Dear viewer, these subtitles were generated by a machine via the service Trint and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/169 Thanks!
Um, this is Chris, Chris is
going to talk about the really
hot issue, which lot of you know,
so please welcome him for his talk
about because government hacking into the
next crypto was.
Can I get the display?
There we go.
That's a.
I'm beginning.
Sorry, I'm using Windows within Linux, so
it's always a little bit complex.
There we go.
Hi, everyone. So thank you all for coming
and coming to this room.
So my name is Chris Soghoian.
I work for the American Civil Liberties
Union. I'm a technologist and I'm
embedded within a team of attorneys.
I work for a bunch of lawyers
who sue the US government for various
surveillance practices.
It's a very, very fun job.
And I actually say as much as I love the
fact we were actually the first ones to
sue over the latest surveillance program,
we sued less than a week after Snowden's
first revelations.
And we have a lot more fun stuff coming.
All right. So today I'm going to tell you
a few stories.
This is really about it.
This is a history lesson.
This is a history lesson and a story
about today.
Really, what I'm going to explain is how
the U.S. government is adapting to
changes in technology, how the US
government is dealing with the transition
from one industry to another.
And the final eventual embrace
of some basic security technologies.
So this is Louis Freeh.
Louis Freeh was the director of the FBI
during most of the 90s,
and Louis Freeh testified
several times before the U.S.
Congress complaining about the kind
of technology that is near and dear to
our hearts.
Encryption technology
so many of you may not remember, but for
some period of time, for several
years, for decades,
cryptographic technology was regulated
under export control rules.
You were not permitted to export strong
encryption from the United States.
And so we had a system of good
encryption for the Americans and shitty
encryption for everyone else.
Not only did we have that system in
place, but the FBI and their friends
also wanted to push for what was
called as a cryptographic
escrow or as escrow
systems that would allow the
government to get information about the
encryption key is used by U.S.
citizens. And so Louis Freeh was
testifying before Congress in 1997,
he said, quote The widespread
use of robust non key
recovery encryption ultimately will
devastate our ability to fight crime
and prevent terrorism.
He added uncrackable encryption
will allow drug lords, spies,
terrorists and even violent gangs
to communicate about their crimes and
their conspiracies with impunity.
The way the free portrayed encryption
to Congress and to policymakers at
that point. Encryption was the devil's
technology. Encryption was something that
would allow really horrible things
to happen.
And so obviously, policymakers took note.
This was a very scary technology
and what he what he
described would be a world in which
the government would be blind.
The government would be unable to go
after the worst of the worst.
And so what Freeh called for,
he said, quote the only acceptable
answer is socially responsible
encryption products, which permit timely
law enforcement and national security
access and decryption pursuant
to court order or otherwise authorized
by law.
Socially responsible cryptography
in the mind of the FBI was
cryptography that didn't actually keep
your information safe from the US
government.
This is in fact one version
of that socially responsible crypto.
This was called the Clipper chip,
and the Clipper chip, thankfully was not
a success in the market.
Not only was it not a commercial success,
but it wasn't even very secure.
The idea was that a third party,
potentially the government or someone
else, would keep a copy of your private
keys. And if you were later suspected
of doing something bad, the government
could go to that third party, obtain
your keys and then listen to your
telephone calls. And thankfully, the
Clipper chip never took off,
and the FBI is dreams
of a world of escrowed encryption.
They didn't materialize.
A few years later, the export
control rules that we had in the United
States were lessened.
In 1996, Bill
Clinton signed an executive order that
really got the ball rolling.
And in the years that followed, we
finally start to saw
a sane crypto export control policy.
This led, for example, to the United
States granting a license to the P-gp
Corporation to export pretty good
privacy.
And it's been, you know, this happened in
1996.
It's been nearly 20 years
since these these rules were relaxed
and the doomsday scenario that
Freeh predicted hasn't happened.
We haven't had drug dealers and
pedophiles and terrorists using
encryption and mass.
We haven't seen wiretaps
and other forms of investigation are
frustrated by encryption.
And so what happened?
Why didn't the prediction of Louis
Freeh and his colleagues come true?
Why didn't the bad guys suddenly
start using encryption because it was
freely available?
Anyone today can go to a number
of websites and download email encryption
software, hard disk encryption software
and encrypt everything they're doing.
But it hasn't happened.
P-gp has not, in fact, been
a problem for the FBI.
And the reason is actually
not a political one, it is a technical
one or a one involving human
beings. This is a research paper.
More than 13 years old now by Alma
Whitten, which was the first usability
study of P-gp.
And the idea was to examine how regular
people used encryption software to figure
out whether regular people could figure
out how to use the encryption software.
This is what he looked like in 1998,
when the when the study was published,
and in fact, the user interface for BGP
hasn't really changed that much since.
And so Auma describes these
really horrific situations.
I mean, horrific from the perspective of
someone in the security field.
She describes situations in which people
thought that they were encrypting when
they were in fact not encrypting or
people sending their private keys instead
of sending their public keys.
And you know, you can crack jokes and
say, Aha, these are the users are so
stupid. But actually, this is a failure
of the engineering community.
This is a failure of our community to
produce tools that are easy enough for
regular people to use.
And things haven't changed, you know?
Glenn Greenwald tried to use BGP,
failed to use PDP, Edward Snowden made a
how to video that still didn't help
and eventually someone had to help
Greenwald out.
And that's not to blame Glenn.
I think Glenn actually Glenn skills are
probably about average for a national
security journalist. It's just these
tools are really difficult to use.
And we as a community haven't done
enough.
But so this is what this is, what
has benefited the FBI.
It has been the massive usability
problems associated with encryption
and the fact that you have to go and
download something.
The fact that you have to take
affirmative steps to get encryption
software means that most people won't
in fact use it. And so the FBI has been
able to take advantage of this as long
as people are, as long
as people are using the default tools and
the default settings.
The FBI wins when those defaults are
not safe or secure.
And so although it hasn't been a problem,
neither has keeps the
encryption that we use in our web
browsers for years has
not been widely used.
This is one of the slides that was
released by I think this one was released
by The Guardian this summer.
This is a GQ slide from
2009 saying, Why are
you interested in HDTV?
And the answer was because at that point
in nineteen ninety nine two thousand
nine, nearly everything a user
does was using HDTV.
Back in 2009, just four
years ago, Facebook, Yahoo,
Twitter, MySpace, Gmail,
Google Earth, Wikipedia, everything
was going over the internet in
clear text.
Although SSL was available in
the browser, consumers
don't choose whether or not the sites
they're visiting are going to be whether
they will be going over SSL or not.
That is generally a decision made by the
server, particularly the server doesn't
even support it.
And so governments took advantage
of this. They could engage in massive
passive interception
enabled because of the fact that
encryption wasn't being used.
Now, of course, that was in 2009.
We're now in 2013, and a lot has changed
in the last few years.
Hell, a lot. A lot has changed in the
last few months.
And so Google was the first of the big
tech companies, first of the big
non-financial companies to finally
roll out SSL by default in January
of 2010.
And then the next couple of years,
several companies followed Twitter,
Microsoft's Outlook email service,
Facebook and then Google even moved their
their search service to SSL by
default. And so we've gone in the past
few years from a world in
which most information, most of our
communications were going
over the public internet and unencrypted
form to a world in which some
of our communications are going over the
web in encrypted form, at least in
portions of the internet.
Even Yahoo has announced that they are
allegedly committed to protecting your
information and are finally
turning on SSL.
I think in a few weeks in
January, they're going to be doing this.
Now, if you see, some of this has
in fact been a direct result
of reporting by The Washington Post
not only revealing that these companies
information, the information between the
users and the sites was being
intercepted, but in fact, the information
between the data centers of various
companies, the internal links between
companies are being intercepted.
And so it was directly as a result of the
reporting of The Washington Post that
Yahoo finally got with the program and
turned on SSL by default, that Google,
Yahoo and Microsoft have announced that
they are all encrypting their server to
server links.
And so we're finally getting to a point
where things are getting a little bit
better.
If you've seen the If Encrypt the web
report, which is a fantastic
compendium of information, this sea of
green that we're now seeing across tech
companies is directly a result
of the disclosures of this summer.
And so we're finally moving in the right
direction.
And of course, the government probably
isn't going to like this too much.
I mean, it will frustrate some forms
of passive surveillance, passive network
surveillance, but HTP
asked does not prevent the US government
from getting data HDP
asks prevents the US government from
getting data from the companies that they
would normally like to get it from.
