The head of the FBI’s science and technology division has admitted what no other agency official has acknowledged before—the FBI sometimes exploits zero-day vulnerabilities to catch bad guys.
The admission came in a profile published Tuesday of Amy Hess, the FBI’s executive assistant director for science and technology who oversees the bureau’s Operational Technology Division. Besides touching on the use of zero-days—that is, attack code that exploits vulnerabilities that remain unpatched, and in most cases are unknown by the company or organization that designs the product—Tuesday’s Washington Post article also makes passing mention of another hot-button controversy: the FBI’s use of stingrays. As reporter Ellen Nakashima wrote:
One area of controversy is the bureau’s use of cell site simulators, or Stingrays, which mimic cellphone towers to elicit signals from cellphones in an area, including from innocent bystanders. The FBI has long been secretive about the tool’s use, and has even made state and local law enforcement sign nondisclosure agreements.
Though the agreements typically state that the local agency “will not . . . disclose any information concerning” the equipment, Hess insists that the FBI has never imposed a gag on local police. For the record, she said, the bureau does not object to revealing the use of the device. It’s the “engineering schematics,” details on exactly how the tool works, that the FBI wants shielded, she said.
Another group that remains shrouded is OTD’s Remote Operations Unit. There, technicians with a warrant hack computers to identify suspects. Euphemistically called “network investigative techniques,” that activity has stirred concerns similar to those raised with the use of Stingrays.
For one thing, the warrant applications do not describe the technique’s use in detail. So judges may not really understand what they are authorizing. Hess said that agents can describe the process more fully to a judge in closed chambers. That’s if the judge knows to ask.
Privacy advocates also worry that to carry out its hacks, the FBI is using “zero-day” exploits that take advantage of software flaws that have not been disclosed to the software maker. That practice makes consumers who use the software vulnerable, they argue.
Hess acknowledged that the bureau uses zero-days—the first time an official has done so. She said the trade-off is one the bureau wrestles with. “What is the greater good—to be able to identify a person who is threatening public safety?” Or to alert software makers to bugs that, if unpatched, could leave consumers vulnerable?
“How do we balance that?” she said. “That is a constant challenge for us.”
She added that hacking computers is not a favored FBI technique. “It’s frail,” she said. As soon as a tech firm updates its software, the tool vanishes. “It clearly is not reliable” in the way a traditional wiretap is, she said.
The Post also includes counterpoint from privacy advocate and American Civil Liberties Union Principal Technologist Christopher Soghoian. He referred to Hess as the “queen of domestic surveillance” and opines: “if it’s high-tech and creepy, it’s happening in the Operational Technology Division.”
The FBI’s secrecy surrounding stingrays has been well documented. And the controversy over the use of zero-days by governments has also generated its share of headlines. Both issues are controversial, in part because they have the potential to harm vast numbers of people who aren’t suspected of committing any crime. That’s because stingrays generally intercept all cell phone communications in a given area, not just those of a drug or kidnapping suspect. Paying large sums of money to buy zero-days, meanwhile, creates powerful incentives for governments to keep the underlying vulnerabilities secret. FBI officials have long attempted to distance themselves from such topics. Today, they inched slightly closer.
SOURCE: Dan Goodin | Ars Technica