Best Buy Bans Huawei Phones Despite Zero Public Evidence Company Spies On Americans

from the hypocritical-protectionism dept

A few years back, you might recall that there was a period of immense government and media hyperventilation over allegations that Chinese hardware vendor Huawei spied on an American consumers. Story after story engaged in hysterical hand-wringing over this threat, most of them ignoring that Chinese gear and components are everywhere, including in American products. So the government conducted an 18 month investigation into those allegations and found that there was no evidence whatsoever to support allegations that Huawei spies on Americans via its products. One anonymous insider put it this way at the time:

"We knew certain parts of government really wanted” evidence of active spying, said one of the people, who requested anonymity. “We would have found it if it were there."

What inquiries into this subject do tend to find is that U.S. networking companies like Cisco, terrified by the added competition from Chinese network vendors, are really effective at scaremongering gullible and non-tech savvy lawmakers into supporting a protectionist stance against Huawei. The hypocrisy of "protectionism is only bad when somebody else does it" is compounded by the fact that Snowden docs revealed that the NSA hacked into Huawei starting back in 2007 to steal source code and...plant backdoors in Huawei gear to spy on people around the world.

In an ideal world, numerous lessons would have been learned from this whole experience.

But this is America! Fast forward to the last few months, and the narrative of Huawei as a villainous, unchecked Chinese spying apparatus is once again all the rage, with nobody apparently heeding the lessons from just a few years ago. As we've been noting, both AT&T and Verizon (who not only help the NSA spy on everyone but have been caught giving advice on how to best tapdance around privacy and surveillance laws) were recently pressured to kill looming business deals with Huawei based on unsubstantiated, unpublished and vague allegations of spying.

While Huawei has some presence here (they helped Google build the Nexus 6P), they'd been making some solid inroads at AT&T and Verizon on deals that would have let them strike major smartphone partnerships. AT&T was just hours away from announcing one such deal at CES earlier this year, when it suddenly announced it would be scrapping the deal. AT&T didn't say why, but later reports indicated it was because of pressure from a handful of lawmakers on the Senate and House Intelligence Committees (again, AT&T has oodles of NSA contracts it would obviously like to protect).

Again though, nobody was able to offer concrete evidence of said spying, nor did anybody seem to remember we just went through this a few years back and found no evidence of Huawei wrongdoing. Fast forward to this week, when Best Buy announced it too would be banning Huawei products from its store shelves (warning: obnoxious autoplay video):

"Best Buy, the nation's largest electronics retailer, has ceased ordering new smartphones from Huawei and will stop selling its products over the next few weeks, according to a person familiar with the situation. Best Buy made the decision to end the relationship, the person said. "We don't comment on specific contracts with vendors, and we make decisions to change what we sell for a variety of reasons," said a Best Buy spokeswoman."

Few news outlets seem to spend too much time worrying about the fact that these decisions are being made completely non-transparently, with no hard evidence being offered to justify them. Again it's not impossible that Huawei helps the government spy, but given the volume and duration of these accusations, you'd think that somebody would be able to drum up a shred of public evidence supporting them. Regardless, protectionism is playing a pretty major role here one way or another, and you'd be hard pressed to find any American tech press coverage that so much as breaches that already documented reality.

While it's obvious that China spies on America, it certainly has an ocean of ways to do so outside of Huawai. Chinese hardware is utterly everywhere in America, including inside of most U.S.-made networking gear and smartphone hardware. And Americans also have a voracious appetite for internet of broken things devices, most of which lack even the most rudimentary privacy and security safeguards. Spying on us at scale doesn't really even require Huawei's help. We volunteer ourselves routinely for the duty courtesy of our collective obsession with "smart" televisions and other easily-hacked devices.

It's routinely amazing how the same individuals and organizations who preach endlessly about the need for healthy, open competition and malign China endlessly for protectionism, are suddenly OK when we're the ones dressing up protectionism under the thin veneer of national security. Similarly there's an endless roster of individuals engaged in all manner of face-fanning when foreign governments spy on us, but don't so much as blink when it's revealed we illegally hack into companies to plant backdoors or intercept U.S. networking gear deliveries for the same purpose.