But it doesn't actually stop them from
getting your data or my data right.
So typically the US government would like
to go to operators of backbone internet
services. It was revealed by the New York
Times that Level three communications
provides the links between Google's data
centers. We know that Verizon and
AT&T have been providing assistance
to the US government for a long time.
And so the government would rather go to
these telcos.
They would rather go to these companies
and get information in bulk.
Right. They can do keyword searches
through people's information or people's
email accounts and other other
forms of information when they get
everything at once.
They would rather do that, do this, then
go to the tech companies and request
information.
And so the shift from http
to S is
also causing a shift in the way that
the government obtains information about
users.
And the way that this shift is occurring
is that they now have to go to Silicon
Valley technology companies, whereas in
the past they could go to friendly
telecommunications companies who were
probably more likely to say yes and
to give them access to far more
information at once.
Right. And so what we've seen then
naturally, is the development
of relationships between the Silicon
Valley technology companies and the NSA
now prison. I think in some ways
people have gotten the wrong impression
about this. These companies have been
providing access to the US government
long before they were listed on the PRISM
slides.
All U.S. technology companies are
required by law to respond to
lawful requests, and the PRISM really
is just about how are these requests
processed and how is information
delivered to the government.
But let's be sure.
Let's be clear, Google will respond
to lawful requests from the Department of
Justice. Facebook, Microsoft, Yahoo.
All of these companies are required by
law and will hand over data
about their customers.
What's happened, though?
What SSL or that the use of
transport encryption has done is
it has. It has moved the point
of interception and has moved the
bottleneck to the technology companies.
The technology companies want to be
the one place through which the
government can spy on their users.
They don't. They've not said that they
want to be or that they want their
users to be safe from all spying.
They just want to be the ones to perform
the spying. They want to know when the
government wants information about one of
their users. They want to be the ones who
receive the court order who examine the
court order, maybe who pushed back or
don't push back.
What they don't want is some other
company, like a telecommunications
company, to be the one providing data
about their customers.
And so I think it's important
to understand and to take note of the
fact that the tech companies still
have your data in unencrypted form.
Right, even though the communications are
going over the internet in encrypted form
once it gets to Google.
Once your emails get to Google's servers,
once your direct messages on Twitter
get to Twitter, they're sitting there in
unencrypted form.
That or at least encrypted form that
their engineers can access when they need
to.
And that's not going to change anytime
soon. It's unlikely that the major
technology companies are going to roll
out products that protect your
information in such a way that they are
never able to hand your information over
to the government when they get a
request.
This is Vint Cerf, many of you.
I'm sure everyone in this room has heard
of him.
One of the fathers of the internet, Vint,
is now a senior executive at Google.
I think his title is internet evangelist,
and Vint was on a panel with me in 2011,
and we were discussing whether
Google could ever sort of deliver secure
services to their customers.
And he said, quote, We couldn't run our
system if everything in it were
encrypted, because then we wouldn't know
which ads to show you.
This is a system that was designed around
a particular business model.
And I have to give them,
you know, a lot of respect for being
on this open in this transparent, it's
something, in fact, that many of his
colleagues haven't done that Google
cannot deliver a service
to you right now where Google is
never going to have to hand over your
information to the government without
shifting to a different business model.
Google's advertising supported business
model requires that they see the contents
of your emails. It requires that they
know the web pages you're going to
and to move to a model where they don't
know the contents of your emails.
When they don't know where you're going
on, the web and where they know nothing
about you will be will require
that they give up the advertising revenue
that they make right now.
And many of us don't give our money to
Google. I'm not going to get into this
business about if you're not paying for
the product, you are the product.
But right now, Google would have to
switch to an entirely different business
model to deliver end to end
encrypted services to users.
And it's not clear that that they want to
move down that path.
I think they want to stay a very
successful advertising company.
So the first thing is that Google's
business model doesn't
actually permit them to move to a
situation in which they have only
encrypted data.
And the second thing is that it's not
even clear whether the tech companies
want to provide services
that keep the government out.
It seems if you listen to the executives
at the Big Tech companies, it seems like
they're actually OK with individualized
surveillance.
You know, they're OK with moving
from a world where we are now to a world
in which the government can only get
information about individual users.
