Seventh Circuit Says Riley Doesn't Apply To Searches Of Parolees' Phones

from the nestled-in-one-of-many-warrant-exceptions dept

In 2014, the Supreme Court extended Fourth Amendment coverage to the contents of cell phones. Prior to that ruling, cops had successfully argued that searching the contents of someone's cell phone was no different than searching the contents of their pockets when arresting them. Claims -- bad ones -- were made about "officer safety" and, for the most part, courts tended to agree. If the pants pocket argument didn't work, cell phones -- with their wealth of personal information and private communications -- were analogized as the digital equivalent of car trunks or address books.

This protection only extends so far, as one parolee has discovered. The key is in the wording of the Supreme Court's Riley decision, which apparently doesn't cover someone being arrested for parole violations. But the Seventh Circuit Court of Appeals decision [PDF] seems to undercut some of the findings of the Riley decision, which recognized the personal nature of these computers capable of being carried in someone's pocket. In doing so, it appears to say this enhanced expectation of privacy simply doesn't apply to anyone on parole or probation.

The opening paragraph appears to show something that oversteps the bounds of the search incident to arrest, at least in relation to the parole violation.

Henry Wood was arrested for violating his parole. Midway through the arrest, parole agents found methamphetamine hidden underneath the back cover of his cellphone. An investigator later extracted the data from his cellphone, revealing child pornography.

While the discovery of drugs may have been inevitable, given its location, it's unclear why this investigator decided a forensic search of the phone's digital contents was necessary. While Wood had served time on meth charges, the discovery of meth doesn't alone appear to justify a full search of his phone. The violation he was picked up for was failing to report to his parole officer. His phone was seized as "evidence" during his arrest and the phone search was performed -- without a warrant -- a week later.

Parolees do have a lowered expectation of privacy in just about everything, but it doesn't seem this agreement signed by Wood covers the contents of his phone.

I understand that I am legally in the custody of the Department of Correction and that my person and residence or property under my control may be subject to reasonable search by my supervising officer or authorized official of the Department of Correction if the officer or official has reasonable cause to believe that the parolee is violating or is in imminent danger of violating a condition to remaining on parole.

The crime was failing to report. The search of the outside of the phone led to the discovery of meth. The phone search was in service of... ??? It seems the search of the device occurred mainly because investigators believed Wood's parole agreement allowed them to perform one without seeking a warrant.

The Appeals Court says there's nothing wrong with this. Riley only covers certain situations.

Wood asks us to apply Riley v. California to parolees. The primary problem with this request is that Riley dealt with searches incident to a lawful arrest. The Supreme Court carefully tailored its analysis to that context and expressly recognized that “other case‐specific exceptions may still justify a warrantless search of a particular phone.”

Wood pointed out he was arrested and the phone search could plausibly be called "incident to arrest." The Seventh Circuit doesn't care for this argument. Instead, it says it could be plausibly argued Wood was never out of law enforcement's custody at any point, so the arrest wasn't a new event but rather just an unfortunate continuation of his incarceration.

Wood maintains his arrest rendered Samson inapplicable and instead triggered Riley. On its face, this seems plausible—Wood was arrested, making him an arrestee, and Riley is about arrestees. But a parolee is on the “‘continuum’ of state‐imposed punishments,” one step removed from incarceration. See Samson, 547 U.S. at 850. A custodial arrest would not increase a parolee’s privacy expectations by placing him outside Samson’s reach. Upon arrest, Wood’s status was not transformed from parolee to arrestee, but from parolee to parolee‐arrestee, so Samson continued to apply.

In the court's eyes, the needs of the state (keeping an eye on parolees, reducing recidivism) justify the lowered expectation of privacy for parolees, making them (and their property) subject to warrantless searches. The court says the Supreme Court expressly referred to this carveout when establishing its warrant requirement for cell phone searches.

Reducing recidivism is an independent goal of the parole system, exclusive from those discussed in Riley, and it would be frustrated by imposing a warrant requirement because it would incentivize concealment of criminal activity.

And that's the end of the discussion for now. Riley doesn't apply to devices owned by parolees. They may have been granted a small percentage of their rights in exchange for their continued good behavior, but apparently a warrant requirement for phone searches isn't one of them. There's nothing more personal for some people than their phones, but if you're still working off your debt to society, the state can access your personal data and private conversations on a whim.

Filed Under: 4th amendment, 7th circuit, device searches, parolees, phones, privacy, riley, searches

No Qualified Immunity For Cops Who Made Stuff Up To Justify Seizing A Man's Phone For Twelve Days

from the but-what-if-terrorism-or-what-not dept

Here's an interesting decision [PDF] by the Eighth Circuit Court of Appeals. On one hand, it says cops can possibly hassle people for filming them if they can find almost any reason at all to justify it. On the other hand, it says they definitely cannot take people's property (cameras, phones) just because their nearly unjustified hassling gave them the opportunity to seize it.

Here's the setup for the multiple rights violations, courtesy of the Appeals Court:

Daniel Robbins was recording illegally parked vehicles from a public sidewalk adjacent to the Des Moines Police Station when officers approached him and asked him what he was doing. Robbins was uncooperative, and the officers temporarily seized him and his camera and cell phone.

This probably would have gone unhassled if it hadn't occurred near a police station. When citizens record officers on their home turf, they become inordinately defensive. Claims of terrorist attacks or the War On Cops™ often arise, even though -- as officers should be painfully aware -- anything they do on public property is observable by the public. The presence of recording equipment shouldn't change a thing.

Nevertheless, the Des Moines police officers decided to make it a thing. Someone referred to here as a "detective" decided to (inadvertently) make a federal case about a citizen recording illegally-parked cars and cops going to and from the station. He had reasons.

While walking towards his car, Detective Youngblut observed Robbins recording vehicles as well as officers and civilian employees entering and leaving the police station. Because he was aware that vehicles had recently been stolen from and vandalized in that area, and because he was aware of a previous incident in which two officers had been murdered by a person with a history of filming the police, Detective Youngblut approached Robbins to make an inquiry.

LOL. OK. Well, let's just ground all the planes and hassle every passenger because one time people flew planes into buildings, killing a few thousand people. While this "suspicion" may have justified a quick, consensual Q&A with Robbins, "Detective" [these scare quotes will be even more justified in a moment…] Youngblut decided to go further.

Other officers -- apparently similarly offended by this reckless display of First Amendment rights -- got to Robbins first. And they applied pressure.

Robbins refused to identify himself or respond to law enforcement inquiries, explaining “I’m taking pictures because it’s perfectly legal for me to do so.” Lieutenant Leo initiated physical contact when he lifted the back of Robbins’s shirt, grabbed his forearm and placed it above his head, and patted him down. Robbins repeatedly asked what about his conduct was illegal, and the officers responded that while he was not doing anything illegal, he was suspicious.

