February 27, 2015

avatar

9 Problems of Government Hacking: Why IT-Systems Deserve Constitutional Protection

Governments around the world are increasingly hacking into IT-systems. But for every apparent benefit, government hacking creates deeper problems. Time to unpack 9 of them, and to discuss one unique perspective: in response to a proposed hacking law in 2008, the German Constitutional Court created a new human right protecting the ‘confidentiality and integrity of IT-systems’. The rest of the world should follow suit, and outlaw government hacking until its deep problems are addressed.

The NSA has been hacking for a while now, but the FBI, state and even local authorities also seem to be hacking at will without public accountability. Yale ISP and Chris Soghoian put together a great conference on Law Enforcement Hacking to start the discussion (video online soon). Probably because of its constitutional DNA, some law enforcement agencies in Europe have felt obliged to provide some details to the public. So in my short talk [slides pdf] I could discuss the 2010 Bredolab botnet case, as well as the 2008 German Constitutional Court ‘Bundestrojaner’ ruling (English summary, excellent case note).

In the landmark ‘Federal Trojan’ case, the German court established a constitutional right the ‘confidentiality and integrity of IT-systems’ (recognize the c.i.a.-triad?). It held that IT-systems are a qualitatively unique space with regard to surveillance, and that government hacking is a stepping stone into further violations. IT-systems contain our most intimate and sensitive data – ‘the core of personality’ that is inviolate under art. 1 of its Constitution. As devices are increasingly networked, a successful hack also gives insight into the lives of people you interact with. Furthermore, devices might become a one stop-shop for law enforcement as we concentrate and even structure our lives on our devices or in the cloud. The Court also reflected on the internet of things: if your future fridge has ‘general purpose’ functionality such as storage, it may fall within the new constitutional right in Germany. The Court left a possibility open for future hacking laws, but only if such laws meet the strictest legal criteria the Court set to date. Much stricter than placing a wiretap, or searching a house.

Its rulings have had global impact before. In 1983, the German election census case created a new constitutional right to ‘informational self-determination’, providing a solid constitutional basis in Europe for data protection and the concept of consent. Interestingly, the European Court of Human Rights case-law is slowly but surely moving forward: I v. Finland (2008, para. 37-39) establishes positive obligations to ensure data security through specific legislation, and the Bernh Larsen v. Norway case (2013, para. 106) rules that ‘all data on a server’ deserves protection, not ‘only’ personal data. The fast-tracked and pending post-Snowden case may push it further.

Constitutional protection provides the normative baseline to evaluate government surveillance law. And to condemn actual practices. The Chaos Computer Club discovered a few years after the ‘Bundestrojaner’ (love that term) ruling that German authorities continued to spread malware anyway. It got hold of a Bundestrojan and reverse-engineered it (recommended read). With the Dutch bredolab case and the comments made by the panel at the conference, a fascinating problem set emerges:

  1. Judicial oversight: judges face a hard or impossible task assessing the admissibility of government hacking warrant. The hacking tools and payload of government malware are either lied about (as in Germany), sealed in court documentation, or obscured in newspeak: ‘network investigation tool’ or any other of over 20 synonyms.
  2. Insecure malware: the reverse engineered German malware was of so deplorable state, that it in facr facilitated man in the middle attacks on suspect and even law enforcement IT-systems. The commends to the trojan were unencrypted. All serious problems in themselves, also creating evidence issues in trial. A suspect may be able to claim someone else has placed code or data on its device.
  3. Bad incentives: governments get an incentive to weaken information security. Bits of Freedom launched a campaign on the role of antivirus companies, which many co-signed, asking whether they will let badly crafted government malware through. FinFisher and FinSpy are existing, deeply troubling commercial hacking toolkit governments can get installed at ISPs. And at the conference we discussed OS software updates as an attack vector for governments. Will Microsoft, Apple or Google be forced to comply with government requests to provide backdoored updates to specific targets?
  4. Parallel Construction: a major issue. This occurs when, say, the NSA hacks into a target, tips a law enforcement agency, which re-creates the same evidence from a different source. At a CITP reading group, we discussed whether this had actually happened in the Silkroad/DPR case.
  5. Jurisdiction: when can a law enforcement agency act? What determines a sovereign territory? ‘Citizenship’, ‘ip-address block’, or can governments hack across borders? Dutch authorities used the Bredolab botnet to hack into and remotely install a unverifiable .executable at thousands of infected machines across the internet.
  6. Constitutional scope: if I VPN my connection to Amsterdam, even though I’m physically based in the U.S., do I lose my reasonable expectation to 4th amendment protection that I would have if the government would raid my U.S. apartment?
  7. Geopolitics: what about the geopolitical Pandora’s box? if you happen to hack into a foreign government system, what about reciprocity, or retaliation?
  8. No reliable data: We don’t have reliable data about the size of the problem. Not aggregate, not in individual cases. Threats are systematically inflated, the size of the Bredolab botnet easily by an order of magnitude.
  9. Necessity: is government malware, or hacking even necessary? Many well-respected technologists frame the debate as “either mass surveillance, or targeted hacking”. While I agree that mass surveillance and weakening of infrastructure is even more problematic, I think that frame is incorrect in this golden age of surveillance. Less problematic alternatives will exist: the recent takedown of Utopia, a TOR hidden service widely regarded as a Silk Road heir, employed intrusive but well-established undercover techniques.