If you listen to the statements
of the executives or you see some of the
things they've put out, for example, just
a week or two ago, eight of the
biggest technology companies published
this is open call to reform
government surveillance. You can see it
online. I think it's reform government
surveillance dot com, and they've called
for the U.S. government and governments
around the world to sort of reform their
surveillance practices and laws.
One of the things they say in that is
that governments should limit
surveillance to specific known
users for lawful purposes
and should not undertake bulk collection
of internet communications.
So on one hand, I guess we should be
happy that these companies have come to
our aid and are deploying their their
PR and lobbying dollars in favor
of surveillance reform.
They clearly don't like dragnet
surveillance.
They don't want governments to get
information about all of their users, but
they do seem to be comfortable with
individualized requests about particular
users.
Now, I don't know about you. Maybe you're
comfortable with the police having
access to your information.
If they go to a judge and they obtain and
you know, they show probable cause and
then they get the emails.
I don't particularly want my emails to be
turned over under any circumstances.
And Google and these other technology
companies are not going to deliver the
kind of encryption and privacy
protections that I actually want.
And that's fine.
There are companies and they can choose
to to target their products
in the market the way that they choose to
do.
But let's be clear, Google and Facebook
and Microsoft are not about to start
delivering end to end encrypted services
to their users. They are not ready to
lock the government out.
So this is Eric Schmidt, of course,
Google's longtime CEO and
now chairman.
And in 2009, Eric Schmidt
was interviewed by Public Radio in
the United States, and he was asked about
surveillance. He said sorry.
He was asked about why Google keeps data
about users.
He said, quote, The reason we keep search
engine data for any length of time is
one we need to make our algorithms
better. But more importantly, there
is a legitimate case of the government or
particularly the police function or so
forth. One thing with a federal subpoena
and so forth, being able to get access
to that information.
So this is not the most articulate
statement that Schmidt has ever made.
But what is clear
is that he was justifying their data
retention under the grounds that it would
be useful to the police.
Again, it's fine that Google wants to do
that. I wish there would be a little bit
more transparent about that.
But Google is keeping your data.
According to Eric Schmidt, because it is
useful to the authorities,
and I don't want my email provider to
have that policy.
And if you want your email provider
to to not keep your data,
then Google probably isn't going to be
the right company for you either.
So the government,
my government has been concerned for
years about the spread of encryption.
They've been concerned about the spread
of easy to use tools.
And slowly,
we are starting to get some
form of encryption delivered to
consumers and enabled by default.
It's not keeping the government out, but
it is limiting their ability to conduct
bulk surveillance and in some cases,
sophisticated users who are using
end to end encrypted services may in fact
cause the government to not be able to
perform intercepts.
The FBI has a term for this.
They have a term for this problem
of not being able to spy on users
anymore. They call it going dark.
This is something they've been predicting
for more than a decade.
This is Valerie Caproni.
She was for a long, long time
the general counsel for the FBI, the
FBI's top lawyer.
Just in the last year or two, she left
the FBI and is now a federal judge
in New York.
And so Valerie Caproni went to Congress
to complain about this going dark
problem. She complained about
the the world that the FBI was facing and
the threat of these encryption
technologies.
She said quote the FBI and other
government agencies are facing a
potentially widening gap between
our legal authority to intercept
electronic communications and our
practical ability to actually intercept
those communications.
What she is saying here is that they can
get an order from a judge
to intercept someone's information to to
tap a phone or two to tap an
instant message conversation.
But once they have that court order,
they're not actually able in all
circumstances to actually tap the
connection. Maybe the person is using
some form of encrypted voice over IP or
encrypted Real-Time text messaging,
but she's saying that they get
the court orders, but then cannot
actually do the taps and the
solution that the FBI called for.
The solution that the law enforcement
community proposed
were legal backdoors.
So what they wanted to do was to get
expanded powers from Congress
to be able to go to technology companies,
to major technology companies and force
them to build in law enforcement
interception interfaces into their
products. These are the same kinds of
interception features that the
telecommunications companies already have
in the U.S. we have a law called CALEA,
the Communications Assistance for Law
Enforcement Act, and really what they
wanted to do was to expand that
to companies like Google and Facebook and
Microsoft.
