21 ms·

I disagree with this. Signal isn't hacking Cellebrite by creating a malformed file that causes Cellebrite's software to implode. I would be interested in seein

• vxNsr 5y ago
  This is false, there are laws about booby traps (they’re generally illegal in all jurisdictions). If you plant mines on your property and a thief walks onto your lawn and loses a leg, he can sue you and will likely win with a competent lawyer. You don’t get to say “well you shouldn’t have been there”
  • wearywanderer 5y ago
    Traps that harm people are illegal. Traps that harm animals are legal under some circumstances (mousetraps are legal basically everywhere afaik.) But traps that harm devices rather than people or animals? Are you sure that is generally illegal?
  • knaik94 5y ago
    Laws on booby traps specify that the trap be used to cause harm to a living thing. It's not a booby trap if it wasn't meant to harm someone. So the digital booby trap isn't governed by the same laws.
    • Waterluvian 5y ago
      I agree. But that law demonstrates the concept.
  • WrtCdEvrydy 5y ago
    booby traps that cause harm are illegal, someone stealing my phone who cuts themselves on a broken piece of glass from the screen can't argue "it's a booby trap"
    • failwhaleshark 5y ago
      This is true. Also, if you add hidden buttons that alter the way a data port works to either disable or enable it, or fry a device attached to it, this isn't intentional harm caused to police equipment specifically. It is a deterrent-after-the-fact, a protection, and a personal choice to modify one's own device without targeting anyone in particular and not intentionally, unexpectedly causing bodily harm.
      • chii 5y ago
        the owner of the device could be charged with tampering with evidence. Signal is, paradoxically, an uninvolved third-party imho (technically uninvolved).
        • ArnoVW 5y ago
          If Signal put this on their home page, in a sort of "download this to fuck with da police" advertising, maybe. Judges aren't machines, that slavishly follow any tenuous reasoning. They're judging; it's in the name. Specifically, they have to judge your intent. In many cases American criminal law requires a 'mens rea', or 'guilty mind' https://en.m.wikipedia.org/wiki/Mens_rea https://en.m.wikipedia.org/wiki/Mens_rea
  • PostOnce 5y ago
    However, in many jurisdictions, a trap is only a trap if it is hidden. For example, you can have barbed or razor-wire fences, its obviously barbed, its your fault if you climb up it and get impaled. They advertised this, it's not hidden, so even if trap laws governed it (which they don't because its not hurting a person), it's not a trap.
    • wearywanderer 5y ago
      Even if it were a trap, it would be a trap for a device, not a person. Like anti-drill pins in a lock, which can damage or destroy a drill bit. I think you could reasonably say anti-drill pins are traps for drill bits, and they're certainly not a violation of anti-boobytrap laws.
• 6gvONxR4sf7o 5y ago
  > If I put a fake USB port on my phone that was a USB zapper to kill the device it's connected to, it would not be illegal and it would be on the people seizing my phone to take responsibility for it. ‘If I put a bunch of laxatives on my sandwich to give the office sandwich thief violent diarrhea, it would not be illegal and it would be on the people stealing my food to take responsibility for it.’ This is the analogy that comes to mind which I’ve always heard to be illegal.
  • knaik94 5y ago
    The analogy breaks down because the USB zapper isn't intended to cause bodily harm, unlike a laxative.
  • WrtCdEvrydy 5y ago
    That's true, but I didn't put the USB zapper to harm anyone. I use it for testing USB grounding and some officer stole my phone.
    • alisonkisk 5y ago
      Blatantly lyng about your intent doesn't make you more innocent in court.
  • zarzavat 5y ago
    I feel confident that if you left a conspicuous note on the sandwich that said "Warning! This sandwich may contain laxatives! Do not eat!" and the thief disregarded it and ate the sandwich anyway, then it would be entirely legal.
    • 4bpp 5y ago
      I am not a lawyer or even particularly well-read on this specific scenario, but my read of the spirit of the law is that (if it indeed contains laxatives) it might still be illegal. What matters is not whether you sprang a surprise to one-up someone who was violating your rights or they had a fair chance to know what exactly the consequences would be, but that you deployed the laxative with the intent of harming the thief, and most modern legal systems do not like vigilante violence (even if it's "cute" vigilante violence like giving someone diarrhea). For an intuition pump, I'm not sure there is a significant difference between the note in question and "Warning! If you take this sandwich, and I know who you are, I will personally hunt you down, wrestle you to the ground and force-feed you laxatives!" as far as the law is concerned, but would you expect to get away with this act just because the target previously stole your sandwich and you warned them? (On the other hand, I feel like the zappy USB port may actually be easier to get away with, especially if you say your threat model was corporate spies or criminals trying to steal your password, because "violence against tools" does not seem to be put in the vigilante violence box. Those special materials they have for safe doors that are designed to damage angle grinders (https://www.newscientist.com/article/2249275-material-that-cannot-be-cut-would-make-the-ultimate-bike-lock/ https://www.newscientist.com/article/2249275-material-that-c...) are not illegal.)
• gbin 5y ago
  I would guess that it is way simpler than that. What will be gauged is the intent. This file is targetted to damage LE property, it is hard to argue that they are random bytes.
  • toomuchtodo 5y ago
    The intent is to protect the content of the user’s device from unauthorized access by poorly written forensic extraction code. It’s not offensive but defensive, as Cellebrite has to actively read the file, a file which is not theirs. Technically, Signal owns the copyright and does not authorize Cellebrite to read it (I’d assume, legally).
    • alisonkisk 5y ago
      Copyright does not prevent lawful seizure of material.
