Mobile Spyware Use In Domestic Violence Ramps Up

from the following-the-nsa's-example dept

We recently wrote about the emergence of NSA-like spying platforms for mobile devices. Ostensibly designed and marketed for worried mothers and/or employers to monitor their children and/or employees, reports instead indicate a more nefarious use employed by jealous men and women looking to spy on their would-be significant others. In other words, technology somewhat similar to what the NSA employs generally is being used quite specifically by the unhinged, who appear to have taken our spy agencies' example to heart.

If some recent reports are to be believed, most of us have probably underestimated the problem instead of blowing it out of proportion.

MobiStealth, the product that received such rave reviews online, was used by convicted murderer Simon Gittany to read his girlfriend Lisa Harnum's text messages, one of several forms of control and surveillance he subjected her to. The product's website encourages potential buyers to ''get the answers you deserve''. When Gittany learned of Ms Harnum's plan to escape the abusive relationship in July 2011, he threw her off the balcony of their 15th-floor Sydney apartment.

Down Under, at least, it would appear this wasn't an isolated incident.

In a Victorian study last year, 97 per cent of domestic violence workers reported that perpetrators were using mobile technologies to monitor and harass women in domestic situations. Two-thirds of the 46 victims interviewed said they were made to feel like they were being watched or tracked, yet less than half told somebody about it.

While that first number is certainly shocking, I'm actually far more intrigued by the second set of statistics. Less than half of domestic violence victims who felt like they were being tracked on their mobile devices didn't say anything to anyone? This reeks of resignation when what might be needed most is a good dose of recalcitrance. While it may be difficult to directly point the blame for these domestic violence perps at intrusively spying government agencies, I wonder if the same could be said for the victims' reluctance to do anything about being spied on. If we have to accept a world in which our own governments, or foreign governments, are going to spy on us, perhaps it makes us less likely to push back against spying that is of a domestic nature?

I'm not sure, but the way this technology is progressing and the price at which it is offered likely means that stories for this kind of thing are in their infancy stages.

Mobile phone spyware costs as little as $6 a month and needs to be installed physically on a phone once for it to operate without the owner's knowledge. Shane Johnson, a spokesman for Sydney company Spousebusters, said it sold ''hundreds'' of GPS trackers, hidden cameras, listening bugs and spyware programs a year. The company asks no questions of purchasers and takes no responsibility for people using legal products to commit illegal acts.

And the perps can claim all along they're only following the NSA's example? Oh, this should work out well...

Filed Under: domestic violence, malware, mobile spyware, spyware

Police Utilizing Private Companies, Exploits To Access Data From Suspects' Smartphones

from the brute-force-attacks-that-don't-involve-SWAT-members,-battering-rams dept

Law enforcement agencies really want to see your phone's contents. I mean, they really want to. Martin Kaste at NPR has a story on law enforcement and smartphones which contains the following quote from a Rolf Norton, a Seattle homicide detective.

"I'm thinking there's probably a wealth of information that just got tucked into your pocket," Norton says. "Something that we'd like to get our hands on."

Easy for law enforcement officers to say, but today's phones have more in common with a personal computer than they do with, say, the contents of someone's pants pockets, as the state of Texas memorably argued.

The courts have offered mixed opinions as to whether a warrant is needed to view the contents of someone's phone. This lack of a "bright line" is increasingly problematic as smartphones have become a convenient, pocket-sized data center that can reveal plenty of information that wouldn't normally be accessible without a warrant.

The NPR story deals only with access granted by warrants, but it does lead off with another Detective Norton quote which points out how officers will attempt to separate the ignorant from their (possibly incriminating) evidence.

Once he's seized a phone, Norton says, he often has to return to the owner to ask for help.

"Maybe you've established a rapport and you're getting along with this person," Norton says. "We'll reach out to that person and say, 'Hey, your phone's locked. We'd like to inspect it. We'll probably be getting a warrant. Would you give us your password?' "

Refusing to hand over a password shouldn't seem to be a problem, but like the issue listed above, the courts have been unclear as to whether the Fifth Amendment's protections against self-incrimination extends to passwords. This could lead to obstruction charges or contempt of court for the phone's owner.

