• Tag Archives encryption
  • Five Eyes Unlimited: What A Global Anti-Encryption Regime Could Look Like

    This week, the political heads of the intelligence services of Canada, New Zealand, Australia, the United Kingdom, and the United States (the “Five Eyes” alliance) met in Ottawa.  The Australian delegation entered the meeting saying publicly that they intended to “thwart the encryption of terrorist messaging.” The final communiqué states more diplomatically that “Ministers and Attorneys General […] noted that encryption can severely undermine public safety efforts by impeding lawful access to the content of communications during investigations into serious crimes, including terrorism. To address these issues, we committed to develop our engagement with communications and technology companies to explore shared solutions.”

    What might their plan be? Is this yet another attempt to ban encryption? A combined effort to compel ISPs and Internet companies to weaken their secure products? At least one leader of a Five Eyes nation has been talking recently about increasing international engagement with technology companies — with a list of laws in her back pocket that are already capable of subverting encryption, and the entire basis of user trust in the Internet.

    Exporting Britain’s Surveillance Regime

    Before she was elevated to the role of Prime Minister by the fallout from Brexit, Theresa May was the author of the UK’s Investigatory Powers bill, which spelled out the UK’s plans for mass surveillance in a post-Snowden world.

    At the unveiling of the bill in 2015, May’s officials performed the traditional dance: they stated that they would be looking at controls on encryption, and then stating definitively that their new proposals included “no backdoors”.

    Sure enough, the word “encryption” does not appear in the Investigatory Powers Act (IPA). That’s because it is written so broadly it doesn’t need to.

    We’ve covered the IPA before at EFF, but it’s worth re-emphasizing some of the powers it grants the British government.

    • Any “communications service provider” can be served with a secret warrant, signed by the Home Secretary. Communications service provider is interpreted extremely broadly to include ISPs, social media platforms, mail services and other messaging services.
    • That warrant can describe a set of people or organizations that the government wants to spy upon.
    • It can require tech companies to insert malware onto their users’ computers, re-engineer their own technology, or use their networks to interfere with any other system.
    • The warrant explicitly allows those companies to violate any other laws in complying with the warrant.
    • Beyond particular warrants, private tech companies operating in the United Kingdom also have to respond to “technical capability notices” which will require them to “To provide and maintain the capability to disclose, where practicable, the content of communications or secondary data in an intelligible form,” as well as permit targeted and mass surveillance and government hacking.
    • Tech companies also have to the provide the UK government with new product designs in advance, so that the government can have time to require new “technical capabilities” before they are available to customers.

    These capabilities alone already go far beyond the Nineties’ dreams of a blanket ban on crypto. Under the IPA, the UK claims the theoretical ability to order a company like Apple or Facebook to remove secure communication features from their products—while being simultaneously prohibited from telling the public about it.

    Companies could be prohibited from fixing existing vulnerabilities, or required to introduce new ones in forthcoming products. Even incidental users of communication tech could be commandeered to become spies in her Majesty’s Secret Service: those same powers also allow the UK to, say, instruct a chain of coffee shops to use its free WiFi service to deploy British malware on its customers. (And, yes, coffee shops are given by officials as a valid example of a “communications service provider.”)

    Wouldn’t companies push back against such demands? Possibly: but it’s a much harder fight to win if it’s not just the UK making the demand, but an international coalition of governments putting pressure on them to obey the same powers. This, it seems is what May’s government wants next.

    The Lowest Common Privacy Denominator

    Since the IPA passed, May has repeatedly declared her intent to create a an international agreement on “regulating cyberspace”. The difficulty of enforcing many of the theoretical powers of the IPA makes this particularly pressing.

    The IPA includes language that makes it clear that the UK expects foreign companies to comply with its secret warrants. Realistically, it’s far harder for UK law enforcement to get non-UK technology companies to act as their personal hacking teams. That’s one reason why May’s government has talked up the IPA as a “global gold standard” for surveillance, and one that they hope other countries will adopt.

