6 ms·

I'm curious if booby-trap laws would have anything to say about this. If I can distill the arguments down to my (completely abstract) understanding: 1) Cellebr

I'm curious if booby-trap laws would have anything to say about this. If I can distill the arguments down to my (completely abstract) understanding: 1) Cellebrite has to interface with software to do extract data. 2) Signal is the software in some scenarios. 3) Signal can alter itself so that if Cellebrite interfaces with it, Cellebrite breaks. 4) If Cellebrite doesn't interface with Signal, Cellebrite is fine, Signal is fine, and no one is hacked. If I trespass on someone's property, and they have a booby trap that blows my leg off, I believe in most US jurisdictions, I can take them to court and have a good chance of winning. Isn't this the same type of thing? On the other hand. If I have a guard dog, and a bunch of "Beware of Dog" signs, and someone trespasses on my property, and the dog attacks them, I don't believe I'm liable. So by publishing this information, has Signal avoided the important nuance of being a trap?

knaik94 5y ago
It is not the same type of thing because booby traps are, legally, specific about causing bodily harm to a living thing. In practice the scope and applicability of the CFAA has to be explored.
- conk 5y ago
  Also not the same thing because the law also considers the harm caused to innocent 3rd parties from booby traps. No firefighter or EMT is gonna be harmed by the Signal code designed to break the cellebrite device.
  - seoaeu 5y ago
    "Police officer executing a warrant" is another typical category of innocent 3rd party that the laws around booby traps think about. If the harm is directed at a police officer using cellebrite -- say by infecting their computer with malware -- that may not be regarded favorably by a court.
    - ethbr0 5y ago
      Disclosure would be an interesting precedent. "I have Signal installed on my phone" seems a reasonable disclosure of a known potential trap. If a police officer chooses to scan said phone with Cellebrite, it feels reasonable that you have discharged your knowledge to the extent possible.
      - NateEag 5y ago
        > "I have Signal installed on my phone" seems a reasonable disclosure of a known potential trap. No, that's a straightforward statement of fact which a software expert might realize implies there's a trap. A police officer could not reasonably be expected to know that. A reasonable disclosure of a known potential trap is "I have Signal installed on my phone, so if you use a Cellebrite device to pull my data your Cellebrite device might get hacked by Signal."
        ethbr0 5y ago
        Unless you're an information security professional, it seems unreasonable to expect an average Signal user to know more about the security of Cellebrite than Cellebrite's user (the police).
        NateEag 5y ago
        Probably so. Thanks for pointing that out. If you're using Signal at all, you probably care at least a little about security, so it's not a given, but probably the vast majority of Signal users wil never hear about this. I wasn't trying to say you're automatically guilty if you don't warn the police about what Signal could do. I was just trying to say that a statement that _implies_ a trap exists, if you know enough about a piece of software, it's not a reasonable warning that a trap exists. If you know the trap exists, a case can be made that such an indirect statement is actually baiting the trap, rather than warning about it.
- op00to 5y ago
  It’s more knowingly destroying evidence than causing bodily harm.
  - furyg3 5y ago
    That’s the thing: It’s not evidence at the time you set the trap. There are plenty of legitimate reasons you may want to protect your computer from Celebrite users. It’s not just cops that use this software. Bad foreign actors do. Private investigators might. Hell, Signal demonstrated that they’re falling off trucks, maybe you want to protect yourself from Moxie!
  - danShumway 5y ago
    I understand the short answer is probably "Judges see it differently so the logic doesn't matter", but I don't get the difference between setting a "booby trap" to wipe a phone and the basic phone-wipe security settings that are already on phones. In the San Bernadino iPhone case there was a lot of hand-wringing about Apple's password limits, but no one was accusing Apple of purposefully destroying evidence because it has a setting that wipes data after multiple failed login attempts. Cellebrite does not only sell its software to the US government; one of its chief criticisms is that it doesn't really care who gets its code. So the threat model to end-users is the same, the same fears that would make me want to wipe my phone if someone is trying to get into it might make me want to wipe my phone if someone is trying to automatically pull large amounts of data off of it. Is the worry here that Cellebrite's vulnerability would need to be executed on a different computer, so it's in a different category? Forget technicalities and cleverness, I don't understand even the basic logical difference between Signal destroying its own data on export and iPhones wiping their data after failed login attempts. I trust the author, but I just don't get it. What security measures are acceptable to build into software?
    - seoaeu 5y ago
      > Is the worry here that Cellebrite's vulnerability would need to be executed on a different computer, so it's in a different category? Yes, possibly. The legal system is all about trying to establish clear lines dividing the spectrum of obviously OK behavior and obviously unacceptable behavior. It is obviously OK to delete text messages off your phone. It is obviously unacceptable to break into a police station and delete evidence off their computers. Somewhere in between is the dividing line, and if this went before a judge it is entirely plausible that they would draw the line there.
csydas 5y ago
I strongly doubt it's anything to do with booby-trapping. The article was less focused on the physical act of data destruction and more the context of destroying data related to an investigation, which arguably constitutes Destruction, Alteration, or falsification of records as per https://www.law.cornell.edu/uscode/text/18/1519 https://www.law.cornell.edu/uscode/text/18/1519 I say arguably of course as I doubt that this is a scenario that has really been carefully tested in law, but the article seemed more focused on how such an act would be interpreted by the courts if it really came to it. And the important part of such a situation is mentioned here: "... (if the user gets blamed for what her phone does to a Cellebrite machine, she will be plunged into a world of pain, irrespective of whether she would ultimately be held culpable for the design of an app she had installed on her phone)... " My layperson read of all this situation is that it doesn't really matter whether or not you know at the time of such a file existing whether or not you're under investigation, if the end effect the file will have on a process used by a Government Agency in a legal search is known, the fear seems to be that even if ultimately you end up inculpable, it's a very long and rocky road to get there legally speaking, as the Government will likely not even try to argue about the quality of code or whether it's you or Cellebrite (or whoever) that is responsible, but that you had a file which had a known effect which in turn impeded an investigation. Remember that criminal cases have specific challenges that the prosecution accuses of and that the defendant protects against; if the challenge is that "[you] knowingly put data on your computer which impedes investigations by Agencies of the US Government by means of corrupting data", the mechanism of how the data got corrupted is not nearly as important as the actual act/intention. If Signal really is doing this, I think their intent was trying to undermine this with the random users part (so that users couldn't feasible know if they had a trap or not), but personally, I think this is kind of weak as with the announcement, there's knowledge that an application you have has a non-0 chance of causing such disruption, and probably it's enough to at least waste a lot of your time and money. (Especially if it really did a number on a Cellebrite device that damaged a lot of other investigations...probably they'd go after a person just out of spite at that point.)
- salawat 5y ago
  This also highlights what should be considered a disqualification for overly broad legislative statute. It seems to me that CFAA was put into practice with woefully little thought as to how computing systems, and by extension, how the legal system interacts with them. This results in an incredibly powerful tool landing in the prosecutions hands that can be used to quite literally drive a person to death by legal system while everyone non-technical has to be brought up to speed on how this stuff works and doesn't work. Realistically speaking, I don't think the CFAA has actually been driven by real concerted attention from tge public. If it had been, I don't think the software industry would be anywhere near as big as it is, because when you really understand what you're doing when accepting a EULA, and then comparing that expectation with what programs actually do, there'd be an awful lot of software that actually falls under CFAA used for official purposes than anyone not in an official capacity would feel comfortable with; nevermind software for private use.
PeterisP 5y ago
"Booby trap" laws aren't relevant because they're specific to physical injury. However, there are explicit laws against tampering with evidence or things that you'd expect are likely become evidence.
ric2b 5y ago
Blowing your leg up is not the right comparison, this is closer to a lock that breaks your lockpick if you try to pick it. No one is harmed but the tool being used to break in.

