Posted by vslira 12 hours ago
That resulted in the Communications Assistance to Law Enforcement Act, which mandated that central offices offer remote wiretapping. Capacity up to 1% of lines is required.
Back in the electromechanical era, the only call data that could be collected was outgoing dial pulses, using a "pen register".[1] (The one shown in Wikipedia is mine. It's a beautiful piece of antique brass telegraph technology. It records dial pulses as dashes, and has to be wound up like a clock, with a big brass key.) The Supreme Court decision allowing "pen registers" without a warrant refers to these "extremely limited" devices. That definition has been stretched and stretched by law enforcement into all non-voice data collected by telcos.
Law enforcement still wants more.
In the fictional world of The Wire, one of the "wires" were blown when the guy checked on his mobile bill to find out his account was flagged to not be disconnected. I'm sure this was art imitating life or inspired by type of thing
Many criminals even today don't engage in basic counter measures like you see on that show.
And I'd call them "dysfunctional" more than inept. Bad leadership stymied by political goals overcomes even good policing.
neat!
https://upload.wikimedia.org/wikipedia/commons/e/e3/Pen_Regi...
assuming you still have it, it wouldn't be the worst idea to update the pic to something without chromatic aberration and motion blur. the wiki pic is probably the worst of the bunch compared to others on google image search :)
I bought it on eBay years ago, out of curiosity, and fixed it. I built a little control box to go with it, with a phone dial and a 9V battery, and found a source of paper tape and ink. So it can be demoed. If it ever is used in a court appearance or legislative testimony, that would be better than it sitting in a box.
This doesn't resonate with me. I see companies adding more sloppily written features with AI. I see more bugs in the software I use, not less. While it's plausible that software is getting both buggier and more secure, I suspect those two move in the same direction not opposite.
My guess is that we're getting better at finding _existing_ security issues with AI (and thus fixing those issues), but simultaneously adding more insecure surface areas _at a faster rate_.
Over the long term this state of play could change, and IC/LEO organizations could start leaning more on application vulnerabilities than on platform RCEs. But the action would probably still coalesce around a couple of app-layer targets that could themselves be hardened.
I think this is a side-effect of the old product management process adapting to AI. We (as an industry) were never very good at defining features rigorously, because there was a smart human in the loop who had to implement the feature and could push back on sloppy definitions.
Whereas security bugs are easy for the LLM to define and fix.
That said if companies want to "ship ship ship fast", then yes even AI can produce bugs or regressions if not carefully reviewed by the human.
These days we're generating multiple times more code than we were writing before. That means a similar multiple of opportunities for bugs to be introduced - so the ability to automate security review is more impactful in proportion to that.
How do you know? You might be adding (latent) bugs every time your LLM fixes one for you.
You should question your ability to see any bugs on YOUR side.
It's like two parallel worlds, that exist in the same place at the same time, but somehow don't cross.
Anyways, while there I attended a little roundtable on software security. It was me, representing a small unit from the Air Force, some dude from Google, and like 15 game devs.
Despite only being a dev of 5 years at that point, I was SHOCKED at the lack of knowledge on software security. Even simple concepts seemed completely foreign to the game devs, though the Google dude seemed to have a really solid understanding of security.
Obviously game devs and website devs and all kinds of devs have different focuses, but it just blew my mind that out of all the topics there I might’ve been considered a comparative expert in, security was somehow the one. I wasn’t sure if that was a major plus for military devs or a major concern for the other devs, but now I’m starting to learn in the latter direction.
As an end user, security in game development seems to hit a minimum is the early 2000s.
I recall playing EverQuest and using ShowEQ on a Linux machine on the same network as a proxy to silently eavesdrop on the traffic to show a map of the game with all the hidden/obscured/visible stuff all present. They either never encrypted that traffic or I quit playing before they did.
As multiplayer games started to become the default, netcode improved quite a bit and basic encryption was implemented - but I don't recall a single multi-player game, ever, that was free of hackers when playing online.
It feels like over the years the issue moved from remote exploitation to hiding processes on the user's machine. That has lead to kernel-level anticheat systems. I'm unsure of the effectiveness as when they started to become common I moved all of my gaming to dedicated hosts because I wasn't willing to give that level of access to my "real" computers. That said, I've certainly not noticed a decrease in the perceived number of cheaters.
These days, as far as I know - and to be clear, this isn't an area of deep interest for me - I'm not worried about my gaming accounts being compromised through technical means. It feels like that sort of security is a solved issue overall, although I suppose it's also possible that other forms of exploits have simply gotten easier/cheaper.
...ish. The solution is false positives and a permanent underclass. You can't play those games unless you're on windows and you grant root to the anti-cheat.
I don't care much about that, but i do care about people being unemployable because some amorphous machine doesn't like the way they comb their hair.