Just getting a warrant doesn't necessarily make everything OK, either. There's a ton of non-relevant data on any given smartphone, all of which can easily be accessed once the phone is unlocked. Narrowly-written warrants that set limits on what officers can and can't look at are a partial solution, but one that few law enforcement agencies are likely to follow.

Blindly diving into the contents of someone's smartphone exposes a whole lot of information, and if officers aren't exactly sure where this incriminating data is located, they'll probe around until they can find it. Armed with just enough "belief and information" to be dangerous, they'll easily be able to make the case that all contents are "relevant" until proven otherwise. This obviously raises privacy concerns, but again, there's no specific protection in place for these contents, which some courts have argued contain no "expectation of privacy" thanks to constant "checkins" with third party providers and services.

Not that the lack of a warrant or permission will necessarily prevent the phone from being searched. (That "problem" can always be dealt with later in the courtroom…)

Companies such as Guidance Software and Cellebrite sell products to law enforcement that "image" smartphones. The products can pull data off in bulk for use as evidence. BrickHouse Security in New York sells products like this for iPhone and Android. CEO Todd Morris says the handset manufacturers don't support this, so it's a constant effort to keep the forensic software up to date.

As Morris notes, cellphone companies aren't cooperating in providing back doors for law enforcement to access phones without warrants. So, like our very own NSA, these companies use exploits to crack phones for curious cops.

These phone-copying systems rely heavily on what hackers call "exploits," or vulnerabilities in the phones' operating systems that can be used to get around the password or encryption.

All in all, Apple's phones are more secure than Android handsets. But either way, having to go through the warrant process can mean weeks to months of waiting (if the handset needs to be returned to the manufacturer) for the release of "rescued" data. (Courts have been more reluctant to force defendants to turn over passwords, seeing this as more of a clear Fifth Amendment violation.) Not surprisingly, this turnaround time is considered unacceptable, hence the arms race of private company vs. private company to gain (and maintain) control of a smartphone's contents.

Even considering the oft-abused Third Party Doctrine, it would seem that a warrantless search of a smartphone would be a Fourth Amendment violation. There's just too much information stored on the average smartphone to be compared to anything found on a person during a normal search. And, as a New York law student recently asked Supreme Court Justice Antonin Scalia, isn't searching someone's computer roughly equivalent to their "effects," Fourth Amendment-wise? For all intents and purposes, a smartphone is a portable computer, loaded with a person's "effects" and creating a time/date/location "event" every time it pings a cell tower.

Considering how much info can be gathered from a single smartphone, It's little wonder law enforcement wants to peek at arrestees' smartphones, but the courts need to do a bit of catching up to today's cellphone realities. And there needs to be more attention paid to the fact that law enforcement agencies are partnering with private companies to crack phones, apparently without asking for a warrant first.

Filed Under: fifth amendment, fourth amendment, law enforcement, mobile phones, passwords, police

Dear Everyone: Stop Freaking Out That Malaysian Airlines Notified Victim's Families By Text Message

from the opt-in dept

Text messages are now used for many, many things. Such as laying off employees, mistakenly locking down schools, and going all George Orwell on local protests. As with most recent trends in technology, there are the detractors, decrying a loss of personal communication in favor of these heartless words that ding our smart phones. Never mind how useful most of this stuff is, or the wants and needs of those involved. For some, new technology is bad and society is about to fail.

There's a similar sentiment found in news reports of the families of the doomed Malaysia Airlines Flight 370 victims being notified that all aboard were killed via text message.

Before a Monday news conference announcing that Malaysia Airlines Flight 370 ended in the Indian Ocean, relatives of passengers learned the tragic news via a text from the airline. The text read: "Malaysia Airlines deeply regrets that we have to assume beyond a reasonable doubt that MH370 has been lost and that none of those on board survived. As you will hear in the next hour from Malaysia's Prime Minister, we must now accept all evidence suggests the plane went down in the Southern Indian Ocean."

