5 ms·

Couldn’t you always claim that malware caused the offending clicks/placed the illegal files on your disk and is hiding/obfuscating itself so well that it’s not

Couldn’t you always claim that malware caused the offending clicks/placed the illegal files on your disk and is hiding/obfuscating itself so well that it’s not detectable by forensic methods? What’s the logic here to still get the criminal?

deleted 5y ago
[deleted]
edenhyacinth 5y ago
"Your honour, I think you'll find that someone broke into my house and planted drugs" This type of logic has been used plenty in court, it being in your possession, digital or not, is sufficient. The claim here is that due to the vulnerabilities Cellebrite has, the offending item may never have been on your device. This is more similar to saying that the images the police took in your house of drugs were kept on an unsecured server, there are recorded vulnerabilities for it, and therefore the images could have been digitally edited to show drugs where none were present.
- dylan604 5y ago
  Possesion is 9/10ths goes both ways
sjy 5y ago
Yes, and it’s not an uncommon defence in child pornography cases. Similarly, you can always claim that the police framed you by lying about the device being found in your possession, or not being tampered with between seizure and forensic analysis. It is up to the jury to decide whether the defence gives rise to a reasonable doubt. The standard is not as high as most technically-minded people think. Juries can convict defendants on the uncorroborated testimony of a single witness: https://newrepublic.com/article/152305/who-to-believe-sexual-assault https://newrepublic.com/article/152305/who-to-believe-sexual...
- giantg2 5y ago
  Yep, and society tends to view defendants as guilty from start.
  - gogopuppygogo 5y ago
    Especially in Japan.
    - giantg2 5y ago
      True. I was mostly talking about the "innocent until proven guilty" saying effectively being BS in the US.
    - bena 5y ago
      There's a game, Judgment, which opened my eyes to this. Because a core part of the backstory of the game is that the main character won a case as the defense which is seen as a huge deal. He's like one of the few defense attorneys to have ever gotten to not guilty. The game takes place in a slightly fictionalized version of Japan and is made by a Japanese game developer noted for making games steeped in contemporary Japanese culture. I guess that's important to note.
  - mc32 5y ago
    It’s even worse now with social media handing verdicts before juries are even assembled. Infamous cases were difficult in the age of newspapers when they got hold of a story, but now everyone can begin their own agendum.
    - acdha 5y ago
      Social media is way less influential than the local news media in this regard. That’s a long running problem – think about how many cases have been covered based on police statements which turned out to be completely fictitious — and social media tends to amplify those stories more than it contributes original coverage.
- zionic 5y ago
ycomnews2021 5y ago
claiming that porn on your device isn't yours is not the problem. the theoretical problem is if you received porn via Signal on 04/01/2020 2:23AM but Cellebrite says you received it on 04/26/2020 5:34PM (while in custody). Or 12/23/2019 at 2:00PM (before you bought the phone). If the dates on the data in Cellebrite can't be aligned to the dates of the actual events AND the last modification of the device was AFTER you last had control of it, nothing can be trusted from it.
- btilly 5y ago
  No, that is not the problem. The problem is that a report about a phone scanned on 2020-02-01 can be altered by a phone scanned on 2020-05-01 to say that there was porn when there wasn't. Oh, and that scan left a running program which will cause 5% of the phones scanned after that to randomly also claim porn that is not on the device. Therefore if a single phone with Signal was scanned at the kiosk, NOTHING from that kiosk can be trusted.
  - ycomnews2021 5y ago
    This is a problem, but I don't think Moxie would do this as it could make him liable for evidence tampering. If the protection mechanism applies to the device being scanned, its a defensive measure, if it is applied to unrelated devices, it looks like a malicious destructive action. If the USER could select the action, for research purposes, that might a different story.
    - btilly 5y ago
      Moxie might or might not have done so. But he made it clear that he could have, and went out of his way to create reasonable doubt about whether he did. If he winds up in court, I'd love it if he sticks to his, "the files are there for artistic effect".
      - myself248 5y ago
        Since after all, Cellebrite claims their device doesn't alter evidence on the way through. If that claim is true, Moxie's artistically-beautiful files obviously can't affect it. Saying those decorative files tampered with evidence is equivalent to admitting that everything the Cellebrite claims to do, it doesn't do and never has done.