Ah. Not illegal. Just worth getting uptight about. The officers ordered Robbins to leave. He refused. So they got even stupider. They demanded Robbins ID himself. This was also wrong. Iowa has no law requiring citizens to ID themselves when interacting with police officers.

But it wouldn't have mattered for Robbins. Why? Because the man with all the investigative skills -- Detective Youngblut -- told the officers to just make something up.

Detective Youngblut suggested that the officers “just make a suspicious activity case . . . [and] confiscate the camera until we have a reason for what we’re doing.”

Swell. If you don't have a REAL reason for doing something, just find ANY reason.

Robbins asked if he was under arrest and being detained against his will. The answer to both questions was yes, provided by the detective who said to make something up. At that point, the illegality started to pile up.

The officers seized Robbins’s cell phone and camera. Detective Youngblut photographed Robbins for his file and then told him that he was free to go. The encounter lasted approximately twelve minutes.

The "encounter" may have lasted 12 minutes, but the seizure of Robbins' phone and camera lasted 12 days. Robbins lost both on May 10. It wasn't until his lawyer spoke to the police department that his items were returned.

Unfortunately, the court says all of this bullshit -- including the detective suggesting someone just make something up -- isn't a violation of Robbins' First Amendment rights. According to the Eighth Circuit, there was enough non-made-up suspicion to justify the rousting of Robbins.

Here, law enforcement officers observed Robbins recording both vehicles near the police station and officers and civilian employees entering and leaving the police station. The officers also possessed other significant information: they were aware of recent criminal activity involving cars parked in the area, and they were aware of a previous filming and stalking incident that escalated into the murder of two officers. Armed with this knowledge, Officer Youngblut approached Robbins and asked him what he was doing. Robbins was non-responsive, evasive, and confrontational. Officer Youngblut reasonably found Robbins’s behavior suspicious.

Robbins’ behavior that went beyond any constitutionally protected recording activity when combined with the officers’ knowledge about vehicles being stolen and vandalized in the area and the previous filming that led to officers being murdered could cause an objectively reasonable person in the officers’ position to suspect Robbins was up to more than simply recording the police. Under these circumstances, we can neither say that the officers’ conduct was objectively unreasonable under clearly established law, nor in violation of the First Amendment.

According to the court, Robbins' filming of police was suspicious enough to justify this interaction. But it was not suspicious enough to justify the seizing of his recording equipment. And definitely not enough to justify holding onto it for 12 days.

The officers argued they never arrested Robbins, therefore the court should bypass analysis of the seizure of Robbins himself. The court says it's pretty clear Robbins was arrested, even if momentarily. That much was made clear by Detective Youngblut, who told Robbins he was both arrested and detained.

Having failed to sway the court with this "non-arrest" argument, the officers went fishing for arrest reasons. One theory was "loitering." Wrong, says the court.

Viewing the facts in a light most favorable to Robbins, a reasonable officer would not have believed he had probable cause to arrest Robbins for loitering because there is no evidence Robbins was blocking the sidewalk or disrupting the activity of the police station.

The other theory was Robbins providing officers with a false name when hassled: "John Doe." Wrong again, says the court. This fake name wasn't presented until after Robbins was already under arrest. It's impossible to arrest someone for something they didn't do until after they were arrested.

Despite there being a clear warrant requirement for search and seizure of cellphones following the Riley decision, the cops argued their seizure of Robbins' recording equipment fell into a "narrow exception'' that covers "brief detentions" of personal property that are "minimally invasive." But the officers could not explain how a 12-day seizure was "brief," even if it was "minimally invasive." GTFO, says the Eighth.

The Supreme Court concluded that a ninety-minute detention of a suspect’s luggage based only on reasonable suspicion was unreasonable.Regardless of whether the Place exception applies to personal effects such as cell phones and cameras, the duration of the seizure – twelve days – was unreasonable.

The refusal to return the property to Robbins made it worse. And it shows Detective Youngblut really hasn't earned that title.

In addition, the officers did not tell Robbins with any precision when or how he would get his property back. Rather, Detective Youngblut told Robbins he was investigating a homicide and would apply for a search warrant “at some point.” Detective Youngblut disposed of his suspicions and the need for a search warrant after discovering Robbins had a YouTube page dedicated to illegally-parked vehicles. Even so, Detective Youngblut continued to detain Robbins’s property until his counsel demanded its return.

Owning a fishing rod doesn't automatically make you a great fisherman. And it sure as shit doesn't make you a good detective. This was a punitive seizure and Youngblut couldn't even be bothered to come up with a credible excuse for separating Robbins from his phone and camera for 12 days.

The court says being a jerk isn't a crime. None of this was justified.

Under the facts of this case, the governmental interest, presumably to dispel whatever suspicion the officers had about Robbins, does not outweigh the intrusion to Robbins. The seizure was unreasonable in the absence of arguable probable cause. See Place, 462 U.S. at 707–10.

The defendants alternatively argue that Robbins’s uncooperativeness gave them probable cause to seize his property. This argument fails for the reasons stated above. The defendant officers violated Robbins’s clearly established right to be free of unreasonable seizures of his property, see id., and are not entitled to qualified immunity.

The case heads back to the district court. The officers -- including this so-called "detective" -- will have to take their chances on a jury finding illegal arrest and follow-up seizure were somehow justified. This seems unlikely. Chances are Robbins will receive a settlement before a jury has a chance to receive instructions from a federal judge. The officers may have had their reasons to approach a man filming a police station, but nothing they did after they approached him was Constitutional.

Filed Under: 4th amendment, daniel robbins, des moines, phones, qualified immunity, seized property

FBI Sent A Special Task Force To Portland To 'Exploit' Phones Taken From Protesters

from the collect-it-all dept

Ongoing protests in Portland have been met with a federal response. The opening salvo was disturbing: Gestapo-esque tactics carried out by unidentified federal officers driving unmarked vehicles. It didn't get any better after that. The federal task force headed by the DHS seemed more willing to escalate the situation than settle things down, even if they were supposedly there to just do federal things like protect federal property and investigate federal crimes.

Documents leaked to Ken Klippenstein indicated the federal presence in Portland was more interested in finding evidence of some sort of Antifa hierarchy than sticking to the directive. FBI forensic analysts and their tech had been scrambled to Oregon to dig into phones taken from protesters and arrestees in hopes of finding some sort of organizational structure for them to attack.

This immediately raised questions about the Constitutionality of these device extractions. There's a warrant requirement in place for phone searches incident to arrests and it's not clear whether this requirement is being followed. For that matter, cloning phones belonging to detainees not necessarily suspected of criminal activity (with or without a warrant) seems like an unjustified abuse of the powers granted to law enforcement.