That bit pulled from a CNN article is fairly tame, though it's a bit strange to see the fact that a text was sent out to some families (others were notified in person, with counselors on hand) leading the piece. Other reports, such as this one from Gawker, seem to treat the text notification as if it was the story. In that instance, the headline reads:

Malaysia Airlines Broke Crash News to Families Via Text

Focusing on this is stupid, not only because it's barely a story, but also because all this hand-wringing is entirely unwarranted. Malaysia Airlines themselves informed the public why they had gone with these text messages, while also clarifying that this wasn't a mass text that went out to all families with no other action taken. The texts were an opt-in decision by families that could not be met face to face at hotels or support centers. They wanted the families of the victims to get the news first before reporters got a hold of the story.

So while this story goes viral throughout the day, keep in mind that this is actually a good thing the airline did, not some heartless brush off of victims' families.

Filed Under: malaysia, text message, tragedy
Companies: malaysian airlines

Town Built Around No WiFi/Radio Waves Rules Is Right Next To NSA Snoop Center

from the i,-uh,-wait,-what? dept

In the realm of conspiracy theories, I suppose the baseless claims that WiFi signals can make people ill doesn't really rank up there with chem-trails, Kennedy assassinations, and that one time former President Bush personally remote controlled alien inviso-missiles into the twin towers and the Pentagon before shooting down another plane over Pennsylvania. Still, the press likes to eat this stuff up, because what harm could come from scaring the hell out of everyone without doing a little fact-checking?

The result can be equal parts sad and hilarious. Take Green Bank, West Virginia, for example. Green Bank is a town of 147 residents that's experiencing a relative population boom simply because it's in an area where WiFi, radio signals and the like are not allowed.

At least 36 people moved to live in Green Bank last year, claiming that they suffer from a condition known as "Electromagnetic Sensitivity", where symptoms include acute headaches, heart palpitations, tinnitus, eye problems and feeling the sensation of burning skin. Green Bank has only 147 residents and sits within the National Radio Quiet Zone, a large area of land measuring 34,000 square kilometres that restricts radio signal transmissions in order to protect radio telescopes, antennas and receivers belonging to the National Radio Astronomy Observatory and the Sugar Grove US Naval Radio Station.

If you're sure you've heard of Sugar Grove before, it's probably not because the alien overlords are beaming those thoughts into your noggin through your wireless router. Instead, Sugar Grove is one of the prime hubs in which the NSA monitors communications of foreigners, domestics, and all those pets of ours that have somehow set up their own Facebook accounts. The delicious irony in a town growing because people don't like electronic signals as it sits directly next to a government facility gathering all those signals would be pure fun if some of the personal stories of the residents weren't so sad.

"It began with a constant ringing in my ears. I couldn't sleep in the house anymore and felt sick all the time. Any food I brought into the house would make me feel ill. I got heart palpitations. It was like I was slowly being poisoned," Deborah Cooney, a former bank vice president from San Diego told the Daily Mail.

Cooney, 50, claims that her symptoms began in 2011 after hundreds of Wi-Fi enabled smart meters were installed near her home, and that the Wi-Fi even affected her purebred Himalayan cat Mimi.

"Mimi went from being a typical house cat to one that would never stay home and eventually she ran away and never came back," she said.

So we have a former VP at a bank, ostensibly a successful woman who was otherwise happy with her surroundings, moving to a completely different small town due to the unsubstantiated fear of the same WiFi signals that don't seem to have any effect on the general population. That's what you get when you have a press that refuses to take a critical look at these claims. Even this article gives too much credence to an organization with a clear conflict of interests.

Powerwatch, a not-for-profit, non-funded UK public information service has been studying the research done on how electromagnetic fields affect health for 20 years. The organisation feels that the evidence points to Electromagnetic Sensitivity likely being a real condition that is in some ways similar to Photosensitive Epilepsy, where some types of light can cause a person to have an epileptic seizure.

"I see no reason why it's not possible. I've seen lots of peer-review published work that is good enough to say 'Yes, we've found something,' but not good enough to say 'Yes, this is conclusively real'. What we're lacking is good research to prove it conclusively and it's difficult to get funding for the research," Powerwatch technical manager Graham Lanburn told IBTimes UK.

