It isn’t just detective work, it is personnel with the skills to identify and pursue likely evidence.

Digital forensics is way outside typical leo training and believe it or not you can make a lot more money in the private sector with IT training.

Local, state and federal case loads get backlogged behind, leaving the highest priority cases to get staffed.

> Digital forensics is way outside typical leo training

That's the problem: attempting to prevent important new technology (actually-secure encryption) from being used is not a substitute for updated training that provides "typical leo" with digital forensics skills that are increasingly needed.

Susan Landau's 2016 testimony before the House Judiciary Committee regarding Apple's encryption on the San Bernardino shooter's iphone:

>> "Instead of embracing the communications and device security we so badly need for securing US public and private data, law enforcement continues to press hard to undermine security in the misguided desire to preserve simple, but outdated, investigative techniques."

>> "We need 21st century techniques to secure the data that 21st century enemies—organized crime and nation-state attackers—seek to steal and exploit. Twentieth century approaches that provide law enforcement with the ability to investigate but also simplify exploitations and attacks are not in our national security interest. Instead of laws and regulation that weaken our protections, we should enable law enforcement to develop 21st century capabilities for conducting investigations."

>> "Developing such capabilities will involve deep changed for the Bureau, which remains agent-based, not technology-based."

While this is easy to agree to broadly, what exactly does she intend that these "technology-based 21st century capabilities" are? If she's talking about something like PRISM, are we going to be any happier with that solution?

That would contradict with her overall disagreement on backdoors in encryption systems.

I think, she was referring to classic investigative measures using modern tools and infrastructure.

I wonder if this would be true if the War on Drugs did not exist. Or if the CIA hadn't played a large role in spreading crack cocaine throughout Los Angeles to fund a proxy war with Iran, leading to a massive criminal element and subsequent rapid militarization of police and refocusing of FBI, CIA and police resources towards non-violent, victimless crimes.

What stops LEO from contracting with a digital forensic company or consultancy?

They do this at the federal level a lot and there is a lot of money in it.

Cost and scalability. LEA and agencies cannot use these resources enmass, and yet they want the results of such.

Thompson Reuters provides ICE with information for immigration enforcement.

And it's crystal clear and obvious in this case that it doesn't matter. The man shot a bunch of people, and was subsequently killed to stop his slaughter. There is no doubt to his guilt. There is no case to build. While the public may wish to know more about the shooters motives, that's not something the public or any law enforcement agency needs to keep people safe.

This seems over-confident. Other people might have been involved. If so, there could be a case to build. Hard to say without investigating?

> It isn’t just detective work, it is personnel with the skills to identify and pursue likely evidence.

I think that at this point of the 21st century, this is 100 % detective work.

This guy's (now deceased) sister drove him to the location. So she was in on it, too. (Why she's not included as a perpetrator in discussions about this event is odd.)

I'm sure he left evidence that goes well beyond his own phone if he was planning and plotting with others. They should have no trouble piecing this together with or without his phone.

Uh, the sister that was shot? What leads you to believe she was in on it?

I think it is more appropriate to refer to them as his brother https://www.out.com/news/2019/8/08/dayton-shooters-slain-bro...

It is quite up for debate whether it is more appropriate or not. Your view may not necessarily be the most correct. That is not a discussion to be had on Hacker News, regardless.

I see this a lot. People who are known to be trans in the wider LGBTQ+ community die, then their family deadnames them to the press, and people come out of the woodworks to defend the family and the press while ignoring the wishes of the person who died.

Sometimes, like in this case, it's complicated because they're only out to a few people. I would still rather err on the side of what close friends say rather than family. The family probably had no idea. They rarely do until someone's ready to come out to everyone.

> I would still rather err on the side of what close friends say rather than family.

Yeah I was thinking of the same. If they came out to their friends, it's probably who they wanted to be and felt most comfortable sharing with. It was also how they would have liked to have been remembered.

I have no knowledge here, but it seems like you're saying that journalists should out people who aren't out to their families? Doing that without having clear evidence of the person's intent seems it might be an invasion of privacy?

I'm saying it's complicated. Sometimes there is no clear right way.

Maybe they can’t build a profile via ad tracking, because ad tracking isn’t as invasive/doesn’t collect data which can be tied back to a specific name.

Well, everyone is talking about how excited they are to violate the 2nd Amendment. Might as well violate the 4th, too, and maybe the 1st and 5th while we are at it. All in the name of safety.

I would argue that all of the Amendments have always been subservient to “national security” (whatever that means in any age), for better or worse.

Also, I have yet to hear anyone argue that we should “violate” the 2A, but I have heard lots of 1A discussion about how we could frame laws or discuss whether 2A is worth keeping in its current state.

> it is, however, harder to automate

If Apple does not give you the tools to decrypt messages on their phones, doesn't that make it "impossible" to automate, where automate is defined as any version of "decrypting the data on the phone"?

One thing to keep in mind is that really only two things Apple can do. The first is to release a modified and signed version of iOS to LE agencies that has any timeouts removed to allow them to try to bruteforce the passcode locks. If a user uses a significantly long password instead of a passcode, this becomes way less effective.

The second thing is to log iMessage data on the server-side (since it has to be decrypted at some point). This would allow them to produce it, but would miss any apps installed on the phone used for alternative communication.

I don't like to see this so much as Apple refusing but there really isn't a way for Apple to enable easy full access without a backdoor, which is an unrealistic expectation.

>The second thing is to log iMessage data on the server-side (since it has to be decrypted at some point).

iMessage is end-to-end encrypted, so that's also not an option. Apple would have to inject a key they controlled into a user's list of device keys. (Which they can do, and the UI doesn't notify users if it were to happen.)

Thanks for the clarification. I guess iCloud backups could then be a viable option then?

Yes, if iCloud backups are enabled, Apple does then have the keys required to decrypt backed-up iMessage messages.

That seems to completely defeat the point of it being end to end encrypted in the first place.

True, but these days you can disable iCloud backups without giving up all that much. (it also re-keys Messages in iCloud when you turn off backups)

Keychain, messages, and health data are all E2E encrypted and synced to iCloud.

By not doing iCloud backups, you're basically only giving up backups of app icon placement, home/lock screen background images, app data that isn't otherwise synced via iCloud or the app's dedicated sync service, and a handful of phone settings.

You can opt for the occasional iTunes backup to preserve those infrequently changing elements on the phone, and not have to compromise on recovery point for more important data like messages and security creds since all of that is synced in real time.

How much longer will iTunes be around?

The backup function is moving to Finder before iTunes disappears entirely.

That's the whole joke. Apple pushes E2E in advertising but fails to mention how by default it's all """backed up""" in their cloud where they hold the keys. It's ridiculous.

My understanding is the passcode and timeout behavior is on dedicated hardware that's tied to the OS level encryption. It's not possible (or maybe just not feasible) to replace or update this hardware.

They wouldn't be able to install the new OS over the old one without the passcode, though.

Not sure if things are in a similar state now, but it looks like the FBI and Apple had reason to believe something like this could be done.

https://en.wikipedia.org/wiki/FBI%E2%80%93Apple_encryption_d...

Although it seems like it would be a RAM-only thing

I suppose that's true, potentially they could release a new firmware or OS that would enable this in the future.

I believe the point that OP is making is that the encrypted data on our phones is data historically would never have been available to law enforcement, as it simply wouldn't have existed. Then as now law enforcement can investigate but the investigative process is impossible to automate. On the other hand giving the government access to all the data that we now store about ourselves would enable automated forms of law enforcement that, in the past, were just not possible (this is what we're seeing in China).