21 ms·
The StingRay Is Why the 4th Amendment Was Written (2017)
- zachlatta 7y agoSeems like a strong case for encryption. Why is it even possible for these devices to read your info?
- afshin 7y agoEncryption does not fix this completely even if you assume all texts and voice calls are encrypted. The metadata is equally important: - your location in time and space - the numbers you contacted - the duration of contact
- ikeboy 7y agoMetadata is useful but it's a stretch to call it equally important as actual call content. If you were spying on someone, what would you rather know: all the above metadata you listed, or a full recording of all their calls?
- michaelt 7y agoIf I had a choice between a full recording of all their phone calls, or a trace of their movement with 50 meter precision? Good chance I'd go for the second one to be honest - unless I knew for sure they made a lot of voice calls.
- desertrider12 7y agoMetadata from one person isn't worth anything, but the graph of who's contacting who is very useful. Plus, it's computationally feasible to do that graph analysis on everyone, while listening to every call wouldn't be.
- ceejayoz 7y ago> If you were spying on someone, what would you rather know: all the above metadata you listed, or a full recording of all their calls? That depends entirely on the purpose of the spying. If you're spying with a goal of assassination, the location data from their morning commute might be far more valuable.
- mirimir 7y agoBecause phones are totally insecure. The only secure option is using an external WiFi or cellular data router for Internet connectivity. The router can of course be geolocated. And adversaries may gain some access. But it should be possible to prevent access through it to the phone. That is, it's a firewall. Then do end-to-end encrypted Internet stuff, messaging and VoIP. And by using some mix of VPNs and Tor, adversaries won't even see most metadata. Except for communication timing, of course. See https://blog.torproject.org/mission-improbable-hardening-android-security-and-privacy https://blog.torproject.org/mission-improbable-hardening-and... Edit: But this still doesn't protect from some third party with root rights on the phone. For Android, the Copperhead OS might be enough. But I don't know enough to know. And for iOS, I suspect that you're stuck trusting Apple.
- judge2020 7y agoiOS's only security issue is users not updating and being vulnerable to well known vulnerabilities. Neither iOS nor Android will survive a truly targeted nation state attack, but for most people 0-days aren't worth protecting against. The only exception to this is the checkm8 vulnerability, which can be performed on an A11 and older chips (so iPhone XR/XS/XS+ and 11/11 pro/11 pro max aren't vulnerable) from DFU mode, which doesn't need the device passcode.
- mirimir 7y agoRight. I guess that phones can't update without direct cellular or WiFi connectivity. But I don't know. Is that true? Could one somehow enable updates through pure TCP/IP?
- Kalium 7y agoOne of the key functions of a cell tower is to know what devices are connecting to it. This is important information for things like routing calls, delivering messages, etc. As you say, all of that can and should be encrypted. With that in mind, there's not really any kind of reasonable way to hide what devices are connecting to what tower. This is where location information comes from. It's really an inescapable part of how cellular devices work. Inbound / outbound numbers are something that has to be available for similar reasons. There's also clear legal precedent making those accessible to law enforcement and not requiring a warrant. There's little to be gained by trying to encrypt them, even if it was possible. Call and text comments are the things here that can be encrypted. It's not something the phone companies are in a rush to do.