Missing in that section of the article is the minor note that Powerwatch profits from the fear they push on people -- and has been hyping up bogus claims of WiFi sickness in the UK for years. They aren't a study group, they sell "tools" to "help" ward off the "effects" of WiFi signals, your cell phones, and ELF waves. Here's a little tip for all you web surfers out there: the moment a home page for a lobbying group boldly features an entire section tab on "industry bias," you should probably run far, far away. Besides that, that quote from Mr. Lanburn should be carved into stone so that future generations can have a wonderful example of a non-scientific statement. Claiming to have lots of peer-reviewed work to back your claim to the point of it being conclusive, while both never bothering to cite the studies and subsequently admitting you don't have any research to prove it conclusively is one of the grandest exhibitions of bullshit I've seen this side of a politician. At the same time, actual studies have shown that that WiFi doesn't make people sick. Considering that Powerwatch has been called out before for these kinds of claims, it's kind of amazing that anyone still takes its claims at face value.

Meanwhile, duped people with wayward felines are flocking to Green Bank, passing an NSA snoop station on their way -- which likely has way more powerful radio waves emanating from its caverns -- all because these people want to pretend to do science. That's both funny and sad, though I think the latter takes precedence.

Filed Under: electromagnetic sensitivity, green bank, nsa, sugar grove, west virginia, wifi, wireless

'5G' Wireless Doesn't Even Technically Exist Yet, But Everyone's Pretty Sure It's Going To Fix Everything

from the this-network-runs-on-nonsense dept

When it comes to wireless networks, no amount of hype is too little when it comes to trying to promote looming standards or the next-generation of wireless technology. You probably remember WiMax, which Intel hyped as the "the most important invention since the Internet itself." The press gladly grabbed Intel's claim willingly and ran with it, insisting repeatedly that the technology was going to change absolutely everything. As it turned out, WiMax wound up being a niche solution that barely made a dent before being made irrelevant by other standards, like HSPA+ and LTE.

You might also be familiar with the constant marketing distortions that herald the arrival of the latest "next-generation" (third generation=3G, fourth generation=4G) wireless standard, whether it's the way Verizon initially pretended that their old network was 3G, or the way that all carriers currently pretend to offer the largest 4G network. Ultimately carriers "fixed" complaints about them being misleading by convincing the ITU that they should be allowed to call pretty much everything 4G, regardless of whether we're talking about LTE or carrier pigeon.

Enter the fifth generation of wireless (5G), which hasn't even been defined yet, but which people are already fairly sure is going to wash your dishes, cure cancer, and help John Travolta with his pronunciation problems. The generations generally come in ten year increments, and while 5G is just a vague outline currently, South Korea appears prepared to lead the charge, spending $1.5 billion to research next-generation 5G networks (whatever they wind up being) that they claim will provide speeds 1,000 times faster than what's available today.

Despite the fact that 5G is barely an embryonic concept, and any real networks likely won't even appear until at least 2020, it's never too early to dive head-first into the shallows of the hype pool. Samsung, for example, has been insisting that pretty much anything they cook up in their their labs is 5G. Broadcom insists their new Wi-Fi gear is 5G, even if it has nothing to do with cellular networks. News outlets are happy to help with the confusion too, calling 4G technologies 5G -- just because. The European Union, like everybody else, has absolutely no idea what 5G wireless is -- but they're pretty damn sure it's going to help them fix youth unemployment and your case of the sniffles:

"Neelie Kroes, vice president of the European Commission, sees 5G as a potential cure for youth unemployment, which has reached 70 percent in some areas of the European Union. It's also going to be key for e-health services and the automotive industry, she said at a news conference in Barcelona."

Is there anything the next, entirely ambiguous incarnation of wireless technologies can't do? The best part moving forward is, even if you're not actually offering "5G" any time in the next decade, you can always just pretend you do. Put "5G researcher" on your next resume update even if you're a janitorial custodian. Sell "5G" burgers! Insist your company's network is the only network that's 5G, and everybody else's network actually runs on pudding! Go ahead! Nobody will fact check. Enjoy!

