Attorney General will ask Zuckerberg to halt plans for end-to-end encryption
buzzfeednews.com
buzzfeednews.com
Oh, so you’re asking for more end-to-end encryption?
> While the letter acknowledges that Facebook, which owns Facebook Messenger, WhatsApp, and Instagram, captures 99% of child exploitation and terrorism-related content through its own systems, it also notes that "mere numbers cannot capture the significance of the harm to children."
This is such a lazy argument :/
> "The proponents of this process use fear tactics to win support, what the four cypherpunks dub "The Four Horsemen of the Info-pocalypse: child pornography, terrorism, money laundering, and the War on Some Drugs." In other words, laws passed to go after child pornographers, terrorists, money launderers, and drug dealers end up chipping away at everyone's privacy. The classic example is the PATRIOT Act, passed to prevent terrorism but soon used to expand wiretapping and National Security Letter powers in other contexts."
I'll take the privacy side in most any discussion of privacy-vs-security, but categorically denying the possibility that some crimes could be aided by encryption seems a step to far.
It's also bad PR strategy: anybody not already on your side will be put off by your apparent lack of reasoning skills.
Instead, acknowledge the possibility and show them why you consider the benefits outweighing the risks.
How about 24x7 surveillance for politicians and priests and no surveilance for normal folks.
edit: ok ok sorry I misread
Reminds me of this story: "Back during World War II, the RAF lost a lot of planes to German anti-aircraft fire. So they decided to armor them up. But where to put the armor? The obvious answer was to look at planes that returned from missions, count up all the bullet holes in various places, and then put extra armor in the areas that attracted the most fire.Obvious but wrong. As Hungarian-born mathematician Abraham Wald explained at the time, if a plane makes it back safely even though it has, say, a bunch of bullet holes in its wings, it means that bullet holes in the wings aren’t very dangerous. What you really want to do is armor up the areas that, on average, don’t have any bullet holes. Why? Because planes with bullet holes in those places never made it back."
Qoute from https://www.motherjones.com/kevin-drum/2010/09/counterintuit...
https://www-m.cnn.com/2019/08/29/us/ring-cameras-police/inde...
i.e., of the illegal stuff that goes through their system, some of it is captured, and the majority of that is caught by Facebook's own system.
Note, this article is recent and highly relevant: https://www.nytimes.com/interactive/2019/09/28/us/child-sex-...
> And when tech companies cooperate fully, encryption and anonymization can create digital hiding places for perpetrators. Facebook announced in March plans to encrypt Messenger, which last year was responsible for nearly 12 million of the 18.4 million worldwide reports of child sexual abuse material
> Data obtained through a public records request suggests Facebook’s plans to encrypt Messenger in the coming years will lead to vast numbers of images of child abuse going undetected. The data shows that WhatsApp, the company’s encrypted messaging app, submits only a small fraction of the reports Messenger does.
Facebook has said that they don't do this outside of Australia, where it is required by law, but come on, are we really going to take Zuckerberg's word for it?
It's disgraceful that Signal hailed WhatsApp's announcement to use it almost like a second coming of a religious figure.
Credit where it's due, good on them building such effective systems to catch this content.
I mean, I agree with you on the argument completely, but I disagree that it’s a lazy argument.
It’s an extremely effective argument, relative to its factual content. The west is culturally conditioned to accept terrorism as justification and child abuse justifiably gets people riled up.
What’s lazy is people who can’t be arsed to look at complex things from multiple angles.
Good to see that the "think of the children" argument[0] is still in use today. /s
They need a permit for a car? Why not just steal it?
I need an identity to do shady stuff on the internet?
Why not steal it?
We cannot reason with malevolent forces, there is always going to be away,
And by that time, we compiled the data of everyone, centralized it all, and let govs that don't understand the implication collect those as if it was mere petrol or gold.
We are putting everyone's life at risk doing so, just wait until it leaks out or it starts getting sold. (ahem, oh wait !)
It is a problem, and tbh it saddens me a f* tons.
1984 rings more true with each passing day.
"It was meant to be a warning, not a manual."
Congress was provided “encrypted text messages [the top US diplomat in Ukraine] exchanged with two other American diplomats in September regarding aid money President Donald Trump ordered to be held back from Ukraine.”
Might the AG also want to monitor these messages?
https://abcnews.go.com/Politics/top-diplomat-ukraine-crazy-w...
