The Arrogance of Ignorance

It looks like law enforcement is pushing back against strong encryption they cannot get into.

FBI quest for smartphone data will fuel privacy battle

FBI Director James Comey said as much Thursday in a speech at the Brookings Institution in Washington, suggesting the agency might ask congress to force companies to provide what amounts to a “back door” to law enforcement to obtain password-protected data on targeted personal mobile devices.

Sigh...

I've argued before that there is no such thing as a backdoor that can only be used by law enforcement. A security hole is a security hole whether it called a "backdoor" or a "golden key". In fact, a deliberately planted backdoor -- as opposed to one resulting from design or programming error -- is worse because the bad guys know for sure it is there. To think that the Chinese or the Jihadis will not look for it and pick the lock is a sure sign of ignorance.

ETA: Another thought that occurred to me is that once the bad guys figure out how to exploit the government mandated "golden key" backdoor, the vendors will not be able to patch it without permission from the government!.

Eliminate the Backdoor

Recently, there was a particularly brain-dead editorial in the Washington Post entitled Compromise needed on smartphone encryption.

Changing the name of a deliberately planted security hole from "backdoor" to "secure golden key" doesn't change the essential security problem. Even if you believe that your government can be trusted to never misuse the power of a backdoor, there is someone out there who will find it and use it for unintended purposes. There is no such thing as a "backdoor" that only law enforcement can use.

In 2005 the Ericsson switches used by Vodafone Greece were compromised. Software using the so-called "lawful interception" modules were exploited to intercept phone call from at least 100 government officials for seven months. Interestingly, the Greek Government did not request these modules be activated but they were still used by the, as yet, unidentified attacker.

In 2006 Telecom Italia users were wiretapped via exploits believed, at the time, to have been discovered during a penetration test. The provenance on this exploit is a little fuzzy -- I don't know for certain if it was deliberate backdoor or a programming error -- but it was found and, apparently, exploited.

In 2010 Chinese hackers discovered and exploited a backdoor into the Gmail system placed there by Google to comply with law enforcement intercept orders. The US government mandated that Google give law enforcement access and the Chinese discovered it then used it to gather private data.

Those are just some of the criminal uses of backdoors we know about.

There may be a good argument or two for not revealing an exploit that could be used against an enemy. I can only think of one and it is only passably good. There are, however, no good arguments I know of for deliberately creating a security hole in software -- no matter how much law enforcement wants it.