And again, this hypocrisy is routinely made worse by a U.S. (and Canadian) tech press that's utterly oblivious to how nationalism skews their reporting and allows them to be easily manipulated by companies simply eager to avoid competition. If you're a tech reporter it is, shockingly enough, still your job to provide hard data--even when reporting on murky allegations against "enemies of the state" you may not personally be a fan of.

Filed Under: china, competition, moral panics, surveillance
Companies: best buy, cisco, huawei

FBI Documents Show More Evidence Of Agency's Sketchy Relationship With Best Buy's Geek Squad

from the squadders-installing-FBI-bloatware dept

Thanks to an FOIA lawsuit, the FBI has finally started handing over documents to the EFF detailing the federal agency's "partnership" with Best Buy Geek Squad employees. The too-cozy-to-be-Fourth-Amendment-compliant relationship was uncovered during discovery in a child porn prosecution. Produced documents showed the FBI not only paid Geek Squad members to search for child porn, but it actively engaged in recruiting efforts at Best Buy locations.

The problem with this relationship is the relationship. And the money. While tech repair personnel are expected to turn over discovered child porn to authorities, the active efforts of the FBI alter the incentives, pushing Geek Squad members towards digging through customers' computers for illicit material, rather than simply reporting what they come across during the course of their work.

The FBI wants to keep this relationship with Best Buy intact. It also wants to keep the evidence provided by Geek Squad members. While private searches can be used to predicate investigations, paying people to look for illegal material when their job is to repair devices turns this into a proxy search for federal law enforcement. That's not permitted under the Fourth Amendment and the FBI certainly knows it. The files central to this prosecution were discovered in unallocated space, making it unlikely they were discovered during routine repairs. It would imply a Geek Squad member went digging for illicit material, motivated by a possible payout from the FBI if anything was found.

The documents obtained by the EFF provide further evidence the FBI paid Geek Squad members to perform searches for it. They also show this relationship dates back at least a decade, with Best Buy doing its best to become an unofficial branch of the FBI.

The documents released to EFF show that Best Buy officials have enjoyed a particularly close relationship with the agency for at least 10 years. For example, an FBI memo from September 2008 details how Best Buy hosted a meeting of the agency’s “Cyber Working Group” at the company’s Kentucky repair facility.

The memo and a related email show that Geek Squad employees also gave FBI officials a tour of the facility before their meeting and makes clear that the law enforcement agency’s Louisville Division “has maintained close liaison with the Geek Squad’s management in an effort to glean case initiations and to support the division’s Computer Intrusion and Cyber Crime programs.”

This relationship has been the basis for several FBI investigations -- all predicated on actions that stray close to the edge of the Fourth Amendment, if not going past its boundaries completely.

Other documents show that over the years of working with Geek Squad employees, FBI agents developed a process for investigating and prosecuting people who sent their devices to the Geek Squad for repairs. The documents detail a series of FBI investigations in which a Geek Squad employee would call the FBI’s Louisville field office after finding what they believed was child pornography.

[...]

Some of these reports indicate that the FBI treated Geek Squad employees as informants, identifying them as “CHS,” which is shorthand for confidential human sources. In other cases, the FBI identifies the initial calls as coming from Best Buy employees, raising questions as to whether certain employees had different relationships with the FBI.

More information about this misuse of private searches will likely find its way into open court and the public domain in the next several years. The FBI is still withholding several files, which probably further corroborate the agency's incentivizing of invasive device searches. And Best Buy is likely not the only company offering both computer repairs and FBI-prompted "private searches" The EFF notes the FBI refuses to confirm or deny it has a similar relationship with other retailers.

The EFF is headed back to court to challenge the FBI's withholding of these documents, so additional documents may be produced sooner than later. But if the FBI can convince the court its payouts to tech repair staff are investigative methods that would be compromised if discussed publicly, we may see nothing at all. But it also has to convince another court its use of Best Buy employees as informants is kosher under the Fourth Amendment. And it has yet to do that.