Last century, if you grew up five to a room then at least you knew why you were marginalised. It wasn't just, but it was legible. Now, some of us are living in Terry Gilliam's Brazil.
BTW, I highly encourage all EU citizens to prepare Cyber Resilience Act complaints for September 11, 2026 when the law kicks in ;-)
[1] https://www.reddit.com/r/blackops2/comments/1v3xowq/just_ent...
Google has probably the best security team in the world, and they need to. The military deals with state actors by definition.
Gamedevs need to ship. I'm not saying they don't care about security, but short of some showstopper critical problem, it's not a thing and doesn't need to be.
It doesn't matter if your game is secure if nobody plays it lol
Besides stopping cheaters, in almost all conceivable cases, security doesn't make a game better.
I could see a future where the government is replaced by the software system which has the fewest security flaws, simply because it is the last thing left standing as everybody hacks everybody else. We end up with a Matrix-like or Terminator-like future where humanity now lives in service of the machines.
we live in a world where the government can't even do much about illegal drug markets anyone can access by downloading a piece of software.
if they pass laws that mandate backdoor access and block software which doesn't conform more and more people will move to the dark networks.
and if they effectively block the dark networks (in the limit they will have to block all encrypted communications) then we will be living in a tyranny.
freedom is messy. accept that digital crime can only be solved when the criminal makes a tangible mistake. LLM's will be building profiles on criminals to help with identifying mistakes.
Still?
The cops will find a way, the criminals will find a way. It's ultimately people v. people with access to the same level of technology.
One of the author’s blind spots here is the concept of “digital sovereignty”. The US is continuing to ban more and more Chinese-made hardware out of fear that the Chinese govt has installed backdoors in them… which you could interpret as an admission that the US does exactly that with American made products. Globalized supply chains are, erm, complex, and few if any companies are really going to be able to achieve “digital sovereignty” with hardware. But with software it’s actually plausible, though obviously hard. Whether or not the feds have actually installed backdoors in Microsoft Outlook, foreign govts are rightly concerned that they have, and are increasingly pushing to avoid US made software for simple national security reasons.
In a nutshell, what I’m saying is “They shouldn’t do either” is at best a platitude and at worst a distraction preventing critical thought.
Governments should behave. I know they don't, but they should, and the population should do everything in their power to force them to. What other choice do we have?
Please demonstrate your powerful faculty of critical thought and explain what we should do instead.
> Thus: over the next two years, major pieces of software are likely to run out of remotely-exploitable bugs.
> While I think this is great, for law enforcement and offensive intelligence agencies, it’s going to be a nightmare.
> So what do we do about it? I honestly have no idea. [...] it’s just occurring to me that we’re on a long greasy slide to a place that will look different than where we are today. [We’re] just going to have to hope that this time we make the right choices.
So is a backdoor worse than a security vulnerability? I don't know but that is what this article is about.
I am just beside myself at such an idea that people looking to feed the prison machine cannot as easily find excuses to turn normal citizens into prison feed.
Just super sad guys.
What felonies are those normal citizens being convicted of that's landed them in prison?
I get the basic 'not wanting everyone's comms to be monitored' part. I think there's an important conversation to be had because indeed, that can't be the answer.
But it sounds like you're saying most people who are convicted of felonies based on a jury unanimously being convinced by the electronic evidence against them... those people are unjustly in prison?
Certain people are arrested and detained far often than others, because of who they are and not what they did.
Many positions in the justice system prioritize conviction rate above all else.
There are many problematic relationships between legislators, law enforcement and the for-profit prison systems.
Our position in this list should make anyone afraid:
https://en.wikipedia.org/wiki/List_of_countries_by_incarcera...
If LE decides you should be "taken off the streets", regardless of if you did the crime you are accused of, you are likely going to prison for something unless you are wealthy. If you are wealthy, they may not bother. All very interesting.
Why would the "best and brightest" work for governments that pay a fraction of market price?
I don't understand how you can both argue for that law enforcement (and intelligence) agencies will force others to implement intentional backdoors AND also everyone will be using AI to find and secure ALL potential holes in the software so there won't be any vulnerabilities anymore.
Wouldn't one AI or another detect this deliberate backdoor and report it, as it'll look just like any other security vulnerability, the only difference being the intention?
I have respect for the author so I feel like I probably misunderstand something from the overall text rather than I somehow have a better perspective on this topic that the author knows very much more about than me. I felt like I nodded along all up until "So how is this a problem?" and now I'm not sure I understood correctly.
It's seems like an odd-duck for sure, and I doubt it's a realistic proposition. I do think "perfect encryption for dummies" is all well and good until organized crime organizations are able to challenge the government in certain regions of our country.