Emails obtained by the New York Times indicate that's exactly what's happening. A special deployment of FBI agents was sent to Portland specifically to aid in the extraction of information from protesters' phones.

The FBI’s Washington, D.C., headquarters sent agents from its “Fly Team,” an elite counterterrorism unit, to Portland this summer during the second weekend in July. Their task was to interview arrested protesters and carry out the “initial exploitation of phones, or other communication devices,” according to FBI emails obtained through a public records request. It is unclear whether the Fly Team operation extended either past that weekend or beyond Portland, but the emails suggest that the FBI has been using counterterrorism tools and powers to map left-wing protest networks just months before an election whose result is likely to be delayed, if not challenged.

The Fly Teams have been in existence since shortly after the 9/11 attacks in 2001. But until now, they've mainly been foreign-focused -- either operating in other countries or targeting foreign terrorists. This breaks some new ground in a disturbing way: counterterrorist activity targeting US citizens, some of which have engaged in nothing more than exercising their First Amendment rights.

The emails also suggest federal law enforcement is working around warrant requirements by exploiting one particular exception:

In one of the replies to [Special Agent] Chamberlin’s email, a colleague in the Portland bureau notes that the Fly Team’s “defintion [sic] of exigency will be different from ours.”

The emails [PDF] detail an incident that might be used to stretch the definition of "exigent" to cover any detained protester. A man arrested for shining laser lights into officers' eyes was found to be carrying weapons and explosives. He consented to a search of his phone, which led to a search of his home and criminal charges. If agents can talk themselves into believing any arrestee or detainee poses a threat, phones are going to be searched without warrants in the hopes a court will grant the government the benefit of a doubt if the search is challenged.

There's nothing in the emails that says the FBI is adhering to the Fourth Amendment. There's nothing in there that says it isn't, either. But you generally don't memorialize Constitutional violations in communications that can be obtained with public records requests.

As the New York Times notes, it's unclear under what authority the FBI is acting if it's treating domestic protests like domestic terrorism. But the Constitution may not be much of an obstacle thanks to actions taken by President Ronald Reagan nearly four decades ago.

Among the special powers granted exclusively to the FBI under a Reagan-era executive order (No. 12333) are authorizations to conduct “unconsented physical searches” and “physical surveillance” for intelligence purposes in the US.

We'll know more as more information leaks out or searches are challenged in court. But even if the FBI is following the law, the law gives it a lot of leeway to engage in acts it probably shouldn't, even if it legally can.

Filed Under: 1st amendment, 4th amendment, antifa, dhs, exigent circumstances, fbi, phones, portland, protests, surveillance

It Was Nice While It Lasted: 9th Circuit Rejects Lower Court Ruling On How Abuse Of Patent Monopolies Can Violate Antitrust

from the wait,-what dept

Last year we had a detailed post about judge Lucy Koh's district court ruling that outlined exactly how Qualcomm abused its patents in an anticompetitive way to shake down the entire mobile phone industry for decades. This was in a case that was brought by the FTC and it was a stunning ruling on multiple accounts. First, it's rare for a court to recognize how patents and copyrights grant monopoly rights that can be abused in violation of antitrust rules. Second, it exposed a stunning degree of anticompetitive behavior on the part of Qualcomm.

Unfortunately, this week, the 9th Circuit overturned that ruling, though did so in a somewhat confused manner. Indeed, this ruling may significantly limit any kind of antitrust activity (at least in the 9th Circuit).

There are a lot of details, but the key element at stake was Qualcomm's "no license, no chips" rules. No company could buy Qualcomm chips, which were necessary for mobile devices, without licensing Qualcomm's entire patent portfolio. This snippet from the lower court ruling gives you the basics:

These high royalties reflected an unusual negotiating tactic called "no license, no chips." No one could buy Qualcomm's cellular chips unless they first signed a license to Qualcomm's patent portfolio. And the terms of these patent deals were heavily tilted in Qualcomm's favor.

Once a phone maker had signed its first deal with Qualcomm, Qualcomm gained even more leverage. Qualcomm had the right to unilaterally terminate a smartphone maker's chip supply once the patent licensing deal expired.

"If we are unable to source the modem, we are unable to ship the handset," said Motorola executive Todd Madderom in a deposition. "It takes many months of engineering work to design a replacement solution, if there is even a viable one on the market that supports the need."

That made Qualcomm's customers extremely vulnerable as they neared the expiration of a patent licensing deal. If a customer tried to negotiate more favorable terms—to say nothing of formally challenging Qualcomm's patent claims in court—Qualcomm could abruptly cut off the company's chip supply.

But, it got worse. The licensing terms for the patents required that you paid based on every device sold even if your devices did not include Qualcomm chips. Basically, even if you chose not to use Qualcomm's chips, you still had to pay for them. That seemed obviously anticompetitive, because if someone is already paying for Qualcomm's technology, why then pay another company as well?

However, the 9th Circuit rejects all of that as anticompetitive. Why? Because it says it wasn't anticompetitive, it was just hypercompetitive.

This case asks us to draw the line between anticompetitive behavior, which is illegal under federal antitrust law, and hypercompetitive behavior, which is not.

The ruling opens with a weird hagiography of Qualcomm. I mean, parts of it read straight out of a puff piece advertorial:

Qualcomm’s patent licensing business is very profitable, representing around two-thirds of the company’s value. But Qualcomm is no one-trick pony. The company also manufactures and sells cellular modem chips, the hardware that enables cellular devices to practice CDMA and premium LTE technologies and thereby communicate with each other across cellular networks.

A key part of the ruling is arguing that Qualcomm's "no license, no chip" plan in selling to OEM's is sensible because of the concept of patent exhaustion. If you don't recall, back in 2008, in the LG v. Quanta case, the Supreme Court made the correct call that patent rights "exhaust" upon sale. That is, if I sell my patent-protected widget to Company A, and Company B buys it and includes it in its contraptions, I can't then sue Company B. This makes sense because it's the same chip that was already legally purchased.

Yet, the 9th Circuit panel seems to conclude that this kind of ruling forced Qualcomm into its "no license, no chip" business model. Indeed, the panel seems in awe of such a business model -- jacking up prices and limiting competition by using the Supreme Court's rule as leverage to cut out a key part of the market.

Qualcomm reinforces these practices with its so-called “no license, no chips” policy, under which Qualcomm refuses to sell modem chips to OEMs that do not take licenses to practice Qualcomm’s SEPs. Otherwise, because of patent exhaustion, OEMs could decline to take licenses, arguing instead that their purchase of chips from Qualcomm extinguished Qualcomm’s patent rights with respect to any CDMA or premium LTE technologies embodied in the chips. This would not only prevent Qualcomm from obtaining the maximum value for its patents, it would result in OEMs having to pay more money (in licensing royalties) to purchase and use a competitor’s chips, which are unlicensed. Instead, Qualcomm’s practices, taken together, are “chip supplier neutral”—that is, OEMs are required to pay a per-unit licensing royalty to Qualcomm for its patent portfolios regardless of which company they choose to source their chips from.