- schoen 7y ago> With that in mind, there's not really any kind of reasonable way to hide what devices are connecting to what tower. This is where location information comes from. It's really an inescapable part of how cellular devices work. The comment from mirimir elsewhere in this thread reminds me that this is kind of an overstatement, or at least that the details are complicated. You could gain a lot of privacy in this regard by separating mobile data services from telephony and identity. For example, you could imagine paying for mobile data anonymously, either using existing prepaid mobile data services or using a hypothetical future service with blinded payment tokens and only extremely-ephemeral device identifiers. Then you could imagine getting all of your identity and communications services from someone totally independent of your mobile data provider. If the mobile data provider cooperated with your application-layer communications service provider more than you wanted, you could try to create your own service instead, or try to route at least the messaging setup part of the process via Tor or other proxies, so that the mobile data operator and application-layer intermediaries didn't even know about the connection. I'm not sure anyone other than privacy advocates would consider this progress relative to the current situation; certainly carriers and governments would like it a lot less (it might already be illegal in some jurisdictions in various ways), and most users would probably find that it increased cost while decreasing reliability and usability of some services. It could also make it harder to use the network to investigate or deter device theft, as well as harder to investigate application-layer fraud and account hijacking. To be clear about what could change, it's true that towers will always know which devices are connecting to them at a particular moment, but this could in principle be separated from billing, identity, and any kind of persistent identifier. So they don't have to know that a particular device is being used by you, or that a particular device is being used by the same person who uses a particular application-layer identity. The other problem in trying to get there right now without carriers' and governments' cooperation is that, since you can't rotate hardware identifiers on GSM interfaces, a carrier can see your movement patterns for the lifetime of your use of a particular device, and can probably determine that those movement patterns are similar enough to another device's movements that they're probably used by the same person. Sometime I hope to write a long article on possible non-metadata-collecting mobile communications futures. It's a really interesting topic.
- softwaredoug 7y agoIt’s actually more a case for authentication. Why don’t our phones authenticate cell towers when connecting to them? Why are providers so lax at enforcing that?
- dahfizz 7y agoBecause then stingrays wouldn't work. Cellular carriers are much more beholden to the government than to the very small subset of users who knows what "authenticate with the cell tower" even means.
- jellicle 7y agoEven if your phone insisted that each cell tower authenticate itself as an authentic Verizon Tower(TM), then Verizon would just provide 500 extra authentic tower keys to various police agencies for their use. shrug emoji You can't trust cell companies to help you against the government.
- gruez 7y ago>then Verizon would just provide 500 extra authentic tower keys to various police agencies for their use. shrug emoji I don't buy this reasoning. It suggests that cell companies will roll over to any law enforcement demands. If that's the case, why don't law enforcement ask cell companies for their cell tower logs directly? Why spend thousands of dollars on equipment when the same information is an email away?
- jniedrauer 7y agoAs I understand it, cellphone infrastructure is intentionally simplistic so that it works the same everywhere. If the US implemented some kind of end to end encryption or authentication, Canada might not, and then everyone who crosses the border would have a brick.
- Spooky23 7y agoIt’s designed to minimize billing issues. User privacy or in transit security aren’t significant business requirements.
- capitalsigma 7y agoSeems like a strong case for making all of your phone calls over an encrypted VoIP channel.
- m0zg 7y agoDo y'all remember the (likely fake, but widely reported) news about Israeli stingrays in DC a few months back, in September of this year? Whatever happened to that story? It was memory holed very quickly, which makes me suspicious that those weren't actually Israeli stingrays.
- redis_mlc 7y agoI've read news reports that half the "cell towers" in DC are suspicious. So it's not about one particular organization or foreign government doing shady stuff. So "likely fake" => "almost certainly true." FTFY.
- m0zg 7y agoSounds implausible to me. In their useful (active) mode these things emit. The FCC (not to mention the other TLAs) can easily track this shit down and shut it down. Except of course if those are NSA/FBI/CIA stingrays.
- ceejayoz 7y agoMake them mobile, use them for short, unpredictable periods. Or site them in embassies, where the FCC can impotently yell through the locked gate.
- gruez 7y ago>Or site them in embassies, where the FCC can impotently yell through the locked gate. Two can play at that game. The FCC can retaliate by setting up jammers with directional antennas pointing towards the embassy.
- sehugg 7y agoIt wasn't memory-holed: https://www.politico.com/story/2019/09/12/israel-white-house-spying-devices-1491351 https://www.politico.com/story/2019/09/12/israel-white-house...
- Animats 7y agoWhy does law enforcement bother? Can't they just get the info from the telcos?