But that's exactly how many problems are solved.
Oh, bull crap. By this argument, literally no protection or liberty that allows even one child to be harmed could ever be tolerated. Why stop at vetting baby-sitters or teachers? We ought to require mandatory background checks for every person who ever visits a family or goes into a public space that might contain children. Law enforcement also ought to be able to track every underage child at all times, via mandatory GPS collars.
At the risk of sounding callous, there are occasionally some situations where you really do need to shut up and multiply.
The reptilian brain will respond differently to children from different cultures on the other side of the world. I understand the logic behind your argument but policy isn't driven by logic.
It's an appeal to emotion and a commonly used tactic of politicians to get what they want (and to convince people it's what they want too). Used all the time in gun control debate.
Well, I think the aim is to create (or in this case, maintain) a emotional button that when pressed, create such an extreme picture in the person's mind that they instantly respond with "your freedom? versus this?, yeah screw your freedom, we gotta stop this."
The extreme the pictures shown on media, the more minachean the TV plot, etc, the stronger reaction.
I completely agree. Now can we talk about guns just lying around the home?
[argument]: Considering that a large amount of child abuse is perpetrated by the parents of children, perhaps the people who need to be vetted first are...
/of course, that devolves into "vet everyone"...
This NYTimes article https://www.nytimes.com/interactive/2019/09/28/us/child-sex-... is quite good. I don't want to punish FB for doing a good job of detection by turning around clutching my pearls at them. Stamos tweeted that every hosting platform has these challenges and I believe him.
There has to be some nuance from the absolute privacy folks on this one. How do we balance the need to fight child abuse with privacy?
One reasonable answer is that FB/Google/etc. should donate or donate more (Google is called out as donating already) to these organizations. I think another reasonable answer is that technologists donate our time, perhaps as 20% projects or as sabbaticals to these orgs and help them modernize.
It does seem Congress (per the NYTimes article I linked above) isn't doling out as much funding as we would like to see.
And, in fairness, children are being harmed here, and at an incredibly alarming rate. Please do read the NYTimes article. The Times is, IMO, a fairly responsible actor in truth telling.
There isn't. This is a logical fallacy. Violating everyone's privacy is not the way to fight child abuse, not even one of the ways that can do anything to prevent it.
I am curious what you think are the ways we can fight child abuse. It seems to me we have some obligation as technologists to see that our works aren't used to harm the most vulnerable.
For example, they might be spotting a large fraction via network analysis, or other metadata approaches. Alternatively, they might just hash every image sent over messenger and match those to known CEP. Encryption screws up one avenue, but not the other.
This doesn't seem like a valid line of reasoning to me. Just because there are pros and cons to encryption does not mean that the right answer must be a nuanced balance where individuals cannot have completely private communication.
The nature of encrypted messaging is that you don't really have a middle ground. Either there is a way for two entities to privately communicate, or all communications are inspected for content by a central party. I believe that allowing private communications is the option that is more suited to the American tradition of free speech.
I'm not saying online systems for catching child abuse can't be implemented. But is it really where our efforts would be most effective?
The question should be: how do you combat child abuse?
For that, we need:
1- Strong reporting systems that connect the people who in contact with children (doctors, teachers, social workers) and centralize and distribute that information. Right now, a social worker doesn't know about the doctor or teacher reports very easily.
2- Then, we need strong systems for handling the situation: i.e. social workers with effective systems for intervention.
3- Then, we need strong systems to take the children that are removed from at risk situations and place them in safe places where they can recover and grow in a healthy environment. This is the foster care system and the national health care system (or lack thereof) that will provide mental health counseling for the affected children.
Given that 1, 2 and 3 of these systems are terribly dysfunctional if not mostly broken, I'm always skeptical when people talk about social media and child protection. The situation gives me a feeling of leaders justifying the erosion of privacy and those who are authoritarian inclined supporting them, rather than people really caring about protecting children.
Well, one place to start is with the realization that 99% of molestation comes from people the child knows. Encryption doesn't affect that pipeline at all, so the gov't shouldn't be worried.
I'd also remind that probably effectively 100% of physical child abuse and violence also comes from people the child knows.
Surveilling strangers can't have anything to do with dealing with any form of child abuse, except the extremely rare case where strangers have been able to find each other and create a subculture with which to provide evidence that exists on Facebook's servers. That's a pretty specific and narrow set of conditions.
