Showing posts with label cybersecurity. Show all posts
Showing posts with label cybersecurity. Show all posts

Thursday, March 10, 2016

Is code speech?

In Apple's fight against a court order compelling it to create specific software to enable the government to break into an iPhone, the company is invoking its First Amendment rights as one of its defenses. In particular, they claim that the government is compelling speech by forcing it to digitally sign the special version of iOS. The Electronic Frontier Foundation (EFF), in their amicus brief in support of Apple, explains how digital signatures are a way of communicating endorsement of a signed document. (Also see the EFF's FAQ on the matter.)

In making this defense, Apple and EFF (as well as others) typically use the term "computer code is speech" in reference to previous court decisions which protected companies and individuals developing software, in particular encryption software. However, this idea (code as speech) is controversial. Below, I will address law professor Neil Richards's claim that "Code = Speech" is a mistake. (As a reference, please also refer to Apple's filling.)

Code is a means of expression

Richards states that "Apple has told the court that 'under well-settled law, computer code is treated as speech within the meaning of the First Amendment.' Unfortunately, it's wrong about that. The Supreme Court has never accepted that code is protected like speech." The problem is that Apple never said that The Supreme Court has ruled on the matter - they referred to "well-settled law." From that perspective, Apple is correct. They even list the lower court case-law to illustrate.

For instance, in Bernstein v. Department of State the U.S. Court of Appeals, Ninth Circuit says "we conclude that source code is utilized by those in the cryptography field as a means of expression, and because the regulations apply to encryption source code, it necessarily follows that the regulations burden a particular form of expression directly" (emphasis added). The court here explicitly refers to cryptography which is exactly what Apple refers to in their filling. They say that
The government asks this Court to command Apple to write software that will neutralize safety features that Apple has built into the iPhone in response to consumer privacy concerns. The code must contain a unique identifier "so that [it] would only load and execute on the SUBJECT DEVICE," and it must be "'signed' cryptographically by Apple using its own proprietary encryption methods (emphasis added).
More directly, though, Apple also lists the case of United States v. Elcom Ltd. which was ruled by the U.S. District Court in Northern California. In that ruling the court states that
the government contends that computer code is not speech and hence is not subject to First Amendment protections. The court disagrees. Computer software is expression that is protected by the copyright laws and is therefore "speech" at some level, speech that is protected at some level by the First Amendment (emphasis added).
At least two other cases address this claim as well:
  • Universal City Studios, Inc. v. Corley - "Computer programs are not exempted from the category of First Amendment speech simply because their instructions require use of a computer"  
  • Junger v. Daley - in reversing a lower court's decision stating that encryption code is not expressive speech, the U.S. Appeals Court, Sixth District concluded that the First Amendment does in fact protect computer source code 
Richards is correct in saying that the Supreme Court hasn't ruled that "code is speech" but they haven't ruled contrarily either. The current accepted view of the courts is that computer code is a form of speech.

Speechiness is not the issue - regulation is

Having said all of that, I do believe that Richards makes a good point when he says that
What matters, in the end, isn't the metaphysics of "speechiness," [the central question of asking whether code is speech] but whether a government regulation of an activity threatens the traditional values of free expression -- political dissent, art, philosophy, and the practices of self-government...The right question to ask is whether the government's regulation of a particular kind of code (just like regulations of spending, or speaking, or writing) threatens the values of free expression.
Like Richards, I see this as the true issue at hand. The clumsy language used by the various courts above only confuses the matter. Computer code is really more like words, not speech, and like words used in other forms of expression, the content matters. Richards provides an illustrative example when he implies that it would be silly (my word not his) to protect malware writers because the code they used to write the programs was protected speech.

In defense of that last view, Richards writes "Code = Speech is a fallacy because it would needlessly treat writing the code for a malicious virus as equivalent to writing an editorial in the New York Times." I have some trouble with this analogy because I could see a case where these were equivalent. For instance, if the New York Times published an editorial that incited a riot in Times Square, that would be the same as writing a malicious virus (or DDoS attack). Using words to incite violence is not protected by the First Amendment, nor is using code to inflict damage. And this, as I see it, gets to the real heart of the matter. However, I wouldn't go as far as Professor Richards in calling for regulation of code.

Conclusion

While I believe that Apple has a valid First Amendment argument in their fight against the government, I also think the simple slogan of "code is speech" and what it implies is clumsy. Computer code can be used to achieve great things including giving power to the powerless and limiting the power of the powerful. In that way, it is no different from traditional values of political dissent, art, and philosophy.

Wednesday, March 09, 2016

Whatever

Get used to America, we just may not be that unique.

