UK Police Circumventing Cellphone Encryption By 'Mugging' Suspects While Their Phones Are Unlocked

from the snatch-and-grab dept

UK police are experimenting with a new brute force technique to defeat cellphone encryption:

Undercover surveillance officers trailed Yew and waited for him to unlock his phone to make a call - thereby disabling the encryption.

One officer then rushed in to seize the phone from Yew's hand - just as would happen in a criminal mugging. As his colleagues restrained the suspect, the officer continually "swiped" through the phone's screens to prevent it from locking before they had downloaded its data.

So, it's come to this: lawful mugging. Still, it's not a terrible solution to the problem. Sometimes the best methods are lo-tech, as anyone swinging a $5 Password Acquisition Tool can tell you.

This method will work in the UK. It may not in the US. UK law enforcement would likely find compelling a suspect to unlock a device a long and possibly fruitless endeavor, but there's no Riley decision standing in the way of seizing/searching phones on the hoof (as it were).

Courts here in the US have interpreted the Supreme Court's Riley decision in diverse ways, but a motion to suppress evidence might succeed if US law enforcement began engaging in this novel form of encryption circumvention. In one case, a judge found that simply opening a flip phone constituted a search under Riley. Keeping a phone "alive" until evidence can be retrieved from it might run afoul of the Fourth Amendment, even if the seizure itself is completely lawful.

It's still a better idea than making encryption backdoors mandatory or requiring device manufacturers to make a second set of keys for the government. The solution isn't elegant but it works. And it will only work in certain circumstances, so there's not much potential for abuse. It might encourage rougher arrests than usual, if only to separate the cellphone from the suspect, but the small number of arrests where this process would work shouldn't result in a sharp uptick in excessive force deployment.

This is a technique US law enforcement should definitely look into. While I'm sure most agencies would prefer a precedential court decision compelling decryption or a legislative mandate, this alternative would allow police officers to end up with fewer inaccessible phones.

There are other benefits as well -- some that could positively affect community relations. The arrest of a suspect in conjunction with the seizure of potential evidence could make related searches far less destructive. With the suspect out of the way, searches of homes/places of business wouldn't necessitate a barrage of flashbang grenades and the tearing of new entryholes by predawn raiding parties in SWAT gear. Sure, this less violent approach to serving search warrants won't appeal to officers who find the real military too restrictive but still harbor a desire to carry a gun and pretend they're participants in a war. But that's actually a good thing.

In addition, arrests of suspects out in the open should lower the chance of violent resistance. People tend to expect the arrival of police officers at their residence -- not so much when they're going about their daily, noncriminal business.

If efforts to keep seized phones alive until a search warrant arrives (or: novel idea -- get one first!) adhere to the Riley decision, the "going dark" problem isn't quite as all-encompassing as it's frequently been portrayed. (Even without this method, the "threat" of phone encryption has been greatly overstated.) It's tough to believe "mugging" might be the lesser of law enforcement's desired anti-encryption evils, but that's the reality of the situation.

Filed Under: encryption, mugging, police, uk

As Google Agrees To Delete Unblurred Street View Images In Germany, One Is Used To Solve A Crime

from the well-how-about-that dept

Earlier this week, Google agreed to delete unblurred images in its Street View database. If you don't know, Google Street View involves cars driving around photographing everything, so they can be placed on Google Maps. It's quite useful. However, some folks (and politicians) have been up in arms about the supposed privacy violation of photographing people walking in public (no, I don't get it, either). To deal with this, Google has been blurring faces of people. However, it usually keeps the unblurred versions in a database for future use (and for better training of its blurring mechanism).

However, just as the company agreed to delete the unblurred photos in its German database, over in the UK, such photos may be useful in helping to solve a mugging. The victim of the mugging (amazingly) noticed that one of the Street View photos was taken right before the mugging happened. It involved two guys who stole his bike, and the photo shows the two guys walking right behind the kid. He alerted the police, who got the unblurred image from Google and were able to track down the accused muggers. Of course, it's not clear if they'll actually be convicted or if there's really enough evidence. In the meantime, though, if you're thinking of mugging someone, maybe take a look around to see if there's a Google car driving along side you first.

Filed Under: crime, germany, google maps, mugging, street view, uk
Companies: google