Really Bad Idea: Senator Klobuchar Wants To Mandate A 'Kill Switch' In All Mobile Phones

from the could-she-please-hire-a-technologist? dept

We hadn't heard much from Senator Amy Klobuchar recently, but every time she gets anywhere near legislation involving technology, you should run screaming for the hills (or, rather, call your own Senators to tell them to block whatever awful plan she's come up with). It's amazing that one Senator can get technology so wrong. Klobuchar, famously, backed the companion bill to PIPA, called S.978 in the previous Congress, which would have made unauthorized streaming of content into a felony, putting all sorts of perfectly reasonable YouTube users at risk of possible criminal charges, and possibly jailtime. In 2012, she tried to introduce the "Cloud Computing Act of 2012" which would have modified the CFAA to apply criminal enforcement to cloud computing as well. However, legal experts described the bill as a complete disaster, with one saying that her "definition of cloud computing service is incoherent."

Her latest move is to propose a bill that would mandate a kill switch in all mobile phones that could be activated remotely. The idea, here, is that this would allow those who had their phones stolen to disable them, rendering them (sorta) useless. It seems that, as with the other bills discussed above, Senator Klobuchar introduces these with the best of intentions, but with no clue about how technology works, or the likely "unintended" consequences of such things.

First, putting such a kill switch into all phones almost guarantees that it will be misused and abused in some form -- whether by government officials looking to cut off communications (as has been done at the tower level) or by malicious hackers looking to kill a ton of phones. The kill switch is just too tempting a target. Second, the actual benefit of this is likely to be limited. Phones will still get stolen and people will figure out how to hack their way around the kill switch within hours of it existing. Third, there's simply no reason for a law here. There are numerous software products that allow individuals to effectively do this on their own if they so desire. Mandating it, and adding fines to mobile operators who don't offer such a thing seems totally unnecessary.

So, even if we assume the best, and believe that, with all of these laws, Senator Klobuchar has the best of intentions, could she please hire someone who understands basic technology before writing any more bad laws that will cause harm?

Filed Under: amy klobuchar, kill switch, mobile phones

US-Israeli Security Company Selling Mobile Phone Surveillance Products To Agencies Around The World

from the NSA-power-at-budget-prices! dept

Privacy International, which has done a very thorough job digging into the backgrounds of the many private companies involved in the surveillance "industry" around the world, has just released a promotional document from the American-Israeli Verint, a security company that provides NSA-level cell phone surveillance power to entities around the world.

[A] scaled down version of this system is also being sold by private surveillance contractors to the highest bidder. The company behind it? Israeli-American company Verint. Their Skylock technology claims to have the ability to "Remotely locate GSM and UMTS targets located anywhere in the world at cell level precision".

The brochure Privacy Int'l obtained doesn't go into detail as to how it achieves this, but what is shown is both impressive and disturbing.

From a brochure collected this year we have discovered one of the newest additions to Verint's product line: mobile phone tracking on an international scale. Previously, mobile phone tracking required presence in the particular areas of interest, focusing on the tracking of phones through monitoring Base Stations (Cell Towers) and local networks to pinpoint location. In the past, if a law enforcement agency wanted location data they requested information from the relevant telecommunication firm operating in that specific territory. By way of an example, this would result in the UK not being able to obtain a French mobile phone’s location without help from the French. Now it would appear that Verint have bypassed the territoriality requirement.With this latest news, we know that location tracking has become borderless in the same way as communications surveillance. The ability to do this has likely come from a focus on international phone systems rather than domestic or regional networks which would never reach the worldwide nature of location tracking Verint is advertising.

Some details on Verint's SKYLOCK offering are available online (under the name ENGAGE). While the brochure seems to indicate this is solely a military product (the brochure cover only lists "Military, Special Forces, Navy, Search and Rescue, Border Control" and the photos contained show only military personnel), the inside notes make it clear these products are available to "law enforcement" as well.

As Privacy Int'l points out, Verint's offering operates "independently of local service providers," meaning pretty much every legal obstacle is demolished. What no one knows is going on won't hurt them. One product is targeted at satellite communications, but even considering that limited scope, it's still very powerful.