I'm not saying Facebook allowing government surveillance on their wires can't produce some hits, but I'd be extremely curious to learn of wider implications and costs that are proportional.
You measure accuracy of detection via a training set of definitely known examples, and comparing it to the detections reported by your system.
You can say with certainty that their system catches 99% of your training data set, but that doesn't mean it Will generalize to "all permutations of child abuse ever".
That's two totally different things. In the end their use of that statistic illustrates an attempt to lie with statistics more than anything else.
I'll try my hand here:
You're talking about this as "preventing child abuse" versus "privacy". The former is pretty concrete, while the latter is pretty abstract. But allowing government to invade everyone's privacy has concrete effects. Let's be clear here: in 2013, 2.2 million people were incarcerated in the US.[1] 1 in 5 is locked up for a nonviolent drug offense[2]--that's 440,000 people. And 540,000 people are incarcerated because they can't afford bail. It's unclear from the graphs on that page how many are locked up for child abuse, but the total incarcerated for rape and sexual assault convictions is 163,000 people in state jails, which by all accounts is where most rape and sexual assault convicts end up. It's unclear how many of those rape and sexual assault cases were convicted due to evidence from surveillance, but I think we can assume that it wasn't all of them. And in case it's not clear, quite a few of those unethically incarcerated will be raped[3]. In short, unethical incarceration is a much larger threat, by the numbers, than child abuse.
We've seen time and time again that violations of privacy are publicized as being used to prevent terrorism and child abuse, but immediately are then used to prosecute nonviolent drug offenders.
What it comes down to for me is that I trust average citizens to do the right thing more than I trust the law. The vanguard of law enforcement is average citizens picking up the phone and calling the police when they see something wrong, and I want to keep it that way. I trust the average person to call the police when they witness a crime like murder, rape, or child abuse, and not call the police when they witness drug possession. I do not trust law enforcement to enforce the law as ethically. Pervasive surveillance takes that power out of the hands of citizens and puts it in the hands of law enforcement who has time and time again shown themselves to be untrustworthy with that power. It's dangerous to be right when the government is wrong.
And that's in the current US. In the past, US law has been even more wrong. For example, US law enforcement was used to suppress, for example, civil rights activists. That time may come again. It has always been beneficial to let illegal behavior slide under the gaze of law enforcement when that illegal behavior wasn't unethical behavior.
[1] https://en.wikipedia.org/wiki/Incarceration_in_the_United_St...
[2] https://www.prisonpolicy.org/reports/pie2019.html
[3] https://en.wikipedia.org/wiki/Prison_rape_in_the_United_Stat...
You can catch a majority of such content just by running a dumb hash over the bits, even though the detection rate suffered a little thanks to dumb smartphone users who will screenshot everything instead of sharing the files, thus creating "new" content.
If you add some simple "content hashing", like https://pypi.org/project/dhash/ or Microsoft PhotoDNA https://www.microsoft.com/en-us/photodna you can catch an astounding number of content shares, something which really looks great in press releases. My guess would be that the vast, vast, vast majority of those 18M reports that letter mentions came from automated engines detecting the "common" content with dumb bit or content hashes. But you really didn't do much except annoy and scare some online pedophiles* who shared the same 10, 20, 40 year old content* and maybe even put a few of them away for good or caused them to kill themselves. And yet, you almost never actually prevented ongoing child rape and other abuses.
The problem however is that you absolutely cannot catch new content that way. Content that isn't widely shared but shared between two people or in rather small groups. These small groups have elaborate vouching and proving systems in place, and are hard to infiltrate, going as far as having to prove yourself by sharing a picture of you victim holding a sign with a time stamp and some passphrase.
facebook aimed their AI at porn so they might catch some of this new content by accident; it's porn after all. Then again, my hopes aren't that high, seeing Microsoft's bing fucked up even removing the known child abuse content from search results even as the company runs the PhotoDNA database I mentioned before. And google's AI is "clever" enough to think black teens are gorillas, but they are supposed to catch child porn?
Also, those dedicated child abuse content producers do read the news and know not to use facebook or twitter. Most of them do, anyway.
There is essentially three types of pedocriminals I have observed: the aforementioned part time online pedos who share the same old child abuse content but do not actually produce it or abuse children in the real world, a group of active pedophiles who do not care about getting caught because they live in places where they do not actually have to fear the police investigating them, and a cautious group who might use common public services to make initial contact and talk a little in code but will immediately exchange tox ids etc or at least link to "how to setup qtox over tor"* guides (I saw a few "groomers" do just that), and never share anything incriminating over a public service. My guess is that they are be behind tor or a VPN even when using those public services.
