US Secret Service Prefers Belt Sanders And Third-Party Vendors To Cell Phone Encryption Backdoors

(Mis)Uses of Technology

from the 80-grit-backdoor dept

The Christian Science Monitor has posted an interesting article detailing some (but certainly not all) of the ways the US Secret Service can obtain data from locked phones. In all the cases discussed in the article, the data itself wasn’t encrypted, but was otherwise inaccessible without the password.

In addition to using third-party forensic software and hardware (like that of recently-hacked Cellebrite), the Secret Service also engages in a lot of manual labor to recover phone data. In one instance, the Secret Service was able to pull out the phone’s flash memory and grab data from it — although this process took it nearly a week.

A Huawei phone obtained by the agency called for a very unique brute force approach.

In another case, involving a password-locked Huawei H883G phone, agents bought multiple copies of the same model and practiced carefully polishing off material from the back of the device with an automated sander.

Often, agents can apply heat to phones to open them up. But Huawei built this particular model in a way that applying too much heat could damage its memory. So, agents sanded off material from the back of the Huawei H883G device to excise sexually explicit images for a case involving a different New Hampshire man.

What’s not contained in the article are complaints about encryption. Either the Secret Service doesn’t encounter that much of it, or it just doesn’t find it to be that much of an obstacle when it does. Dave Aitel, a former NSA research scientist, is the only person quoted in the article who says anything about encryption — and even he believes the Secret Service’s combination of hardware and software is a better approach than giving government agencies encryption backdoors.

Watering down encryption on phones is “not a good path,” says Dave Aitel, a former National Security Agency research scientist who currently runs the cybersecurity firm Immunity. “The path of hacking is much nicer – from a policy perspective.”

[…]

“If a device is using encryption at rest … that could be problematic, especially if the implementation of the encryption is good,” he said.

It could be problematic, but encryption keeps bad guys out the same way it keeps the good guys out. And there’s nothing covered here that suggests the Secret Service is as opposed to encryption as FBI Director James Comey is. Granted, the Secret Service probably runs into fewer encrypted phones than the FBI does, but even in its more-limited selection, it seems to be making the progress it needs without suggesting the government force companies to give them all-access backdoor keys.

One other somewhat surprising revelation contained in the piece is the fact that small phone manufacturers might (inadvertently) be making more secure phones than the Apples and Samsungs of the world. Why? Because the limited market draws less interest from government contractors who develop cell phone-cracking tools. If there are fewer government buyers interested in cracking Brand X, no company is going to expend research resources trying to find a way around the phone’s built-in protections.

“A cheaper phone that might be less popular, it seems like it’d be easier for the vendors to get into it,” says [James] Darnell of the Secret Service phone lab. “But it’s actually quite the opposite.”

What’s covered here indicates James Comey’s “sky is falling darkening” proclamations are pretty much his alone. Law enforcement at large isn’t demanding encryption backdoors. It’s just the same handful of holdouts, albeit ones with inordinately-large soapboxes.

Filed Under: backdoors, belt sanders, encryption, hacking, secret service