7 ms·

You're not supposed to sympathize with Cellebrite, according to the article. > If you work at Cellebrite, on the other hand: get down off your high horse, stop

You're not supposed to sympathize with Cellebrite, according to the article. > If you work at Cellebrite, on the other hand: get down off your high horse, stop it with the “we’re the good guys” shtick, quit selling to authoritarian governments, and for god’s sake, fix your shit. > Giving defense attorneys more ammo to push back harder against the use of Cellebrite devices against their clients is Good and Right and Just. The general point that Moxie made — Cellebrite’s tools are buggy A.F. and can be exploited in ways that undermine the reliability of their reports and extractions as evidence, which is the entire point of their existence — is actually more important than the specifics of this exploit You're kind of missing the point of the article. The article agrees with you that Signal's hack was a net positive and Cellebrite is not a good company.

kstrauser 5y ago
I saw those parts, but my overall impression was that the author thought Signal was foolish to write up their adventure and they shouldn’t have done it (while conceding that Cellebrite aren’t angels). I also disagree with the notion that it’s good that Cellebrite exists because without them we’d have stronger anti-encryption laws. That’s hypothetical and all we know is what we have today. I’m not thrilled that someone is peeing on my basement carpet instead of peeing in my living room; I’d rather not have someone peeing on any of my rugs.
- jakelazaroff 5y ago
  I’m not reading the article as a criticism of the work Signal has done, but their “lol u got pwned” way of announcing it — in particular, their coy threat about exploiting the vulnerability. Specifically: - The threat is likelier to annoy judges than garner sympathy - Following through on it is probably illegal - Worse, following through could put their users in legal (and/or physical) jeopardy - More generally, Signal should consult with lawyers before doing things like this
  - indigochill 5y ago
    > Following through on it is probably illegal I'm curious how? If they announce publicly that they will place files on devices that may exploit a publicly announced vulnerability in Cellebrite, then it's Cellebrite's prerogative to fix the vulnerability. If they knowingly ignore a publicly disclosed risk, then they have only themselves to blame.
    - asddubs 5y ago
      TFA: >Uh, is that legal? >No, intentionally spoiling evidence — or “spoliating,” to use the legal term — is definitely not legal. >Neither is hacking somebody’s computer, which is what Signal’s blog post is saying a “real exploit payload” could do. It said, “a real exploit payload would likely seek to undetectably alter previous reports, compromise the integrity of future reports (perhaps at random!), or exfiltrate data from the Cellebrite machine.” All of those things are a violation of the federal anti-hacking law known as the Computer Fraud and Abuse Act, or CFAA, and probably also of many state-law versions of the CFAA. (If the computer belongs to a federal law enforcement agency, it’s definitely a CFAA violation. If it’s a state, local, or tribal government law enforcement agency, then, because of how the CFAA defines “protected computers” covered by the Act, it might depend on whether the Windows machine that’s used for Cellebrite extractions is connected to the internet or not. That machine should be segmented apart from the rest of the police department’s network, but if it has an internet connection, the CFAA applies. And even if it doesn’t, I bet there are other ways of easily satisfying the “protected computer” definition.)
      - vinay_ys 5y ago
        Imagine physical vault in your house. This vault has mechanism within it such that if anyone forces it open it will destroy all its contents. It may have defense mechanisms triggered to act as deterrence – it may spill/spew very bad odor and permanent ink – on anything nearby and that odor and color will be very hard to get rid of. Is such a vault legal? If someone breaks into your house and steals such a vault and in the process of trying to open it, if they suffer damage, is the owner of the vault liable? What's the principle being applied here? How would the same principle be applied in the case of digital property?
- neltnerb 5y ago
  My read was closer to what the article stated at the end -- the issue is that it is written for a tech geek audience when the real audience should have been judges and lawyers. So being vague and flippant was why they were foolish, not in saying something at all. And that they should probably not have implied that they were going to break the law, which also seems foolish. Doesn't mean it isn't net positive, just means the details of how they did it were... maybe not the cleverest. But who knows, one person's opinion, etc.
  - mrmanner 5y ago
    I think it should have been written for politicians. The big problem isn’t that some American police agencies use these tools, the problem is that it’s legal to make, sell, use, and export them. And that’s not for (American) lawyers and judges to decide against, its for politicians in all democratic countries:)
- robertlagrant 5y ago
  I think the article was pretty clearly written, and did not in any way appeal to or try to engender sympathy for Cellebrite.
- thayne 5y ago
  No, the complaint was with how it was written, not what signal did.

