A man used Compaq's DriveLock to protect his homemade porn,
only to have the FBI retrieve it when he was arrested on an
unrelated charge.
Michael Alan Crooker sued Circuit City, Compaq, and Microsoft for
selling defective security software when the FBI forensics
lab uncovered his porn preferences following his arrest for
selling a rifle with a silencer. Circuit City for telling him the
software would work, Compaq for leaving a hole, Microsoft for not
erasing IE's browsing history securely when he configured it
to discard history/cache/whatnot.
The DriveLock software allows you to set a master password that
will unlock the disk if someone forgets the user password. This
may or may not be the same as the master password in the ATA
spec.
The "information" from the press leaves all these
possibilities open:
He left the master password at its default
The FBI used the ATA master password, which they could ask
the drive manufacturer for, assuming it's one that hasn't
leaked out already.
The FBI cracked the case and copied the drive in a cleanroom.
The ATA password doesn't encrypt the disk, it just tells the
controller to refuse to talk to anyone.
The FBI moved the drive to a new controller card. I thought
that threw off calibration data, but some sources say it works,
which implies that the password lives on the controller card.
Compaq left a back door and is still lying about it.
What I find disturbing is that the man, who was charged with a firearms violation (i.e. NOT a computer violation) had his computer seized and scanned.
Which raises the question in my mind "Under what legal logic did the FBI seize his computer?" Were they looking for records of his transactions? If he had kept his transactions on paper, in a filing cabinet, with his other papers (tax records, receipts, warranties, old love letters) could they have taken the whole filing cabinet?
In short, what ever happened to "secure in their person and papers"?
I expect this to happen more and more in many countries.
Anyone who is suspected of a crime will have substantial amounts of their property seized. Computers, CDs, digital camera's, any equipment that could be used to store information. With embedded computers everywhere this could end up meaning a lot of stuff.
Have you ever witnessed a search warrant being executed?
When I was a teenager I saw the aftermath of a DEA search & seizure in a house of an accused LSD trafficker in Atlanta GA. If memory serves the damage was around 20~30% of the value of the house. Sheet rock was ripped from the walls, carpet removed, major appliances disassembled, and all electrical fixtures removed.
More recently I saw photos of damage made during the search & seizure of the home security equipment belonging to the man who recorded an incident with the police on his front porch, when they came to speak with him about his son. All of the sensors had been ripped out & off and the wiring simply cut.
Then there is the incident of the gun collector whose estranged wife made unfounded accusations against him... he still doesn't have the entire collect returned and many of the pieces that were returned were returned damaged.
Finally I watched the unfortunate search of a co-worker's house for child porn. This, from a detached perspective, was forceful lesson on how much the government, at least enforcement, is not your ally. There is a vindicative quality about the way they go about things... a cultivated indifference to the damage they do. There is also this backhanded reveling in the lack of their knowledge... the idea that because they do not know about computers everything that may have circuitry or wiring inside is seized. The large screen television was seized (and then broken) but backup tapes were not. The VCR was seized along with all the VCR tapes but the CD & audio tape collection was ignored. The safe was seized & drilled despite the combination being written down and tapped to it.
I read about this particular incident last year or so when Bruce wrote about it. He was right then and he's still right.... these people are the sorts of people that you are not likely to be sympathetic with but this doesn't matter. In order for anyone's rights to be upheld and respected everyones rights must be respected.
As a side note...given how hard good crypto is to achieve anyone buying into this sort of thing is bound to be disappointed.
A final observation: Many folks in the tin hat crowd has made suggestions that inside the government there was some sort of decision making process which sounds like this: "Do we want to prosecute this so much that we a willing to disclose our ability to overcome the cryptology used" I think this case highlights the flaw in this line of thinking.
One of the important points here was actually that if you don't have crypto, you can't count on anything. The ATA security lock simply means the controller won't talk to the host until it gets the right password. If he'd encrypted his disk, instead of "lock"ing it, he would have had a different set of problems (look at the support boards for full disk encryption products, scary).
This sort of thing won't go away untill law enforcement is required to make full restitution for any damage in all cases. It would be wise to require that even if the evidence leads to a conviction, otherwise they will have way too much incentive to plant evidence in every search just to avoid paying.
A few years ago here in Atlanta there were a few cases that appear to be people 'punishing' neighbors they didn't like by phoning in false drug tips anonymously knowing that the 'red dog' squad would be sure to destroy their home as a result. Since anonymety was assured, there could be no negative consequences for these very bad neighbors.
Until we as a society really consider the consequences of being accused of a crime and take steps to restore the innocent, we are just deluding ourselves when we presume that innocent people have nothing to worry about. It's far to easy for an innocent person to find themselves practically homeless, jobless, and saddled with huge legal bills just from the process of being accused and found innocent. Unfortunatly, the same protection will have to be extended to the guilty. Otherwise we'll start seeing a lot more wrongful prosecutions in an attempt to avoid paying a staggering bill for damages.
At the heart of this is a failure to presume innocence in the first place. While suspicion of guilt does require searches for evidence and in many cases, incarceration, there is a duty to minimise the inherant harm of those actions unless/until the citizen is found guilty in a court of law.
Drive manufacturers need to test the functionality while developing, therefore have controller firmware that doesn't fully implement the ATA spec. This "developer" firmware does everything the full-spec firmware does, including read the password, generate the checksum, etc. but it doesn't lock the firmware if a password is found. It just says "here I will lock the firmware until the ATA UNLOCK WITH PASSWORD command is sent".
I.E. - Debug firmware.
The FBI either has copies of this, along with a utility to either burn or replace the firmware on the drive; and/or has contacts with all major drive manufacturers and can get updates on short notice.
Use DriveLock, get humiliated
A man used Compaq's DriveLock to protect his homemade porn, only to have the FBI retrieve it when he was arrested on an unrelated charge.
Michael Alan Crooker sued Circuit City, Compaq, and Microsoft for selling defective security software when the FBI forensics lab uncovered his porn preferences following his arrest for selling a rifle with a silencer. Circuit City for telling him the software would work, Compaq for leaving a hole, Microsoft for not erasing IE's browsing history securely when he configured it to discard history/cache/whatnot.
Summary of the Crooker/DriveLock case for nontechnical people at my blog.
Not sure why this hit the news just now, unless it's because Circuit City and Compaq settled. Covered almost a year ago on Bruce Schneier's blog.
Accurate information is, as usual, not forthcoming. It looks like Compaq is using the ATA command to lock a disk with a password, which stores the password in a controller register or in the hidden system maintenance cylinder, depending on who you listen to. There's a limit of 5 password attempts per power cycle, and apparently no way to read the password. According to HP, There is no "back-door" that can be used without the correct password and unauthorised individuals will find the data on your hard drive impossible to access. See also Compaq's white paper about DriveLock.
The DriveLock software allows you to set a master password that will unlock the disk if someone forgets the user password. This may or may not be the same as the master password in the ATA spec.
The "information" from the press leaves all these possibilities open: