and NSA co-operate on stopping 9/11. Of course he refused to act when CIA demanded an emergency meeting, they shouldn't have named their memo "Bin Laden determined to attack the US", as soon as he saw Bin Laden, I bet the memo went in the bin.

        • That's an interesting re-write of history. Maybe you should look up Jamie Gorelick and the "wall of separation" that essentially made 9-11 inevitable.
        • You mean like putting the split in between the NSA and FBI? The one Bush removed? Removing that split allowed the "Parallel Construction" path

          Supposedly, a DEA official told Reuters: "Parallel construction is a law enforcement technique we use every day. It's decades old, a bedrock concept."

      • Convey to us that those who gather intelligence will respect the doctrine of the fruit of the poison tree, and refrain from using tainted evidence in building criminal cases against citizens outside of dire threats. https://en.m.wikipedia.org/wik... [wikipedia.org]
      • How do you prevent criminals et al from using it? The problem with back doors is there really isn't any way I know of to make them secure. You can't make encryption where you don't need the key to decrypt it, yet it still is secure. The back door can be obfuscated or the like, but if someone finds it then it is game over.

        So even if we decide we trust the government and they have good oversight and all that, it is still leaving things open to other parties. Good encryption keeps everyone else out, that is ju

        • Re:That aside (Score:5, Informative)

          by Zontar The Mindless ( 9002 ) <{plasticfish.info} {at} {gmail.com}> on Sunday December 13, 2015 @09:17AM (#51109303) Homepage

          All you need is to look at what happened with those TSA master keys for your luggage.

          Not going to post the link again because I've already done so twice in the last few days and I'm not looking to be a karma whore, but just search for something along the lines of "TSA Keys Schneier Security" and you'll find the story quickly enough.

        • by dgatwood ( 11270 )

          How do you prevent criminals et al from using it?

          Well, it is possible, but it requires making it hard enough to use that the government won't want to bother with it. For example, the company could place a private key in an escrow service offshore, destroy their only copy, and provide the public key to every device. The device could then encrypt a copy of its private key using the company's public key, which the company could print out on paper and store in boxes organized by date. If the government wante

      • by AmiMoJo ( 196126 )

        The problem will always be foreign governments. I don't want the FBI to be able to decrypt my communications under any circumstances, and they have no legal jurisdiction over me as I'm not a US citizen. Worse still, US constitutional protections don't apply to me so they don't even have to pretend to have permission.

        Anything with an FBI backdoor is automatically banned for me.

        • FBI is domestic so you wouldn't be worrying about them unless you are in the US or in communication with someone or something that is.

            What you need to be concerned with is the CIA and the NSA unless you are in a terrorist hotspot which you can add sigtel opperations by various military organizations including those of other countries too.

      • by cfalcon ( 779563 ) on Sunday December 13, 2015 @04:57AM (#51108803)

        > If you want us to trust our intelligence communities with decryption capabilities in case we happen to be criminals, then we need

        It's not decryption they want, it's a backdoor. If there's a back door, it was never really encrypted to begin with.

        And what we need is encryption that works and is implemented properly- with no back doors. The idea that the government has the right to spy on each and every thing that is said at any time, at any place, and push it through whatever the latest grep / pattern analysis / AI farm- is ludicrous. It's simply ludicrous.

        Encryption- not back doored encryption where you are trusted with a slave key and a bunch of people in the shadows have a master key- is the only answer.

      • > then we need the FBI to put MUCH better accountability in place to ensure that THEY are not doing anything criminal.

        The FBI has demonstrated that they can, and will, use their privileged access to monitoring to abuse and harass innocent people, and to perform criminal behavior to go after the "big fish" or the "kingpins". They've also demonstrated fundamental incompetence in handling chronic, lower level crime such as identity theft, "copyright violation", inter-state stalking of minors and domestic ab

    • Re:Dear Mr FBI (Score:5, Insightful)

      by Anonymous Coward on Sunday December 13, 2015 @02:09AM (#51108433)

      The FBI recently admitted to using 0-day exploits. By definition, this means they do not alert vendors to the the exploits so that they can be fixed. It's not clear to me how this can be viewed as anything but acting like the bad guy. Law enforcement's role is to uphold law, not to catch criminals by any means.