    In venues like the Five Eyes meeting, we can expect Britain to advocate for others to adopt IPA-like powers. In that, they will be certainly be joined by Australia, whose Prime Minister Malcolm Turnbull recently complained in the Australian Parliament that so many tech companies “are based in the United States where a strong libertarian tradition resists Government access to private communications, as the FBI found when Apple would not help unlock the iPhone of the dead San Bernardino terrorist.” Turnbull, it seems, would be happy to adopt the compulsory compliance model of the United Kingdom (as would, he implied at the time of the Apple case, would President Trump).

    In the meantime, the British authorities can encourage an intermediary step: other governments may be more likely to offer support for a IPA regime if Britain offers to share the results of its new powers with them.

    Such information-sharing agreements are the raison d’être of the Five Eyes alliance, which began as a program to co-ordinate intelligence operations between the Anglo-American countries. That the debate over encryption is now taking place in a forum originally dedicated to intelligence matters is an indicator that the states still see extracting private communications as an intelligence matter.

    But hacking and the subversion of tech companies isn’t just for spies anymore. The British Act explicitly granted these abilities to conduct “equipment interference” to more than just GCHQ and Britain’s other intelligence agencies. Hacking and secret warrants can now be used by, among others, the civilian police force, inland revenue and border controls. The secrecy and dirty tricks that used to be reserved for fighting agents of foreign powers is now available for use against a wide range of potential suspects.

    With the Investigatory Powers Bill, the United Kingdom is now a country empowered with a blunt tools of surveillance that have no comparison in U.S. or any other countries’ law. But, along with its Five Eyes partners, it is also seen as a moderate, liberal democracy, able to be trusted with access and sharing of confidential data. Similarly, Australia is one of the few countries in the world (and the only one of the Five) to legally compel ISPs to log data on their users. Canada conducts the same meta-data surveillance projects as the United States; New Zealand contributes its mass surveillance data to the shared XKEYSCORE project.

    While such data-sharing may be business as usual for the Cold War spies, the risk of such unchecked co-operation have been barely considered by the judicial and legislative branches.

    In the world of law enforcement, the UK has for the last year conducted a sustained lobbying campaign in the United States Congress to grant its police forces fast-track access to American tech companies’ communications data. The UK would be permitted to seize the contents of Google, Facebook and other companies’ customers’ inboxes without a U.S. court warrant. In return, the U.S. would gain a reciprocal capability over data held in the U.K.

    The danger is that, by forging broad agreements between these five countries, all will end up taking advantage of the lowest privacy standards of each. The United Kingdom will become the source of data obtained through the Investigatory Powers Bill; the United States will launder data taken from UPSTREAM and other programs through the United Kingdom’s legal system, and so on.

    Secret “Five Eyes” is not the venue for deciding on the future of global surveillance. Intelligence agencies and their secret alliances are no model for oversight and control of the much broader surveillance now being conducted on billions of innocent users of the public Internet. The Investigatory Powers Bill is no “gold standard.” Britain’s radical new powers shouldn’t be exported via the Five Eyes, either through law, or through data-sharing agreements conducted without judicial or legislative oversight.

    Source: Five Eyes Unlimited: What A Global Anti-Encryption Regime Could Look Like | Electronic Frontier Foundation


  • Why We’re Being Watched

    Why We’re Being Watched

    Wikileaks has just published over 8,000 files they say were leaked from the CIA, explaining how the CIA developed the capacity to spy on you through your phone, your computer, and even your television. And Wikileaks’s Julian Assange claims these “Vault 7” documents are just one percent of all the CIA documents they have.

    The media will be combing through these for weeks or months, so now is a perfect moment for us to reconsider the role of privacy, transparency, and limited government in a free society.

    We’ve put together a quick list of the six best Learn Liberty resources on government spying and whistleblowing to help inform this discussion.