The list doesn’t end here. The cynic and realist would say, “it’s happening anyway so why bother?” The simple answer is: government hacking is different than a wiretap, so needs a specific policy response. Until aforementioned problems are addressed and legal safeguards are in place, judges should push back and government hacking should be considered what it currently is: illegal.

Comments

  1. Among the problems with government-based hacking that you point out, I think the most fundamental philosophical one is that most hacking destroys the assumption that is used to justify hacking into a system in the first place. Namely that the bits in the system are an accurate, unaltered representation of the system’s (and the target’s) actions. Once you start inserting a little data here, deleting a little there, you need impeccably audited code and procedures to give confidence that the government hasn’t altered the record for its own benefit. And the very fact that the government has hacked someone serves as a strong argument that anyone else in the world could have done similarly.

    And that’s before you even get to the evils of using the data obtained.

    • i wholehartedly agree. blackmailing by vested interests is as old as humanity, and it’s particularly attractive in this context. and that’s even before you enter the courtroom, some of those information asymmetries will precisely be executed for cases *not* to enter the courtroom in the firs place.

    • If the Govt are hacking to get evidence to take to court (not blackmailing) then can’t it be said that if they were able to get in, then it would be equally possible for someone else to have gotten in and put it there. Government hacking essentially admits that the evidence could have been tampered with.

      But not only in a single case. Data integrity and the chain of evidence could be questioned in any case involving digital evidence. I think this door has already been opened and now can’t be shut.

      Great article.

  2. To those who say that the militarization or arming of cyberspace is “happening anyway so why bother?” they need to look at the history of space exploration with satellites and understand that there were some very good reasons why putting weapons into space did not happen. Imagine the world today without commercial/private satellites operating in space and you’ll have your answer why there needs to be international agreement against the militarization of cyberspace.

    It’s not just about evidence and court cases (although this was a fascinating read). Having governments beef up their presence in cyberspace can very easily lead to an arms race which disrupts our globalized economy in ways we can’t even imagine. We have seen the global economic system collapse before (WWI did just that) and without serious global standards and treaties outlawing this type of hacking we may very well see either the fragmentation of the internet (something equivalent to many mini-Iron Curtains) or worse. This should be a major priority for the UN and every non-despotic country.

    • avatar Anonymous says:

      “This should be a major priority for the UN and every non-despotic country.”

      Excepting that the UN and all its member States including the US are “despotic countries” when it comes to hacking computer system. They ALL want the ability. No government on earth doesn’t want the ability to hack into their populace’s computers.

      Now the populaces might not want that, but the governments do. The space arms race? Well, think of it this way, all the governments are in collusion to build weapons in space with the promise that they only target citizens, never military targets. That is the world of cyberspace today.

      Yea I do care, but what can I do about it?

    • avatar NathanT says:

      “This should be a major priority for the UN and every non-despotic country.”

      Excepting that the UN and all its member States including the US are “despotic countries” when it comes to hacking computer system. They ALL want the ability. No government on earth doesn’t want the ability to hack into their populace’s computers.

      Now the populaces might not want that, but the governments do. The space arms race? Well, think of it this way, all the governments are in collusion to build weapons in space with the promise that they only target citizens, never military targets. That is the world of cyberspace today.

      Yea I do care, but what can I do about it?

      Eek, not sure if this will be a duplicate or if as anonymous I can only post once, but my fingers keep getting ahead of myself and forgetting to put in my name each time.

  3. msdvkl