      • deleted 5y ago
        [deleted]
      • toomuchtodo 5y ago
        Signal payloads don’t prevent competent, properly implemented seizure and forensic analysis.
    • count 5y ago
      And technically if the LEO user of Cellebrite has a warrant, they are legally authorized to look at that data no matter what Signal or the phone's owner thinks. So, in that sense, it's the ultimate 'authorized access'.
      • toomuchtodo 5y ago
        Yes, I agree LEO with authorization to seize and search someone’s property (with a warrant or similar due process) is authorized to utilize a forensics tool chain that adheres to application security best practices (without which taints chain of custody). None of my comments should be construed as supporting the evasion of a legal law enforcement act. I take issue with LEO overreach when it occurs and vendors shoveling garbage (paid for with tax dollars) to the justice system.
• COGlory 5y ago
  I'm curious if booby-trap laws would have anything to say about this. If I can distill the arguments down to my (completely abstract) understanding: 1) Cellebrite has to interface with software to do extract data. 2) Signal is the software in some scenarios. 3) Signal can alter itself so that if Cellebrite interfaces with it, Cellebrite breaks. 4) If Cellebrite doesn't interface with Signal, Cellebrite is fine, Signal is fine, and no one is hacked. If I trespass on someone's property, and they have a booby trap that blows my leg off, I believe in most US jurisdictions, I can take them to court and have a good chance of winning. Isn't this the same type of thing? On the other hand. If I have a guard dog, and a bunch of "Beware of Dog" signs, and someone trespasses on my property, and the dog attacks them, I don't believe I'm liable. So by publishing this information, has Signal avoided the important nuance of being a trap?
  • knaik94 5y ago
    It is not the same type of thing because booby traps are, legally, specific about causing bodily harm to a living thing. In practice the scope and applicability of the CFAA has to be explored.
    • conk 5y ago
      Also not the same thing because the law also considers the harm caused to innocent 3rd parties from booby traps. No firefighter or EMT is gonna be harmed by the Signal code designed to break the cellebrite device.
      • seoaeu 5y ago
        "Police officer executing a warrant" is another typical category of innocent 3rd party that the laws around booby traps think about. If the harm is directed at a police officer using cellebrite -- say by infecting their computer with malware -- that may not be regarded favorably by a court.
        • ethbr0 5y ago
          Disclosure would be an interesting precedent. "I have Signal installed on my phone" seems a reasonable disclosure of a known potential trap. If a police officer chooses to scan said phone with Cellebrite, it feels reasonable that you have discharged your knowledge to the extent possible.
• sterlind 5y ago
  unfortunately it seems pretty clear to me that it'd be a CFAA violation: "(A)knowingly causes the transmission of a program, information, code, or command, and as a result of such conduct, intentionally causes damage without authorization, to a protected computer;" if Signal downloaded Cellebrite-pwning shellcode to its app, that shows intent.. it's "knowingly causing transmission" in the sense that worm authors knowingly cause transmission of their viruses by equipping them with exploits (and are thus responsible for damage wherever the worm goes.) if that shellcode does anything at all - deleting files, adding files, bricking the device, that falls under the CFAA's definition of "damage," since it affects the integrity of the extracted files. you could argue that Signal doesn't knowingly intend to infect "protected computers," but unless these updates are, say, geofenced to not hit the US, it'll be obvious to the court that they could anticipate government machines getting hit. the smartest thing would be for Signal to follow through on delivering these files, but have them be cat pictures. troll Cellebrite and muddy the waters for prosecutors. no CFAA violation, but Cellebrite can't ever be sure (and prosecutors can't ever prove.)
  • Sephr 5y ago
    > if Signal downloaded Cellebrite-pwning shellcode to its app The transmission in this legal context is the other way imo. Cellebrite's device is transmitting Signal data out, and Signal is not intentionally sending data to these devices.
    • zerocrates 5y ago
      So, let's say for the sake of argument that Signal does download files that are intended to exploit these Cellebrite vulns to users' phones. The part of the statute we're talking about triggers when someone: - knowingly causes the transmission of a program, information, code, or command - and as a result of such conduct, intentionally causes damage without authorization to a protected computer Notice: this didn't require someone to transmit code to the victim machine: they knowingly cause code to be transmitted somewhere, and that intentionally causes damage as a result. Isn't that what you have here? In our assumed world, Signal's devs have written the app to pull down the exploit to the users' phones, thereby knowingly causing it to be transmitted. I think it'd be hard to claim with a straight face that your Cellebrite-targeting code (that you told the world about) wasn't intentionally targeting Cellebrite. Under your rule of "you have to intentionally send data to the victim device," what result if you write malware and post it, say, on Facebook: just as you intended, anyone who clicks is infected, but the payload is inert as to Facebook's servers. Are you in the clear because the harmed users all initiated the download themselves?
• dleslie 5y ago
  Reminds me of "DOS ain't done til Lotus won't run."
• IshKebab 5y ago
  > Signal isn't hacking Cellebrite by creating a malformed file that causes Cellebrite's software to implode. It absolutely is. This is the sort of "technically I didn't break the law!" nonsense that he explicitly called out in the article: > Trying to find the edges of the law using technology will not make a judge, or prosecutors for that matter, shrug and throw up their hands and say “Wow, that’s so clever! You sure got us.” They won’t reward your cleverness with reddit coins and upvotes and retweets. They will throw the book at you.
  • salawat 5y ago
    This type of legal revisionism power in the judiciary is exactly what Thomas Jefferson and Madison were leery of, as it does come down to legislating from the bench. When case law can take an inch given in statute, and turn it into a mile or a femtometer, you have a problem.