Filed Under: 4g, 5g, hype, wireless

Police Tell Courts Non-Disclosure Agreement Prevents Them From Getting A Warrant For Cell Phone Tower Spoofers

from the NDAs,-the-new-4th-amendment-workaround dept

As we've noted before, several law enforcement agencies, including the FBI, have been deploying "stingray" devices (devices that mimic cell towers) for years, using them to collect data on thousands of cell phone owners. Almost every single "stingray" device has been put into use without informing the public. That opacity is standard operating procedure for everyone, from local law enforcement all the way up through the DOJ.

This opacity is to be expected. The public is rarely notified in advance of deployment. It's only after the use is discovered that an effort is made (and usually a weak one at that) to address the public's concerns. Officials tend to claim the "danger" presented by being transparent far outweighs whatever collateral damage to privacy or civil liberties the public suffers.

That these devices are routinely used without a warrant is also, sadly, unsurprising. As far as the law has been interpreted, US citizens have very little expectation of privacy in the so-called "business records" generated by their cell phones' connection to each and every cell tower. This is why "cell tower dumps" have become a go-to tool for warrantless data hauls.

So far, so routine. But as Kim Zetter at Wired reports, there's yet another reason law enforcement agencies aren't seeking warrants before deploying stingray devices.

Police in Florida have offered a startling excuse for having used a controversial “stingray” cell phone tracking gadget 200 times without ever telling a judge: the device’s manufacturer made them sign a non-disclosure agreement that they say prevented them from telling the courts.

The shocking revelation, uncovered by the American Civil Liberties Union, came during an appeal over a 2008 sexual battery case in Tallahassee in which the suspect also stole the victim’s cell phone. Using the stingray — which simulates a cell phone tower in order to trick nearby mobile devices into connecting to it and revealing their location — police were able to track him to an apartment.

During proceedings in the case, authorities revealed that they had used the equipment at least 200 additional times since 2010 without disclosing this to courts and obtaining a warrant.

This is a new dodge. Law enforcement has usually avoided obtaining warrants by using the third party doctrine and, in most states, this has been deemed perfectly legal. However, it seems unlikely that judges will be sympathetic to claims that a private contractor's NDA supersedes stipulations meant to keep law enforcement in adherence with the Fourth Amendment.

This surprising admission by the Tallahassee Police Dept. is part of a sealed court record. This was inadvertently exposed during the appeal. Courtroom video shows just how irritated two of the presiding judges were at the PD's violation of warranty requirements.

When the government attorney tried to argue in court that the police had planned to obtain a warrant to enter the apartment, one of the judges interrupted.

“No, no, no, no, no,” he said. “I think this record makes it very clear they were not going to get a search warrant because they had never gotten a search warrant for this technology.”

His fellow judge then interjected loudly, “Two-hundred times they have not.”

This appears at about the 18:00 mark on the video of the oral arguments. The government attorney's explanation (beginning around 16 minutes in) is also informative and entertaining as she dances around the illegality of the entire situation, which also included a warrantless search of an apartment. Apparently, the government's argument is that it intended to get a warrant for the apartment search, which is supposedly as legitimate as actually obtaining one. (The questions about consent for the search are far from settled, something a Tallahassee police officer made even cloudier by blocking the door from being shut with his foot.)

So, two hundred times the Tallahassee police department deployed a stingray device and never bothered getting a warrant (and that's just since 2010). When finally pressed on the issue, it deferred to the manufacturer's NDA. The manufacturer (Harris) has itself deferred any questions to the police department.

Unfortunately, this case will not be dealing with the warranty requirements for stingray devices, nor the PD's insistence that a manufacturer's NDA should allow it to skirt any potential privacy issues and withhold information in court cases.

This should put the spotlight on manufacturers of "stingray" devices. If they're using NDAs to keep the public uninformed and prevent the discussion of usage even in court, that's a huge problem. If these agreements are common across manufacturers, then there can be no doubt that law enforcement agencies across the nation have falsified reports and generated alternate narratives to cover up the origins of obtained evidence.

Filed Under: fourth amendment, nda, police, stingray, surveillance