Now, as recently
as April 28th of this year,
just before May, the FBI
was ready. They had a proposal ready to
go.
That was that would.
If passed by, Congress would have given
the FBI the authority to find technology
companies if they refused to provide
this kind of surveillance assistance.
Allegedly, the president was even getting
close to signing onto it.
And then something happened.
Something happened that slightly
disrupted their plans.
This gentleman,
you know, reached out to journalists and
provided some documents.
And thankfully, it seems
like the proposals to make life
easier for wiretap orders are
dead in the water.
It seems like right now there isn't very
much appetite in Washington, D.C.,
for legislation that would make
surveillance easier,
but it probably won't stay that way
forever.
At some point, the FBI and their friends
are going to come back to Congress, and
the winds will change and they will say,
we need new powers.
We need powers to add surveillance
features to our networks.
Of course, many of you in the past
few months have heard about
the NSA's role in
cooperating with technology companies,
and we learned even the
last couple in the last two or three
weeks about RSA getting $10
million to switch
to a problematic random
number generator.
But these covert backdoors that the NSA
has been able to get, they're not
actually very useful for the law
enforcement community.
So what the needs of the NSA are very
different from the needs of law
enforcement for the simple reason that
the stuff that the NSA does doesn't end
up in court documents, things
that law enforcement do end up in
court papers.
And so any secret backdoor will be
revealed to the public when it's when
someone is arrested and prosecuted
in court.
And so any backdoor that depends
on secrecy is no good for the police.
They don't want to spend $10 million,
you know, convincing RCA to do something.
And then it comes out in court a month
later and then that money is wasted.
Right. So they need backdoors that
are not secret.
And the way that you get backdoors that
are not secret is through legislation.
And so at some point, what we're likely
going to see are our government
officials providing
or trying to provide powers
that allow law enforcement agencies to
access information in the same way that
the NSA can already get
information.
I mean, many people will think that, like
the government is this one big beast, and
so the US government has the power to
spy.
That's not true.
The NSA may have tools, but that
doesn't mean that the local police have
those tools, too. That doesn't mean that
the FBI, in all parts of the FBI,
have those tools as well.
And so the NSA might be able to listen to
every Skype call and might be able to
hack into everyone's computer.
But that doesn't mean that the local
police have the ability to get encrypted
Scott communications or have the ability
to hack into cell phones to steal
information.
And probably what we're going to see is a
call to give local police the same
level of access that the NSA already
enjoys.
All right, so the back door thing
isn't really working right now.
Right? They're not able to convince
Congress to give them these expanded
powers.
The companies, although they're willing
to provide some assistance, may not be
providing all the assistance that they
want. And so law enforcement agencies
have to go out and get it for themselves.
And so the response has also been
to use hacking technology.
I don't know how many of you went and saw
the excellent talk that was just 45
minutes ago by Claudio and Morgan on
government hacking. But those two have
really led our community in exposing
the use of hacking technology by
governments around the world.
The two biggest players in the commercial
hack are commercial malware market
are the German company called Finn Fisher
and an Italian company called Hacking
Team.
I'm not going to go into the details
of this stuff too much because those
two individuals have done such
spectacular research on it.
But I will just show you one
one cute thing about this.
So this is Martin Munk, who is the
CEO or managing director.
I guess of he was Gamma now
Finney Fisher. I guess he's.
Is he a big player in the German security
scene? I know that he was.
He created BackTrack for the Linux
security distribution.
And so this is my favorite photo of
Martin.
He was profiled by Bloomberg last year.
And the reason this is my favorite
profile is it shows him with his laptop,
and I'm just going to zoom in and
enhance the image here, and you can see
that he has a little sticker over his
webcam.
So he clearly knows what his own products
can do.
So gamma software has been used
and sold to a bunch of really nasty
governments around the world.
This is the marketing literature for an
Italian company called Hacking Team.
Their stuff has also been widely used.
This is just some of the information from
the marketing literature defeat
encryption, total control over
your target's thousands of encrypted
communications per day.
Get them in the clear.
So this software is being sold
as a solution to the problem of
encryption.
If people were not using encrypted
communications, I don't think we would
see governments rushing out to
buy these things.
I'm not saying this is good or bad,
although I personally am not a huge fan
of this industry.