    1. War Is Why We’re Being Watched

    Why is the US government spying on its citizens in the first place? Professor Abby Hall Blanco says that expansive state snooping at home is actually the result of America’s military interventionism abroad:

    2. Is Privacy the Price of Security?

    Yes, you may think, the government is snooping on us, but it’s doing that to keep us safe!

    That’s the most common justification for sweeping and intrusive surveillance, so we held a debate between two experts to get right to the heart of it. Moderated by TK Coleman, this debate between Professor Ronald Sievert and Cindy Cohn, the Executive Director of the Electronic Frontier Foundation, was inspired in part by the revelations about NSA surveillance leaked by Edward Snowden in June 2013.

    3. Freedom Requires Whistleblowers

    People are already drawing parallels between the Snowden leaks and the Vault 7 revelations. If the leaks are indeed coming from a Snowden-like whistleblower, that will once again raise the issue of government prosecution of people who reveal classified information to the public.

    Professor James Otteson argues that a free society requires a transparent government, and whistleblowers play a key role in creating that accountability. Otteson also sounds a warning that should resonate with many Americans today:

    Maybe you’re not concerned about the invasions of privacy that the federal government agencies are engaging in because you think, “Well, I haven’t done anything wrong. What do I have to fear?” Maybe you think, “I like and support this president. I voted for him.”

    But what about the next president?  The powers that we let the government have under one president are the same powers that the next president will have too.

    What if the next president is one you don’t support? He, too, will have all the power that you were willing to give the president you now support.”

    4. Encryption Is a Human Rights Issue

    Documents from Vault 7 suggest that the CIA has been so stymied by encrypted-messaging apps, such as Signal and Whatsapp, that it has resorted to taking over entire smartphones to read messages before they are sent.

    That turns out to be a costly, targeted, and time-consuming business that doesn’t allow for mass data collection. But for decades, government officials have tried to require tech companies to give the government a backdoor into their encryption. In “Encryption Is a Human Rights Issue,” Amul Kalia argues that protecting encryption from government is essential to our safety and freedom.

    5. The Police Know Where You Live

    It turns out that it’s not just spy agencies that have access to detailed information about your life. Ordinary police officers have it, too, and they often face little supervision or accountability. As Cassie Whalen explains, “Across the United States, police officers abuse their access to confidential databases to look up information on neighbors, love interests, politicians, and others who had no connection to a criminal investigation.”

    Surveillance is a serious issue at every level of government.

    6. Understanding NSA Surveillance

    If you’re ready to take your learning to the next level, check out our complete video course on mass government surveillance with Professor Elizabeth Foley. In it, you’ll learn what you need to know to make sense of the NSA scandal in particular and mass surveillance in general.

    Reprinted from Learn Liberty.


    Kelly Wright

    Kelly Wright is an Online Programs Coordinator at the Institute for Humane Studies.

    This article was originally published on FEE.org. Read the original article.


  • EFF to Tech Leaders: Stand With Users and Tell Trump We Need Strong Encryption, Internet Freedom

    Technology company leaders are reportedly meeting with President-elect Donald Trump and members of his transition team tomorrow in New York. Mr. Trump’s relationship with technology companies has been frosty, and his statements during the campaign and recent cabinet picks raise serious concerns about the new administration’s commitment to protecting the digital rights of all Americans and fostering innovation. They also point to the deep need for Mr. Trump and his team to talk to those who represent the users of technologies, not just the companies that build and sell those technologies.

    Mr. Trump has criticized Apple for refusing to attack the security of the iPhone and says that fighting ISIS propaganda could require closing parts of the Internet. Users have a stake in each of these discussions, since they suffer when their technologies are insecure and when legitimate voices are censored. 

    We urge tech leaders in attendance to press Mr. Trump on these topics, and let the president-elect know that they will stand with their users and the core values of privacy, security, freedom of speech, and transparency.

