Why Did Congress Let Law Enforcement Officials Lie About Encryption?

Tech Dirt – by Mike Masnick

When you testify before Congress, it helps to actually have some knowledge of what you’re talking about. On Tuesday, the House Energy & Commerce Committee held the latest congressional hearing on the whole silly encryption fight, entitled Deciphering the Debate Over Encryption: Industry and Law Enforcement Perspectives. And, indeed, they did have witnesses presenting “industry” and “law enforcement” views, but for unclear reasons decided to separate them. First up were three “law enforcement” panelists, who were free to say whatever the hell they wanted with no one pointing out that they were spewing pure bullshit. You can watch the whole thing below (while it says it’s 4 hours, it doesn’t actually start until about 45 minutes in):  

Lots of craziness was stated — starting with the idea pushed by both chief of intelligence for the NYPD, Thomas Galati and the commander of the office of intelligence for the Indiana State Police, Charles Cohen — that the way to deal with non-US or open source encryption was just to ban it from app stores. This is a real suggestion that was just made before Congress by two (?!?) separate law enforcement officials. Rep. Morgan Griffith rightly pointed out that so many encryption products couldn’t possibly be regulated by US law, and asked the panelists what to do about it. You can watch the exchange here:

You see Cohen ridiculously claim that since Apple and Google are gatekeepers to apps, that the government could just ban foreign encryption apps from being in the app stores:

Right now Google and Apple act as the gatekeepers for most of those encrypted apps, meaning if the app is not available on the App Store for an iOS device, if the app is not available on Google Play for an Android device, a customer of the United States cannot install it. So while some of the encrypted apps, like Telegram, are based outside the United States, US companies act as gatekeepers as to whether those apps are accessible here in the United States to be used.

This is just wrong. It’s ignorant and clueless and for a law enforcement official — let alone one who is apparently the “commander of the office of intelligence” — to not know that this is wrong is just astounding. Yes, on Apple phones it’s more difficult to get apps onto a phone, but it’s not impossible. On Android, however, it’s easy. There are tons of alternative app stores, and part of the promise of the Android ecosystem is that you’re not locked into Google’s own app store. And, really, is Cohen literally saying that Apple and Google should be told they cannot allow Telegram — one of the most popular apps in the world — in their app stores? Really?

Galati then agreed with him and piled on with more ignorance:

I agree with what the Captain said. Certain apps are not available on all devices. So if the companies that are outside the United States can’t comply with same rules and regulations of the ones that are in the United States, then they shouldn’t be available on the app stores. For example, you can’t get every app on a Blackberry that you can on an Android or a Google.

Leaving aside the fact he said “Android or a Google” (and just assuming he meant iPhone for one of those)… what?!? The reason you can’t get every app on a BlackBerry that’s on other devices has nothing to do with any of this at all. It’s because the market for BlackBerry devices is tiny, so developers don’t develop for the BlackBerry ecosystem (and, of course, some BlackBerries now use Android anyway, so…). That comment by Galati makes no sense at all. Using the fact that fewer developers develop for BlackBerry says nothing about blocking foreign encryption apps from Android or iOS ecosystems. It makes no sense.

Why are these people testifying before Congress when they don’t appear to know what they’re talking about?

Later in the hearing, when questioned by Rep. Paul Tonko about how other countries (especially authoritarian regimes) might view a US law demanding backdoors as an opportunity to demand the same levels of access, Cohen speculated ridiculously, wildly and falsely that he’d heard that Apple gave China its source code:

Here’s what Cohen says:

In preparing for the testimony, I saw several news stories that said that Apple provided the source code for iOS to China, as an example. I don’t know whether those stories are true or not.

Yeah, because they’re not. He then goes on to say that Apple has never said under oath whether or not that’s true — except, just a little while later, on the second panel, Apple’s General Counsel Bruce Sewell made it quite clear that they have never given China its source code. Either way, Cohen follows it up by saying that Apple won’t give US law enforcement its source code, as if to imply that Apple is somehow more willing to help the Chinese government hack into phones than the US government. Again, this is just blatant false propaganda. And yet here is someone testifying before Congress and claiming that it might be true.

