3 ms·

Who would sue them, and what would the claim be?

by akerl_ 5y ago

vxNsr 5y ago
Police or Cellbrite for hacking and/or boobytrapping.
- akerl_ 5y ago
  I feel like you’re conflating “charging” and “suing” here. Cellbrite would sue, and in doing so would need to allege damages. Given that they wrote code to extract data from Signal, and Signal gave public warning that doing so might be dangerous, it seems implausible they’d be able to claim damages. “Boobytrapping” in physical space usually becomes problematic when it’s a surprise: if you hop over my fence to rob me and are injured by land mines in my yard, I’m at fault. If I have signs saying “Warning, this yard is full of dangerous objects, do not hop the fence, you may be harmed”… dramatically less so. “The police” generally don’t sue, The State charges. And for the state to charge someone with a crime, it can’t just vaguely be “hacking”, it would need to be a violation of a criminal statue. At best, this would perhaps be tampering with evidence? Because I doubt you’d find a jury willing to convict someone of a violation of, for example, the CFAA, for activity that they undertook solely within their own app, which did not initiate any activity until scanned by Celebrite’s tool
PeterisP 5y ago
If there's an actual case where evidence on stored on a law-enforcement operated Cellebrite machine gets destroyed or corrupted, and if further forensics shows that it happened due to e.g. an aesthetically pleasing file with a specific payload being deployed on that phone, then the state is likely to charge the people involved in this particular act for tampering with evidence. And if it happens, then Moxie's original blog post would help prosecution a lot.
- akerl_ 5y ago
  Generally, from what I can tell, statutes regarding “tampering with evidence” require both intent (which would likely exist here) and knowledge that the action is interfering with evidence of a crime (which seems pretty implausible). If Signal set up their phones so the user could click “I’m gonna do crimes, opt me in” and it would add the nefarious files, the risk of prosecution would seem much more likely.

Who would sue them, and what would the claim be?

by akerl_ 5y ago

Who would sue them, and what would the claim be?

vxNsr 5y ago

Police or Cellbrite for hacking and/or boobytrapping.

akerl_ 5y ago
I feel like you’re conflating “charging” and “suing” here. Cellbrite would sue, and in doing so would need to allege damages. Given that they wrote code to extract data from Signal, and Signal gave public warning that doing so might be dangerous, it seems implausible they’d be able to claim damages. “Boobytrapping” in physical space usually becomes problematic when it’s a surprise: if you hop over my fence to rob me and are injured by land mines in my yard, I’m at fault. If I have signs saying “Warning, this yard is full of dangerous objects, do not hop the fence, you may be harmed”… dramatically less so. “The police” generally don’t sue, The State charges. And for the state to charge someone with a crime, it can’t just vaguely be “hacking”, it would need to be a violation of a criminal statue. At best, this would perhaps be tampering with evidence? Because I doubt you’d find a jury willing to convict someone of a violation of, for example, the CFAA, for activity that they undertook solely within their own app, which did not initiate any activity until scanned by Celebrite’s tool

PeterisP 5y ago

If there's an actual case where evidence on stored on a law-enforcement operated Cellebrite machine gets destroyed or corrupted, and if further forensics shows that it happened due to e.g. an aesthetically pleasing file with a specific payload being deployed on that phone, then the state is likely to charge the people involved in this particular act for tampering with evidence. And if it happens, then Moxie's original blog post would help prosecution a lot.

akerl_ 5y ago
Generally, from what I can tell, statutes regarding “tampering with evidence” require both intent (which would likely exist here) and knowledge that the action is interfering with evidence of a crime (which seems pretty implausible). If Signal set up their phones so the user could click “I’m gonna do crimes, opt me in” and it would add the nefarious files, the risk of prosecution would seem much more likely.