-2

I'm currently studying forensics, and one thing that keeps coming up is the authorities breaking into phones.

There are several third party tools they can use, but one of the most popular is 'Cellebrite'.

My understanding of this device was that they could NOT access an encrypted, password protected phone BFU (before first unlock), as long as it was a modern device and the firmware was updated to the most recent version.

But time and time again, the police are able to crack any phone they want. It takes time sometimes, but they get in there eventually.

There was even a case not too long ago where they couldn't easily access the iphone they had seized, so they went to Apple's HQ and Apple unlocked it for them.

I assume Samsung would comply with the police as well.

Not to mention the stack of backdoors or zero day bootrom exploits the intelligence agencies could be sitting on.

So what is the point of encryption in regards to law enforcement, really? If they are getting in either way, why even bother?

How can one ensure their device is 100% (or even 99.9%) protected? Buy a Chinese phone? But then you have to worry about surveillance from China. Not to mentioned the hardware exploits that could be used.

Extending this to computers, what is the point of even having things like VeraCrypt or Bitlocker exist if the government can go to the manufacturer and get them to crack it open? If they can utilize zero days and hardware and bios exploits every time?

15
  • 2
    The question reads as: "if someone with enough money and time can break into some devices, what's the point of securing them?" The answer is simply because it takes time and money, and there is no guarantee of success.
    – schroeder
    Dec 2, 2023 at 11:02
  • 1
    And that article you linked says nothing of encryption or what was required to extract the data. Nor does it say that the device was unlocked. You're jumping to too many conclusions.
    – schroeder
    Dec 3, 2023 at 8:40
  • 2
    No need to be patronising. A warrant does not enable any party to break encryption. It only provides legal permission to attempt it. So, no, your comment about the warrant isn't relevant.
    – schroeder
    Dec 3, 2023 at 16:11
  • 1
    Here's info from Apple: apple.com/customer-letter/answers/…. So, yes, you are jumping to conclusions and you have several facts incorrect. That makes this difficult to answer without challenging your initial premise.
    – schroeder
    Dec 3, 2023 at 16:28
  • 2
    If you look up what the Apple case was actually about it did not involve the FBI wanting Apple to break their own encryption. It was a request for Apple to create a modified version of IOS to allow the FBI to try and brute force the password (basically a version of IOS that doesn't lock you out after n attempts). In so far as a warrants go, they can compel someone (say Apple) to break their encryption but as @schroeder pointed out it doesn't magically acheive it - if Apple CAN'T break their own encryption then the warrant is meaningless. Dec 3, 2023 at 21:52

2 Answers 2

5

You cannot ensure that the device is 100% protected, the same way that you cannot 100% ensure that nobody could ever break into an apartment, get access to your bank account etc.

It is instead always a trade-off between costs on one side and security on the other. Costs can involve the actual money, but it also involves usability, efficiency ... . To find the right balance you need to understand your actual risks which depend both on your personal situation and the value of the data. Messages containing just food recipes usually have a low value even in repressive countries, while messages which show conflicts with the government might be of low sensitivity in some countries but might be considered very sensitive in others.

So, if the government is interested in your data then you need to have different protections than if only your friend is too nosy. Phones are usually designed for high usability while still providing sufficient protection in face of attackers with limited resources - which includes limits on knowledge, money, time, ... needed to break into your phone. If the value of the data on your phone is low then it will not be worth for attackers to invest lots of resources to break into the phone, and this is true for governments too.

And even if you get a real secure device with lots of digital locks protecting your information which make it really hard even for you to get access, then there can simply be non-digital ways to force you to reveal this information - even if these might be illegal in some places. So you cannot assume that information are safe just because they are stored on a seemingly safe device. Obligatory xkcd:

enter image description here

1

Most people seem to have this binary opinion of whether the government can/can't break into phones/computer/encryption/etc but it is a lot more nuanced than that. The more important question is can they be bothered and also something not really talked about called "public interest".

If you are selling a bit of dope out of your apartment and the Police come a knocking and find that your phone is encrypted out the wazoo are they going to be bothered to break into it to find out the names of a few local drug users? Is it in the public interest to spend resources in order to identify such people? Probably not. On the other hand if the Police come a knocking because you are planning the next 9/11, they are going to be a lot more motivated, plus there is also a strong public interest to get into your devices. They will have a blank cheque to do anything to get into it. So the first question is whether what you are being investigated for is worth the time and money.

You mention the Apple incident. Apple actually refused to help the FBI break into that specific phone and further refused requests from the FBI to build backdoors into future IOS versions. The FBI went to Cellebrite who employ a number of very clever people and Cellebrite built a tool to get around Apple's encryption. Ultimately this is what companies like Cellebrite do and this is how they make their money. It comes down to the age old arms race of building a more secure system and the other team figuring out how to break it (take safe manufacturers vs safe crackers for instance).

Ultimately some of the premises upon which you build your question are flawed (such as companies helping the government every time), but the reality is against a motivated enough attacker with unlimited resources no device is 100% secure. Basically you encrypt your phone/data for the same reason you lock your car/house - it offers some protection against some people.

10
  • How is the premise of having the company help the government flawed? Apple is an American company and while they can fight warrants in certain cases, they cannot magically refuse to suddenly cooperate with the government. toronto.ctvnews.ca/… This is a Canadian case, but i'm sure many American warrants have also been served. I'm willing to bet Samsung would cooperate too. Dec 3, 2023 at 1:22
  • 2
    I believe this is the Apple iPhone case you are referring to: en.wikipedia.org/wiki/Apple%E2%80%93FBI_encryption_dispute Apple did in fact fight the validity of the court order. Given that the FBI withdrew the matter before judgement means that there is no precedent set for whether these types of court order are valid or not. As such the premise that Apple cooperated in anyway is flawed. The Toronto case you have linked (2014) predates the FBI one (2015&16) so it appears apple has changed their minds or the law is somehow different in the US. Dec 3, 2023 at 3:33
  • But regardless of whether Apple does it or not, the entire point of relying on a company to decide whether to keep you safe or not doesn't sit right with me. Dec 3, 2023 at 5:48
  • 1
    @ElizabethVogue If you actually have a read of the court documents in that Canadian case you keep mentioning. The warrant as it pertains to Apple states: "It is hereby further ordered that Apple shall provide reasonable technical assistance to enable law enforcement agents to obtain access to unencrypted data on the Device". It futher goes on to state "to the extent that data on the iOS device is encrypted, Apple may provide a copy of the encrypted data to law enforcement but is not required to attempt to decrypt or otherwise enable law enforcement to access any encrypted data" Dec 5, 2023 at 5:48
  • 1
    This is a Q&A site, not a place to "open a discussion on advanced encryption techniques that would withstand forensics". Your question literally is, "what's the point of protecting my phone?" If you are wanting to "open a discussion" then your question is too open-ended. And since you are rejecting all attempts to make this question about the facts and not your feelings around the issue, I'm closing as unanswerable.
    – schroeder
    Dec 6, 2023 at 8:26

Not the answer you're looking for? Browse other questions tagged .