4 ms·

I am a little confused on why the author makes a distinction between Cellebrite using zero-days to hack a phone to read data and Signal's hack. While the US gov

I am a little confused on why the author makes a distinction between Cellebrite using zero-days to hack a phone to read data and Signal's hack. While the US government might have the framework to not be considered violating CFAA, what about when other governments use Cellebrite? From this point of view, Cellebrite isn't a valve that's stopping back door decryption in systems, it is the back door. Signal including these files is in a sense covering a back door. Also, is leaving a file that breaks the admissibility of previously gathered evidence considered active hacking? Am I misunderstanding something about the function of the files in Signal? I thought the only way Cellebrite's software is interacted with is if it tries to access Signal on the device. Signal isn't actively searching to hack back. It's triggered by Cellebrite's software, not Signal's. The straightforward workaround would be to delete Signal before using the Cellebrite software which I think is the real point. Signal isn't trying to protect the end user actively and can't do anything if it's not installed on a phone.

tptacek 5y ago
In the US, Cellebrite extractions are done under color of law; for the same reason, the police don’t get in trouble for forcing open locked doors while executing search warrants.
- atat7024 5y ago
  > Cellebrite extractions are done under color of law Until they find they're in the wrong house. Or that a warrant is invalid.
- sneak 5y ago
  > In the US, Cellebrite extractions are done under color of law Are you sure that is the case 100% of the time? Bars on my door keep out burglars as well as hinder police serving a warrant. Even if Signal does deploy these files (no evidence thus far that they have deployed Cellebrite exploits, as their blog post was careful not to claim that), the vast majority of them (just like deadbolts) will not be used to hinder search warrants.
vxNsr 5y ago
> Also, is leaving a file that breaks the admissibility of previously gathered evidence considered active hacking? Am I misunderstanding something about the function of the files in Signal? I thought the only way Cellebrite's software is interacted with is if it tries to access Signal on the device. Signal isn't actively searching to hack back. It's triggered by Cellebrite's software, not Signal's. Yes this is called booby trapping and at least in the US is illegal. It’s akin to tying a trigger to a door opening so that whoever opens the door gets shot, even if that person had no right to be there, you can still be held liable for any injury the bullet causes.
- knaik94 5y ago
  Booby trapping specifies a device that causes bodily harm to a living thing, legally. There is no chance of bodily harm from evidence becoming inadmissible. The question of whether it is considered a computer virus, legally, is my question. Signal isn't actively trying to hack Cellebrite.
- tptacek 5y ago
  I don't think axiomatic derivation from Quora posts about physical booby traps is going to be a reliable way of understanding how the law actually functions here.
- weswpg 5y ago
  Do such laws apply to digital booby traps though?
- disposekinetics 5y ago
  In your estimation is having a zip bomb I'm proud of crafting on my laptop a boobytrap because it could cause problems for a malicious actor naively unzipping all my files?

tptacek 5y ago

In the US, Cellebrite extractions are done under color of law; for the same reason, the police don’t get in trouble for forcing open locked doors while executing search warrants.

atat7024 5y ago
> Cellebrite extractions are done under color of law Until they find they're in the wrong house. Or that a warrant is invalid.
sneak 5y ago
> In the US, Cellebrite extractions are done under color of law Are you sure that is the case 100% of the time? Bars on my door keep out burglars as well as hinder police serving a warrant. Even if Signal does deploy these files (no evidence thus far that they have deployed Cellebrite exploits, as their blog post was careful not to claim that), the vast majority of them (just like deadbolts) will not be used to hinder search warrants.

vxNsr 5y ago

> Also, is leaving a file that breaks the admissibility of previously gathered evidence considered active hacking? Am I misunderstanding something about the function of the files in Signal? I thought the only way Cellebrite's software is interacted with is if it tries to access Signal on the device. Signal isn't actively searching to hack back. It's triggered by Cellebrite's software, not Signal's. Yes this is called booby trapping and at least in the US is illegal. It’s akin to tying a trigger to a door opening so that whoever opens the door gets shot, even if that person had no right to be there, you can still be held liable for any injury the bullet causes.

knaik94 5y ago
Booby trapping specifies a device that causes bodily harm to a living thing, legally. There is no chance of bodily harm from evidence becoming inadmissible. The question of whether it is considered a computer virus, legally, is my question. Signal isn't actively trying to hack Cellebrite.
tptacek 5y ago
I don't think axiomatic derivation from Quora posts about physical booby traps is going to be a reliable way of understanding how the law actually functions here.
weswpg 5y ago
Do such laws apply to digital booby traps though?
disposekinetics 5y ago
In your estimation is having a zip bomb I'm proud of crafting on my laptop a boobytrap because it could cause problems for a malicious actor naively unzipping all my files?