- giancarlostoro 7y agoThat requires a warrant. Surprised the FCC allows them to tamper with peoples phones tbh. Its all sketchy as heck and flawed if cases are dismissed when they question how the tech works.
- bonestamp2 7y agoThey're probably using it for parallel construction rather than gathering actual evidence for a court case. In other words, it will help them understand how/where to look for evidence that will be admissible in court.
- upofadown 7y agoLast I heard the FCC doesn't. When people complained the devices were not licensed the FCC issued licenses "for emergency use only". That's probably because interference with radio communications is against the law and the FCC as a mere regulator is subject to that law. All rather moot as these things are mostly used for various forms of illegal surveillance. The police have to keep their activity as secret as possible. That includes the fact that they are using them in the first place. This whole issue isn't new. The police normally do, or get others to do, surveillance that is illegal in various ways. The existence of these sorts of devices is an expression of a kind of desperation. Privacy is getting too good. So this might actually be a good thing if this forces a long overdue discussion.
- bb88 7y agoFirst, IANAL. This gets into some interesting legal law. If you are a normal private citizen, wiretapping without the the caller's permission is always a crime. However, The Government can apparently wiretap if: 1. There is an executive order allowing it from the president directly. This may or may not be a national secret. This may or may not be a 4th amendment violation. But if it's a secret, how would you know whether or not it's a 4th amendment violation? 2. There is congressional authorization (by law) in place that allows the government to perform warrantless wiretaps. 3. There is an existing wiretap warrant in effect that allows the recording of an individual or organization's telephones. This is how the FBI, DEA, etc, get their wiretaps typically. 4. A court has held the wiretapping on each of the three instances above was legal. Edited to add: Before 9/11 the government typically respected the 4th Amendment in day to day operations ("Look before you leap"). After 9/11 the respecting the 4th amendment was seen as "pre-9/11 thinking" and forced a shift to early interception ("Easier to ask forgiveness than permission").
- jijji 7y agothe simple solution is for cell phones to have a whitelist of cell towers that they connect to with GPS locations of those towers, it could even compare against known databases of towers [0]... Until some software like that gets implemented, this will keep happening. [0] https://opencellid.org/ https://opencellid.org/
- jb775 7y agogreat idea...I wonder if a 3rd party app could enable this or if that type of access is currently closely held? I'd only consider software that has super low level hardware access so you could basically control electrical access to that part of the phone's circuitry (so backdoor features can't be built that make sneaky connections).
- jijji 7y agoThe closest thing I've seen was an opensource app called SnoopSnitch, but it requires root on the phone and supposedly only works on Qualcomm modems.
- luxuryballs 7y agoBetween this example and “no knock” warrants (where people get killed, including police) I think it seems obvious that people have forgotten what the point of a warrant is. A warrant is suppose to prevent either of the two cases from resulting in lengthy court battles or death from confusion, and it’s very simple: YOU SHOW THE PERSON BEING SEARCHED THE WARRANT IN ADVANCE! That is how you gain authorization... somehow people are being searched and the warrant is either kept secret entirely or not shown to them prior to the search! That’s literally the fundamental purpose of a constitutional warrant! Things are so backwards now, search then warrant, shoot first then ask questions, execution before trial...
- AndrewKemendo 7y agoI'm not sure where you are getting this definition of the purpose for warrants, but it's not based on any historical fact that I'm aware of. The way I'm aware of history, a warrant simply allows for an individual or group to take an action on behalf of the state, specifically by statement from a judge, which would have otherwise been illegal. For some individuals and groups, specifically sworn Law Enforcement officers, they fall within warrant exceptions or broad granted "warrant authorities." It has no relation to a suspect being notified of a warrant and there is no legal mandate to notify the suspect as far as I am aware.