And there is a small number of dumb fucks too who will get caught easily and who end up in the press, and, of course, a probably quite large group of pedophiles who just abuse children but do not tell anybody about it, especially not on the internet.
The majority of people you'd actually want to neutralize because they engage in ongoing child abuse you will not catch on facebook or twitter or whatever. I sometimes liken it to catching a lot of drug users, but not the dealers let alone the drug producers.
Not that my experience dealing with the police is much better. The average time for them to get back to you is a few months if they are from the West, and usually never in other parts of the world, even if they have dedicated groups and/or tip lines. Maybe sometimes they do investigate without acknowledging the reports you sent, I don't know, but it is my feeling that probably not. I don't want to blame the individual police officers and detectives who have to deal with this shit, it's probably all due to lack of resources and institutional support.
But to shit a bit more on the police: I saw some chats with essentially reverse-grooming, where a "girl" started off telling how "wet" she is and how much she likes dicks and only then that she is only "13". After learning about "her" age the dude then usually quickly leaves, but often only after having posted some personal information already. I later learned that such "girls" are either the police "child grooming" units, or blackmailers. I don't even want to know how many of the grooming cases that actually go to court are a result of this tactic, catching stupid horny wannabe pervs, while the actual groomers go free. Burning resources like this instead of using them to catch the truly evil and nasty people again seems to be a political decision.
Source: personal experience from having to deal with this shit occasionally, and having caused some pedophiles to go to prison.
* There have been a few studies that found that the group of people consuming child abuse media and the group that actually molests and rapes children doesn't have too much overlap, contrary to what one might expect.
A lot of the "common" content is rather old, like digitized VHS tapes and magazine scans, or stuff like "1st st" (the producer of which went to prison like 10 years ago) or the East European nude "modelling" stuff from the early 2000s, or webcams from a time when webcams had half a megapixel. There is some newer stuff, like "Rbn" and "Rgirls", but that's the exception. And if you try to fill in the blanks and google any of this, you're stupid and/or evil; don't.
* I have had a few tell that to my face, taunting me to report them to their local police.
I am singling out tox/qtox because at least at in the recent past it seems to have been the goto tool for security conscious pedophiles, based on my personal observations.
Do you have some links for this? I've anecdotally heard it both ways.
https://olemiss.edu/depts/ncjrl/pdf/I%20C%20A%20C/2013%20-%2... seems to imply the opposite.
Mostly encryption protects privacy and business information. Corporate espionage is bigger than state espionage or terrorism my many multiples, and directly threatens national security as well as markets.
Encryption is pro-business and pro-privacy for business and individuals. Without encryption or with backdoors you are trusting that bad actors don't get access to it, they will.
Why have a world class security system, yet plenty of keys under rocks in the backyard?
I wish encryption was framed like this:
Going without encryption or including backdoors is another level of trust, like leaving your window open on vacation and putting a note that says, "Only Sally the neighbor can come in through the window, please" (Sally being the gov't). Guess what, Sally won't be the only one coming in. In that situation you may as well open the front door because that is the same as the backdoor or window, just less obscurity but more attractive to underground/opposition forces whether that is state, corporate, personal or more.
Oversight and security has gotten lazy, two decades of surveillance based detective work without warrants over real detective work with warrants has made enforcement and security lazy and unable to operate without all the noise that comes with access to everyone's data. Initially it was about terrorism, but everyone knows it is about business information, personal information and other over steps like the drug wars or fights against sex workers or other wars on people that are low hanging fruit that are picked on constantly. Good detective and intel work needs to come back and less of the surveillance type.
(I'm not saying they're right, but to say that end-to-end encryption is always pro-business is naive.)
They want to surveil the public.
Writing it yourself for the first time, or just copying some code off the internet, is going to have a vanishingly small chance of being actually secure.
If you tried to set up a "super protection" around your house, which (for example) electrocuted people who entered by breaking the door down, and this hurt a police officer you would go to jail.
So to me, the real world seems to line up with having encryption with a "back door" only the government has access to.
Physical access is easier to control as getting access has a cost. Digital access is effectively free.
