Electronic Communications and Cell Phone Surveillance

As a society we are increasingly dependent on electronic communications. We can call each other from the grocery store, telecommute into work, or instant message (IM) our colleagues when we need to collaborate. I’ve even been known to IM coworkers sitting on the other side of a desk from me (nice because it doesn’t break their workflow). By communicating using these tools we give all kinds of information to third parties and in so doing we give up some of our constitutional protections. Pretty much everyone carries a cell phone in their pocket at all times, and as the cell phone sits, it maintains a connection to the nearest cell phone towers, and this gives cell phone companies a rough picture of where it is at all times. Recently this situation has been frequently discussed as citizens become increasingly concerned with protecting their privacy.

Legal Background

There are several kinds of requests that the US Government can issue to a content provider regarding electronic communications. Most are covered by the Electronic Communications Privacy Act (ECPA) and the Wiretap Act. These include: subpoenas, court orders, search warrants, pen registers, and wiretap orders. The first three all pertain to existing records and do not allow law enforcement to request information in real time. Pen registers and wiretap orders allow for the request of information to be provided in real-time. Only subpoenas and pen registers can be issued without consulting a judge. More details can be found here. While the 4th amendment protects citizens from unreasonable searches and seizures, in the 1970s the supreme court found in United States v. Miller and Smith v. Maryland that “a person has no legitimate expectation of privacy in information he voluntarily turns over to third parties”. This “third party doctrine” has been used as a standard in many subsequent cases, notably in United States v. Graham (2012) which ruled that cell phone location information is voluntarily turned over, and thus covered by the doctrine.

The third party doctrine has been vocally criticized in recent years, especially when the NSA’s program requesting bulk telephony information of citizens came to light. Critics point out that we live in a world increasingly dominated by electronic communications, and that surrendering data to third parties is unavoidable. In response to increasingly privacy-minded consumers, cell phone manufactures have started to create devices with privacy protections in place. 

Metadata

Most of the options to request information protected under the ECPA only allow access to metadata. Metadata is all the information pertaining to a communication that isn’t the communication itself. Some examples of metadata are: the location of each of the participants, the duration of the communication, and the time the communication took place. 

While it is incredibly difficult to protect metadata data from a technical standpoint, some options exist. Since cell networks offer so much information and are already well equipped to hand over subscriber information, any option that avoids the use of cell phone networks helps protect communications. The only way to hide both metadata and content is the use of a trusted third party which will act as an intermediary (known as a proxy).

Case study: Apple

In response to growing demands for consumer data, Apple began to implement software and hardware to protect their consumers’ privacy. Recent iOS devices (Apple’s phones, iPods, and tablets) feature a “secure enclave”, a separate piece of hardware with a built in unique key. Hardware is built in such a fashion that no software could ever extract the key (this has been claimed by Apple and verified by their party researchers hacking the device, but it is possible a backdoor exists). They use the this hardware key coupled with the device's unlock passcode to encrypt all the user’s files. Because the key is irrecoverable from the device, any cracking attempts require the use of the unique phone’s physical hardware. This slows down any attempt to recover the information stored in the device (making it take years to crack the the encryption and removing the possibility that custom hardware could be built to decrypt the device faster). 

In addition to hardware protections Apple is applying software protections as well. Public statements from Apple indicate that all FaceTime and iMessage communications (this includes audio-video, audio only, and text communications) are end-to-end encrypted. This means that only the parties involved in the conversation can decode the conversation. Third parties could recover some or all of the metadata. This technology only works between two Apple devices, and, while iMessages gets enabled by default whenever two iPhones text each other, phone calls still use traditional cellphone voice communications unless specifically requested by the caller. 

Manufacturers other than Apple have implemented some of the above protections for their devices although certain Android devices have come under fire for not sufficiently protecting user data. Many third party developers are creating secure messaging applications with varying degrees of success. This is clearly an issue that is square in the public’s attention right now and I think that we will be hearing a lot more about it in years to come. 

Open Source

In light of all the flaws with many secure messaging implementations, free software proponents advocate open protocols. One of the basic precepts of encrypted communication is that the cryptosystem should remain secure even if all the algorithms are publicly available, meaning that the only part of the system that should be secret is the encryption key. This is important so that we can discuss algorithms and prove security without weakening the algorithm. This is also important so that reverse engineering an encryption code will not help you break communications protected by the code. All modern encryption algorithms satisfy this requirement. In light of these facts Apple’s iMessage (and most other secure communication apps) have come under fire for not submitting themselves to scrutiny. Researchers contend that iMessage’s protections could be subverted by an attack by Apple (namely a man-in-the-middle attack on the key exchange). Open source software is software where the code for the software is publicly accessible. This software can be vetted by professionals and the community and is generally considered to be the safest option for privacy minded individuals.

Author's thoughts

Electronic communications are a complicated and integral part of modern life. To solve the problems this technology presents we need to improve both the public and private sectors. Our legal code should be updated to correctly protect 21st century communications, creating or modifying laws to appropriately support both privacy and law enforcement. Private corporations should use well vetted protocols to ensure that their customers are afforded the degree of protection they desire. They should offer as much documentation of their practices as to make it possible for security researchers to vet their software while not revealing their corporate secrets.