But, what does Qualcomm "obtaining the maximum value for its patents" have to do with anything here? The only way to obtain maximum value for your patents is, by definition to be anticompetitive.

And here's where the ruling gets truly bizarre. It says that because the device manufacturers (the OEMs) don't compete with Qualcomm, then it's clearly not anticompetitive.

Although Qualcomm’s licensing and modem chip businesses have made it a major player in the broader cellular technology market, the company is not an OEM. That is, Qualcomm does not manufacture and sell cellphones and other end-use products (like smart cars) that consumers purchase and use. Thus, it does not “compete”—in the antitrust sense—against OEMs like Apple and Samsung in these product markets. Instead, these OEMs are Qualcomm’s customers.

Later it goes even further:

Thus, a substantial portion of the district court’s ruling considered alleged economic harms to OEMs—who are Qualcomm’s customers, not its competitors—resulting in higher prices to consumers. These harms, even if real, are not “anticompetitive” in the antitrust sense...

But... that gets almost everything backwards. First off, for years, antitrust experts have been saying the proper determination of whether or not something is anticompetitive is the impact on its customers. And here, it's clear that Qualcomm is using this bundling policy to jack up the prices (massively) for its customers. It seems like a quintessential example of anticompetitive behavior... and the court says no?

The ruling is worth reading in detail, as it bends over backwards to basically say that nothing that Qualcomm does violates antitrust law, it's all just good business to squeeze as much money as possible out of its patents. It even repeats again that since it doesn't see Qualcomm's actions hurting "competition itself" and merely just some competitors:

... the anticompetitive harm identified must be to competition itself, not merely to competitors.... The FTC identifies no such harm to competition.

Now, there is some reasonable logic to that line. Any kind of competition can harm competitors. If I market myself better than a competitor, that's harm to a competitor, but it's not an antitrust issue. But if that harm to the competitor is because of my monopoly power it's a different story. And here, that is absolutely the case.

Also, there are a few lines in here that, at the very least, might doom any attempts at bringing an antitrust case against companies like Amazon, Google, Apple or Facebook (at least in the 9th Circuit). For example, the court suggests that any new competitor entering the market proves there's no antitrust problem, no matter how well they did in that market, or whether or not they were hindered from obtaining market share through abuse of monopoly power:

The FTC’s conclusion that OEM-level licensing does not further competition on the merits is not only belied by MediaTek and Intel’s entries into the modem chip markets in the 2015–2016 timeframe, it also gives inadequate weight to Qualcomm’s reasonable, procompetitive justification that licensing at the OEM and chip-supplier levels simultaneously would require the company to engage in “multi-level licensing,” leading to inefficiencies and less profit. Qualcomm’s procompetitive justification is supported by at least two other companies—Nokia and Dolby—with similar SEP portfolios to Qualcomm’s.

In finally talking about the fact that Qualcomm is able to use its monopoly position to charge an anticompetitive surcharge, the panel basically says "nah..." because "patent monopolies are cool."

We hold that the district court’s “anticompetitive surcharge” theory fails to state a cogent theory of anticompetitive harm. Instead, it is premised on a misunderstanding of Federal Circuit law pertaining to the calculation of patent damages, it incorrectly conflates antitrust liability and patent law liability, and it improperly considers “anticompetitive harms to OEMs” that fall outside the relevant antitrust markets.

In short: because they have a government granted patent monopoly, it's okay for them to abuse that in anticompetitive ways, and we won't consider it anticompetitive. Or, another way of reading this: patent laws inherently create anticompetitive situations, and we're fine with it. And, tragically, that may be a correct reading of the law, as crazy as it is.

I guess this isn't that surprising. This has been the issue we've had with patents for ages -- that they are a monopoly. And that's why we were excited about the original ruling: finally recognizing that patent monopolies could be as abusive as any monopoly. But, here, the court is basically saying "abusing your patent monopoly is fine by us."

And, really, what this should mean is that we need to fix our patent laws, which are dangerous and harm competition. But... that seems unlikely.

Again, this kind of ruling almost certainly means phone prices will remain much higher than they would be in a competitive market for chips (which is why it's slightly frustrating that I've seen some supposedly "free market" supporters cheering on this ruling). But it might also mean that any antitrust fight against big tech just became significantly more difficult as well. As the court says:

Anticompetitive behavior is illegal under federal antitrust law. Hypercompetitive behavior is not.

Good luck figuring out which one is which.

Filed Under: 9th circuit, abuse, antitrust, competition, customers, devices, monopoly, patents, phones
Companies: qualcomm

UK Information Commissioner Says Police Are Grabbing Too Much Data From Phones Owned By Crime Victims

from the losing-the-tech-race,-eh? dept

The UK's Information Commissioner's Office (ICO) has taken a look at what law enforcement officers are hoovering up from citizens' phones and doesn't like what it sees. The relentless march of technology has enabled nearly everyone to walk around with a voluminous, powerful computer in their pocket -- one filled with the details and detritus of everyday living. And that relentless march has propelled citizens and their pocket computers right into the UK's regulatory void.

The ICO's report [PDF] doesn't just deal with the amount of data and communications UK cops can get from suspects' phones. It also deals with the insane amount of data cops are harvesting from devices owned by victims and witnesses of criminal acts. Left unaddressed, the lack of a solid legal framework surrounding mobile phone extractions (MPEs) will continue to lead law enforcement officers to believe they can harvest everything and look for the relevant stuff at their leisure.

Very few people would consent to this sort of intrusive search, but some aren't aware of how extensive these searches are. Those that are aware are less likely to come forward to help further an investigation, even if they're a victim of a crime.

Large volumes of data are likely to include intimate details of the private lives of not only device owners but also third parties (eg their family and friends). In other words, it is not just the privacy of the device owner that is affected, but all individuals that have communicated digitally with that person or whose contact details have been added by the owner. This presents considerable risks to privacy through excessive processing of data held on or accessed through the phone.

Left unexplained, or in cases where it is not necessary or justified, this intrusion into individuals’ privacy presents a risk of undermining confidence in the criminal justice system. People may feel less inclined to assist the police as witnesses or to come forward as a victim, if they are concerned that their and their friends’ and families’ private lives will be open to police scrutiny without proper safeguards…

Privacy is paramount when dealing with those not suspected of committing criminal acts. Standard MPE practice appears to ignore this crucial element, which only heightens distrust of law enforcement agencies. But privacy concerns are being swept aside in favor of efficiency. Why do things the right way when it's so much easier to do them this way?