The problem with this is that physical access has a cost and limiting it behind approvals and procedures - can deter improper access. (Not always - if a cop really wanted into your house - they will get in)
Digital access is effectively free. It doesn’t cost very much to use a backdoor on millions of devices across the globe. There isn’t much that can be done if the backdoor is leaked.
Police officers use a battering ram or force to get into a house. We know how it works. But knowing it doesn’t increase chances of burglaries.
The problem is when the law is against them with things like national security orders, along with the question of how we can ensure that they are regulating access properly. But in theory, these things could be fixed.
Republicans were never pro-market. Or at least not in the last 100 years.
Everybody that works for the state will not be a defender of freedom or liberty. They are servants of the American Empire, and the US is most certaintly an Empire.
The primary function of the state security is preservation of the state, and not security for its people.
Isn't the entire point of E2E Encryption for user safety, as in safety from the government reading your message?
That is their stated reason. If given access they will also read your messages to determine if you are a drug dealer, or a drug user, or have committed financial crimes, or if you're organizing disfavored political activity, or...
I'm starting to wonder if this is a smokescreen. Eventually give in to E2E because you know you have got app store signing keys for the apps so you can upload a patched one with backdoors.
> I'm starting to wonder if this is a smokescreen. Eventually give in to E2E because you know you have got app store signing keys for the apps so you can upload a patched one with backdoors.
Is there no way to prevent auto-updating of apps? If the app blocks access barring upgrade it may be suspicious. Though I guess the upgrade would probably be veiled in new features.
You and whoever you are messaging of course.
Ah yes, "think of the children!" This is so tired, I'm (just a bit) surprised they fell into this argument.
Kids being shot in schools: the price of freedom.
Private communications means also criminals can communicate privately: outrage.
What are you talking about? I'm seriously asking. This sounds like something people say without having anything real behind it.
I am still pro E2E encryption, especially given the Snowden revelations (the US gov cannot be trusted to be responsible), but it does come at a high cost.
https://www.nytimes.com/interactive/2019/09/28/us/child-sex-...
https://en.wikipedia.org/wiki/Blackstone%27s_ratio
"It is better that ten guilty persons escape than that one innocent suffer."
If you start thinking that parents "can be" the criminals then you've decided that parents are automatically guilty and must be proved innocent. This goes against the very moral fiber of the entire western world theory of law, the presumption of innocence.
I don't understand why they don't just ask for what they want, why say it's about "user safety" when it's not about that at all.
Just say "As a matter of national security, the government needs to be able to read user messages (and we don't care if that opens up a hole that enables other governments to do it too)"
Have you never heard someone lie through their teeth?
They (government workers at the agency) have no real incentives to fight for privacy other than having to live with eroded privacy, which most people just don't think about as giving something up until it affects them anyways.
If the demand was phrased around security, it would be less emotionally laden (for most).
I find that quite appalling, to be frank.
Because they don't care about an honest representation of their argument, they just want to have their will imposed. The best way to do that is to lie.
I spent a few moments trying to understand what had led to the manufacturer of Tizer, Irn Bru, and various other traditional British soft drinks getting involved in this.
Submitted title was "AG Barr Will Ask Zuckerberg To Halt Plans For End-To-End Encryption".
https://twitter.com/hashbreaker/status/709314886384427008
> Fun game to play: Take statements from Comey et al. Replace "smartphones" with "brains"/"memories"/"thoughts". Technology will get us there!
Very on brand for the new versions of this request...
I don't think they will be hurt by the fraction that do leave for this reason.
Assuming someone already has knowledge of Facebook's past activities, then they are likely already gone. If they are still using the service, it's unlikely this will make a difference.
Cheap and convenient is just too much of a draw for some folks. Especially when it involves "staying connected" with friends and family (irrational behavior driven by emotion).
https://keybase.io/blog/chat-apps-softer-than-tofu
(I have no affiliation with Keybase, I just appreciate their very thorough and public analysis.)
But since this idea has been brought up by a number of ad companies (Google, most notably), I can answer in the more general sense.
I would not support ad targeting done that way. It is a bit less objectionable, but it doesn't really address my objections to the entire practice.
Also, should we read this request as "if you implement E2E encryption we will no longer have visibility over what FB users say"?