All of this sends us deep into the realm of political philosophy, the nature and purpose of governments, and the freedom vs security tradeoffs we live with.
I listened to the latest Plain English podcast this morning, which was explicitly about the potential for a ransomwarepocalypse in the coming years, as open models let any tom, dick, or harry become capable of a plug-and-play ransomware attack, instead of that being left to the realm of professionals. It's a bit nerveracking to think about every nigerian prince scam suddenly becoming a sophisticated attack on your local water sanitation system.
I think I can kind of see that from the text re-reading it, it's kind of hidden though and not so explicit if this is what he is trying to communicate. Thanks for giving me a new perspective to read it with!
That's precisely the author's point: deliberate backdoors will be more adversary-exploitable than ever before, but the demand for such from law enforcement agencies is likely to ratchet upwards.
But that's one step after, I'm trying to understand how those backdoors even end up in software if everything gets automatically reviewed by the people working on these codebases? Wouldn't things like these be flagged by systems other than the developers tasked by the agency to implement it? How can law enforcement actually get these things implemented without big parts of the engineering team not seeing warnings about it happening?
If you're a US company building an app/device/etc. such that an intelligence agency like the CIA or FBI would want access to the data in that product which is normally secured, then they're not going to try to sneak it in there without your development team knowing. They're going to have a meeting with the owners of the company and say, "hey, we'd really like you to implement this backdoor for us, and in return we won't cause you in problems."
Note that this does certainly already happen a lot, but it's also not something that can happen across the board (like the author points out). Apple, being one of the largest companies in the world and who has one of their biggest selling points being their security, has explicitly refused to do this to the point that the intelligence agencies couldn't break into an iPhone until another company found a way to do so.
>I'm trying to understand how those backdoors even end up in software if everything gets automatically reviewed by the people working on these codebases?
The people working on these codebases are "in on it." Of course, we're talking backdoors which are very subtle, target very minimal infrastructure, and are known about by very few people. But, like I said, companies are currently shipping products with backdoors in them knowing they exist already. AI doesn't change that dynamic.
>Wouldn't things like these be flagged by systems other than the developers tasked by the agency to implement it?
The only people who would have access to the systems that can even be flagged by this stuff would be people who would know about it. Keep in mind that the scale we're talking here is massive. Think about how software development works at companies like Apple, Microsoft, Google, etc. There are devs working in offices all around the world where they only ever have access to a fraction of the code that company owns. These companies are very capable of keeping their stuff locked down. It's a necessary component of their work.
>How can law enforcement actually get these things implemented without big parts of the engineering team not seeing warnings about it happening?
Hopefully my explanation at this point is clear, but just to be concrete: backdoors are, by design, very hard to detect. That doesn't mean they're just sneakily written code that humans don't notice as they read over it, but, instead, they're very subtle implementations in very specific parts of huge systems that are already locked down to the point that the number of people who even have access to those portions of the systems are very limited. These agencies don't slip in backdoors without anybody noticing; they convince the minimal number of people needed to know about it to implement it. Again, we're talking about a meeting between the directory of a three letter agency and a CEO, where the CEO then directs the CTO to implement the backdoor who then instructs the handful of very high-ranking engineers to do so.
AI systems in these companies may very well flag these backdoors to the people who already know they exist, then these people can tell the AI "hey, those are their on purpose, so just move on," and the other 99.99% of the company will never know they exist.
I suppose it's important to emphasize, again, that these systems are incredibly massive and complex and most people at these orgs don't have any access to most of these systems, so it's not like you can expect an intern running BugBot across a repo and expecting it to find a backdoor.
I would imagine most big companies, like Microsoft, have dozens of CIA and FBI plants in their organizations. Agents who are legitimate software engineers, tasked with acquiring intelligence and undermining security.
And then you say, loudly and publicly, "all the source code of our software is public, and our binaries use binary transparency so it's not possible for us to build a binary that doesn't match the source, and people will rapidly find this in our source code at which point we go out of business and you stop having a product to backdoor in the first place".
(And you move out of the US.)
And since this is a foreseeable future, you should start acting now to prepare for that future.
In fact, we're increasingly seeing a desire to build the "backdoor" directly into the software, e.g. mandatory age verification, client-side scanning, etc.
The author agrees with you and addressed this point. The US forcing backdoors into its own systems ("own": Those for sale and distribution within the US) would create vulnerabilities making those systems weaker.
Like if we were willing to stop adding new code and just have a small secure code base, AI could maybe help us find all the vulnerabilities in that code base.
But people have consistently been unwilling to do that. Like if we were willing to stop adding code we could have stopped decades ago and done SQLite level testing everywhere and probably have found almost all the bugs already.
Now it’s just as you said- asking AI to red team your app will get you pretty far.
heh. long greasy slide. It really does feel like that.
