Comment by derefr | Hacker News Reader

Comment by derefr | Hacker News Reader

Parent Full thread

> They can subpoena the data and throw the person who controls the key in jail until they release it

I think, a lot of the time, they want to read data from a device owned by someone who's not jailable any more—i.e., dead people.

Reading data off the phones of murder victims—the activity you'd expect "digital forensics" to properly refer to—would be pretty useful, if it were possible. I imagine a lot of police work has gotten harder in the move from "little black books" and feature-phone contact lists to everything about a person's contacts/calendar/call history/etc. being on an FDE-ed smartphone. Manufacturer key escrow services seem almost sensible in this light.

The other use is in reading data off devices of someone who's already dead because law enforcement just killed them. I can see both good and bad outcomes of that: if it were quick to do, it would help to map e.g. a hired hitman to their client, or a gang-member to the gang-leader. But it would also encourage/enable "shoot first, ask questions [to devices] later" tactics, which is just plain horrible.

You can subpoena google for the calendar and email, Apple for iMessage routing, and the phone company for phone calls and texts. You can even get emergency warrants for that kind of thing. Then you subpoena all those contacts.

This idea that the immediate access to all of an individual's information is necessary for law enforcement to do their work is a farce, especially considering the propagation of private and public security cameras. The same logic is used to justify torture, expand SWAT and procure urban assault vehicles. These things are almost always unnecessary, impractical, or unreliable.

Yes, people can be extremely careful to avoid police. That's not the average case, and we shouldn't optimize our law enforcement for it.

Aren't active criminals generally extremely careful to avoid police (by, e.g., using burner phones?) And isn't law enforcement mostly about catching criminals? I don't see why law enforcement would be about anything other than figuring out how to catch people who are extremely careful to avoid police.

I don't disagree with your first two paragraphs. I just think the average criminal of this generation is well aware of the idea that they need to avoid putting incriminating data "in the cloud", to about the same degree that they're aware of the idea that you have to wear gloves to avoid leaving fingerprints.

No, most criminals aren't that smart.

You mean criminals that get caught.

We know basically nothing about the ones who don't get caught.

Though we do know some things about what people have done to evade (and continue to evade) capture. I link this story around and wish politicians knew of it: https://web.archive.org/web/20130119025623/http://dee.su/upl...

If criminals were really extremely careful, they'd get burner phones with custom firmware that performs FDE without key escrow. I'm sure there are plenty of sellers who are willing to supply such phones at a high margin given the opportunity.

If it becomes a crime to encrypt your phone, only criminals will encrypt their phones.

Well the last statement is tautologically true, but yeah. Key Escrow is also impossible to enforce in user space (JavaScript), so unless you only allow signed everything, there will always be workarounds.

The NSA isn't a law enforcement agency. It's a national security agency. There is a huge difference in goals, tools and the laws they operate under.

> Manufacturer key escrow services seem almost sensible in this light.

I understand your position, but I could not disagree more strongly with your conclusion. Many of the techniques law enforcement is complaining about losing didn't exist before cell phones (and smart phones in particular). The challenges they face in a world with FDE-by-default are not new, their biggest frustration is in losing capabilities that they feel have been valuable.

The problem with something like key escrow is that while there might be value in occasionally providing access to law enforcement, there is absolute certainty of damage in cases where the keys are lost, stolen, or compromised -- all of which happen with alarming regularity already. You can't un-ring the bell of a data loss due to compromised encryption - so the only real question is how many abuses we should be expected to endure in order to realize marginal benefits in some circumstances.

It is understandably inconvenient & frustrating for law enforcement to lose access to the contents of smartphones, but that alone is not sufficient justification for universally compromising one of the layers responsible for protecting our data.

Note that I said almost sensible. As in, "that motorcycle almost jumped that gorge." :)

And the techniques didn't exist, certainly. I'm more interested in the information itself, though. Before computers existed, all of a person's personal information was likely held on paper somewhere, either on their person or in their car or home or bank. At worst, the papers of a dead person would be locked in a safe—and law enforcement could always get a subpoena to have a safe cracked open.

Computers made the safe figurative, but FDE made the safe uncrackable, and put everything the person owns in there rather than just the stuff they think needs protecting. We really did lose something, and it's not just convenience for law enforcement; many people's entire life histories now evaporate upon their death, having been held entirely as digital artifacts on FDEed devices.

I'm not sure what to do about that. Manufacturer key escrow is obviously not the solution. I have a feeling that having a culture of peer key escrow might be, though. Teaching children that having escrowed backup keys is important, in the same way that having an emergency contact number for hospitalization is important, might help quite a bit. (We could also teach them the value of good passwords, while we're wishing for a pony.)

Encrypted data without a key are something that is irreversible, but you wish it wasn't, really. I think you have to accept it as a fact of life.

Your wish to "reading data off the phones of murder victims" is akin to "it'd be cool they wouldn't be dead, they could tell us who the murderer was".

Right, but if I die, I don't want people accessing my phone after death. They can still get call and text metadata from the phone companies for 90+ days. In fact, I think even the text contents of SMS messages are available for 90 days. The stuff I send over encrypted services, I don't want read.

Reply on news.ycombinator.com