Law Enforcement Finding Few Allies On Encryption
Cloud providers, mobile device manufacturers, private citizens, and a bipartisan Congressional committee are lining up on the opposite side.
At the RSA Conference in April, Homeland Security Secretary Jeh Johnson asked the assembled audience of information security professionals for their indulgence on the subject of encryption. Law enforcement is thus far not receiving that indulgence from the security community, cloud services providers, nor some of the most security-savvy members of Congress.
Historically, law enforcement has been able to go straight to cloud service providers with requests for data residing on its servers, without needing, necessarily, to inform the cloud customer whose data is being requested -- or any other customers whose data might also be residing on the same server. This puts cloud providers in an uncomfortable position -- a position theyve begun trying to get themselves out of.
Cloud service providers are now giving data owners the power to create and manage their own encryption keys. Thales e-Security and Microsoft pioneered Bring Your Own Key (BYOK) and expanded it in March to Microsoft Azure, so that anything created in the Azure environment can use BYOK as well.
Box is also
giving its cloud storage customers power over their keys, starting with Amazon.
What this means, is that when the courts or intelligence agencies want encrypted data residing on a public cloud, theyll need to subpoena the data owner directly if they want to read it. The cloud provider cannot serve as the go-between.
Richard Moulds, VP of product strategy at Thales e-Security says this suits the cloud providers just fine because encryption keys are just a liability, anyway -- best-case scenario, you dont lose them. Decreasing their own responsibilities and satisfying the users privacy concerns at the same time is a winning proposition for both parties.
It does not, however, suit the interests of law enforcement, which is actively lobbying for ways around it.
Last week, the U.S. House of Representatives Committee on Oversight and Government Reforms Subcommittee on Information Technology held a hearing on the topic of encryption. Officials from the Department of Justice and the FBI requested Congressional intervention, citing concerns that encryption is making it impossible for law enforcement to get access to essential data, even with appropriately obtained court orders, and that this was going to drastically impede criminal investigations.
Dan Conley, district attorney of Suffolk County, Massachusetts gave testimony taking specific aim at Apple and Google for marketing inaccessibility to law enforcement as a major selling point for their newest mobile devices.
I am here today to ask Congress to help us find a solution, because what Apple and Google are doing is dangerous and should not be allowed to continue, said Conley.
Conleys remarks were met with strong criticism by the Congressmen.
Representative Ted Lieu (D-CA), who holds a degree in computer science, said he took great offense to Conleys testimony and that the actions of Apple and Google are a private sector response to government overreach.
To me its very simple to draw a privacy balance when it comes to law enforcement and privacy: just follow the damn Constitution, said Lieu. And because the NSA didnt do that, and other law enforcement agencies didnt do that, youre seeing a vast public reaction to this. Because the NSA, your colleagues, have essentially violated the 4th amendment rights of every American citizen for years by seizing all our phone records, by collecting our internet traffic, that now is spilling over into other aspects of law enforcement. And if you want to get this fixed, I suggest you write to NSA and the FBI should tell NSA stop violating our rights and then maybe youd have the public much more on the side of supporting some of what law enforcement is asking for.
The technological solutions that have been floated thusfar -- like some sort of cryptographic backdoor that law enforcement would only activate when it properly obtained a warrant -- have been met with criticism.
As a recovering computer scientist, it is clear to me that creating a pathway for decryption only for good guys is technologically stupid, said Lieu. You just cant do that.
Rep. Will Hurd (R-TX), who is a former CIA agent and former senior advisor for information risk management firm FusionX, asked Dr. Matthew Blaze, who also testified at the hearing, for his opinions about a split-key approach to encryption. Blaze is a computer science professor at the University of Pennsylvania whos been focusing on cryptography, surveillance, and the legal aspects of it since the days of the Clipper Chip:
Blaze: There are things we can do, like splitting the key between multiple locations, that can reduce some aspects of some of the risks in a system like this.
Hurd: But it does create additional vulnerabilities that anyone who has technical capabilities would be able to take advantage of.
Blaze: Thats right. We can move some of the risks around from one part of the system or another, but there is still fundamental problems.
Hurd also questioned Conleys assertions that Google and Apple have made it impossible for law enforcement could obtain data they need with properly issued warrants. Conley said we could get the device, but we couldnt get the information off the device if its running iOS 8, which would be secured with a passcode.
Hurd did not buy the argument. He asked Blaze how long it would take to crack a 4-digit PIN, using modern methods. Blaze responded on modern computing hardware, essentially no time at all.
Hurd: Thats the equivalent of taking a safe out of a home and using some safecracking skills -- this would be the digital equivalent?
Blaze: No this would be much easier.
Hurd: [laughs]
Something more complicated than a 4-digit PIN, of course, would be another matter.
Another solution thats been discussed: holding copies of encryption keys in escrow for government use. Yet, Moulds from Thales points out that confidentiality is not the only thing encryption is used for. Encryption is also used for digital signatures; and holding a key used for that purpose in escrow would entirely defeat the purpose of the digital signature. If more than one copy of a seal exists, then how can you be sure it wasnt forged?
If I take a back-up of it, says Moulds, I can never say that [the signature] was really her, because she can always say it was someone else.
The solutions that have been proposed may not be solve any more problems than they create, but theres no denying that encryption has a dark side, as anyone whos contended with ransomware knows.
Speaking at RSA, Assistant Attorney General for National Security John Carlin was asked for his thoughts on the matter. He had an optimistic viewpoint, saying that other complex issues have been handled before by the government and the security community working together to develop norms, and this would just be one more example of that.
Is there a solution? said Carlin. I would think the best minds could come up with one.
Tags:
Law Enforcement Finding Few Allies On Encryption