An interesting approach to limit wasteful exchanges of political favors during election cycles. "In ancient Athens, not only juries but many office-holders were selected by lot. But the most intriguing unpredictable election process was probably that of the medieval Venetian Republic. In Venice, many political offices were selected by a repeated cycle of lottery, vote, .... lottery, vote."

The Ukrainian power grid was hit by Russian-sponsored hackers late last year. Kim Zetter has the compelling story. The scary part - "the control systems in Ukraine were surprisingly more secure than some in the US, since they were well-segmented from the control center business networks with robust firewalls."

Oh France! Why? "[T]he French National Assembly has amended a pending counterterrorism bill to impose heavy penalties on technology companies that fail to cooperate in decrypting communications relating to terrorism investigations."

Science is messy. "An influential psychological theory, borne out in hundreds of experiments, may have just been debunked. How can so many scientists have been so wrong?"

Artificial "octopus skin" for robots - what more needs to be said.

While bitcoin is having some success, maybe it's the blockchain that will be the real 'game changer.' "Goldman Sachs says the technology 'has the potential to redefine transactions' and can change 'everything.'"

"Legal marijuana may be doing at least one thing that a decades-long drug war couldn't: taking a bite out of Mexican drug cartels' profits."

Could the insurance industry help reform American policing? Radley Balko found "several examples in which insurers had demanded changes to policies regarding the use of SWAT teams, usually after one or more incidents that resulted in a payout to someone shot or injured during a police raid...[T]he financial incentives insurers can offer to cities and towns for good policing are powerful."

Bonds by William Dupre
All that we look to spend
To suit a legacy
With others there to lend
The bonds that are not free.
The sense we must abuse
And trespass to for-give
On lies we like to use
For lives we long to live.
We must, but no alone,
End the art to deceive,
Lest what we love be gone
And we ourselves take leave
Of senses that are the
Guise of what is to be.

Thursday, March 03, 2016

Security Roundup

I've been blogging a lot about security lately, but there is a lot going on to blog about. Here is a roundup of some hot news items.

ACLU: You can kiss trust in software updates goodbye if Apple's forced to help the FBI: "What the government seeks here is an authority that would undermine American and global trust in software security updates, with catastrophic consequences for digital security and privacy."

We are currently dealing with the consequences of intentionally weak cryptography. The latest is the DROWN attack which exploits bad decisions made by the U.S. government during the 1990s Crypto Wars. "Today, some policy makers are calling for new restrictions on the design of cryptography in order to prevent law enforcement from 'going dark,'...[H]istory's technical lesson is clear: Weakening cryptography carries enormous risk to all of our security."

The U.S. government has funded projects like TOR and Open Whisper with the intention of giving dissidents across the world the ability to communicate freely. So, is the government fighting itself on encryption? "We thought the risks of not allowing the Internet to be secure and a vehicle for free speech was more detrimental than the risks of bad guys using it in ways that made it harder to go after them."

Could the Feds get into iPhones without Apple's help? Maybe they should ask the NSA.

Wednesday, March 02, 2016

Whatever

  • An open-source alternative to Android Wear OS
  • Wonderful piece, great player
  • Pirates of the 21st Century!
  • Help Wanted for hackers - "Some groups also offer incentives for new talent, such as promising fame and notoriety, profit-sharing, and travel expenses."
  •  How to make good decisions? Don't ignore the base rate.
  •  FBI's Tor hack shows the risk of subpoenas to security researchers - "If you're a researcher, you need to think: Am I going to get subpoenaed here? Should I be gathering this information and risking putting it into the wild?"

Oh, God! a lipogram in O by William Dupre
Oh! To know God’s blood,
Don’t brood on school’s rot
Or cool to Mom’s cocoon -
Stomp on roots of doom!

Look to books for food
To stop torpor’s hoofs.
Don boots to crook cons
Or to loot God’s boon.

Go now! Look how blooms
Took to soot on sod
On footholds of foo
To grow food for fools!


Pirate Ship image courtesy of EricaMaxine Price at Fine Art America

Monday, February 29, 2016

Apple gets some love from the Big Apple

U.S. Magistrate Judge James Orenstein in New York has ruled against the government in a separate All Writs Act request to unlock an iPhone. Alex Bewitt at InfoQ highlights some of the key points in the decision (the full ruling can be found here).

