Is the FBI right in decrying the stronger encryption about to come to smartphones?

[Projammer]

US Police Can Copy Your iPhone’s Contents In Under Two Minutes

The CelleBrite UFED is a handheld device that Michigan officers have been using since August 2008 to copy information from mobile phones belonging to motorists stopped for minor traffic violations. The device can circumvent password restrictions and extract existing, hidden, and deleted phone data, including call history, text messages, contacts, images, and geotags.

Revalations like these are why the FBI’s whining won’t be getting many sympathetic ears other than the few pandering apologists who have nothing to hide.

[KarlGauss]

@Projammer

US Police Can Copy Your iPhone’s Contents In Under Two MinutesRevalations like these are why the FBI’s whining won’t be getting many sympathetic ears other than the few pandering apologists who have nothing to hide.

As the OP’er, you can be assured that I’m sympathetic to your position.

Still,let me ask: just because a phone’s contents can be copied (in 2 minutes or 2 microseconds), it doesn’t mean those contents will necessarily be decipherable, does it?

Generally, just because data is public doesn’t mean that it can be understood by an interested party sans password.

[Projammer]

The point was that the unencrypted data was(is?) being copied from people’s phones with no warrant or even anything resembling reasonable cause. That’s justification enough for encryption for me.

ETA: I’m sure that ‘2 minutes’ is an exaggeration for shock value. Any data transfer is going to be restricted by the limitations of USB. Anyone who has copied large amounts of data from a phone or camera will have a more realistic estimate.

[KarlGauss]

Ah, gotcha.

[Steve_MB]

@Projammer

ETA: I’m sure that ‘2 minutes’ is an exaggeration for shock value. Any data transfer is going to be restricted by the limitations of USB. Anyone who has copied large amounts of data from a phone or camera will have a more realistic estimate.

Actually, it’s a reasonable estimate. USB 2.0 has a 60 MB/s bandwidth; that translates to 7.2 GB transferred in 2 minutes. Even allowing for the difference between theoretical and actual performance, it’s not at all unrealistic that the actual data (as opposed to operating system and apps) on a phone could be sneak-peeked in that timeframe.

In other news on the topic, the FBI director James Coney has apparently started a Whinefest Media Tour (tip for Jimbo: If you’re going on all the TV shows that specialize in catering to people who wish to publicly divest themselves of their remaining vestiges of self-respect, get yourself some cheap expendable suits so you won’t mind when they get torn or muddy or goo-saturated or whatever).

[Steve_MB]

@Steve_MB

Actually, it’s a reasonable estimate. USB 2.0 has a 60 MB/s bandwidth; that translates to 7.2 GB transferred in 2 minutes. Even allowing for the difference between theoretical and actual performance, it’s not at all unrealistic that the actual data (as opposed to operating system and apps) on a phone could be sneak-peeked in that timeframe.

Addendum: I had overlooked the fact that USB 3.0 is supported by some of the latest generation of smartphones, cutting data transfer times by an order of magnitude. I’m presuming that this snooping device also supports USB 3.0 – if so, a fishing-expedition scoop-up from a USB 3.0 phone would easily take less than 2 minutes, even including the phone OS and apps in the transfer.

[Steve_MB]

One amusing sidelight from just a few years ago:

[QUOTE=FBI Webpage]

Responding to the Cyber Threat

…Managing the consequences of a cyber attack entails minimizing the harm that results when an adversary does break into a system.

An example would be encrypting data so the hacker can’t read it, or having redundant systems that can readily be reconstituted in the event of an attack…
[/QUOTE]

:dubious: :dubious: :smack:

[Steve_MB]

The answer to the original question is shifting from merely “no, of course they’re not right” to “it’s long past time for them to quit pissing on our heads and telling us it’s raining”:

FBI Director James Comey gave a speech Thursday about how cell-phone encryption could lead law enforcement to a “very dark place” where it “misses out” on crucial evidence to nail criminals. To make his case, he cited four real-life examples — examples that would be laughable if they weren’t so tragic.

In the three cases The Intercept was able to examine, cell-phone evidence had nothing to do with the identification or capture of the culprits, and encryption would not remotely have been a factor.

In the most dramatic case that Comey invoked — the death of a 2-year-old Los Angeles girl — not only was cellphone data a non-issue, but records show the girl’s death could actually have been avoided had government agencies involved in overseeing her and her parents acted on the extensive record they already had before them.

In another case, of a Lousiana sex offender who enticed and then killed a 12-year-old boy, the big break had nothing to do with a phone: The murderer left behind his keys and a trail of muddy footprints, and was stopped nearby after his car ran out of gas.

And in the case of a Sacramento hit-and-run that killed a man and his girlfriend’s four dogs, the driver was arrested in a traffic stop because his car was smashed up, and immediately confessed to involvement in the incident…

[Grumman]

This thread seems relevant. Even the government is committing identity theft these days.

[KarlGauss]

@Grumman

This thread seems relevant. Even the government is committing identity theft these days.

While I don’t disagree with you, I suspect that Steve MB is aware of that thread.

[Steve_MB]

@KarlGauss

While I don’t disagree with you, I suspect that Steve MB is aware of that thread.

Well, yes, I did notice that.

In any case, the matter is now pretty well settled, with the new OS security improvements formally announced, Congress telling the FBI director “In your dreams”, and the issue moving on to cell message content as T-Mobile hardens its network against snooping.

[Steve_MB]

The apologists are now sinking to the point-and-laugh level:

Former NSA Lawyer Says Reason Blackberry Failed Was ‘Too Much Encryption’ Warns Google/Apple Not To Make Same Mistake

[former NSA General Counsel Stewart] Baker said encrypting user data had been a bad business model for Blackberry, which has had to dramatically downsize its business and refocus on business customers. “Blackberry pioneered the same business model that Google and Apple are doing now - that has not ended well for Blackberry,” said Baker…

I have this mental image of getting a letter from Mr. Baker with a request to send copies to a dozen friends: “…the CEO of Blackberry broke the chain, and his business began to flounder…”.