- aspaceman 7y agoThe definition they use follows from the definition you use, but is dependent on the times. If you are given authority to act on a warrant by the state, then you show that to the person you're investigating so they don't shoot you for being on their property. Without the warrant, they have every right to shoot a strange person walking through their property without permission. Since this was before the concept of Law Enforcement officers (I feel like people forget cops haven't always been a thing in the U.S.), people wouldn't just accept some nobody in a uniform as a person of authority. There weren't cops, so the warrant was the only way to show you had the authority of the state.
- 7y ago
- voldacar 7y agoGood article. Needs a (2017) though in the title
- Half_pint 7y agoWasn't this behaviour already ruled unconstitutional in Kyllo v United States (https://en.wikipedia.org/wiki/Kyllo_v._United_States https://en.wikipedia.org/wiki/Kyllo_v._United_States)?
- abbadadda 7y agoSeems related but not the same. Looks like Kyllo took up the case all the way to the Supreme Court. I think the only way for this Sting Ray stuff to be ruled unconstitutional is if a specific case against it was brought forth. > Kyllo then petitioned the Supreme Court for a writ of certiorari, which was granted.
- remote_phone 7y agoUnfortunately the only way around this is to donate to the ACLU and have every single case thrown out no matter how egregious until the police learn their lesson.
- BurningFrog 7y agoI used to donate to ACLU when they were a pure civil liberties organization. Now that they're a leftist/social justice group I have nowhere to donate.
- nothingtos33 7y agoSame here. Last I checked the 2nd amendment was still a right.
- iso947 7y agoWhich militia are you in?
- kls 7y agoTLDR; 1700's English (Latin origin words) was closer to their true Latin definitions. You realize that the term regulated is different than governed or ruled. The closest approximation for regulated would be to supply in a measured fashion or a pattern which follows a rule. It is from the Latin Regula. A SCUBA regulator does not rule you, it supplies, in measured order, breathable air, which your lungs survival depends on the supply by the regulator. You need armed men to supply a militia or army. Regulated does not imply government run or even being associated with a militia it implies having armed men available should the militia (we had no standing army at that time) need them. for reference: "A well regulated Militia, being necessary to the security of a free State, the right of the people to keep and bear Arms, shall not be infringed."
- giancarlostoro 7y agoThis also has the side benefit that even with our more organized military of today, if invaders were all over US soil, the citizens could rise up as one unified militia as well to protect the country. Not something I ever hear anybody discuss much, but absolutely nothing is going to stop citizens from protecting themselves if a war breaks out in US soil.
- mirimir 7y agoBack in 1989, I had this dream that the Poqet PC would evolve into a smartphone. And that one could install Linux or *BSD on it. But no, it just died.
- nine_k 7y agoAn android phone already runs Linux; you can use it as such, and in many cases gain root. OTOH what's happening in the baseband processor is impenetrable, and that processor has much more control over the device than a cellular modem would.
- mirimir 7y agoOK. But why did we end up with baseband radios instead of cellular modems? Is it because they grafted "computer stuff" on phones? Instead of adding cellular capacity to computers? Or is it just because we can't have phones without surveillance? All those wiretap-ready requirements, I mean.
- rival_elf 7y agoI work in the field of cell network security research and want to help clear up some misinformation I'm seeing in these comments. First, I just want to highlight that reason cell site simulators (the more general term for StingRays/IMSI-catchers) exist is because cell phones cannot authenticate all messages coming from cell towers. I'm seeing some vague comments about "a lack of encryption", but it's primarily more of an authentication issue. You can read more about why it's primarily an authentication issue + how some of the relevant types of cell network attacks work in this technical post I wrote for EFF: https://www.eff.org/wp/gotta-catch-em-all-understanding-how-imsi-catchers-exploit-cell-networks https://www.eff.org/wp/gotta-catch-em-all-understanding-how-... There are some interesting proposals for fixing this lack of authentication using a certificate-based PKI system, the most promising being this paper from Purdue: https://relentless-warrior.github.io/index.php/publications/insecure-connection-bootstrapping-in-cellular-networks-the-root-of-all-evil/ https://relentless-warrior.github.io/index.php/publications/.... This solution is very far from production-ready, but it's a much-needed step in the right direction.