PI [Privacy International] published a report calling for an urgent review of the use of MPE by the police, (“Digital stop and search: how the UK police can secretly download everything from your mobile phone” 15). It raised questions over the lawful bases for carrying out extractions, the lack of national and local guidance, and the authorisation process. [...] PI were also concerned that the use of MPE kiosks (‘self-service’ devices used by police forces to download and analyse the contents of individuals’ mobile phones) is becoming more common and forming part of ‘business as usual’ for officers, despite a lack of governance, oversight and accountability in their use.

But if law enforcement officers don't get what they want, there's a good chance crime victims won't get what they want. Here's where things get extremely unpleasant. It's not that crime victims feel this way. It's what's actually happening. When investigators aren't given consent to perform MPEs on crime victims' phones, there's a chance law enforcement will just decide to stop pursuing the investigation.

Here's what Big Brother Watch discovered after obtaining records from multiple police forces in England and Wales:

It found officers had asked for the complainant's mobile phone data in 84 sexual assault cases.

And every one of the 14 of those in which the complainant had declined had then been dropped by police.

The report calls for a long list of improvements and reforms, with an eye on safeguarding the privacy of crime victims and witnesses. ICO says all extractions should be logged and audited routinely. Investigators should be made aware that it's almost impossible to comply with data privacy laws when performing MPEs due to the amount of data/communications present on the average phone -- much of which "belongs" to other people who have communicated with the victim/witness.

It won't be enough to establish guidelines under the current legal framework. ICO says new laws must be put in place to make it explicit what can and can't be obtained with phone searches and when they can be lawfully carried out. This law would also need to set time constraints on examinations of extracted data, as well as the length of time it can be stored once obtained.

For now, the UK's legal framework is more limited than law enforcement's powers. The ICO's report aims to change that. Unfortunately, this will move at the speed of bureaucracy while tech continues to move at the speed of innovation. It's impossible to play catch-up at this speed. I say it's time to hit law enforcement with some broadly-written legislation -- you know, the sort of stuff the normals are forced to deal with all the time. Maybe that will slow the roll of data extraction until the government as a whole has time to address all the nuances.

Filed Under: data, ico, phones, police, privacy, uk

FBI Holds Press Conference To Claim Apple Prevented It From [Checks Notes] Verifying Attribution In The Pensacola Air Base Shooting

from the what-a-compelling-argument-for-broken-encryption dept

The FBI held a very performative press conference to announce it had finally gained access to communications and data originating from the Pensacola Naval Air Station shooter. The coup, apparently, is that the FBI was able to -- after months of fighting iPhone encryption -- um... nail down attribution. Here's CNN's report on the FBI's press conference:

The Saudi military trainee who killed three US sailors and wounded several others in a terror attack last year on a military base in Pensacola, Florida, was in touch with a suspected al Qaeda operative, according to multiple US officials briefed on the matter.

US investigators uncovered the al Qaeda connection after the FBI broke through the encryption protecting the Saudi attacker's iPhones, the officials said.

So, the FBI discovered that a shooter who al Qaeda claimed to be one of theirs was actually one of theirs. I'm sure the FBI found a few more leads to investigate -- potentially targeting US persons involved with the terrorist group -- but it's far from the wealth of evidence the agency continually asserted was definitely present on the phones agents weren't able to access.

It's big news in a smaller way.

If Alshamrani was directed or trained by al Qaeda, it would mark the first time since 9/11 that a foreign terrorist organization had done so in a deadly attack in the US, according to New America, a think tank.

That's an 18-year gap between foreign terrorist group-directed attacks on US soil. Not much to write home about, but the FBI seems to feel we all should be writing about it. Hopefully, this isn't the FBI's linchpin argument, because something that happens once every other decade is hardly worth the broad undermining of encryption the agency seeks.

CNN's report says something the FBI doesn't actually say: the "FBI broke through the encryption" statement. Chris Wray's remarks at the press conference don't actually state that the FBI broke the phones' encryption. (And nothing is said about the iPhone that was damaged by a bullet, which possibly rendered it completely useless.)

On the topic of innovation—I want to thank and congratulate the men and women at the FBI who devoted months of hard work to accessing these devices. They successfully tackled a problem that required tenacity, creativity, and technical expertise. Those qualities are valuable in any organization—so I know how fortunate we are, and how fortunate the American people are, that we have so many people with those qualities at the Bureau. That’s why we work to recruit the kind of people we do.

The magnitude of the challenge they faced is hard to overstate.

[...]

Unfortunately, the technique that we developed is not a fix for our broader Apple problem—it’s of pretty limited application. But it has made a huge difference in this investigation.

This doesn't clarify anything. This just says the FBI was finally able to access some of the contents, which means it could have found a way to exfiltrate or recover some data without actually breaking encryption.

What I've excised in this quote shows that this press conference wasn't about announcing these findings. It was an anti-encryption pep rally pretending to be a dry announcement about an ongoing investigation. The FBI's ulterior motives made their way to the forefront, starting with this:

We received effectively no help from Apple.

Wrong. The FBI received all the help Apple could give it. Apple was compliant with turning over all data and communications it could access. What it didn't do was offer to break the encryption on the seized devices. And while Wray may talk about delays and (no, seriously) agents "toiling through the pandemic," it was the FBI that sat on this investigation, waiting a month before asking Apple for assistance.

Then there's this statement, in which Wray says everyone's been misinformed about encryption-breaking tools sold by a handful of vendors.

We canvassed every partner, and every company, that might have had a solution to access these phones. None did, despite what some claimed in the media.

"What some claimed in the media" is a fucking disingenuous statement. This is what was claimed by vendors offering tools that bypassed Apple's built-in protections to provide access to iPhone contents. The media didn't spin this. If vendors over-promised and under-delivered, that's on them, not the journalists reporting on the latest in encryption-breaking tech.

This is twice as disingenuous when you remember the FBI refused to seek outside options in the San Bernardino shooter case because it really would rather have had legal precedent. While the FBI and DOJ went after Apple in court, vendors tried to offer their assistance. When the FBI finally decided to work with a still-undisclosed vendor to obtain the (useless) contents of the shooter's iPhone, FBI officials were upset this had derailed their attempt to obtain judicial blessing for compelled decryption. This is pure spin and it was delivered by the head of the FBI solely to portray Apple as an enemy of the rule of law and the public's safety.

Flow my collective tears, the federal policeman said.

Public servants, already swamped with important things to do to protect the American people—and toiling through a pandemic, with all the risk and hardship that entails—had to spend all that time just to access evidence we got court-authorized search warrants for months ago. Our engineers and computer scientists working to access these phones were also needed on other, pressing, national security and criminal investigations.

But the delay getting into these devices didn’t just divert our personnel from other important work. It’s also seriously hampered this investigation.