But I think we should understand that the
reason that governments are now
rushing to buy this is because
they're worried about encryption.
They're worried that they're not able to
tap all of the calls and all of
the emails and all of the messages.
So hacking team opened
a U.S. office last year
in Annapolis, Maryland, which is about
100 miles, maybe from from Washington,
D.C.
They have spoken.
Both hacking team and Gamma have spoken
at some of the largest surveillance trade
shows in the United States.
This is Issa's world, which is commonly
nicknamed the wiretap ball,
and they even spoke.
This hacking team also spoken exhibited
at the Association of Law Enforcement
Intelligence Units conference in Chicago
this summer.
Not only were they on a panel talking
about their products, but hacking team
also sponsored the coffee break in the
afternoon.
So I don't have
the documents here that I can say, you
know, I haven't caught these companies
red hand and I cannot stand up here and
say that they've sold their technology
to local police in the United States.
I think that their market in the United
States, if they are successful, will be
local and state law enforcement agencies.
But I cannot tell you that they've
sold their technology in the United
States because no one's caught them yet.
But what I can tell you is if they
haven't sold it to law enforcement yet,
it's not because they're not trying
really hard.
They've been showing up at conferences
for several years.
I think they will be successful at some
point.
OK, so what about the feds?
The software that gamma and hacking team
make? This is really
this is not exclusive technology.
You'll find that, you know, the
government of Bahrain will be using the
same hacking software as the government,
the local police in Germany.
And that doesn't really work for the FBI.
The FBI wants a custom,
exclusive tool that no one else is using
that antivirus companies have been
haven't been able to analyze.
They want something unique
and they're willing to pay a premium for
that. Whereas local and state
law enforcement agencies that have
smaller budgets, they'll buy the off the
shelf hacking software from these
surveillance companies.
So I've spent about a year
trying to figure out what the FBI has
been doing, and most
of my research happened through LinkedIn.
I'm not going to show you all the details
here, but basically I
figured out the name of the team at the
FBI that does their
hacking. They have a dedicated team
called the Remote Operations Unit, and
all they do is deploy malware to the
target, to the targets.
And I searched LinkedIn profiles using
that term, and I found a bunch of former
contractors who worked there and
and that revealed the existence of the
team and also some of the stuff that they
do. I gave that information to The Wall
Street Journal. Summer, and
they published a bunch of information.
But before I describe it, let me just
also say that
this isn't really a secret.
The FBI has sort of admitted
the fact that they're doing this.
This is Valerie Caproni, their general
counsel, back in 2011.
Quote There will always be very
sophisticated criminals that are
virtually impossible to intercept through
traditional means.
The government understands that it must
develop individually tailored solutions
for those sorts of targets.
Now, she didn't say the word hacking.
She didn't say malware.
She didn't say webcam.
But this is what she means when Caproni
talked about individually tailored
solutions.
What she meant was that they were going
to use malware for targets
who they couldn't otherwise reach.
And it just took us a little while to
figure out what they were doing.
So The Wall Street Journal, based on some
of my research and some some research,
they they then also did was
able to pin the FBI down and get a
confirmation on the record that the FBI
can remotely activate the microphones
and telephones and laptops without
the user knowing.
Then, just a couple of weeks ago, The
Washington Post did a follow up,
revealing quote that the FBI has been
able to covertly activate the computer's
camera without triggering the light
that lets the user know it's recording
for several years.
I personally think this is terrifying.
I think it's terrifying that the
government has this capability.
I think it's terrifying that
law enforcement agencies have known that
our webcam lights are not reliable
and haven't told us because of course,
they're not the only ones doing this.
There are other governments that have
this capability.
There are criminals who could have this
capability.
And so I think it's it's slightly scary
that we have.
We have slipped into a world
where the government is hacking into the
computers of domestic targets without
having an informed debate about it first.
There have been no public congressional
hearings about the use of hacking
by law enforcement. This is something
that just happened. There have been no
there's been no explicit legislation that
has been passed. Empowering this, they're
using the existing authority.
They have to search people's homes or
search their cars.
It's the same kind of warrant that they
get to search a house that they're now
using to hack into a laptop
and install this malware.
Now there is a silver lining, at
least for this community.
The Washington Sorry, The Wall Street
Journal also revealed that the FBI
doesn't really like to use these tools
when investigating hackers because
they're worried that their tools will be
discovered and they won't be useful
anymore.
So I guess congratulations, you're safe.
I mean, it's funny, I guess,
huh?
But the sad thing is this is actually
happening.
The government really is doing this and
they have a dedicated team.
It's mainly contractors who are providing
the technology and then FBI agents who
are supervising it.
But whether or not you think this is a
good thing or a bad thing, whether or not
you think that, you know, maybe you think
that there are people who are so bad and
so evil and are such a big threat to our
society that the government should have
these tools. Even if you think that we
should at least have an informed public
debate are our elected
politicians should go on the record and
say that they wish for these powers to be
used. They wish to fund the acquisition
of these tools.
But that hasn't happened if no one who is
politically accountable has actually
embraced this, and instead it's happened
behind closed doors.
OK, so we
have the use of crypto
slowly.
We have the government
trying to force companies to
modify their products and not having so
much success unless it's through
bribes.
We have the acquisition
and use of hacking technology by law
enforcement agencies.
Is that enough?
No, probably not.
The US government will not rest.
They want to be able to access
every telephone call, every email,
every instant message.
And if there is one email that is
out of their reach, that will be enough
for them to seek additional authority.
And the problem that they're having is
that finally, there are some
tools and services that are coming online
that actually do deliver end to end
encryption to users.
Finally, independent researchers
and some small companies are
delivering services that are designed
to deliver end to end encrypted
communications to users.
And these are seen as a massive
and significant threat to the
government's ability to intercept
communications.
So for years, many people thought
that Skype was one of those services.
Skype had proudly
advertised its encryption, its end to
end encryption. They had hired an
independent security researcher
to conduct a study of the service,
and they put their report proudly on
their website. Whenever people asked
Skype about interception, their response
always was, You know, we have
built end to end encryption with keys
that we don't know into our products,
blah blah blah blah.
And so I think many people were surprised
when we learned this summer that
the NSA and the FBI
had been able to get access to Skype
communications. I think many people were
very surprised when we learned
that Skype had been served with a
directive to comply by the attorney
general and that the company had modified
their service to enable
surreptitious wiretapping by the U.S.
government.
Skype wasn't perfect.
Obviously, there are many flaws
in in both the technology, but actually
at a policy level, it was closed source.
We couldn't see what was happening.
And even though there had been an audit
of the technology originally it had, it
had of course, changed many times over
the years.
But I think many of us were surprised
that a company that had advertised itself
as being private had been able to
be forced to modify its products to be
less private, in fact, to permit
this covert surveillance.
After the Guardian story broke,
Brad Smith, the general counsel of
Microsoft, released a public statement
on the Microsoft blog and he said quote
as internet based voice and video
communications increase, it is
clear that governments will have an
interest in using or establishing
legal powers to secure access to
this kind of content to investigate
crimes or to tackle terrorism.
He added We therefore assume
that all calls, whether over the
internet or by fixed or mobile phone,
will offer similar levels of privacy
and security.
Now, those of you who've been coming to
this conference for years probably
know that there is zero privacy or
security in cell phone calls and landline
calls. And so I think this is Brad
Smith's way of telling us to expect
similarly nothing from Skype.
But look, Microsoft paid
an awful lot of money for Skype.
This is a service that has a huge
number of users. Many of us, I think,
probably still have Skype on
our handsets and it's now embedded
within various other Microsoft
products.
And I think it should be troubling
that this top executive at this company
has basically basically said, don't
rely on us for any kind of security.
Don't expect that we will deliver end to
end encrypted communications.
Don't expect that we will keep your calls
safe from the government.
They just said, don't worry, we haven't
provided the government with bulk access.
We just, you know, the government still
has to come through us.
But Microsoft isn't the only game in
town. In fact, there are other companies
who are trying to do something different.
A silent circle is one of these
companies. It's a small firm
created by Phil Zimmermann, the the
original creator of BGP.
And they have, you know, one of, I think,
a handful of companies at this point who
are trying to deliver products that are
truly end to end encrypted.
And they've said we have no backdoors
and they've actually said, in addition to
that, that if they were forced to build
in a backdoor, they would shut down the
company and move somewhere else.
And so you could imagine that a company
like Silent Circle is
going to ruffle a few feathers of the
FBI.
