3 ms·
> Lest you jump to the argument that this would endanger operations, I would still point out two very salient facts: this information is not intelligence data,
by exelius 11y ago
> Lest you jump to the argument that this would endanger operations, I would still point out two very salient facts: this information is not intelligence data, and as Schneier pointed out, this attack can be used against many in the US government, including FBI agents in the field. Getting it fixed is the right thing to do.
I agree with you that given the facts we know today, notifying Apple is the right thing to do. But I also think the FBI should have some latitude in deciding what is in its best interest; and if they're making their own agents vulnerable to an exploit they know exists -- well, that's dumb and I hope it bites them in the ass.
- ryao 11y agoWe do not even know if the FBI knows the vulnerability. The phone could have been attacked by a contractor working for the FBI without the contractor sharing the tools.
- camillomiller 11y agoThis is a great point. Cellebrite's known for their black box approach. Law enforcements and Courts can send their locked iPhone and get it back unlocked. They'll just get the job done without knowing what was actually performed on the phone. This might as well be the case here.
- c22 11y agoDoesn't this approach cast doubt on the legitimacy of any evidence obtained from the device?
- camillomiller 11y agoDon't think so, it's basically like lock picking a suspect's apartment with a warrant. What is found should be valid evidence, no? Law enforcement can break the door or call a locksmith and pay him for his service. In this case Cellebrite's the locksmith.
- c22 11y agoThat seems reasonable, but usually investigators would be on the scene while the locksmith works. If the process is a black box that happens while the device is in Cellebrite's possession isn't it more like calling up the locksmith from the precinct and saying "hey, could you open up the apartment at this address and call us when you're done? Don't go inside or touch anything though, thanks!" What prevents Cellebrite employees from planting or deleting evidence after the device is unlocked and before returning it? What guarantees are there that Cellebrite's unlocking process doesn't intentionally or unintentionally modify some other aspect of the device? Scouts honor? What if their process is to just flash a new rom filled with child porn and no passcode then skip merrily to the bank to cash their checks?
- camillomiller 11y agoYep, I understand that. I don't think that was posed as a problem in the Italian case I know of, although I think that in the U.S. rules on the chain of custody are stricter, indeed. That's a good point.
- deleted 11y ago[deleted]
- deleted 11y ago[deleted]
- deleted 11y ago[deleted]
- deleted 11y ago[deleted]