Filed Under: geek squad, private law enforcement, surveillance
Companies: best buy, fbi

EFF Sues FBI For Refusing To Turn Over Documents About Its Geek Squad Informants

from the best-buys,-best-friends dept

A child porn indictment in California has led to a full-fledged examination of the FBI's use of "private searches." Private searches, performed by citizens, can be used to instigate investigations and obtain warrants. In this case, the private searches were performed by Best Buy Geek Squad members, who came across alleged child porn images while fixing the defendant's computer.

Private searches during computer repairs are normal. But they're not roughly analogous to searches performed with a warrant. Companies that repair electronic devices are legally required to report discovered child porn to law enforcement. What they're not supposed to do, however, is dig through devices they're repairing in hopes of finding something illegal.

Most techs don't go looking for child porn. But the FBI's close relationship with Best Buy turned private searches into searches performed by paid informants. Once government money is introduced into the equation, the search can no longer be considered "private." The introduction of cash rewards also skews the incentives, possibly encouraging Geek Squad members to spend more time looking for illicit images than focusing on the repair job at hand.

Documents uncovered in this case strongly suggest the FBI has been using Best Buy repair center techs as confidential informants, paying them for their discoveries while claiming these warrantless, secondhand searches are nothing more than completely legal "private searches."

The EFF wants to know what the FBI knows about its long-running Best Buy partnership. The FBI isn't nearly as interested in making this information public. It sent a FOIA request to the FBI in early February. The FBI's first response was a Glomar. From the EFF's FOIA lawsuit [PDF]:

By letter to Plaintiff dated April 18, 2017, the FBI denied EFF’s request for agency records. The FBI stated, inter alia, that “it is the FBI’s policy to neither confirm nor deny the existence of any records which would tend to indicate or reveal whether an individual or organization is of investigatory interest to the FBI.”

The EFF immediately appealed this determination. Since then, the FBI has yet to respond. The EFF's lawsuit seeks a better response to its FOIA request, as well as a ruling finding in favor of its requested fee waiver. The EFF's decision to move forward with a FOIA lawsuit is the unfortunate result of the government's disinterest in fulfilling its FOIA obligations. There's hardly any action a citizen can take to speed up this process. Lawsuits are only marginally better than firing off reminder emails. Unfortunately, they're also a lot more expensive.

There's a good chance these documents -- should they ever be released by the FBI -- will show this sort of thing isn't limited to Best Buy repair centers.

We think that the FBI's use of Geek Squad informants is not an isolated event. Rather, it is a regular investigative tactic law enforcement employ to obtain digital evidence without first getting a warrant as the Fourth Amendment generally requires.

This bears watching. The FBI loves parallel construction and law enforcement in general loves anything that allows it to bypass obtaining warrants. Turning repair crews into informants serves these interests well.

Filed Under: 4th amendment, fbi, foia, geek squad, informants, private searches
Companies: best buy, eff

Court Documents Appear To Confirm The FBI Is Using Best Buy Techs To Perform Warrantless Searches For It

from the private-search-loophole dept

As we covered last week, the FBI has apparently been paying Best Buy Geek Squad members in exchange for tips about illegal material discovered on customers' computers. This is problematic for a couple of reasons.

First, adding a financial incentive could lead to Best Buy employees digging around in users' computers in hopes of finding something to turn in, rather than limiting themselves to the job at hand: repairing the device.

Second, while companies are legally obligated to report the discovery of child porn to law enforcement, this occurs as a "private search." As such, it's perfectly legal and can result in the probable cause needed to perform a forensic search of the computer, as well as (possibly) any other electronic devices the customer owns. But when the FBI turns Best Buy employees into confidential informants -- paid or not --it's no longer a private search. It's a third-party search at the government's request. The government can't task private individuals with performing warrantless searches on its behalf -- at least not if it wants to hold onto the evidence.

The government is arguing that there was nothing wrong with the FBI's relationship with Best Buy. This is being argued despite the growing amount of evidence showing the FBI's role in Best Buy searches of computers is anything but passive.