Here's what ENGAGE/SKYLOCK can do:

- Intercept voice calls and text messages
- Decrypt A5/1 and A5/2 encryptions with an embedded decipher
- Operate undetected leaving no electromagnetic signature
- Selectively downgrade UMTS traffic to GSM

Other ENGAGE products target wireless communications. Verint's intercept-in-a-box can do all of the following.

- Actively and passively intercept WiFi communications based on: 802.11 a/b/g/n, 2.4Ghz, and 5GHz
- Active interception of mobile handsets, even when not intentionally connected to a WiFi network
- Intercept target communication at a distance with zero packet loss
- Choose from multiple active interception methods to overcome encryption of private communication
- Identify access points and intercept MAC addresses in the area

Verint also gives its purchasers the power to target phones using 3G networks, remotely activate cell phone mics, and block cellular communication.

The capabilities that were presumed to only be in the hands of national intelligence agencies now can be had by nearly anyone who can come up with the money. Powerful cell phone surveillance products are a growth market. Anything that can increase data and communication harvesting while simultaneously eliminating a majority of legal restrictions and oversight practically sells itself.

We may feel this sort of power is OK in the "right hands," but we don't get to decide which hands this ends up in. We may believe the NSA should be able to do this sort of thing (overseas, preferably), but that local law enforcement agencies should be forced to jump through warrant and subpoena hoops before tracking locations and intercepting communications. But ultimately it doesn't matter what we prefer. That call is made by Verint and it's in the business of selling surveillance products, not protecting the privacy of the world's citizens.

Filed Under: mobile phones, surveillance
Companies: verint

In News That Will Surprise No One, NSA Has Cracked Mobile Phone Encryption To Listen In On Calls

from the duh dept

One of the latest reports from the Snowden documents over at the Washington Post falls more into the "well, duh" category than many previous reports. The NSA has easily cracked the A5/1 encryption used to encrypt mobile phone conversations on many GSM mobile networks. Of course A5/1 has been around forever, and others have shown that it's not particularly secure for quite some time. But, it's just a reminder that, yes, of course, the NSA could listen in on calls. Some networks do use more modern encryption, which is much harder for the NSA to crack, and it sounds like the recent revelations are leading at least some mobile operators to upgrade the encryption on their network. Still, at this point, it seems safe to assume that if you want to have a truly private conversation, you shouldn't use a phone.

Filed Under: a5/1, encryption, mobile phones, nsa, privace

Warrantless Collection Of Cellphone Data By Law Enforcement On The Rise, As Is The Use Of Stingray Tower Spoofers

from the millions-of-'incidental'-records dept

As we covered last week, cellphone tower "dumps" are increasingly being used by law enforcement to track criminals. These "dumps" provide LEOs with the information gathered every time someone's cell phone contacts the tower, whether it's to make a call, send a text or email or access the web.

This vast amount of data being sought is obtained with a court order, which has a much lower bar than a search warrant, which requires probable cause. The ease in which this data is obtained is one concern. The other concern is that many law enforcement agencies have little to nothing in the way of guidelines for dealing with this collected data -- often allowing it to be stored for years, completely unmiminized. Agencies also are under no obligation to inform citizens that their data has been collected.

USA Today has compiled some more information about how these tower dumps are used, as well as on how common they are becoming. As was noted in our original article, requests for these data dumps has jumped over 75% over the last five years (according to Verizon) and more than 1.3 million requests were made in 2011 alone (Verizon and AT&T combined).

Here's how one particular case utilized data dumps to search for a suspect.

In October 2012, in Colorado, a 10-year-old girl vanished while she walked to school. Volunteers scoured Westminster looking for Jessica Ridgeway.

Local police took a clandestine tack. They got a court order for data about every cellphone that connected to five providers' towers on the girl's route. Later, they asked for 15 more cellphone site data dumps...

The tower dump data helped police choose about 500 people who were asked to submit DNA samples. The broad cell-data sweep and DNA samples didn't solve the crime, though the information aided in the prosecution. A 17-year-old man's mother tipped off the cops, and the man confessed to kidnapping and dismembering the girl, hiding some of her remains in a crawl space in his mother's house. He pleaded guilty and last month was sentenced to more than 100 years in prison.