- stefan_ 7y agoWe have SIM cards for 30 years to authenticate unique users to the network, but those same cards can't authenticate the network? No, this is entirely by choice and could have been trivially solved. They just forgot the "server certificate" part.
- dunmalg 7y agoI'd say it's less a "choice" than an "oversight". SIM cards solve the problem of "how do we know if Random Phone is attached to an account and the bill is paid?" The question of "how does the phone know it's talking to a real tower" was never even ASKED, as the very idea would have seemed preposterous.
- JacksCracked 7y agoThe movie War Games came out 36 years ago, so the claim that no-one was even asking themselves about the value of authentication in public services all these years seems preposterous.
- ejz 7y agoIt’s tough to see how a court would rule. Existing privacy law cares a lot about whether what you’re doing is some kind of trespass. In this case, it would be trespass on chattel. I wouldn’t have guessed that a court would accept this reasoning for property in a public space, but that’s happened this year in Taylor v. Saginaw, the tire chalking case. The stingray is eventually going to go to SCOTUS and I’m not sure how they’ll rule. Modern conservatives don’t like trespass, but they do like law enforcement.
- PlasticTank 7y agoWhere I live I see police SUVs driving around with these types of devices on their roofs, this is a couple of times per day occurrence. I was wondering strictly for research purposes what kind of attacks are these devices vulnerable to? Could one for example spoof enough phones/connections to cause some DoS like affect.
- NotACop182 7y agoThose devices are license plate readers. They use them to scan plates for “hits”. I’ve heard of units in police departments that use stingray but they are detached with the feds and are on NDA’s. How’s that legal I don’t know. You should be more worried about who agencies give body cam videos to and plate reader data too. I can tell you this if you dig it won’t be good news. Axion is a for profit company pretty sure facial recognition is in there plans. -from definitely not a cop
- urvader 7y agoIt should be fairly easy to put together a Raspberry Pi as a stingray detector?
- mhb 7y agoProbably this isn't technically possible but here is a possible way to collectively authenticate cell towers: A service which receives information from an app reporting which cell towers are in range of the phone. The server triangulates the positions of cell towers and updates users about their authenticity.
- spyder 7y agoThere are several several IMSI catcher detector apps, but they aren't perfect: https://www.wired.com/story/stingray-detector-apps/ https://www.wired.com/story/stingray-detector-apps/
- mhb 7y agoI don't understand how those work but they seem different from what I am suggesting. I am saying to use the strength of the cell tower signal received by many phones in order to detect where authentic cell towers are.
- larkin221 7y agoDeval Patrick needs to get his name out to have a chance at the democratic nomination. In California, deval Patrick should go see California attorney general Becerra and ask him Why his office is not investigating the LAPD Crimebuster vigilante complaint filed with becerra two years ago.Deval Patrick is a former Civil Rights Lawyer for the justice department. Deval Patrick, Bernie Sanders and Joe Biden would be wise to work with the Los Angeles Chapter of Black Lives matter. 43 percent of Los Angeles homeless are black males. Becerra now refuses to investigate the violent anti-homeless crimes onto the Los Angeles Homeless by the LAPD Crimebuster Vigilante. LA Crimebuster vigilante attacks on the homeless is , in reality crimebuster vigilante attacks on the California Black population. LApd Crimebuster Vigilante is racial crime by the Racist LAPD. If the democrats don't take up this issue. President Trump can easily win the issue and gain African American Support all across America. Trump may order US Attorney General, Bill Barr and the FBI to investigate the racist hate scam that is the LAPD Crimebuster Vigilante Scandal.
- lidHanteyk 7y agoSorry, there's no respect for somebody who can't spell "segue". I hope that you don't shoot anybody.