One former agent confirms [PDF] in her declaration that the employee who alerted the FBI to alleged child pornography found on the computer of the defendant in this case, had been signed up by the agency as a “confidential human source” (CHS) in 2009 — two years before the offending content was discovered in this case — but contends that this worker was “never asked” to “search for child pornography or evidence of any other crime on behalf of the FBI.”

However, in a Dec. 19 order [PDF] in this case, the judge notes that emailed communications may hint at a deeper connection between the agency and the Geek Squadder.

For instance, in Oct. 2009, this agent emailed the Best Buy staffer to set up a meeting “to discuss some other ideas for collaboration.” The since-retired agent now says she has no “independent recollection of what ‘collaboration'” refers to in that email, blaming her memory lapse on brain damage caused by Lyme disease.

Whatever the case may be, the documents do seem to show what Mark Rettenmaier, the defendant at the center of this case, alleges they do: a close partnership between the FBI and Best Buy that has gone on for years.

Judge Cormac Carney's ruling on Rettenmaier's demand for document production from the FBI indicates that what he's seen so far (many of the documents handed over by the FBI to date are under seal) points in this direction.

According to the FBI, [Best Buy employee] Meade was a CHS [confidential human source] for two periods of time—October 2008 to January 2009 and November 2009 to November 2012. During the first CHS period, Meade worked with FBI Agent Richard T. Boswell. (See Bates 1123; Dkt. 152 at 6.) Before the second CHS period, Agent Jennifer Cardwell took over for Agent Boswell (Agent Riley took over for Agent Cardwell in July 2010 (Bates 1028)). (Bates 1122–23.) Meade estimates that he contacted the FBI reporting child pornography approximately six to nine times per year. (Bates 544–45.) Though the FBI has had eight different CHS at Best Buy’s Kentucky facility, at the time when Best Buy had Rettenmaier’s hard drive, only Meade and Ratliff were connected to the FBI. (Dkt. 152 at 6.) Both Ratliff and Meade received payment from the FBI; every CHS prior to February 2012 received payment.

The government is refusing to hand over any more information that may shed more light on this relationship, but Judge Carney isn't going to let it get away with it. The government claims any such evidence, if produced, would only "undermine" Rettenmaier's "unsupported argument" about the FBI/Best Buy BFF situation. Judge Carney basically says we won't know until we see it, will we?

The Court cannot determine whether Rettenmaier’s “unsupported” argument has merit as long as the Government refuses to produce the evidence that may support it; the Government’s hope that the evidence will undermine Rettenmaier’s motion does not exempt its production.

The ruling almost completely denies the government's motion to quash, which means that the documents demanded -- if they exist -- will have to be turned over to the defendant. Most will probably be filed under seal, but some are bound to escape the FBI's desire for complete secrecy. What leaks out around the edges will be interesting, and mostly sussed out through defense motions and judicial orders. If the FBI is treating private companies' employees as confidential informants, then it's basically utilizing the private sector to perform warrantless searches for it.

Filed Under: 4th amendment, computer repair, fbi, geek squad, informants, warrantless surveillance
Companies: best buy

The FBI Is Apparently Paying Geek Squad Members To Dig Around In Computers For Evidence Of Criminal Activity

from the maybe-these-are-the-'smart-people'-who-can-fix-Comey's-encryption-&# dept

Law enforcement has a number of informants working for it and the companies that already pay their paychecks, like UPS, for example. It also has a number of government employees working for the TSA, keeping their eyes peeled for "suspicious" amounts of cash it can swoop in and seize.

Unsurprisingly, the FBI also has a number of paid informants. Some of these informants apparently work at Best Buy -- Geek Squad by day, government informants by… well, also by day.

According to court records, Geek Squad technician John "Trey" Westphal, an FBI informant, reported he accidentally located on Rettenmaier's computer an image of "a fully nude, white prepubescent female on her hands and knees on a bed, with a brown choker-type collar around her neck." Westphal notified his boss, Justin Meade, also an FBI informant, who alerted colleague Randall Ratliff, another FBI informant at Best Buy, as well as the FBI. Claiming the image met the definition of child pornography and was tied to a series of illicit pictures known as the "Jenny" shots, agent Tracey Riley seized the hard drive.