    Encryption

    First up: defend strong encryption. Tech leaders must explain to the transition team that it is technically impossible to design a “backdoor” that allows law enforcement access to devices and communications without compromising everyone’s security. EFF and the overwhelming majority of the tech community supported Apple when it correctly resisted FBI efforts to force its programmers to write and sign software code to bypass the lock screen of a seized iPhone. Not only would that weaken security for all users, it would also violate the Apple’s First Amendment rights by forcing it to endorse a position—favored by the government—that it disagrees with. Tech leaders should make it clear to Mr. Trump’s transition team that talk of building backdoors for law enforcement is a non-starter.

    Mass Surveillance

    Second, we urge tech leaders to voice their opposition to mass surveillance by the NSA. We’re deeply troubled by Mr. Trump’s cabinet picks, such as Senator Jeff  Sessions and Representative Mike Pompeo, who have advocated the restoration of the expensive and useless mass telephone records surveillance under the Patriot Act. The program eviscerated the privacy rights of hundreds of millions of innocent Americans with no proof of a countervailing gain. This embrace of unconstitutional surveillance is particularly chilling given the historical misuse of domestic spying programs against political opponents.

    Sessions, Trump’s Attorney General pick, has also supported requiring companies to reduce the security they offer to their users to facilitate law enforcement access, and last year floated a proposal to allow federal agents wide access to online personal information without first obtaining a warrant. Meanwhile, Pompeo, Trump’s CIA director nominee, has called for reviving metadata collection and combining that “with publicly available financial and lifestyle information into a comprehensive, searchable database,” presumably including millions of innocent Americans.

    Free Speech

    Third, industry leaders should push back against Mr. Trump’s attacks on free speech and Internet freedom.

    Requring social media companies to act as censors has the very real threat of going too far. Trump called those raising free speech concerns “foolish,” and he shouldn’t get away with that. Any speech-limiting practices and policies must be narrowly applied, transparent, and easily correctable, or they will inevitably be targets for gaming and harassment. Special care should be taken to protect researchers and speech that criticizes the government and its agents.

    Net Neutrality

    Fourth, Trump opposes net neutrality, a key principle for protecting the future of our open Internet. Tech companies should stand with their users and urge the president-elect to preserve the FCC’s open Internet order and rules that prevent companies from using customers’ private information for profit.

    Protecting User Information

    Finally, Trump has also talked about creating a database of some or all Muslims. He says he plans to round up and deport millions of illegal immigrants. Both of these will likely involve combing through databases of information about Americans that have been compiled for other purposes.

    If the Trump administration moves ahead with these plans, it will need Silicon Valley’s cooperation. Tech companies may face unprecedented demands to build such databases, or to search for, analyze, and hand over private data of and about their users. These companies hold our private conversations, thoughts, experiences, locations, photos, and more. All of this is vulnerable to misuse by a hostile administration. Tech companies must tell Trump that they won’t cooperate in building, or providing user information for, systems that enable discrimination, intolerance, or ethnic targeting forbidden by the Constitution.

    Many technology companies have already taken stands against previous government demands for user data, pushed for more transparency, and some have even gone to court to challenge law enforcement efforts to access customer data without a warrant or to fight gag orders. We’ve recommended that companies implement strategies to gather and store as little data as possible about their users so that when the government comes knocking, there’s nothing to give.

    Now’s the time to double down. We urge tech leaders to send a clear message to the Trump transition team that technology companies will not be agents of the government, especially when it comes to programs that defy the Constitution and violate our civil rights. Mr. Trump is famously unabashed in his use of social media to get his thoughts and messages out. He understands the power of technology to speak directly to users and communicate to a willing audience. Tech leaders need to be equally bold. They must stand up for all of the users of these tools and reject efforts to weaken the privacy and security that their users rely on. And users need a seat at this table. Mr. Trump, we’re waiting for your call. Or tweet.

    Source: EFF to Tech Leaders: Stand With Users and Tell Trump We Need Strong Encryption, Internet Freedom | Electronic Frontier Foundation