To sum up, tons of data was collected, resulting in a broad sampling of 500 people's DNA, and yet it was an old-fashioned tip that resulted in the arrest and indictment of the suspect. What should be considered a troubling incursion on our civil liberties is viewed by law enforcement as just another tool in the toolset, albeit one that goes long on data and comes up short on results.

From this lowered bar (court orders), police use previously obtained cellphone tower dumps as justification for even more tower dumps, along with any other information that they can gather without having to obtain a warrant: home addresses, call records, locations and the content of texts. This data is combined with the info gathered by other surveillance technology, including plate readers and traffic cams, to generate very precise recreations of a person's actions and movements -- all without a warrant or any concern for the amount of unrelated data gathered.

The intrusion goes even deeper than bulk data dumps, though.

Local and state police, from Florida to Alaska, are buying Stingrays with federal grants aimed at protecting cities from terror attacks, but using them for far broader police work…

Typically used to hunt a single phone's location, the system intercepts data from all phones within a mile, or farther, depending on terrain and antennas.

Stingray devices give law enforcement agencies roaming cell tower impersonators to grab even more data with, bypassing both search warrants and the wireless providers themselves.

Law enforcement agencies don't want to talk about these devices, something the manufacturer has an active hand in.

Initially developed for military and spy agencies, the Stingrays remain a guarded secret by law enforcement and the manufacturer, Harris Corp. of Melbourne, Fla. The company would not answer questions about the systems, referring reporters to police agencies. Most police aren't talking, either, partly because Harris requires buyers to sign a non-disclosure agreement.

Beyond not wanting to talk about the devices, agencies are also reluctant to discuss what guidelines (if any) they have in place to help safeguard civil liberties. As it stands now, most of these devices are deployed covertly, with citizens having no idea their local law enforcement even possesses this capability.

Documents obtained by Indianapolis Star indicate the Indiana state police own a Stingray device valued at nearly $375,000. Unsurprisingly, the state police have no interest in discussing this purchase.

[O]fficials at Indiana’s largest police agency aren’t saying what they do with the technology; they’re mum on whose data they’ve collected so far; and they’re not talking about what steps they take to safeguard the data.

Citing concerns that releasing any information would endanger public safety by hindering the agency’s ability to fight crime and combat terrorism, they won’t even say whether they ask a judge for a search warrant before they turn the equipment on.

There it is again -- concerns about intrusive technology and untargeted data hauls being waved away by throwing out the word "terrorism" and claiming that revealing any information would "endanger public safety." It's a cop-out -- one that dodges every potential issue by appealing to fear.

The reality is that very few people know how these are being deployed. The power of the device lends itself to abuse, or at the very least, overuse. As the article points out, police in South Carolina used tower dumps to investigate items being stolen from vehicles and in Miami, the police department deployed a Stingray to spy on protesters at a world trade conference.

According to the documents, 25 police departments around the country have contracts with Harris Corp. These devices may be expensive, but utilizing the word "terrorism" when applying for a grant from the DHS generally makes the tech more affordable. These devices also appear to be loaned out freely to other agencies, meaning the actual count of law enforcement agencies with access to this technology is considerably higher than the 25 listed.

This unofficial sharing program vastly increases the amount of data gathered -- as well as the potential for the civil liberties violations. While one agency may have guidelines affecting use and destruction of gathered data, the agency borrowing it may have nothing in place at all. And, considering the fact that no agency wants to talk about their usage of Stingrays, it's safe to assume whatever safeguards are in place are lax and full of loopholes.

Outdated laws have combined with expansive readings of the Third Party Doctrine to give law enforcement agencies nearly unlimited access to vast amounts of data. The rise of cellphones has been fortuitous for agencies with unquenchable thirsts for data, providing millions of metadata points for millions of users. And, like our intelligence agencies, these law enforcement agencies are operating largely under the cover of "darkness," actively avoiding (or directly thwarting) any attempts at oversight.