Not necessarily a problem, considering companies performing computer/electronic device repair are legally required to report discovered child porn to law enforcement. The difference here is the paycheck. This Geek Squad member had been paid $500 for digging around in customers' computers and reporting his findings to the FBI. That changes the motivation from legal obligation to a chance to earn extra cash by digging around in files not essential to the repair work at hand.

More of a problem is the FBI's tactics. While it possibly could have simply pointed to the legal obligation Best Buy has to report discovered child porn, it proactively destroyed this argument by apparently trying to cover up the origin of its investigation, as well as a couple of warrantless searches.

Setting aside the issue of whether the search of Rettenmaier's computer constituted an illegal search by private individuals acting as government agents, the FBI undertook a series of dishonest measures in hopes of building a case, according to James D. Riddet, Rettenmaier's San Clemente-based defense attorney. Riddet says agents conducted two additional searches of the computer without obtaining necessary warrants, lied to trick a federal magistrate judge into authorizing a search warrant, then tried to cover up their misdeeds by initially hiding records.

The "private search" issue is mentioned briefly in OC Weekly's report, but should be examined more closely. Private searches are acceptable, but the introduction of cash payments, as well as the FBI having an official liaison with Best Buy suggests the searches aren't really "private." Instead, the FBI appears to be using private searches to route around warrant requirements. That's not permissible and even the FBI's belief that going after the "worst of worst" isn't going to be enough to salvage these warrantless searches.

As Andrew Fleischman points out at Fault Lines, the government's spin on the paid "private search" issue -- that it's "wild speculation" the Best Buy employee was acting as a paid informant when he discovered the child porn -- doesn't hold up if the situation is reversed. AUSA Anthony Brown's defensive statement is nothing more than the noise of a double standard being erected.

Flipping the script for a minute, would an AUSA say it was “wild speculation” that a man was a drug dealer when phone records showed he regularly contacted a distributor, he was listed as a drug dealer in a special book of drug dealers, and he had received $500.00 for drugs? Sorry to break it to you, Mr. Brown, but once you start getting paid for something, it’s tough to argue you’re just doing it for the love of the game.

In addition to these problems, the file discovered by the Best Buy tech was in unallocated space… something that points to almost nothing, legally-speaking.

[I]n Rettenmaier's case, the alleged "Jenny" image was found on unallocated "trash" space, meaning it could only be retrieved by "carving" with costly, highly sophisticated forensics tools. In other words, it's arguable a computer's owner wouldn't know of its existence. (For example, malware can secretly implant files.) Worse for the FBI, a federal appellate court unequivocally declared in February 2011 (USA v. Andrew Flyer) that pictures found on unallocated space did not constitute knowing possession because it is impossible to determine when, why or who downloaded them.

This important detail was apparently glossed over in the FBI's warrant application to search Rettenmaier's home and personal devices.

In hopes of overcoming this obstacle, they performed a sleight-of-hand maneuver, according to Riddet. The agents simply didn't alert Judge Marc Goldman that the image in question had been buried in unallocated space and, thus, secured deceitful authorization for a February 2012 raid on Rettenmaier's Laguna Niguel residence.

Courts have shown an often-excessive amount of empathy for the government's "outrageous" behavior when pursuing criminals. The fact that there's child porn involved budges the needle in the government's direction, but the obstacles the FBI has placed in its own way through its deceptive behavior may prevent it from salvaging this case.

The case is already on very shaky ground, with the presiding judge questioning agents' "odd memory losses," noting several discrepancies between the FBI's reports and its testimony, and its "perplexing" opposition to turning over documents the defense has requested.

In any event, it appears the FBI has a vast network of informants -- paid or otherwise -- working for both private companies and the federal government. Considering the FBI is already the beneficiary of legal reporting requirements, this move seems ill-advised. It jeopardizes the legitimacy of the evidence, even before the FBI engages in the sort of self-sabotaging acts it appears to have done here.