  • by Anonymous Coward on Saturday December 12, 2015 @11:43PM (#51108045)
    "We see that encryption is getting in the way of our ability to have court orders effective to gather information we need in our most important work"

    So does the Fifth Amendment. What's your point? Gonna put a back door in that too? (Posting AC so the FBI trash men don't come get me.)
  • by Wovel ( 964431 ) on Saturday December 12, 2015 @11:45PM (#51108055) Homepage

    Groups like ISIS are now using their own encryption apps so there is nothing that can be done by any US tech companies prevent that. What would the point of making everything less secure be.

    • Re: (Score:3, Insightful)

      by Anonymous Coward

      Because it isn't about terrorism, it's about control.

    • What would the point of making everything less secure be.

      The FBI has obviously been compromised by traitors and foreign double-agents.

      Their true purpose is to sabotage US technology companies in favor of foreign technology companies.

    • by NReitzel ( 77941 )

      Back a few decades ago, the MP3 file format was created, documented, and some apps became available.

      Enter the Music industry, on full tilt attack mode They're still at it. The salient point that they have missed is that it is not the pirates, the sellers, the site operators that made the difference. The fundamental change was the mere existance of a portable, easily exchanged format. What has transpired since then, and what is still transpiring is due to the simple fact that file copying and exchange w

  • by Anonymous Coward on Saturday December 12, 2015 @11:45PM (#51108057)

    They want to expand PRISM, remember PRISM?

    http://www.theguardian.com/world/2013/jul/11/microsoft-nsa-collaboration-user-data

    The documents show that:

      Microsoft helped the NSA to circumvent its encryption to address concerns that the agency would be unable to intercept web chats on the new Outlook.com portal;

      The agency already had pre-encryption stage access to email on Outlook.com, including Hotmail;

      The company worked with the FBI this year to allow the NSA easier access via Prism to its cloud storage service SkyDrive, which now has more than 250 million users worldwide;

      Microsoft also worked with the FBI's Data Intercept Unit to "understand" potential issues with a feature in Outlook.com that allows users to create email aliases;

      In July last year, nine months after Microsoft bought Skype, the NSA boasted that a new capability had tripled the amount of Skype video calls being collected through Prism;

      Material collected through Prism is routinely shared with the FBI and CIA, with one NSA document describing the program as a "team sport".

    In June, the Guardian revealed that the NSA claimed to have "direct access" through the Prism program to the systems of many major internet companies, including Microsoft, Skype, Apple, Google, Facebook and Yahoo.

    Blanket orders from the secret surveillance court allow these communications to be collected without an individual warrant if the NSA operative has a 51% belief that the target is not a US citizen and is not on US soil at the time. Targeting US citizens does require an individual warrant, but the NSA is able to collect Americans' communications without a warrant if the target is a foreign national located overseas.

    ----------------------

    So all the private communications you have well the US grabbed them stuck them in giant databases to be datamined at the whim of the military complex without judicial process.
    And all the companies involved knew it, and helped. Microsoft even helping remove the encryption on future version so the NSA could slurp down their data more easily.

    So when you want to use Cloud Office Services, remember that your companies documents are directly available within any judicial process to the spys for the military industrial complex.

    • by swillden ( 191260 ) <shawn-ds@willden.org> on Sunday December 13, 2015 @12:52PM (#51109921) Homepage Journal

      In June, the Guardian revealed that the NSA claimed to have "direct access" through the Prism program to the systems of many major internet companies, including Microsoft, Skype, Apple, Google, Facebook and Yahoo.

      FWIW, David Drummond, chief legal counsel for Google, denied [theguardian.com] that Google has ever given access, direct or indirect, to the NSA. Snowden's documents made clear that the NSA was tapping communications links between Google data centers, which may have been the basis for the "direct access" claim. Google quickly moved to encrypt all of those communications links, though, so if that was the "direct access", it's been shut off.

  • by fredrated ( 639554 ) on Saturday December 12, 2015 @11:56PM (#51108091) Journal

    hit this guy with a clue stick. Asshole.

  • Nope... (Score:5, Insightful)

    by jaymz666 ( 34050 ) on Saturday December 12, 2015 @11:58PM (#51108099)

    There is no way to guarantee nobody but the FBI can access these "back doors", or to guarantee that the FBI will do the right thing.

    The business model of the FBI needs to change.

    • Re:Nope... (Score:5, Interesting)

      by wvmarle ( 1070040 ) on Sunday December 13, 2015 @12:28AM (#51108189)

      It provides great opportunity for foreign companies to produce similar products, but better and cheaper as they don't have to add this insecurity.

      Thanks to the FBI, Chinese-built software may very well become the more secure choice over US-built software.

