A Teenager Tried To Warn Apple About It's Facetime Security Flaw, But Appears To Have Been Ignored

from the go-to-voicemail dept

By now, you've almost certainly heard about the latest big technology security flaw, in which Apple's FaceTime feature contains a bug that allows a caller using FaceTime to hear through the recipeient's phone while the call was still ringing. This obviously has all kinds of people all kinds of freaked out, since the bug essentially turns any iPhone into a short-burst surveillance bug. This has led some to opine that Apple, which has a fairly decent reputation from a privacy standpoint, is at risk of having that reputation torpedoed over this story.

And that might be all the more the case when the public discovers that Apple was informed of this bug by a teenager and his mother in the weeks running up to the press coverage of it, and did nothing about it.

The Wall Street Journal reports that Grant Thompson, from Tucson, was “setting up a FaceTime chat with friends ahead of a ‘Fortnite’ videogame-playing session when he stumbled on the bug”. It was then that Thompson noticed that he could hear audio from friends who had yet to join the call. Grant quickly told his mother, Michele, and the pair spent a week trying to contact Apple to warn them about the issue.

The WSJ say after some calls and faxes they “eventually traded a few emails” with Apple’s security team, but it wasn’t until reports of the bug blew up on Twitter that the decision was made to disable Group Facetime.

This apparently happened a week or so before this all exploded on Twitter and in the media. We've heard stories like this in the past, of course, but it always amazes me that tech companies aren't better about having a unified message across entire companies that staff should want to report this sort of thing up the hierarchy, and those high-ups should jump on addressing these reports both quickly and publicly. Imagine a world where Apple had lauded this teenager for informing the company about the bug and in which Apple had proactively disabled group FaceTime until the bug was resolved? Apple would have come out looking, once again, as though it were looking out for the privacy interests of its users.

Instead, it sure looks like the company was hoping to stick its head in the sand and pretend the bug didn't exist. Or, more charitably, perhaps the company thought it could simply do away with the bug quietly via an update with vague patchlist notes. Either way, it's not a great look.

Filed Under: facetime, grant thompson, security, security disclosure, warning
Companies: apple

FBI Wants To Make It Easier For You To Tell Your Customers They Might Be Felonious Pirates

from the yeah,-that'll-work dept

The following may look familiar to you: It's the FBI's special "anti-piracy" warning. For the past few years, under a special "pilot" program, the FBI has allowed the RIAA, MPAA, BSA, ESA and SIIA (basically, the big record labels, movie studios, video game makers and software companies) to make use of the logo to warn all of their customers that they just might be felons and the FBI might show up at any moment. It's pure FUD. It also makes no difference. Is there seriously anyone anywhere in the world who sees this logo and suddenly changes their behavior?

However, this program is about to expand in a big, big way. The FBI is about to release new rules (pdf and embedded below) that expand the program so that any copyright holder will be allowed to slap this logo on their product. Expect to start seeing it everywhere... and to feel that much more like the content creator you're legitimately buying from thinks you're a crook subject to federal law enforcement action. Way to "connect" with fans, huh?

The document from the FBI discussing this repeats a few times that the FBI really feels like this program is effective and important. Could they be any more out of touch?

First, the FBI believes that the APW Seal and accompanying warnings convey important messages to the public and are a significant component of its efforts to deter and to investigate federal crimes involving the piracy of intellectual property. Allowing use by copyright holders who are not members of industry associations will enhance those efforts. Second, although broader access may make unauthorized use more likely, this concern is overshadowed by the value of increasing public awareness of these prohibitions and the FBI’s role in investigating related criminal activity.

There are all sorts of issues with this. The first is that this whole campaign is ignoring a key point: nearly all copyright infringement is a civil infraction, not a criminal one. Most ordinary users don't understand the difference between civil and criminal infringement -- and the FBI and its silly seal do nothing to explain that difference. It's pretty clear that the purpose is to falsely imply that sharing with a friend music you legally purchased might somehow lead you to being targeted in an FBI sting operation. It's FUD, plain and simple. Second, the idea that spreading this logo further will deter actual criminal infringement? Are they serious? Remember, one of the requirements for criminal copyright infringement is that the action is willful. That means that the person knows they're breaking the law. So educating them on the fact that they're breaking the law... er... shouldn't make much of a difference.

Finally, notice that nowhere does the FBI provide any data on how effective this program has been. Because there isn't any. The MPAA shows this logo before movies, and it's not like there has been any less infringement. In fact, the FBI and ICE recently decided to double up and extend the warnings on DVDs , and it's not like that made a difference either. No, instead, all it's done is piss off tons of legitimate customers, who paid good money for the content, only to be interrupted by a giant FBI logo warning them that they may be criminals facing federal charges. The FBI even admits: "it is difficult to measure the effectiveness of the APW Seal program at preventing piracy," but apparently that won't stop it from expanding it. Who in their right mind thinks this is a sensible strategy?

Either way, it's interesting to read through the comments and feedback on this program -- including someone who suggested that the FBI should make sure the warning is skippable at the beginning of movies (the FBI notes that's up to the film producers) or another one that says this seal should be mandatory on copyright-protected works (the FBI rightly points out it has no such authority). Repeatedly, when people raise issues of more widespread use of the seal (dilution, confusion, belief that works without the seal aren't protected, etc.) the FBI insists that the supposed benefits of blanketing the universe with this logo far outweigh any downsides.

There were also concerns raised that the logo will have serious chilling effects on fair use -- which is definitely a major possibility. And the FBI's response is ridiculous.

Five comments also expressed a concern that the broader accessibility of the APW Seal may have a “chilling effect” on fair use, as some copyright holders may attempt to use the APW Seal to discourage uses of their copyrighted work that would otherwise be permissible under the fair use doctrine. The FBI fully recognizes that fair use, which is authorized under Title 17, United States Code, Section 107, does not constitute infringement, much less a federal crime. The warning language does not suggest otherwise. The FBI intends to address this matter on its public website.

Because we all know that everyone who sees the logo will go to the FBI's website and read the fine print at the bottom of the page.

Of course, what's really crazy in all of this is that the FBI is famous for having an itchy trigger finger when anyone uses its normal logo. Remember, this is the same FBI that, just two years ago, sent a threat letter to Wikipedia, because the Wikipedia page on the FBI shows the FBI logo (leading to an awesome reply from Wikimedia General Counsel, Mike Godwin).

Honestly, the whole thing is silly, but because of this kind of cluelessness, expect to see those pointless FBI warning logos on all sorts of content in the future, so that every time you legitimately purchase content, you'll be reminded that the copyright holder thinks you're a lousy stinking thief who deserves a federal investigation. I'm still trying to figure out how that could possibly be good for business, but I guess I just don't understand copyright...

Filed Under: anti-piracy, chilling effect, fair use, fbi, warning
Companies: bsa, esa, mpa, riaa, siia