Underneath it all is the perplexing and disturbing aversion to adhering to the Fourth Amendment we've seen time and time again from law enforcement agencies, both at local and federal levels. Anything that can be done to avoid seeking a warrant, and anything that creates an obfuscatory paper trail, is deployed to make sure the accused faces an even more uphill battle once they arrive in court.

Filed Under: fbi, geek squad, informants, searches, warrants
Companies: best buy

DailyDirt: Advertising Needs To Be More Considerate

from the urls-we-dig-up dept

• Best Buy wrote a playful tweet about having everything you need in its stores -- except a payphone, referring to the Serial podcast about a murder case and an unaccounted for payphone near a Best Buy store that might have exonerated a teen accused of murder. Best Buy apologized for making light of the topic since there was a backlash from people who thought it was inappropriate to joke about such a serious subject. [url]
• Greenpeace wanted to promote renewable energy with a huge banner, and unfortunately, it placed its message on the site of the Nazca Lines -- a 1,500-year-old ancient monument in Peru. Greenpeace will likely be charged criminally for defacing a heritage site with a tone-deaf advertisement that ignored the local population completely. [url]
• Sesame Street also tweeted a mildly humorous joke about Serial. However, the children's TV show didn't provoke much backlash for making a pun related to a murder case. Not-for-profit muppets aren't apparently held to the same standards as retailers, but then again, Bert didn't actually refer to anything specific in the murder case. [url]

Filed Under: ads, advertising, content, media, mistakes, nazca lines, podcast, serial, sesame street
Companies: best buy, greenpeace

Merger Of The Also Rans: Rhapsody Buys Napster

from the too-late dept

Filed Under: mergers, music, subscription
Companies: best buy, napster, rhapsody

Intellectual Ventures Keeps On Suing

from the trolly-trolly-trolly-troll dept

Filed Under: patents
Companies: best buy, dell, hp, intellectual ventures, walmart

Details Emerge On Best Buy's 'Music Cloud' Service

from the press-your-computer's-power-button?-that's-$49 dept

Stripmine your hard drive of all porn, personal photos, personal data, functioning AV programs and music files. Music will be uploaded to the cloud and accidentally deleted from your hard drive. All other items will remain in place but be conveniently duplicated to your Geek's personal "cloud" and uploaded later to Facebook and image boards.

Install trial version of various products, including the AV program you didn't want and multiple trial versions of software you'd never purchase. This "Convenience Package" can be uninstalled for $49.

Provide you with a link to your personal cloud ($29), an email verification form ($7.99)* and a complimentary USB drive (2 GB or lower) from the Returns pile to be used as a personal "take anywhere" pocket cloud or whatever.
* Optional email installation (Gmail, Hotmail or Earthlink - $39)

Sneeze or cough on your computer no less than four(4) times.

Possibly corrupt your hard drive. (Offer not valid in AL, HI or PR.)

Disconnect your internet service ($19/per occurence).

Comment on the "loveliness" of your home. ($39-$99, depending on sincerity.)

Create some sort of error requiring a trip to the nearest Best Buy for repair. ($"Add to Cart" to see surprisingly high price.)

Hand-copy your login info to the back of his business card ("for quick reference").

Note: additional supplies needed to ensure proper home service will be added to the minimum bill. These include:

• 5' Ethernet cable - $39
• Blank DVD to create recovery disk - $4.99
• Complimentary Geek Squad pen ($0 if left behind by technician. Otherwise, $4.99.)
• Screen defragmenter - $12.99/bottle (Active ingredients: isopropyl alcohol, Geek palm sweat)
• 5' Power cord - $19
• Comment card - $2

* "Anywhere" is defined as any of the contiguous 48 states (excl. TX, MT and VT). Your "Cloud" can be accessed from any Best Buy Certified Computer for up to 6 hours a day or 3 hours continuous play. Other restrictions may apply. See EULA for details.
** "Anytime" is defined as normal store hours. "Cloud" hours will NOT extend during the holiday season. Expect regular interruptions for scheduled maintenance, unscheduled maintenance, "someone forgot to turn it on when they clocked in" and inadvertent login info dissemination.

Filed Under: cloud, music, satire
Companies: best buy