If so, and because the connection between us and FB is over https, I assume there are deals in place where various 3-letter-agencies from these 5 countries are given (or they take themselves) the contents of our private messages? I wonder why they would be opposed to something like E2E then /s
Facebook (or other messenger app owners) could train a good classification model to detect child abuse pictures on large servers and provide the model to smartphones locally. Before sending pictures, the app would run the trained model (which is cheap computationally). If if detects pictures of abuse with a certain accuracy, the app would block the transmission of the picture (possibly, explaining why to the user). If the detection of pictures of abuse happens again, the user could be banned from the app for 1 day, and if it happens more often the ban would become longer and longer.
That way facebook can fight child abuse without ever having the pictures.
I want to applaud you for thinking outside the box though.
People sending CP through whatsapp/FBM are not clever. If they were clever, they wouldn't be doing that. The justice department is not primarily interested in catching clever criminals, at least not via this particular mechanism.
As for Facebook, it is more likely because Facebook is in "progress" of enabling E2E and they have more users than Apple right now. It is easier to hit Facebook now than later unlike in the case of Apple that already implemented it from the start; it would go into court litigation for several years and most likely end up in Supreme Court.
Barr is just assuming FB will cave in.
PS: No, a huge value prop for iMessages is that it's built into iOS and any iPhone user can talk to another iPhone user, not because of E2E. Most users aren't aware of what E2E is.
Because when Apple was preparing it, it wasn’t public about it, and the then-sitting AG wasn't looking to generate news articles with his name that weren't attached to his role in acts fueling an imminent Presidential impeachment, so no similar warning note.
Here is some legislation from 2000: https://en.wikipedia.org/wiki/Regulation_of_Investigatory_Po...
> Critics claim that the spectres of terrorism, internet crime and paedophilia were used to push the act through and that there was little substantive debate in the House of Commons.
20 years in life of internet is a lot. Same arguments. Remarkable.
What historical events and periods are you referring to in the past millenia?
I think tech companies would have a stronger basis for refusing to monitor and censor user traffic if they hadn't volunteered to monitor and censor some user traffic. Doing anything some of the time makes you vulnerable to pressure to do more of that thing.
Carrying all legal content and refusing any cooperation with the government without a warrant is the only sustainable path.
https://arstechnica.com/information-technology/2013/11/googl...
(Of course, this just prompted Google to serve more legal data requests, but better than letting the Justice Dept sweep everything for who knows what end)
https://hacked.com/italian-hacking-team-hacked/
How do you like those apples?
I can't think of a technical defense against a threat like that that doesn't involve disconnecting all the computers in my house and throwing them away.
This tool is not described in the article you've linked. Do you have an additional link for those of us who want to read more about this?
https://news.ycombinator.com/item?id=9836336
It is true, there is a tool that was developed to basically plant evidence on a compromised machine. So the idea here being that the hired hackers would compromise the machine and then the government client would tell the hackers to put CP, incriminating evidence or other stuff on the machine before the police raided the house/building. The computers would be seized and then it would be used as evidence to prosecute the target.
It is real.
Also if you are interested, dark net diaries did an episode on this group called "hacking team".
Seems easy for FB to comply with this: they are adding encryption specifically to improve user safety.*
The later extract in the article body talks about "public" safety, which is the classic false dichotomy that has been brought up by law agencies for the past 30 years.
Much as it sticks in my craw to say something supportive of either of that meretricious duo Barr and Patel, I have to admit I am glad that they are using an open letter rather than trying for a backroom deal or quiet threats. Perhaps they tried those already and have been rebuffed.
I have seen some friends of mine outraged by social media's inability to do wholesale censorship, spurred by some NYT articles on child abuse from last week. I wonder if that was coordinated?
* OK, they are a corporation doing it to encourage people to use their service, but they are trying to accomplish that by improving user safety.
So the government not having access to private communication is a threat to public safety, and won't somebody think of the children!
Australian here. Does "user safety" include journalists not being raided and/or prosecuted for publishing public interest material? For example, likely evidence of war crimes by some of our soldiers.
As has begun happening here, after laws were introduced forcing our telco's to allow monitoring of anyone.
https://theintercept.com/2019/08/04/whistleblowers-surveilla...
Some more statistics would be useful to quantify the impact on criminal justice of losing either of those options. Otherwise the arguments just feel political or emotional.
End-to-End won’t impact the major source of evidence in, say, sexual assaults where the victim unlocks their phone and submits a copy of their decrypted message threads to the police, though this is a controversial policing method, recently reported on in the UK:
https://www.theguardian.com/society/2019/sep/21/people-repor...