      And that's before the keys to the FBI-mandated back doors are leaked or cracked or whatever making them available to the world at large...

  • key escrow (Score:5, Informative)

    by Orgasmatron ( 8103 ) on Sunday December 13, 2015 @12:10AM (#51108133)

    Maybe we could call this new scheme "key escrow". That way we can run our side of the debate just by recycling posts from ~20 years ago.

  • by sethstorm ( 512897 ) on Sunday December 13, 2015 @12:11AM (#51108137) Homepage

    Comcast:

    It's not a "cap", it's a "usage plan"

    If Comcast were a Swiss insurance agency:

    Don't think of it as "exclusive", think of it as a "custom experience".

    If Comcast was the FBI:

    It's not a backdoor, it's [redacted].

  • by NostalgiaForInfinity ( 4001831 ) on Sunday December 13, 2015 @12:22AM (#51108165)

    So, the FBI doesn't want to call these things "backdoors". OK, let's come up with some alternatives:

    The FBI wants to install security barndoors in your software.

    The FBI wants to create festering security wounds in your software.

    The FBI wants to buttf*ck your software.

    Which of those other euphemisms would you prefer, Mr. Comey?

    • This is a government policy, remember. From the organisation that brought you the "Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act."

      I suggest "Secure Homeland Intel Transferal holes."
      Or possibly "Freedom holes."

  • typewriters are still made and sold; ribbons are made and still sold

  • by iamacat ( 583406 ) on Sunday December 13, 2015 @12:38AM (#51108215)

    Remember how, back in the days, we used to download PGP from Finland because of US export restrictions? These days are coming again, with resulting renewed public interest in free software and sideloading apps outside the walled garden. As well, it's a chance for a developing country to establish an alternative Silicon Valley exporting truly secure software, even PC and mobile operating systems, worldwide. Hopefully I can move there and live like a king.

    • by Burz ( 138833 )

      Nowadays people are turning to apps like Signal [whispersystems.org] and RetroShare. Another interesting option is Ostel. [ostel.co] For browsing and other PC apps, running Tor on Whonix fits the bill.

  • A lot of people rush to Orwell references, but this seems like a genuine attempt at Newspeak [wikipedia.org] to me.

  • by selling only communications gear that enables law enforcement and foreign governments to access communications in unencrypted form,

    FTFY

  • by nashv ( 1479253 ) on Sunday December 13, 2015 @01:01AM (#51108293) Homepage

    It's come to this now? The US agencies don't even pretend to respect the rights to privacy and freedom of expression. They are now openly asking for Orwelian features in products produced by private companies?

    Are American citizens so lost that they do not see how ridiculous that sounds ? They might as well just as every citizen to spend a mandatory year in prison ...just in case they get incarcerated later in life.

  • by yacc143 ( 975862 ) on Sunday December 13, 2015 @01:19AM (#51108329) Homepage

    So considering that that the us government uses nowadays mammy commercial products of the shelf itself;
    Considering that other governments control access to potentially as big or bigger markets than the US one ->

    Are they happy with the Chinese/Russians also reading the communications of the US government?

    And they are using commercial regular stuff. By design (to save money and make certain projects even feasible) or mistake (do I need to say Clinton ' email).

    Also consider that practically all the hardware for these new communications is produced outside the states. Where other governments can insist on back doors (when it quacks ... call it by it's proper name).

    E.g. the German privacy watchdog has currently issued a ruling that Google Mail is a communication service and needs to provide "an automatic interface for lawful interception". If the courts let that stand (something quite realistic) and Google not being able to prove to legal standards if an account is "German", that might mean that they'll need to allow to intercept traffic on all accounts.

    Great that the FBI gives governments the inspiration to what they should require from companies (including US ones).

  • How's "Freedom Anuses" grab you? Honestly, if it hadn't been for the Government's meddling in the 90's, all traffic on the Internet would be encrypted by now and the whole place would be much more secure. Near as I can tell, you still can't integrate PGP into a E-Mail client without the government trying to fuck you in the ass. I mean backdoor, er... freedom anus!
    • by KGIII ( 973947 )

      Just click and install Enigmail. It's not PGP but it is GPG and I don't recall needing the government's permission to make use of it. They do (if they want) have my public key files available but that's not a problem - they're the public keys and they're allowed to have them. I can, if I want, opt to transfer the key to someone via any number of different routes and not have a public key store.