Thankfully, at the end of the hearing, Rep. Anna Eshoo — who isn’t even a member of the subcommittee holding the hearing (though she is a top member of the larger committee) joined in and quizzed Cohen about his bizarre claims:

She notes that it’s a huge allegation to make without any factual evidence, and asks if he has anything to go on beyond just general “news reports.” Not surprisingly, he does not.

Elsewhere in the hearing, Cohen also insists that a dual key solution would work. He says this with 100% confidence — that if Apple and law enforcement had a shared key it would be “just like a safety deposit box.” Of course, this is also just wrong. As has been shown for decades, when you set up a two key solution, you’re introducing vulnerabilities into the system that almost certainly let in others as well.

And then, after that, Rep. Jerry McNerney raises the point — highlighted by many others in the past — that rather than “going dark,” law enforcement is in the golden age of surveillance and investigation thanks to more and new information, including that provided by mobile phones (such as location data, metadata on contacts and more). Cohen, somewhat astoundingly, claims he can’t think of any new information that’s now available thanks to mobile phones:

Here’s Cohen:

Sir, I’m having problems thinking of an example of information that’s available now that was not before. From my perspective, thinking through investigations that we previously had information for, when you combine the encryption issue along with shorter and shorter retention periods, in a service provider, meaning they’re keeping their records, for both data and metadata, for a shorter period of time, available to legal process. I’m having difficulty finding an example of an avenue that was not available before.

Huh?!? He can’t think of things like location info from mobile phones? He can’t think of things like metadata and data around unencrypted texts? He can’t think of things like unencrypted and available information from apps? Then why is he on this panel? And the issue of data retention? Was he just told before the hearing to make a point to push for mandatory data retention and decided to throw in a nod to it here?

At least Galati, who went after him, was willing to admit that tech has provided a lot more information than in the past — but then claimed that encryption was “eliminating those gains.”

Cohen is really the clown at the show here. He also claims that Apple somehow decided to throw away its key and that it was “solving a problem that doesn’t exist” in adding encryption:

There he’s being asked by Rep. Yvette Clarke if he sees any technical solutions to the encryption issue, and he says:

The solution that we had in place previously, in which Apple did hold a key. And as Chief Galati mentioned, that was never compromised. So they could comply with a proper service of legal process. Essentially, what happened is that Apple solved a problem that does not exist.

Again, this is astoundingly ignorant. The problem before was that there was no key. It wasn’t that Apple had the key, it’s that the data was readily available to anyone who had access to the phone. That put everyone’s information at risk. It’s why there was so much concern about stolen phones and why stolen phones were so valuable. For a law enforcement official to not realize that and not think it was a real problem is… astounding. And, again, raises the question of why this guy is testifying before Congress.

It also raises the question of why Congress put him on a panel with no experts around to correct his many, many errors. At the very least, towards the beginning of the second panel, Apple GC Sewell explained how Cohen was just flat out wrong on these points:

If you can’t see that, after his prepared remarks, Sewell directly addresses Cohen’s claims:

That’s where I was going to conclude my comments. But I think I owe it to this committee to add one additional thought. And I want to be very clear on this: We have not provided source code to the Chinese government. We did not have a key 19 months ago that we threw away. We have not announced that we are going to apply passcode encryption to the next generation iCloud. I just want to be very clear on that because we heard three allegations. Those allegations have no merit.

A few minutes later, he’s asked directly about this and whether or not the Chinese had asked for the source code, and Sewell says that, yes, the Chinese have asked, and Apple has refused to give it to them:

Seems like they could have killed 3 hours of ignorant arguments presented to Congress, if they had just not allowed such ignorance to be spewed earlier on.

https://www.techdirt.com/articles/20160419/12293034214/why-did-congress-let-law-enforcement-officials-lie-about-encryption.shtml