3 ms·

This story is surprising as there were rumours about 18 months ago that EncroChat had been vulnerable. Esp when other similar services had been taken down and t

This story is surprising as there were rumours about 18 months ago that EncroChat had been vulnerable. Esp when other similar services had been taken down and targeted. Random side story: Governments have become much more aware of the purposes of these sorts of phones and seller. About 18 months ago I was asked to meet with the sales people from a specialist phone company like this one, they were interested in selling them to the NGO/journalist market. I'm always happy to chat and test the utility of interesting security tech and compare versus more common setups (locked down phones, Signal etc). I've met a load of these sort of companies at trade shows etc as I'm sure many here have but they wanted to meet in person as they were in town talking to various potential clients. The product was decent enough but way beyond the price of anyone in the sector would be able to afford. Anyways the guys were nice and I genuinely didn't get a sense they particularly up to anything bad... However when I left the meeting (in a European capital) I had physical surveillance all over me. Not a particularly good team, hence I detected them. Totally caught me by surprise. Ran a hastily arranged surveillance detection route and managed to confirm a few (no doubt there may have been more). At first I thought it might be the company I had met doing it to me for some weird reason. However as I thought through the tactics, people profile and operational reason for doing it to me I can only assume that whoever the local police were had been watching closely anyone who was meeting with the secure phone providers (they were foreign to the country in question, so probably came under more suspicion). No doubt this was because of the connection between a lot of these sort of companies and the criminal underworld. (Again, I didn't get the sense these particular sellers were up to no good, I just thought it was an interesting perspective)

have_faith 6y ago
> Ran a hastily arranged surveillance detection route What did this entail?
- tantalor 6y ago
  Four left/right turns in a row
- adflux 6y ago
  difficult way of saying "i drove around in circles for a while"
- djmobley 6y ago
  Not OP but could be as simple as travelling in circles or taking nonsensical routes.
  - secfirstmd 6y ago
    That would be considered very suspicious and alert the team immediately, plus they would have been trained to deal with that. I had no reason to feel threatened by them as I haven't done anything wrong. I just used the chance to practice some past training, buy myself time to figure out WTF was happening then broke off at a point where that would seem legitimate to them without them sensing it was what I was doing. It may well have been a genuine criminal investigation I'd somehow walked into by accident so I had no desire to compromise that.
    - bladegash 6y ago
      Never thought I would see someone referring to the use of SDRs - let alone effectively applying one - on HN. Curious as to where you picked up the skillset.
      - secfirstmd 6y ago
        Mostly private courses and experience built up over the years driven by the need to use and train on it for journalists and activists at risk. On a few, thankfully limited occasions I've had to use it in relation to myself where a real threat existed but rarely enough. Mostly when I've had to use it personally it was to ensure I wasn't risking anyone I was meeting or if I wasn't sure if they might be a deliberate/accidental security threat. We teach it on some of the source protection training courses with do with journos/NGOs. Also we write some basic stuff about it in our open source app, Umbrella. Some activists are threatened by actors ranging from kidnap to ISIS, from corporate to government intelligence, from crime to stalkers. So it's very useful for helping people identify a wide range of threats early. Also just generally for getting peoples heads up out of their phones and off the ground and taking in more alertness of their surroundings - the sort of Coopers Colour Code style thinking.
- secfirstmd 6y ago
  Well being trained properly is the best advice as there is nothing more risky than thinking you are clean and are not. It was on foot in a busy city so it's way too much to write up here but if your interested in reading basic stuff from a general security guide follow the link in my bio.
- Benjammer 6y ago
  I was so curious about this that I did some googling and read this article about it: https://protectioncircle.org/2016/05/25/surveillance-detection-on-yourself/ https://protectioncircle.org/2016/05/25/surveillance-detecti...
  - secfirstmd 6y ago
    Ami's stuff is excellent. If you ping any of the resources in my bio I can send you more if you are interested.
darkerside 6y ago
Maybe a police state keeping tabs on journalists potentially investigating corruption?
- secfirstmd 6y ago
  No definitely wasn't a police state. I mean I wouldn't rule out that was why but very very unlikely.

have_faith 6y ago

> Ran a hastily arranged surveillance detection route What did this entail?

tantalor 6y ago
Four left/right turns in a row
adflux 6y ago
difficult way of saying "i drove around in circles for a while"
djmobley 6y ago
Not OP but could be as simple as travelling in circles or taking nonsensical routes.
- secfirstmd 6y ago
  That would be considered very suspicious and alert the team immediately, plus they would have been trained to deal with that. I had no reason to feel threatened by them as I haven't done anything wrong. I just used the chance to practice some past training, buy myself time to figure out WTF was happening then broke off at a point where that would seem legitimate to them without them sensing it was what I was doing. It may well have been a genuine criminal investigation I'd somehow walked into by accident so I had no desire to compromise that.
  - bladegash 6y ago
    Never thought I would see someone referring to the use of SDRs - let alone effectively applying one - on HN. Curious as to where you picked up the skillset.
    - secfirstmd 6y ago
      Mostly private courses and experience built up over the years driven by the need to use and train on it for journalists and activists at risk. On a few, thankfully limited occasions I've had to use it in relation to myself where a real threat existed but rarely enough. Mostly when I've had to use it personally it was to ensure I wasn't risking anyone I was meeting or if I wasn't sure if they might be a deliberate/accidental security threat. We teach it on some of the source protection training courses with do with journos/NGOs. Also we write some basic stuff about it in our open source app, Umbrella. Some activists are threatened by actors ranging from kidnap to ISIS, from corporate to government intelligence, from crime to stalkers. So it's very useful for helping people identify a wide range of threats early. Also just generally for getting peoples heads up out of their phones and off the ground and taking in more alertness of their surroundings - the sort of Coopers Colour Code style thinking.
secfirstmd 6y ago
Well being trained properly is the best advice as there is nothing more risky than thinking you are clean and are not. It was on foot in a busy city so it's way too much to write up here but if your interested in reading basic stuff from a general security guide follow the link in my bio.
Benjammer 6y ago
I was so curious about this that I did some googling and read this article about it: https://protectioncircle.org/2016/05/25/surveillance-detection-on-yourself/ https://protectioncircle.org/2016/05/25/surveillance-detecti...
- secfirstmd 6y ago
  Ami's stuff is excellent. If you ping any of the resources in my bio I can send you more if you are interested.

darkerside 6y ago

Maybe a police state keeping tabs on journalists potentially investigating corruption?

secfirstmd 6y ago
No definitely wasn't a police state. I mean I wouldn't rule out that was why but very very unlikely.