Guardian: FBI director attacks tech companies for embracing new modes of encryption

http://www.theguardian.com/us-news/2014/oct/16/fbi-director-attacks-tech-companies-encryption

FBI director attacks tech companies for embracing new modes of encryption

James Comey says data encryption could deprive police and intelligence companies of potentially live-saving information

Spencer Ackerman in Washington

16 October 2014

The director of the FBI savaged tech companies for their recent embrace of end-to-end encryption and suggested rewriting laws to ensure law enforcement access to customer data in a speech on Thursday.

James Comey said data encryption such as that employed on Apple's latest mobile operating system would deprive police and intelligence companies of potentially life-saving information, even when judges grant security agencies access through a warrant.

"Criminals and terrorists would like nothing more than for us to miss out," he said. Technologists have found such statements reminiscent of the "Crypto Wars" [1] of the 1990s, an earlier period in which the US government warned about encryption constraining law enforcement.

Framing his speech at the Brookings Institution as kickstarting a "dialogue" and insisting he was not a "scaremonger", Comey said "encryption threatens to lead us all to a very, very dark place."

Comey also posed as a question "whether companies not subject currently to Calea should be required to build lawful intercept capabilities for law enforcement", something he contended would not "expand FBI authorities". Calea is a 1994 surveillance law mandating that law enforcement and intelligence agencies have access to telecommunications data, which Comey described as archaic in the face of technological innovation.

"I'm hoping we can now start a dialogue with Congress on updating it," Comey said.

Privacy advocates contend Comey is demagoguing the issue.

It took a June supreme court ruling, they point out, for law enforcement to abandon its contention that it did not require warrants at all to search through smartphones or tablets, and add that technological vulnerabilities can be exploited by hackers and foreign intelligence agencies as well as the US government. Additionally, the FBI and police retain access to data saved remotely in the so-called "cloud" -- where much data syncs for storage from devices like Apple's -- for which companies like Apple keep the encryption keys.

Comey, frequently referring to "bad guys" using encryption, argued access to the cloud is insufficient.

"Uploading to the cloud doesn't include all the stored data on the bad guy's phone," he said.

"It's the people who are most worried what's on the device who will be most likely to avoid the cloud."

Tech companies contend that their newfound adoption of encryption is a response to overarching government surveillance, much of which occurs either without a warrant, subject to a warrant broad enough to cover indiscriminate data collection, or under a gag order following a non-judicial subpoena. Comey did not mention such subpoenas, often in the form of National Security Letters, in his remarks.

The National Security Agency, whistleblower Edward Snowden revealed, accesses customer information in transit between Google and Yahoo data centres, as one of its surveillance tools.

"The people who are criticising this are the ones who should have expected this," Google's CEO, Eric Schmidt, said last week. [2]

Christopher Soghoian, the chief technologist for the American Civil Liberties Union, called Comey's speech "disappointing".

"What was missing from his remarks was an acknowledgement that when Congress passed Calea in 1994, they explicitly protected the rights of companies that wanted to build encryption into their products -- encryption with no backdoors, encryption with no keys that are held by the company," Soghoian said.

"So if he wants to get what he's describing, not only is he talking about expanding Calea to technology companies and not just communications companies, but to be successful, he would have to remove that provision of Calea, and that would be a major and negative step."

Comey praised Apple and Google as run by "good people" and said he recognised their embrace of encryption responded to "perceive[d]" market pressures in the wake of Snowden's disclosures. But Comey suggested that end-to-end mobile device encryption amounted to a safe haven for criminals.

"Are we no longer a country that is passionate both about the rule of law and about their being no zones in this country beyond the reach of that rule of law? Have we become so mistrustful of government and law enforcement in particular that we are willing to let bad guys walk away, willing to leave victims in search of justice?" he said.

Comey acknowledged that the Snowden disclosures caused "justifiable surprise" among the public about the breadth of government surveillance, but hoped to mitigate it through greater transparency and advocacy.

Yet the FBI keeps significant aspects of its surveillance reach hidden even from government oversight bodies. Intelligence officials said in a June letter to a US senator that the FBI does not tally how often it searches [3] through NSA's vast hoards of international communications, without warrants, for Americans' identifying information.

Comey frequently described himself as being technologically unprepared to offer specific solutions, and said he meant to begin a conversation, even at the risk of putting American tech companies at a competitive disadvantage.

"Where we may get is to a place where the US, through its Congress, says, 'You know what, we need to force this on American companies,' and maybe they'll take a hit. Someone in some other country will say, 'Ah, we sell a phone that even with lawful authority people can't get into.' But that we as a society are willing to have American companies take that hit. That's why we have to have this conversation," Comey said.

[1] http://www.theguardian.com/technology/2014/oct/09/crypto-wars-redux-why-the-fbis-desire-to-unlock-your-private-life-must-be-resisted

[2] http://online.wsj.com/articles/googles-schmidt-says-encrypted-phones-wont-thwart-police-1412812180

[3] http://www.theguardian.com/world/2014/jun/30/nsa-data-troves-identifiers-information