kstrauser 5y ago

I saw those parts, but my overall impression was that the author thought Signal was foolish to write up their adventure and they shouldn’t have done it (while conceding that Cellebrite aren’t angels). I also disagree with the notion that it’s good that Cellebrite exists because without them we’d have stronger anti-encryption laws. That’s hypothetical and all we know is what we have today. I’m not thrilled that someone is peeing on my basement carpet instead of peeing in my living room; I’d rather not have someone peeing on any of my rugs.

jakelazaroff 5y ago
I’m not reading the article as a criticism of the work Signal has done, but their “lol u got pwned” way of announcing it — in particular, their coy threat about exploiting the vulnerability. Specifically: - The threat is likelier to annoy judges than garner sympathy - Following through on it is probably illegal - Worse, following through could put their users in legal (and/or physical) jeopardy - More generally, Signal should consult with lawyers before doing things like this
- indigochill 5y ago
  > Following through on it is probably illegal I'm curious how? If they announce publicly that they will place files on devices that may exploit a publicly announced vulnerability in Cellebrite, then it's Cellebrite's prerogative to fix the vulnerability. If they knowingly ignore a publicly disclosed risk, then they have only themselves to blame.
  - asddubs 5y ago
    TFA: >Uh, is that legal? >No, intentionally spoiling evidence — or “spoliating,” to use the legal term — is definitely not legal. >Neither is hacking somebody’s computer, which is what Signal’s blog post is saying a “real exploit payload” could do. It said, “a real exploit payload would likely seek to undetectably alter previous reports, compromise the integrity of future reports (perhaps at random!), or exfiltrate data from the Cellebrite machine.” All of those things are a violation of the federal anti-hacking law known as the Computer Fraud and Abuse Act, or CFAA, and probably also of many state-law versions of the CFAA. (If the computer belongs to a federal law enforcement agency, it’s definitely a CFAA violation. If it’s a state, local, or tribal government law enforcement agency, then, because of how the CFAA defines “protected computers” covered by the Act, it might depend on whether the Windows machine that’s used for Cellebrite extractions is connected to the internet or not. That machine should be segmented apart from the rest of the police department’s network, but if it has an internet connection, the CFAA applies. And even if it doesn’t, I bet there are other ways of easily satisfying the “protected computer” definition.)
    - vinay_ys 5y ago
      Imagine physical vault in your house. This vault has mechanism within it such that if anyone forces it open it will destroy all its contents. It may have defense mechanisms triggered to act as deterrence – it may spill/spew very bad odor and permanent ink – on anything nearby and that odor and color will be very hard to get rid of. Is such a vault legal? If someone breaks into your house and steals such a vault and in the process of trying to open it, if they suffer damage, is the owner of the vault liable? What's the principle being applied here? How would the same principle be applied in the case of digital property?
neltnerb 5y ago
My read was closer to what the article stated at the end -- the issue is that it is written for a tech geek audience when the real audience should have been judges and lawyers. So being vague and flippant was why they were foolish, not in saying something at all. And that they should probably not have implied that they were going to break the law, which also seems foolish. Doesn't mean it isn't net positive, just means the details of how they did it were... maybe not the cleverest. But who knows, one person's opinion, etc.
- mrmanner 5y ago
  I think it should have been written for politicians. The big problem isn’t that some American police agencies use these tools, the problem is that it’s legal to make, sell, use, and export them. And that’s not for (American) lawyers and judges to decide against, its for politicians in all democratic countries:)
robertlagrant 5y ago
I think the article was pretty clearly written, and did not in any way appeal to or try to engender sympathy for Cellebrite.
thayne 5y ago
No, the complaint was with how it was written, not what signal did.