Filed Under: abuse, cell tower data, law enforcement, mobile phones, privacy, stingray

Cell Phone Manufacturers Offer Carefully Worded Denials To Question Of Whether NSA Can Track Powered-Down Cell Phones

from the it's-not-so-much-what's-being-said,-it's-how-it's-being-said dept

Back in July, a small but disturbing detail on the government's cell phone tracking abilities was buried inside a larger story detailing the explosive expansion of the NSA post-9/11. Ryan Gallagher at Slate pulled this small paragraph out and highlighted it.

By September 2004, the NSA had developed a technique that was dubbed “The Find” by special operations officers. The technique, the Post reports, was used in Iraq and “enabled the agency to find cellphones even when they were turned off.” This helped identify “thousands of new targets, including members of a burgeoning al-Qaeda-sponsored insurgency in Iraq,” according to members of the special operations unit interviewed by the Post.

Ars Technica reports that some security researchers are calling this statement into question and have contacted cell phone providers for statements on the NSA's claim. Only a few have responded at this point, and their denials have been worded very specifically.

Google had this to say:

When a mobile device running the Android Operating System is powered off, there is no part of the Operating System that remains on or emits a signal. Google has no way to turn on a device remotely.

Google may not have a way, but that doesn't mean the NSA doesn't.

Nokia:

Our devices are designed so that when they are switched off, the radio transceivers within the devices should be powered off. We are not aware of any way they could be re-activated until the user switches the device on again. We believe that this means that the device could not be tracked in the manner suggested in the article you referenced.

Once again, we're looking at words like "should" and "not aware." This doesn't necessarily suggest Nokia does know of methods government agencies could use to track phones that are off, but it doesn't entirely rule it out either.

Samsung's response is more interesting. While declaring that all components should be turned off when the phone is powered down, it does acknowledge that malware could trick cell phone users into believing their phone is powered down when it isn't. Ericsson, which is no longer in the business of producing cell phones (and presumably has less to lose by being forthright), was even more expansive on the subject.

The only electronics normally remaining in operation are the crystal that keeps track of time and some functionality sensing on-button and charger connection. The modem (the cellular communication part) cannot turn on by itself. It is not powered in off-state. Power and clock distribution to the modem is controlled by the application processor in the mobile phone. The application processor only turns on if the user pushes the on-switch. There could, however, be potential risks that once the phone runs there could be means to construct malicious applications that can exploit the phone.

On the plus side, the responding manufacturers seem to be interested in ensuring a powered down phone is actually powered down, rather than just put into a "standby" or "hibernation" mode that could potentially lead to exploitation. But the implicit statement these carefully worded denials make is that anything's possible. Not being directly "aware" of something isn't the same thing as a denial.

Even if the odds seem very low that the NSA can track a powered down cell phone, the last few months of leaks have shown the agency has some very surprising capabilities -- some of which even stunned engineers working for the companies it surreptitiously slurped data from.

Not only that, but there's historical evidence via court cases that shows the FBI has used others' phones as eavesdropping devices by remotely activating them and using the mic to record conversations. As was noted by c|net back in 2006, whatever the FBI utilized apparently worked even when phones were shut off.

The surveillance technique came to light in an opinion published this week by U.S. District Judge Lewis Kaplan. He ruled that the "roving bug" was legal because federal wiretapping law is broad enough to permit eavesdropping even of conversations that take place near a suspect's cell phone.

Kaplan's opinion said that the eavesdropping technique "functioned whether the phone was powered on or off." Some handsets can't be fully powered down without removing the battery; for instance, some Nokia models will wake up when turned off if an alarm is set.

While the Genovese crime family prosecution appears to be the first time a remote-eavesdropping mechanism has been used in a criminal case, the technique has been discussed in security circles for years.

Short of pulling out the battery (notably not an option in some phones), there seems to be little anyone can do to prevent the device from being tracked and/or used as a listening device. The responding companies listed above have somewhat hedged their answers to the researcher's questions, most likely not out of any deference to government intelligence agencies, but rather to prevent looking ignorant later if (or when) subsequent leaks make these tactics public knowledge.

Any powered up cell phone performs a lot of legwork for intelligence agencies, supplying a steady stream of location and communications data. If nothing else, the leaks have proven the NSA (and to a slightly lesser extent, the FBI) has an unquenchable thirst for data. If such exploits exist (and they seem to), it would be ridiculous to believe they aren't being used to their fullest extent.