Finally getting our hands on the evidence al-Shamrani tried to keep from us is great. But we really needed it months ago, back in December, when the court issued its warrants.

Needed it for what? Confirming what al Qaeda said after the shooting? If that's all there is, it really isn't worth undermining the security of millions of encryption users, including those who work at the FBI. And it sure as hell didn't stop the FBI from performing an investigation. Wray states the FBI interviewed 500 people and obtained all the evidence it could from sources other than the locked iPhones. The investigation continued and personnel still worked round-the-clock "through a pandemic" to put this case together. Apple's contribution (or lack thereof) is only a footnote, but Wray insists it's the headline.

Don't be swayed by Wray's cheap shots. This press conference was held to directly (in Apple's case) and indirectly smear every US company that offers encryption to their users. If the FBI had held an intellectually honest press conference, it simply would have noted it found evidence linking the Pensacola shooter to al Qaeda and left it at that. (It also might have explained why it still hasn't updated its count of encrypted devices in its possession.) Instead, Wray grabbed a bunch of nails and hung his agency on the cross, punctuating every hammer strike with oblique assertions that a refusal to create encryption backdoors may result in another foreign-directed terrorist strike on the homeland sometime in the next twenty years. When the facts alone aren't compelling, the rhetoric has to make up the difference. And all we have here is a lot of anti-encryption filler.

Filed Under: al qaeda, chris wray, encryption, fbi, iphone, pensacolar, phones, terrorism
Companies: apple

We Know The FBI Can't Count Phones. A New Report Shows It Can't Count Guns And Ammo Either.

from the multi-billion-dollar-agency-using-pen-and-paper-to-track-weapons dept

We know the FBI can't accurately track how many encrypted devices it has in its possession. Two consecutive directors have pushed a "going dark" narrative using an inflated number of uncracked phones. At one point the FBI claimed it had nearly 8,000 phones in its possession, each one presumably full of evidence. When pressed for information by members of Congress, the FBI suddenly realized it had overstated this number by at least 6,000 phones. It discovered its error in May of 2018. It has yet to release an updated number.

The FBI can't track seized phones so it should come as no surprise it can't accurately track the guns and ammo in its possession. The DOJ Inspector General has completed its audit [PDF] of the FBI's weapons control system and found that the FBI isn't really controlling its weapons.

The FBI claims to have nearly 58,000 firearms in its inventory. This is pretty much the extent of the good news in the IG report:

We found that the FBI has strong physical controls over its unassigned firearms, and Special Agents are personally responsible for properly safeguarding assigned firearms. The FBI tracks its firearms using the Asset Management System (AMS), its automated property management system. During our physical inventory we were able to locate all firearms selected for our sample.

And here comes the bad news. The IG found over 360 firearms that had no designated property custodian, which is against FBI policy. Its audit sample also found two guns the FBI could not explain how or why they were in its possession.

We were unable to trace two firearms back to AMS, both of which were located in a gun safe in the Madison Resident Agency. The Firearms Instructor in Madison explained that the origins of the firearms were unknown.

The FBI also has trouble tracking firearms that have been lost or stolen.

Of the 45 lost or stolen firearms, 24 have been recovered, 1 of which was used in a crime. We also found that the FBI did not maintain complete documentation for 8 of the 45 lost or stolen firearms, including its make, model, or serial number; and a stolen firearm that was subsequently recovered more than 1 year ago was still marked as lost or stolen in AMS.

The list of lost/stolen guns is an interesting read. In every case, agents who lost weapons were suspended. But safely handling firearms appears to be an ongoing problem. Guns were stolen from vehicles, left behind in restrooms and hotel rooms. One was apparently "left on a bumper." But the best/worst missing gun synopsis is this: "stolen by daughter."

The agency's control of ammunition is even worse. Only one of the sites visited by the IG is doing this job properly.

The FBI maintained duty ammunition at 14 of the 15 sites we reviewed. We found that the FBI stored its ammunition in secured areas with access limited to FBI personnel. However, we identified weaknesses in the FBI’s ammunition tracking and physical inventory policies that increase the risk of ammunition being lost or stolen without detection. As a result, we found that 6 of the FBI sites included in our audit were not tracking over 1.2 million rounds of ammunition, and another 7 sites were not adequately tracking ammunition.

Explosives tracking fared a little better, but the system used for keeping tabs on explosives contains weaknesses that could increase the risk of explosives being lost or stolen. Only two of the eight sites with explosives on the premises were adequately tracking these items.

The Inspector General obviously recommends the FBI do better at tracking guns, ammo, and explosives. The FBI pretty much agrees with all of the IG's suggestions. But it's had plenty of time to improve things and it hasn't done all that much. The FBI loses far fewer weapons than it used to, so it at least has this area mostly under control. A 2007 audit showed the FBI had 354 weapons lost or stolen over a 22-month period in 2001-2002. By 2007, it had cut that number in half. The most recent audit shows only 45 lost/stolen weapons over a three-year period.

But this report highlights the agency's inability to count and control things in its possession. So, it's hardly surprising it has no idea how many encrypted devices it has on hand. And if it doesn't know that, it can't present an accurate picture of device encryption and its impact on investigations.

Filed Under: counting, evidence, fbi, phones

Report Says Saudi Prince MBS's Whatsapp Account Personally Sent Jeff Bezos Malware Used To Access His Phone

from the 21st-century-espionage dept

Things sure are getting even more bizarre in the world of the rich, famous, and powerful. Saudi Crown Prince Mohammed bin Salman (usually called "MBS") is now being accused of personally being involved in the hacking of Jeff Bezos' phone to get data that was eventually used against him by the National Enquirer. This is a soap opera-level story that involves a bit of background.

You may recall that, approximately a year ago, Jeff Bezos put out quite a Medium post, entitled: No thank you, Mr. Pecker, in which he exposed an attempt by David Pecker's National Enquirer to engage in what sure looks like a blackmail effort to silence Washington Post (which Bezos owns) reporting efforts. The post came about a month after the National Enquirer had released evidence of an affair that Bezos was having, including releasing personal text messages (the National Enqurier release came hours after Bezos himself announced he was getting a divorce from his wife). According to Bezos' blog post, the Enquirer had also threatened to release personal photos of Bezos if he did not call off an investigation he had launched into how the National Enquirer had obtained those text messages.