This is a scathing ruling against the government.One key point appears in a footnote:
In considering the burden the requested relief would impose on Apple, it is entirely appropriate to take into account the extent to which the compromise of privacy and data security that Apple promises its customers affects not only its financial bottom line, but also its decisions about the kind of corporation it aspires to be. The fact that the government or a judge might disapprove Apple's preference to safeguard data security and customer privacy over the stated needs of a law enforcement agency is of no moment: in the absence of any other legal constraint, that choice is Apple's to make, and I must take into account the fact that an order compelling Apple to abandon that choice would impose a cognizable burden on the corporation that is wholly distinct from any direct or indirect financial cost of compliance [emphasis added].
In other news from New York, District Attorney Cyrus Vance Jr. will go before Congress to discuss encryption. As Gregg Keizer at ITWord says of Vance, he "wanted Apple to return to the security model it used through 2013's iOS 7. 'We want smartphone makers to offer the same strong encryption that Apple employed before iOS 8,' Vance said."

Apple wants personal device security to be controlled by the person; the government wants it controlled by the government via corporate proxies.

Saturday, February 27, 2016

Apple Defenses

Kim Zetter at Wired has an article up explaining the First Amendment defenses that Apple could use in its case against the government. As I mentioned in a previous post, the courts have ruled that, in essence, computer code is speech. A defense tactic in this vein could argue that requiring Apple to write a special version of iOS is compelled speech. However, as Zetter illustrates, there is another line of defense Apple could take, and it pertains to the digital signing of that new code.
Instead, it's the digital signature that Apple would use to sign that code that is the key to Apple's First Amendment argument, say legal experts who spoke with WIRED. "The human equivalent of the company signing code is basically saying, 'We believe that this code is safe for you to run,'" says Jennifer Granick, director of civil liberties for the Center for Internet and Society at Stanford Law School. "So I think that when you force Apple to cryptographically sign the software, it has a communicative aspect to it that I think is compelled speech to force them to do it."
"[B]ecause what's so expressive, necessarily, about that? But to me, the signing is expressive—very clearly so," she says. "That's kind of what the code signing is—it's saying 'I'm Apple Computer and we support this software and we think this software is safe for you to run'...So a forced signature to me is compelled speech."
 If Apple were to use this defense it could set some interesting precedents for digital signatures.

Other than the First Amendment, Apple could take the 5th in this case. Not refuse to testify, of course, but apply that other pesky part of the 5th Amendment - due process. David Kravets at Ars Technica explains how "conscripting Apple to build something that it doesn't want to do...is a breach of its 'substantive due process.'"

There is also the question of whether Congress has already had its say in this matter. The All Writs Act that the FBI is using to compel Apple only gives courts a tool to enforce existing statutes. As Albert Gidari shows, Congress in 1994 passed the Communications Assistance for Law Enforcement Act (CALEA) which "did not prohibit a [telecommunications] carrier from deploying an encryption service for which it did not retain the ability to decrypt communications for law enforcement access" (emphasis mine). So, CALEA could trump AWA. It is yet to be seen, however, if the courts view Apple as a "telecommunications carrier."

Wednesday, February 24, 2016

Whatever


Little Lies by William Dupre
We can't escape
Having a little of what we hate
Of others within ourselves. 

Yet we let the lie reside
Lest we make light the biases
We desire to hide --

The Hypocrisy doesn't wear well
As we tell stories of the self.

Thursday, February 18, 2016

#FBIvsApple

Elsewhere (on Facebook), I backed away from a claim that the order issued by the California Court requiring Apple to assist the FBI in accessing a locked iPhone was a 4th Amendment issue. In this particular case it clearly isn't. However, if Apple loses its challenge, the precedent set could have longer term 4th and 5th Amendment issues. (This is important because the current makeup of SCOTUS, especially since the passing of Justice Scalia, leans towards deference to the government is such cases.) There is also an interesting First Amendment issue to consider. In Bernstein v. Department of Justice, the U.S. District Court for the Northern District of California ruled that, in essence, computer code is equivalent to speech. So, is it compelled speech if the government requires Apple to create a modified version of iOS?

So, clearly there are some Civil Rights issues on the line with this order.

Another interesting angle in this case is the question of whether the FBI actually needs Apple at all. It is known that the government has tools to hack into software systems already. Specifically, the NSA has a stash of zero-day exploits it has collected over the years. Now, of course, the NSA isn't going to share those with the FBI, but could the FBI have its own stash? Also, are they really just using this order to set a legal precedent? Or are they using it to garner public support to force software companies to include backdoors in encryption tools? There is no evidence that this is what is going on, but these are some of the issues that are now in play.

Apple has a fight on its hands and we will soon see how this particular case plays out. However, there are serious security, technology, privacy, and rights implications that will play out over the longer term.