Exploits of "lawful access" interfaces, such as the Chinese attack reported today by the WSJ, appeared almost immediately after they became standardized in the 90's. The most famous example is the case known as "the Athens Affair" https://spectrum.ieee.org/the-athens-affair .
It was a bad idea then, and still a bad idea now.
Mandated wiretap interfaces and cryptographic backdoors are *expensive*, both in terms of money and, more importantly, exposure to risk. Worse, those burdens are borne inequitably.
Overall, almost no one is the subject of a lawful wiretap, even in places where wiretapping is an important investigative tool. Most people aren't suspects. But these mandates degrade security (and impose other costs) for *everyone*, the vast majority of whom will never be wiretapped.
Also, these wiretapping systems have become so bloated and complicated (a security risk in and of itself) that there are now intermediate service providers that act as a buffer between carriers and law enforcement. Compromise one of them, and you've hit the interception jackpot.
I wouldn't be surprised if that's what happened here.
“The purpose of a system is what it does.” 🤷🏻♂️
@mattblaze
Also no one ever remembers when post 9/11 AT&T, Sprint and Verizon had employees in the FBI anti-terror office with terminals to do quicker lookups. Pretty quickly the minimal paperwork was dispensed with and FBI agents would just write down phone numbers on post-it notes and hand it to them to get chains
Before the office of inspector general report came out, Obama's DoJ retroactively legalized it.
Backdoors don't just get hacked, they get abused.
@mattblaze Remember:
The only winning move is to commit "#AssetDenial" and commit to untappable communications with proper #E2EE via @torproject / #Tor.
So you want law enforcement to not report security-holes in software, because they will need them to stay open for "lawful hacking" purposes ?
That doesn't sound particular workable to me... ?
Yeah, that's what I think too.
But Matt just said that court orders would have to be satisfied by "lawful hacking", so how does that work, if there are no vulnerabilities to exploit ?
To me it sounds like having your cake and eating it too:
You want perfect encryption and perfect software, and then police must rely on "lawful hacking" to satisfy a court-order for wiretapping.
What precisely is "lawful hacking" then ?
The reason law-enforcement comes up with all these horrible ideas, and will get them legislated, is that nobody from the IT-side is willing to accept that court-orders is a necessary tool for any "Country Built On Laws", much less help come up with a compromise we all can live with.
@bsdphk @SteveBellovin If only we had written an entire paper about this, and if only Steve had included a link to it.
But I understand if you'd rather just yell at people on the Internet.
I've read your paper, I dont recall you answering the question I asked anywhere in it ?
What have I overlooked ?
No, I do not believe in perfect software, and that has nothing to do with what I'm asking you guys:
Your suggestion is taht law enforcement can only execute wiretaps through "already present [...] software vulnerabilities".
My question is: How do you guarantee that there are already vulnerabilities available when a court order must be executed ?
And if there is a shortage, how will they be meted out ?
As I said: That is no way to run "A country built on laws"
You overlooked that I'm not from USA ?
Your paper does not address the situation in any other country, than USA.
And I will posit, that if your "solution" for USA is adopted, it will kneecap the judicial system in almost all other countries.
Because, surely you realize, that there can not be one solution for USA and another for Denmark, right ?
How do you expect a small country like Denmark will obtain an adequate supply of vulnerabilities ?
@bsdphk "but what if no bugs" is dealt with in exactly the same way as every other form of "but what if no evidence": do something else to get the necessary evidence, or else learn to live with the fact that, in the real world, unlike TV, sometimes the bad guys get away with it.
@womble @dave_aitel @SteveBellovin @mattblaze
Then any non-stupid asshole is totally free to send dick-picks to any woman he can find coordinates for ?
Ask you mom if she is OK with that ?
Today most instances of intimidation, harassment and blackmail are never investigated, much less resolved or brought to justice.
I wonder how people like you can miss the connection between "almost all communication is digital" and "almost all crime involves digital communication" ?
@bsdphk I don't miss that connection, because it's not true. I also don't miss that the overwhelming majority of cases of intimidation, blackmail and harassment are over media which is already entirely accessible to law enforcement, which means that the reason they're not investigated has nothing to do with a lack of lawful access to the evidence.
@womble @dave_aitel @SteveBellovin @mattblaze
And you say this because you live in USA, right ?
Countries like Luxembourg and Denmark do not have police resources on the scale that FBI do.
A lot of services which are "entirely accessible" to FBI are not accessible to police in countries which cannot intimidate the owners of said service.
This is why I say: EU are going to legislate something which works for police in all EU countries, so "solutions" must not depend on massive resources.
@bsdphk no, I do not live in the USA.
Your arguments that police need access to everyone's private communications all the time are nonsense, because even the crimes that *can* be prosecuted with existing available evidence aren't, so the problem isn't a lack of evidence.
@womble @dave_aitel @SteveBellovin @mattblaze
I have said nothing remotely like that.
What societies built on laws need, is for court orders to be executed.
IT-liberalists insist that /everything/ must be encrypted so that it can /never/ become evidence in a court of law.
Clausewitz warns to never back your enemy into a corner, from which the only way out is through your own destruction.
IT-liberalists did that.
PS: My next column in queue.acm.org will be about this very problem.
@womble @dave_aitel @SteveBellovin @mattblaze
And yes, it is possible and valid to hold a nuanced opinion which is neither "wiretap it all" and "encrypt it all", and I do that.
It's called "A compromise" Look it up.
@mattblaze The other area of focus that people are missing, with the same foundational arguments, are our OS and Phone makers spying on us for advertisement reasons. While these companies lament that making backdoors for gov is impossible, they've certainly put forth a solid effort to syphon the same data for their revenue. All this data should be protected in both cases; but people, I feel, have lost sight and subsequently control of their data by these companies.
After all, they are the ones buying, selling, trading and loosing our data on a daily basis. I'm less concerned now with the gov backdoor concerns than what is being forced to coerced by big tech.
@dntlookbehindu Well, of course that's a huge concern, too. But these are additive risks. We don't have to only worry about one.
And it's not the government abusing its legal access I'm worried about here (that's a different question). It's that the architectural burden that implementing it imposes makes everything vulnerable to *illegal* access. As with adware, too.
@mattblaze I'm feeling we are past the architectural burden for this stuff when my phone see's an encrypted Singal conversation, and provides a popup of "do you want this translated from XX to English" without my permission or request (and no foreign language being used as well). The companies are screen scraping our encrypted conversations with poor AI systems, and turning their data into business transactions.
In short, I feel these companies have already made the backdoors and related infrastructure, and the malware, doing so under the color of adtech and revenue. All the keystroke loggers, screen scrapers, etc.
Matt Blaze
Coach Pāṇini ®
Ryan Singel
Kevin Karhan 
Richard W. Woodley ELBOWS UP 🇨🇦🌹🚴♂️📷 🗺️
dexter
Justin Scholz
Christ van Willegen
Poul-Henning Kamp
Steve Bellovin
Jeff Craig
Ben Rosengart
Matt Palmer
Ryan Clough 
Dr. Russ 
gary