A little over a month and a half later, the investigator that Bezos had hired, Gavin de Becker, announced that he believed Saudi Arabia was involved in obtaining Bezos's personal data, adding a bit of international intrigue to the whole thing. de Becker argued that the evidence pointed to the Saudis much more than Michael Sanchez, the brother of the woman with whom Bezos was having the affair, who had claimed that he had given the data to the National Enquirer. As de Becker noted, Sanchez seemed to be a fall guy to distract from the possible Saudi connection:

My office quickly identified the person whom the Enquirer had paid as a source: a man named Michael Sanchez, the now-estranged brother of Lauren Sanchez, whom Bezos was dating. What was unusual, very unusual, was how hard AMI people worked to publicly reveal their source’s identity. First through strong hints they gave to me, and later through direct statements, AMI practically pinned a “kick me” sign on Michael Sanchez.

de Becker's investigation pointed out that the National Enquirer had contacted Sanchez first about the affair, suggesting that the attempt to work with him may have been a case of parallel construction, rather than an original source.

Saudi Arabia's potential involved was fascinating -- as the Saudi government, and MBS, have apparently been upset about the Washington Post publishing columns critical of the Saudi government by Jamal Khashoggi -- the journalist who was then killed by Saudi operatives in late 2018, in an operation that many blamed on MBS, and which MBS has eventually taken responsibility for. That murder has brought a lot more critical attention to MBS and his efforts to stomp out criticism.

So now we finally get to the latest news, in which the Guardian first reported that the real way that Bezos' text messages and photos were accessed was because MBS sent Bezos a Whatsapp message that contained the malware payload.

The encrypted message from the number used by Mohammed bin Salman is believed to have included a malicious file that infiltrated the phone of the world’s richest man, according to the results of a digital forensic analysis.

This analysis found it “highly probable” that the intrusion into the phone was triggered by an infected video file sent from the account of the Saudi heir to Bezos, the owner of the Washington Post.

The two men had been having a seemingly friendly WhatsApp exchange when, on 1 May of that year, the unsolicited file was sent, according to sources who spoke to the Guardian on the condition of anonymity.

A related story noted that Bezos and MBS had met a few weeks earlier at a Hollywood dinner organized by filmmaker Brian Grazer and agent Ari Emanuel (what a dinner that must have been) at a time when MBS was trying to ingratiate himself with both the American tech and entertainment industries (efforts that began to run into some issues after the murder of Khashoggi). Bezos and MBS apparently began communicating by Whatsapp after that dinner, and in the midst of the conversation, MBS passed along the link.

The Guardian understands a forensic analysis of Bezos’s phone, and the indications that the “hack” began within an infected file from the crown prince’s account, has been reviewed by Agnès Callamard, the UN special rapporteur who investigates extrajudicial killings. It is understood that it is considered credible enough for investigators to be considering a formal approach to Saudi Arabia to ask for an explanation.

While the Guardian does not share the full report (or even say who wrote it), Vice Motherboard has since obtained the report, and provides even more details:

The report, obtained by Motherboard, indicates that investigators set up a secure lab to examine the phone and its artifacts and spent two days poring over the device but were unable to find any malware on it. Instead, they only found a suspicious video file sent to Bezos on May 1, 2018 that “appears to be an Arabic language promotional film about telecommunications.”

That file shows an image of the Saudi Arabian flag and Swedish flags and arrived with an encrypted downloader. Because the downloader was encrypted this delayed or further prevented “study of the code delivered along with the video.”

Investigators determined the video or downloader were suspicious only because Bezos’ phone subsequently began transmitting large amounts of data. “[W]ithin hours of the encrypted downloader being received, a massive and unauthorized exfiltration of data from Bezos’ phone began, continuing and escalating for months thereafter,” the report states.

The report highlights that this new massive amount of data flow "never returned to baseline" suggesting that the link certainly did something to his phone that started sending all Bezos' data elsewhere. The report includes some fairly fascinating screenshots, including first how Bezos and MBS connected on Whatsapp:

And then there's a screenshot of the random video link that supposedly lead to the infection of Bezos' phone:

The story then gets even crazier, as it alleges that a few months later, MBS sent two more odd texts to Bezos:

The first such text was sent to Bezos from MBS' account on November 8, 2018, and contained a single photograph of a woman resembling Lauren Sanchez, with whom Bezos was having a then-secret personal relationship. For context, this was after the relationship would have been obvious to persons with access to private texts, calls, and images on Bezos' phone, but months before the relationship was known or reported publicly. The photo and the cryptic caption were sent precisely during the period Bezos and his wife were exploring divorce. "Arguing with a woman is like reading the Software License agreement. In the end you have to ignore everything and click I agree." (Memes such as this were available on the Internet, however the content of the text was not typical of any past communication from MBS, making it likely it was sent with reference to Bezos' personal life events at the time.

The second text was also somewhat creepy -- and also somewhat counterproductive. The two hadn't communicated for a while, and yet just a couple days after Bezos was given a briefing about how the Saudis were mounting a big online campaign against him, MBS randomly texted Bezos not to believe everything he's heard:

The second text demonstrates awareness of non-public information that could have been gained via surveillance of Bezos' phone was sent to Bezos from MBS's WhatsApp account, after more than three (3) months of no communication between the parties. On February 14, 2019, Bezos was provided a detailed briefing about the extent of the Saudi online campaign against him. The briefing was provided in two (2) calls on the Bezos' phone. This text evinces an awareness of what Bezos had just been told:

It seems a bit galaxy brain to suddenly pop up with a message like, telling Bezos not to believe all he'd heard about Saudi attempts to hack him, in a manner that basically would confirm that the Saudi's had access to his private conversations. Though, to be fair, it is possible that MBS's message was not in reference to private briefings, but rather in reference to Bezos' own Medium blog post (referenced at the top of this story) which had come out a week earlier, and had mentioned the possibility of Saudi involvement with the National Enquirer. So there is a potentially non-nefarious explanation for this particular text.

However, it does seem that it was this latter text that caused Bezos and de Becker to begin seriously investigating whether or not the Saudis had hacked Bezos' phone, because it was the very next day that de Becker agreed to get Bezos' phone analyzed.

In response to all of this, two UN Special Rapporteurs, Agnes Callamard, UN Special Rapporteur on summary executions and extrajudicial killings, and David Kaye, UN Special Rapporteur on freedom of expression, have put out a call for an investigation into MBS's role in all of this:

"The information we have received suggests the possible involvement of the Crown Prince in surveillance of Mr. Bezos, in an effort to influence, if not silence, The Washington Post's reporting on Saudi Arabia. The allegations reinforce other reporting pointing to a pattern of targeted surveillance of perceived opponents and those of broader strategic importance to the Saudi authorities, including nationals and non-nationals. These allegations are relevant as well to ongoing evaluation of claims about the Crown Prince's involvement in the 2018 murder of Saudi and Washington Post journalist, Jamal Khashoggi.

"The alleged hacking of Mr. Bezos's phone, and those of others, demands immediate investigation by US and other relevant authorities, including investigation of the continuous, multi-year, direct and personal involvement of the Crown Prince in efforts to target perceived opponents.