If Americans cared so much about their freedom to protect themselves from their government, rationally it would make far more sense to be up on the fence about encryption than about firearms.
[1] https://law.stackexchange.com/questions/3696/is-the-right-to...
[Edit] I don't want to start a flame war about guns, I'm genuinely curious about what the law would say about encryption under the second amendment.
If you see the insanity of this, you should see the insanity of the Government tapping into private messages.
Well, I don't see the Feds cracking down hard enough on homegrown fascist groups, and I would be happy if Bob Barr's kids or grandkids were locked in a dungeon and made to sit in their own filth Omelas-style if it meant we'd have strong crypto for everyone.
Electronic surveillance is primarily used for reconstruction and back tracking after a significant crime has taken place. After the fact.
Electronic surveillance is paying cheap lip service to a problem instead of paying the expensive price of doing it properly, in meatspace, with boots on the ground.
Ask any woman/minority, domestic abuse victim, etc. They don't want people spying on their messages.
If you want to prevent criminals from communicating safely in the long run, you would have to prohibit open internet access and/or mathematics.
Prohibiting platforms will lead to some delay at best. The collateral damage, taking away privacy from the population at large, is proably the real goal.
So, when is ban on guns, cars and parents coming? Each of them killed countless kids.
I don't think it works that way. Serious criminals that we really want to catch are probably not coordinating their activities using unencrypted channels anyway.
I don’t get it. How could end-to-end encryption reduce user safety?
I eagerly await the publication of these politicians’ private communications.
Classic Spielberg called ’Minority Report’ with underwater ‘precogs’
This will, of course, never happen because breaking up businesses and consumer protection is verboten and anti-american, but I really wish someone with a big voice could stand up and make this point because it makes them look silly.
If there is an infinite supply of encrypted channels, controlling them all becomes literally impossible.
A system that handled things like performing the encryption and decryption of messages over any platform would be interesting, the only pushback you would get from an authoritarian government is them telling providers to "block all pgp/encrypted comms on your platform" and/or the platform actively attempting to block your client's access to the API.
For instance, discovering and negotiating various publically available http or irc or jabber etc. nodes, and coordinating around their unavailability.
What's stopping the government from just forcing Facebook to provide access to the servers directly, or through some sort of portal?
This just means the government can't intercept them without Facebook cooperation... no?
Although I have a tough time believing Facebook would lock themselves out fully... they need all those data points for pushing ads...
The infrastructure should be there. If there's a court order or lawful authorization, info should be accessible without delay.
But
The way to do that would be more systems of review for when it's used, generally making the standards more strict, less ambiguous.
But
The problem is there are side effects to changing the law that can give away methods and also put convictions at risk. There's other ramifications we may not know about until it was put in effect, but they could be negative. I bet that's one reason there isn't as much movement in the area.
There was an article in the news recently that right now in USA the case law considers unopened email to be discarded.
GDPR went into effect in EU. That is another aspect that US doesn't a similar thing for (does it need one? I don't see people bringing it up often, convince me otherwise?)
My point is, backdoors are more of a hypothetical thing. The legal framework around them and making them better is more productive use of your time.
That would involve people coming together and nuancing what the types of privacy are and whether it involves US people, foreign countries, drug dealers, etc.
> end-to-end encryption into its messaging apps will prevent
> law enforcement agencies from finding illegal activity
> conducted through Facebook, including child sexual
> exploitation, terrorism, and election meddling.
Not buying the case for the protection of children from the UK, after repeated failures to protect children despite mountains of evidence [1] [2] [3] [4] [5] [6] [7] [8] [9] [10]. Finding pedophiles is relatively easy in the UK, they are one of the single most hated groups and often cited as the reason to bring back capital punishment.
Terrorists are already using encrypted chat services such as Telegram to evade intelligence agencies. Encryption has no influence over election meddling.
What this is really about is watching the general public. Facebook now blocks content even in private messages. The other day I wanted to share a free-documentary (i.e. fully legal) with a friend and so shared a page with a direct download and magnetic link, which in turn Facebook kindly blocked. Something that is pouted as "safety" is actually just about trying to line the pockets of the film/music industry.
[1] https://en.wikipedia.org/wiki/Rotherham_child_sexual_exploit...