[Bricker]

Why does the SDMB force me into this position so often?

Up front: I don’t agree that the government should limit encryption strength, or that companies should limit encryption strength or provide back doors to investigators.

So I am totally in favor of the overall point made by the OP, and indeed by the articles quoted.

But I am not in favor of shading the facts to prove your point, and that’s what the article in the OP has done when it claims that the text messages between Brian Horn and Justin Bloxom were legally irrelevant or merely cumulative.

During closing arguments, prosecutor Dhu Thompson told the jury to recall the text message sent by Justin Bloxom in response to explicit photos sent to him by Horn, which said, “you gotta remember, I’m only 12.” When that portion of the text conversation was read aloud on Monday as the state presented its case, an audible reaction was heard in the courtroom.

Thompson said Bloxom’s response to Horn in reminding him of his age is important to note because it shows Horn’s intent.

My argument is: regardless of the fact that broken electronic communication may have served as evidence in criminal cases, it’s neither prudent nor really even possible to hold back the tide of encryption. I would NOT make my case by pretending that the evidence recovered was never of any use.

[Steve_MB]

@Bricker

But I am not in favor of shading the facts to prove your point, and that’s what the article in the OP has done

I can’t find anything remotely resembling this quote in either of the articles linked from the OP.

Based on the quote itself, wherever it came from, I’m at a loss to figure out how a text message sent from the victim’s phone (which is now presumably in the custody of parents or guardians who are presumably perfectly willing to cooperate with the prosecution) is supposed to be in any way relevant to the issue at hand.

[Chronos]

Hey, Smapti, just out of curiosity, what’s your bank account number, routing number, and the username and password you use for online banking? I’m sure that you won’t have any reluctance revealing this information, because after all, you’re not doing anything illegal with your banking, right? So you have nothing to fear.

[Steve_MB]

@Chronos

Hey, Smapti, just out of curiosity, what’s your bank account number, routing number, and the username and password you use for online banking? I’m sure that you won’t have any reluctance revealing this information, because after all, you’re not doing anything illegal with your banking, right? So you have nothing to fear.

Eh, not much point continuing to kick around Smapti’s arguments – that piñata is pretty much empty.

[robert_columbia]

@Grumman

So, is the FBI stupid enough to believe that they are the only ones capable of exploiting security vulnerabilities, or do they just not care as long as it’s not the government’s ox being gored? Actively advocating that the American people should be made more vulnerable to crime just in case they want to exploit the same weakness is quite obnoxious.

Very true. Someone might want one of these phones for a reason other than evading US law enforcement. Maybe they want to protect themselves from the Mob. Or maybe their creepy stalker ex-boyfriend is an IT guru and leet haxor. Or perhaps they want to prevent their data from falling into the hands of foreign intelligence and/or law enforcement hands. Is it an offense under US law to block the KGB from hacking your phone?

[Steve_MB]

@robert_columbia

Very true. Someone might want one of these phones for a reason other than evading US law enforcement. Maybe they want to protect themselves from the Mob. Or maybe their creepy stalker ex-boyfriend is an IT guru and leet haxor. Or perhaps they want to prevent their data from falling into the hands of foreign intelligence and/or law enforcement hands. Is it an offense under US law to block the KGB from hacking your phone?

One of the lessons of the Snowden case is that government secrets do not necessarily remain secret or confined to the government. If the government has a backdoor, any of the above attackers can purloin the government’s secret backdoor keys and gain the same level of access for themselves.

[Bricker]

@Steve_MB

I can’t find anything remotely resembling this quote in either of the articles linked from the OP.

Based on the quote itself, wherever it came from, I’m at a loss to figure out how a text message sent from the victim’s phone (which is now presumably in the custody of parents or guardians who are presumably perfectly willing to cooperate with the prosecution) is supposed to be in any way relevant to the issue at hand.

Here’s the source of the quote.

If the victim’s phone was encrypted, and the text messages were sent as data as opposed to SMS messaging, how would having the phone help, no matter how willing the parents or guardians were to help? If they didn’t know the victim’s password, they couldn’t unlock the phone. Carriers may keep records of SMS texts, but iPhone-to-iPhone texts are simply data packets, and are not captured and stored by the carrier. And third party text applications like WhatsApp also use that method.

So I’m not sure what you mean. Can you explain precisely how their cooperation would surmount that obstacle?

Again I point out that I’m simply responding to the implication that the texts were not a factor in the criminal prosecution, which was the implication of the article linked in post 268:

At trial, the sexually graphic texted messages between Bloxom and Horn were presented to the jury. But they were hardly necessary for conviction.

That’s not true – establishing that Horn knew the victim’s age might well have been necessary, and was certainly valuable to the prosecution for proof of aggravating factors.

Finally, I again emphasize that I do not favor weakening encryption in any way, shape, manner, or form.

[Lightnin]

@Smapti

If I’m not doing anything illegal, then the government has no reason to care what I’m doing in the first place, and they won’t bother with me. If I’m doing something illegal, then I have no right to hide it from the government, and I deserve to be captured and punished for it.

I’m not doing anything illegal. The government has no reason to care what I’m doing or what’s on my phone, and I have nothing to hide.

However…

If the cops can get into my phone today, the hackers got into it last week. Any backdoor *will *be found by hackers, and it will be used. An open, unsecured system (which is exactly what a backdoor gives you) is more of a danger to me than I am to the government.

If, in the process of hardening my data against hackers means that the government can’t spy on me, that’s the government’s problem, not mine.