deleted 5y ago

[deleted]

edenhyacinth 5y ago

"Your honour, I think you'll find that someone broke into my house and planted drugs" This type of logic has been used plenty in court, it being in your possession, digital or not, is sufficient. The claim here is that due to the vulnerabilities Cellebrite has, the offending item may never have been on your device. This is more similar to saying that the images the police took in your house of drugs were kept on an unsecured server, there are recorded vulnerabilities for it, and therefore the images could have been digitally edited to show drugs where none were present.

dylan604 5y ago
Possesion is 9/10ths goes both ways

sjy 5y ago

Yes, and it’s not an uncommon defence in child pornography cases. Similarly, you can always claim that the police framed you by lying about the device being found in your possession, or not being tampered with between seizure and forensic analysis. It is up to the jury to decide whether the defence gives rise to a reasonable doubt. The standard is not as high as most technically-minded people think. Juries can convict defendants on the uncorroborated testimony of a single witness: https://newrepublic.com/article/152305/who-to-believe-sexual-assault https://newrepublic.com/article/152305/who-to-believe-sexual...

giantg2 5y ago
Yep, and society tends to view defendants as guilty from start.
- gogopuppygogo 5y ago
  Especially in Japan.
  - giantg2 5y ago
    True. I was mostly talking about the "innocent until proven guilty" saying effectively being BS in the US.
  - bena 5y ago
    There's a game, Judgment, which opened my eyes to this. Because a core part of the backstory of the game is that the main character won a case as the defense which is seen as a huge deal. He's like one of the few defense attorneys to have ever gotten to not guilty. The game takes place in a slightly fictionalized version of Japan and is made by a Japanese game developer noted for making games steeped in contemporary Japanese culture. I guess that's important to note.
- mc32 5y ago
  It’s even worse now with social media handing verdicts before juries are even assembled. Infamous cases were difficult in the age of newspapers when they got hold of a story, but now everyone can begin their own agendum.
  - acdha 5y ago
    Social media is way less influential than the local news media in this regard. That’s a long running problem – think about how many cases have been covered based on police statements which turned out to be completely fictitious — and social media tends to amplify those stories more than it contributes original coverage.
zionic 5y ago

ycomnews2021 5y ago

claiming that porn on your device isn't yours is not the problem. the theoretical problem is if you received porn via Signal on 04/01/2020 2:23AM but Cellebrite says you received it on 04/26/2020 5:34PM (while in custody). Or 12/23/2019 at 2:00PM (before you bought the phone). If the dates on the data in Cellebrite can't be aligned to the dates of the actual events AND the last modification of the device was AFTER you last had control of it, nothing can be trusted from it.

btilly 5y ago
No, that is not the problem. The problem is that a report about a phone scanned on 2020-02-01 can be altered by a phone scanned on 2020-05-01 to say that there was porn when there wasn't. Oh, and that scan left a running program which will cause 5% of the phones scanned after that to randomly also claim porn that is not on the device. Therefore if a single phone with Signal was scanned at the kiosk, NOTHING from that kiosk can be trusted.
- ycomnews2021 5y ago
  This is a problem, but I don't think Moxie would do this as it could make him liable for evidence tampering. If the protection mechanism applies to the device being scanned, its a defensive measure, if it is applied to unrelated devices, it looks like a malicious destructive action. If the USER could select the action, for research purposes, that might a different story.
  - btilly 5y ago
    Moxie might or might not have done so. But he made it clear that he could have, and went out of his way to create reasonable doubt about whether he did. If he winds up in court, I'd love it if he sticks to his, "the files are there for artistic effect".
    - myself248 5y ago
      Since after all, Cellebrite claims their device doesn't alter evidence on the way through. If that claim is true, Moxie's artistically-beautiful files obviously can't affect it. Saying those decorative files tampered with evidence is equivalent to admitting that everything the Cellebrite claims to do, it doesn't do and never has done.