[2] https://en.wikipedia.org/wiki/Derby_child_sex_abuse_ring
[3] https://en.wikipedia.org/wiki/Huddersfield_grooming_gang
[4] https://en.wikipedia.org/wiki/Jimmy_Savile_sexual_abuse_scan...
[5] https://en.wikipedia.org/wiki/Manchester_child_sex_abuse_rin...
[6] https://en.wikipedia.org/wiki/Newcastle_sex_abuse_ring
[7] https://en.wikipedia.org/wiki/North_Wales_child_abuse_scanda...
[8] https://en.wikipedia.org/wiki/Oulu_child_sexual_exploitation...
[9] https://en.wikipedia.org/wiki/Oxford_child_sex_abuse_ring
[10] https://en.wikipedia.org/wiki/Rochdale_child_sex_abuse_ring
"While the letter acknowledges that Facebook, which owns Facebook Messenger, WhatsApp, and Instagram, captures 99% of child exploitation and terrorism-related content through its own systems, it also notes that "mere numbers cannot capture the significance of the harm to children." "
Encrypt it, end to end, the government does not need to be able access all private communications of private citizens. There are other means of investigating potential crimes.
I love the Internet, and my career is in security. But we as a security/privacy/technology community truly need to look hard in the mirror about how we are allowing and perpetuating lifetime harms to children and women.
Terrorism exceptions, like San Bernardino, don't ring with as much impact as the CEP argument.
COINTELPRO was a thing that actually happened and should be brought up every time privacy rights and government surveillance is discussed
* https://en.wikipedia.org/wiki/Room_641A
* https://arstechnica.com/tech-policy/2013/10/new-docs-show-ns...
bin Salman in Saudi Arabia: https://en.wikipedia.org/wiki/2017–19_Saudi_Arabian_purge
Law enforcement and security agencies need to be able to access any communication. This does not mean that they should monitor all communications.
They can eavesdrop on any phone call. They do not eavesdrop on all phone calls.
The problem with E2E encryption is that it prevents eavesdropping even with the standard legal safeguards (warrant, etc), while not being required for the privacy of users. It is only effectively a marketing tool to convince people to use services from providers they don't trust, although, of course, since they control the app they can still in principle access the data.
Even with E2E the police can get warrants for the devices which is usually more than enough to access data.
They just want an easier job, it’s not a major roadblock. When police jobs being easy is a good sign that privacy has been completely destroyed.
I don't agree with this -- but I think this does strike at the very heart of what the debate is all about.
Why? And while we are at it, why is this such a given that they need it.
We're just going to completely ignore the last administration spying on their political opponents?
But if it was true, seems to be another reason to allow End 2 End.
Unless this was essentially a "but her emails" post.
[0] https://www.politifact.com/truth-o-meter/article/2017/mar/21...
Nobody really cares about your personal Facebook messages to your friends and family. You're not that important. But still considering what is being offered in payment for this privacy, it's still worth it to you?
I'm not so sure it is, personally.
What do you think the negative consequences are for a government to have a permanent record of every private conversation made over the Internet? Bear in mind that the fraction of all private conversations which occur over the Internet is only increasing.
You must assume that "exceptional access" really means "routine access". While the government claims it only wants access to some encrypted content, decryption leaves no trace. The NSA's collection posture is: "Sniff it All, Know it All, Collect it All, Process it All, Exploit it All, Partner it All." Does it sound to you like the NSA will sit on their hands while some other USG functionary has the Golden Key?
> Nobody really cares about your personal Facebook messages to your friends and family. You're not that important. But still considering what is being offered in payment for this privacy, it's still worth it to you?
Perhaps you're correct now. But imagine that a decade from now, you (or a friend or family member) become an activist or a political candidate. Now your incumbent political opponents have a wealth of sensitive private data to mine to find anything to imprison or discredit you. The argument extends further than your own direct interests: What happens to our political system when policymakers are completely transparent to the NSA and their political co-conspirators?
Considering the very real risks of a totalitarian government ruling with an iron machine learning model, or a silent coup by military intelligence, is it still worth it to you?
This is demonstrably false. Companies are very interested in your private communications and the buying and selling of your personal private data is a multi-billion dollar industry. Governments also have an interest in your data because they can flag you for whatever the current administration finds distasteful. That might mean identifying threats to those in power like activists, or (as we've seen in other places) attempts to hunt down whatever they consider "evil" like homosexuals
The issue isn't privacy vs security. Loss of privacy is also loss of security.