"This reported surveillance of Mr. Bezos, allegedly through software developed and marketed by a private company and transferred to a government without judicial control of its use, is, if true, a concrete example of the harms that result from the unconstrained marketing, sale and use of spyware. Surveillance through digital means must be subjected to the most rigorous control, including by judicial authorities and national and international export control regimes, to protect against the ease of its abuse. It underscores the pressing need for a moratorium on the global sale and transfer of private surveillance technology.

"The circumstances and timing of the hacking and surveillance of Bezos also strengthen support for further investigation by US and other relevant authorities of the allegations that the Crown Prince ordered, incited, or, at a minimum, was aware of planning for but failed to stop the mission that fatally targeted Mr. Khashoggi in Istanbul.

At a time when Saudi Arabia was supposedly investigating the killing of Mr. Khashoggi, and prosecuting those it deemed responsible, it was clandestinely waging a massive online campaign against Mr. Bezos and Amazon targeting him principally as the owner of The Washington Post."

The whole story is completely crazy -- and feels like a made up Hollywood movie of the kind Grazer might produce -- rather than a true story involving two of the world's richest and most powerful men. Anyway, in the meantime, never click on random videos sent to you by rich autocrats with a history of oppression.

Filed Under: ari emmanuel, brian grazer, david pecker, gavin de becker, hacking, jeff bezos, malware, mbs, mohammad bin salman, phones
Companies: whatsapp

Low Cost Phones Are Turning Privacy Into A Luxury Option

from the ill-communication dept

Even when you're shelling out thousands of dollars for the latest smartphone and an "unlimited" data plan for it to run on, that cost expenditure still puts you at great privacy risk. Wireless carriers, for years, have collected and sold your location and other data to a long line of dubious middlemen, and despite a lot of sound and fury on this subject, few (outside of maybe the EFF) are really doing much about it. And with the FCC recently having self-immolated at lobbyist request and any new meaningful privacy protections derailed by bickering, that's not changing anytime soon.

Less discussed is the privacy nightmare you'll find in "discounted" phones designed to help "bridge the digital divide." While numerous vendors and tech giants have cooked up lower-cost Android phones with marketing focused on helping the poor, a new study by advocacy group Privacy International found that the privacy trade offs of these devices are... potent. Not only do they usually come with outdated OS' opening the door to hackers, the phones have locked down user control to such a degree they're unable to remove apps that may also pose security risks:

"The MYA2 also has apps that can’t be updated or deleted, and those apps contain multiple security and privacy flaws. One of those pre-installed apps that can’t be removed, Facebook Lite, gets default permission to track everywhere you go, upload all your contacts, and read your phone’s calendar. The fact that Facebook Lite can’t be removed is especially worrying because the app suffered a major privacy snafu earlier this year when hundreds of millions of Facebook Lite users had their passwords exposed. Facebook did not respond to request for comment."

It's part of a broader issue in telecommunications where privacy has become a luxury available only to those who can afford it. Some telecom giants like AT&T have tried to push the barrier even further, only letting users opt out of online snoopvertising if they're willing to pay $500 more annually for telecom services. Between the apps, the phone, hackers, and your wireless carrier tracking, hacking, and monetizing your every waking moment, it's a privacy and security minefield out there for even affluent smartphone buyers.

Studies suggest low income users realize that in the modern telecom landscape there are stark privacy penalties for being poor, yet feel they have no real power in the equation:

"Yet millions of Americans who can’t afford to buy a computer or install broadband internet at home often have no choice but to use such devices, which become their sole means of accessing the internet. If they want to enjoy the same basic conveniences that people in higher socioeconomic tiers have—such as transportation directions, online bill pay, and email—they may have to give up their privacy in exchange."

The market won't stop the practice because it's profitable to hoover up every shred of data. The government won't stop this process because Congress is slathered with mountains of cross industry campaign contributions that eliminate any motivation to craft meaningful privacy guidelines with any real teeth. With 3.7 billion users expected to have their only online access come via smartphone by 2025, that might just be a problem, and making privacy a "luxury feature" will only make said problem worse.

Filed Under: luxury, mobile devices, phones, price, privacy

The FBI Tried To Get A Secure Phone Company To Create A Backdoor In Its Encrypted Network

from the more-holes-equals-less-jail dept

Not a great week for the FBI, encryption-wise. The same week it was revealed the FBI's encrypted communications system was cracked by the Russians, a report by Joseph Cox of Motherboard details the agency's failure to punch a hole in a phone company's encrypted network.

The phone company targeted by the feds was Phantom Secure, a device maker with a business model that revolved almost exclusively around making secure phones for criminals. Apparently the supplier of choice for the Sinola drug cartel, Phantom Secure had been under investigation for years when its owner was arrested in 2018.

These efforts were apparently made after the arrest of the head of the company, with the FBI pitching a major sentence reduction if Phantom Secure CEO Vincent Ramos built the agency a backdoor.

"He was given the opportunity to do significantly less time if he identified users or built in/gave backdoor access," one source who knows Ramos personally and has spoken with him about the issue after his arrest told Motherboard.

Other law enforcement officers who worked on the investigation said similar things. The FBI wanted a backdoor so it could go after Phantom's numerous criminal customers. Despite the pressure, it appears Ramos never gave the FBI what it wanted.

A third source told Motherboard "He never gave law enforcement a backdoor into Phantom Secure. He did not do that." When pressed on whether the FBI still asked for access, the source, who worked directly on the case, said, "Basically that's all I want to say. He did not give law enforcement a backdoor into Phantom Secure."

The DOJ's tradition of begging for backdoors was apparently part of this criminal investigation as well. Cox's report says the CEO didn't actually have the tech talent to create a backdoor so the FBI pushed him to talk one of his employees into crafting a hole in the Phantom's PGP-protected system. When your customers are drug cartels known for their viciousness, it's probably safer to take the extra years in an American prison, which appears to be what Ramos chose to do.

The arrest of Ramos gave the FBI some leverage but it still couldn't get the backdoor it wanted. And just because Phantom Secure ended up in the business of selling exclusively to criminal organizations doesn't mean that's the reason the company was created. As Cox notes, Phantom Secure started as a legit option for security-conscious customers. Unfortunately, it chose to pursue the criminal market when that appeared to be the more profitable sector.

While it may suck that the FBI it didn't get its backdoor, it probably works out better for cellphone users anywhere. Phantom Secure modified Blackberry devices with its own software to create an encrypted network. The creation of a backdoor into this network may have made it easier to exploit off-the-shelf Blackberry devices or other secure messaging services that use PGP to encrypt data. Assuming this backdoor would have been harmless just because it targeted known criminal users is the kind of assumption the FBI would love everyone to make. Let's not do it any favors.

Filed Under: backdoor, doj, encryption, fbi, phones, vincent ramos
Companies: phantom secure