Similarly, Spider Oak, which is a
commercial operator of encrypted backup
services, they say that they've created
a system that makes it impossible for
us to reveal your data to anyone.
They want to provide a service to their
customers. They want to provide a
reliable backup service, and they don't
want to know what you're doing.
They just want to make sure that it
works, that it's reliable, that your data
is safe, but they don't want to be in the
business of receiving law enforcement
requests. And these are just two
companies from a growing
industry of firms that want to
deliver products to people who care
about their privacy and are willing to
pay for it.
And I'm actually really delighted
that these companies exist.
I have no financial relationship with any
of these firms. This is not an
advertising session.
I just bring them up as an example,
because these are the kinds of companies
that you might imagine law enforcement
agencies are not terribly happy about.
So Lavabit was sort
of one of these companies, although
their products were not designed to be as
secure as they might have advertised.
And Lazaro Levinson, the creator of
the company, I think learned the hard way
that that companies like his are
now seen as a threat to the government.
This summer, he received this subpoena
from the Eastern District Court of
Virginia.
I'm just going to read you a quick
selection from this quote.
You are directed to bring the grand
jury, the public and private encryption
keys used by loss of income
in any SSL or tailor session,
including sessions with clients
using the love of Bitcoin website.
This is the first that we know of
this kind of order, although probably
this is not the first that has ever
occurred.
And this is this is really
a new world.
It is really. It's one thing for
the government to go to a technology
company and say, you have some stored
data about your users, you have some
emails or some text messages
on your systems. Give us a copy of those
text messages.
It's another thing entirely
for the government to go to a technology
company and to say, give us your
encryption keys that are used to protect
all of your users information.
It's another thing to say we want to
install a DPI device
in your network that will grab
every single user's information.
And don't worry, just trust us.
We're only going to look at one person's
information once we scan everyone's,
which is in fact what the FBI
ultimately wanted to do.
Now, Lavabit has appealed
the decision of the court in this case.
They ultimately destroy the encryption
key and then shut down the company.
Sorry, they handed over the encryption
key in four point font and then shut down
the company.
But this is is, I think,
the first public example we
have, and I suspect that we will have
others at some point down the road.
So this is Valerie Caproni again, our
friend at the FBI.
Quote No one should be promising their
customers that they will thumb their nose
at a U.S. court order.
They can promise strong encryption.
They just need to figure out how they can
provide us with plain text.
All right. So again, it's really funny,
but this is the top FBI lawyer
telling you this.
And in fact, that's what they told a lot
of it. They said, by all means, you know,
say what you want on your website, but
we want a way to get your customers data.
And so this is the world we now live in.
We now live in a world where the
US government and likely other
governments will go to companies and
demand whatever it takes
to get their customers data.
This is a scary world and it's a world
we're going to have to adapt to.
And as technologists, we have to
design with this threat model
in mind.
The threat model is one.
And in which the government essentially
has pseudo power over any
company.
And so we have to build our products
to be resistant to this level of coercive
power.
That doesn't mean that the government
gets everything at once, but it means
as engineers that we have to design
our products and our technologies
ahead of time to withstand this
amount of coercion.
Now, Lava Bits design wasn't
sufficient. I think that's pretty clear
now.
But there are technologies and products
that could in fact withstand
this amount of coercion.
But we need to take a look
at everything that we're doing and
everything we're using and ask
ourselves if we actually trust this
piece of software or the design of
this piece of technology, for example,
many, many people who are using app
stores from either Apple or Google have
essentially given these companies the
ability to push software down to our
handsets without our knowledge or
control.
You can try this for yourself.
If you're using the Android operating
system, log in to the Google Play Store
through your web browser on your computer
and install an app, and it will show up
on your phone without asking for any
prompt. Google has the ability to push
code down to your phone.
Well, what happens when the FBI or the
NSA go to Google and ask them to deliver
an update to a particular user?
Well, we don't know.
Right now, the only thing protecting us
is Google's legals is Google's legal
team, and it would be very nice if
Google's technical team could protect us
from those kinds of threats to
to close.
This isn't all bad news.
It's mostly bad news,
but it isn't all bad news.
So concludes,
We really need to take these
government seriously.
They want to get our data
and it's our job to keep them out.
Thank you very much.