Saturday, September 14, 2013

Creating a Backdoor

So, here's a legal question for you, that will help determine how you see the Internet. Read the article and now, decide: Is what the FBI did fair game? Whoa, wait. Don't click more or read below without reading the Wired article, or you're just not going to grok the rest of this. You should probably Google grok too if you don't know what that means, but that's just because I like to use that word frequently.

Is this just a legal speed trap on the information superhighway? Speed traps are pretty much accepted by courts and citizens. You have a police officer sitting somewhere you know people are going to break the law, and then stop them from doing so.

Or, is this going a step further to something like a sobriety checkpoint, which a simple Google search shows there to be some fraction over the acceptability of. The argument, of course, being that the checkpoint assumes wrongdoing before inspecting the driver, an argument that the stop/search is illegal due to a lack of probable cause. Whereas with a speed trap, the officer doesn't stop everyone who goes by, just the ones he or she sees breaking the law, with the checkpoint, everyone gets stopped.

This is maybe even worse than a checkpoint, where you at least know that the police are the ones stopping you for what is, at least, a debatable public service. Here, anonymous (but not Anonymous -- this is one of the areas where their antics actually lined up with something I agreed with, because, see above, child porn is evil) entities have compromised your computer, to means unknown.

On the one hand, I have a reflexive "child pornography is evil" instinct. This is a good instinct, and we should not discount it. But, on the other hand, I have a reflexive, "uploading malware to innocent civilians is bad" instinct. Note the distinction. Is the evil of child pornography enough to justify the badness of the malware?

The important thing to note is that the FBI did not just seed the .onion sites that had child pornography on them to report back who visited (which would, under almost any interpretation of rights of citizens, most people would agree is fair play. It is sort of like a police-as-prostitute scam to catch unwary Johns (assuming, of course, that they don't enter into entrapment.)) However, everyone who used the service was pinged; even users of perfectly legal and legitimate (if secretive) sites.So, if we're going along with the speedtrap, checkpoint analogy, would this be like secreting a speed metering device into every vehicle? Would that be legal(1)?

This is a power I'm not sure we want the FBI to have. We've seen what government groups do with this sort of power; they target their political enemies with it (see Lerner, Lois; Scandal, IRS; Rosen, James; LOVEINT.(2)) On the other hand, child porn is evil. They say that hard cases make bad law, and this very well may be one of them. My instinct is that this sort of search and seizure of data would require some warrants, which the FBI probably has somewhere.

But, should they be able to get those warrants? This wasn't quite as much of a fishing expedition as if they did this to, say, G-Mail users. But, at the same time, a lot of innocent people were hit by this malware (at least, I hope the vast majority of TOR users are not looking for child porn, and I think I'll be proven right on this if someone does the metrics.)

This leads us to another question about the nature of the Internet: Is it a public library? If it is, then the government has a right to put a camera in the library to watch what you do? Or, is it more of a private collaboration, in which case we expect the government to treat it like private property [of course, they probably did in this case and got them some warrants]?

I'm honestly not sure what the right answer is here, but I thought it would be interesting to try and define the battlespace on how we should be discussing the topic.

* * *

Note: I don't use TOR, and I am not a member of the FBI or Wired's staff [though they could hire me if I want -- the antecedent being deliberately vague to show I'm flexible!] In addition, as usual, this is presented in draft, unproofed/edited form.

(1) Note that the secreting part is crucial here. It is possible to tailor a law requiring a black box for cars (though I doubt such a thing could ever pass muster), but the FBI already has laws against child porn. The question is the legality of the method allegedly used to catch them.

(2) I only felt one of these needed a link.

No comments:

Post a Comment

Are you commenting? Thank you! Please be nice; I'm lazy and would hate to actually have to moderate things.