Filed Under: mobile phones, privacy, surveillance, tracking
Companies: ericsson, google, nokia, samsung

DA Claims Mobile Phone Obsession Resulted In No One Noticing Guy With Gun On SF Train

from the or,-you-know,-people-keeping-to-themselves dept

The San Francisco Chronicle has the sort of silly story that is all too common from local news organizations these days: making broad claims based on a single anecdote, with no actual evidence to support the thesis. In this case, it's claiming that people "absorbed" by their devices were to blame for no one noticing a guy brandishing a gun on the SF Muni train a few weeks ago:

A man standing on a crowded Muni train pulls out a .45-caliber pistol.

He raises the gun, pointing it across the aisle, before tucking it back against his side. He draws it out several more times, once using the hand holding the gun to wipe his nose. Dozens of passengers stand and sit just feet away - but none reacts.

Their eyes, focused on smartphones and tablets, don't lift until the gunman fires a bullet into the back of a San Francisco State student getting off the train.

From there, the article just goes on basically a long rant about the evils of mobile devices and how no one looks at each other any more. To make this claim plausible, it quotes the District Attorney, who claims that this "speaks to a larger dilemma of the digital age." And then there's a professor who makes the same argument:

"When you used to go into a public place, you assumed everyone was in that place with you," said Jack Nasar, an Ohio State University professor in city and regional planning who specializes in environmental psychology. "What happens to public places when everybody is talking on a cell phone? Everyone is somewhere else.

"Someone can take a gun, hold it up, and nobody will notice it."

This seems pretty damn questionable. While I'm sure it's true that lots of people get absorbed by looking at their mobile devices, the fact that no one looked at the guy can't be blamed on mobile devices. Perhaps it's because I grew up in NY, but I learned from a very young age that you don't look at people on public transit. You just don't. It's rude and, if anything, it's more likely to provoke a dangerous situation. Over the years, I've ridden plenty of public transit systems around the world, and this is pretty typical -- and it was typical long before mobile devices came on the scene. In fact, it seems like mobile devices just helped give people something to do rather than stare off into random space.

So, yes, it seems shocking that no one noticed the guy with the gun until he shot and killed someone, but it's a pretty big leap to automatically blame everyone being on their mobile phones. It seems unlikely that everyone on the train was staring at a mobile device. It seems likely that some were just staring out the window as well. Will the DA and professor Nasar blame windows for destroying public places now too?

Filed Under: mobile phones, paying attention, public transit

Twenty-Year-Old Requirement For 'Real-time, Full-time' Eavesdropping On Canadian Mobiles Revealed

from the thanks-to-Mr-Snowden dept

Even if it now seems likely that Linus Torvalds wasn't approached to add a backdoor to Linux, there are plenty of others that were asked and acquiesced, as this story from The Globe and Mail in Canada makes clear:

For nearly two decades, Ottawa officials have told telecommunications companies that one of the conditions of obtaining a licence to use wireless spectrum is to provide government with the capability to monitor the devices that use the spectrum. The Sept. 17 kickoff of the auction-countdown process will underscore that commitment, made out of sight of most Canadians because it is deemed too sensitive by the government.

The secret agreement apparently contains specific details of what telecom companies must provide:

"Real-time, full-time" eavesdropping on conversations is just one of the capabilities sought by police, according to the standards. Authorities also want records of call logs, texts, keystrokes and other data, including "the most accurate geographical location known."

Communications made with encryption provided by the carrier must be decrypted:

Carriers that help their customers scramble communications must decrypt them. "Law enforcement requires that any type of encryption algorithm that is initiated by the service provider must be provided to the law-enforcement agency unencrypted."

No doubt, many people might think phone companies should provide this kind of information, provided a properly executed court warrant is presented. What's problematic here is that this has been going secretly on for 20 years, with no public oversight and with no debate about where to draw the line for such surveillance. That discussion would hardly compromise police operations, but would provide vital transparency and legitimacy. The fact that two decades after the practice started the Canadian people are finally hearing about this capability now is probably yet another beneficial knock-on effect of Edward Snowden's leaks.

Follow me @glynmoody on Twitter or identi.ca, and on Google+

Filed Under: canada, mobile phones, surveillance