      But no, not all traffic needs to be encrypted (for starters) and no government cared one iota that I opted to use e

  • Just call a hammer a hammer and a backdoor a backdoor.

    Today I'd worry more about shortcomings in security on Chinese-made devices, but with the FBI involved it's going to be additional holes.

    Meanwhile the terrorists just go on with their own ways of information exchange. It's also a huge information flood to sift through making it hard for authorities to ever figure out if something is serious or not. Even if they know they may not take action to avoid revealing their sources. Like the shootings in Paris -

  • American companies (Score:4, Insightful)

    by mwvdlee ( 775178 ) on Sunday December 13, 2015 @03:20AM (#51108629) Homepage

    He also says tech companies should just accept that they would be selling less secure products.

    LMFTFY

    He also says American tech companies should just accept that they would be selling less desirable products than their non-American competitors.

    • by sconeu ( 64226 )

      He also says tech companies should just accept that they would be selling less secure products.

      Federal Agencies should just accept that they are supposed to be bound by the US Constitution.

      • by mwvdlee ( 775178 )

        Federal Agencies should just accept that they are supposed to be bound by the US Constitution.

        Federal Agencies accept that they are supposed to be bound by the US Constitution the same way whores accept they are supposed to decent.

    • Yep. First thing I thought when I saw that line. I'm not generally a fan of the degree of influence businesses can impose on the government, but if it takes the united front of everything from Apple down to (relatively tiny) Mozilla to stop this bullshit, I'll take it. The NSA has already cost American corporations significantly, both in lost sales and in needing to defend themselves against their own government (which, in fairness, isn't that different from the defending against foreign governments that th

    • Oh, that can be made worse. US companies could be forced to buy those products for security relevant applications, pretty much opening any and all trade secrets to anyone willing to bribe whoever has the key.

  • Dumbed down software and hardware produced in the USA with official back-doors (unofficial ones seems to be already in existence) would give a chance to producers from other countries. The same as happened with bureaucratic limitations on civil commercial UAV usage in the USA.

    One of the leaders in civil UAV is the DJI, and it is not an US company.
  • by Tom ( 822 ) on Sunday December 13, 2015 @03:44AM (#51108673) Homepage Journal

    We'll just be going back to using strong crypto from outside the USA, like we did for most of Internets history.

  • This will continue (Score:4, Insightful)

    by cfalcon ( 779563 ) on Sunday December 13, 2015 @04:07AM (#51108715)

    This will continue nearly indefinitely. The game plan would be something like- first pass laws to prevent it from happening in the US, which will include free and open source software, second talk easily persuaded nations into the same thing, third use trade tactics and even threats to push down the "terrorism supporting" nations.

    Encryption is speech. Any of these attempts are flatly unconstitutional.

  • Would they also like to force everyone to buy guns that can only shoot blank ammunition?

    I'd like to see that debate.

  • No problem, folks. We've been calling you "assholes" for a while now already.

  • Whats the point? (Score:3, Insightful)

    by balajeerc ( 1461659 ) on Sunday December 13, 2015 @08:09AM (#51109131)
    Even if I do sign an EULA saying that I allow [Microsoft/Yahoo/Apple/Google] to provide my correspondence to the FBI, what prevents the bad guy from encrypting his message using a 4096 bit PGP encrypted string and THEN using steganography to hide it in image data and sending that image out to his compatriots? Are you also going to make it illegal for the user to just use a complicated math calculation? Even if you do, how are you going to detect a violation of that? This entire witch hunt on encryption by the enforcement agencies boggles my mind.
  • Don't call our "back doors" by the evil name of "back doors"!!

    Call them "Butthole Access Portals" or "Freedom Shafts", but not "back doors"!

  • This is stupid. (Score:4, Insightful)

    by johnnys ( 592333 ) on Sunday December 13, 2015 @12:18PM (#51109809)

    The real bad guys ALREADY have strong encryption. PGP is free and widespread. Hizbollah operate a fiber network in Lebanon, just to make it hard for Israel to tap their traffic. Cyber criminals and terrorists know how to use strong encryption to protect their traffic.

    So all you're doing by putting backdoors in all the products is to allow the bad guys to break into those devices and steal law-abiding citizen's data, while not affecting the ability of the bad guys to communicate securely. The backdoors ENABLE the criminal behaviour while doing NOTHING to help the victims of the bad guys.

    When strong encryption is outlawed, only outlaws will have strong encryption.

If you think the system is working, ask someone who's waiting for a prompt.

Working...