knaik94 5y ago

It is not the same type of thing because booby traps are, legally, specific about causing bodily harm to a living thing. In practice the scope and applicability of the CFAA has to be explored.

conk 5y ago
Also not the same thing because the law also considers the harm caused to innocent 3rd parties from booby traps. No firefighter or EMT is gonna be harmed by the Signal code designed to break the cellebrite device.
- seoaeu 5y ago
  "Police officer executing a warrant" is another typical category of innocent 3rd party that the laws around booby traps think about. If the harm is directed at a police officer using cellebrite -- say by infecting their computer with malware -- that may not be regarded favorably by a court.
  - ethbr0 5y ago
    Disclosure would be an interesting precedent. "I have Signal installed on my phone" seems a reasonable disclosure of a known potential trap. If a police officer chooses to scan said phone with Cellebrite, it feels reasonable that you have discharged your knowledge to the extent possible.
    - NateEag 5y ago
      > "I have Signal installed on my phone" seems a reasonable disclosure of a known potential trap. No, that's a straightforward statement of fact which a software expert might realize implies there's a trap. A police officer could not reasonably be expected to know that. A reasonable disclosure of a known potential trap is "I have Signal installed on my phone, so if you use a Cellebrite device to pull my data your Cellebrite device might get hacked by Signal."
      - ethbr0 5y ago
        Unless you're an information security professional, it seems unreasonable to expect an average Signal user to know more about the security of Cellebrite than Cellebrite's user (the police).
        NateEag 5y ago
        Probably so. Thanks for pointing that out. If you're using Signal at all, you probably care at least a little about security, so it's not a given, but probably the vast majority of Signal users wil never hear about this. I wasn't trying to say you're automatically guilty if you don't warn the police about what Signal could do. I was just trying to say that a statement that _implies_ a trap exists, if you know enough about a piece of software, it's not a reasonable warning that a trap exists. If you know the trap exists, a case can be made that such an indirect statement is actually baiting the trap, rather than warning about it.
op00to 5y ago
It’s more knowingly destroying evidence than causing bodily harm.
- furyg3 5y ago
  That’s the thing: It’s not evidence at the time you set the trap. There are plenty of legitimate reasons you may want to protect your computer from Celebrite users. It’s not just cops that use this software. Bad foreign actors do. Private investigators might. Hell, Signal demonstrated that they’re falling off trucks, maybe you want to protect yourself from Moxie!
- danShumway 5y ago
  I understand the short answer is probably "Judges see it differently so the logic doesn't matter", but I don't get the difference between setting a "booby trap" to wipe a phone and the basic phone-wipe security settings that are already on phones. In the San Bernadino iPhone case there was a lot of hand-wringing about Apple's password limits, but no one was accusing Apple of purposefully destroying evidence because it has a setting that wipes data after multiple failed login attempts. Cellebrite does not only sell its software to the US government; one of its chief criticisms is that it doesn't really care who gets its code. So the threat model to end-users is the same, the same fears that would make me want to wipe my phone if someone is trying to get into it might make me want to wipe my phone if someone is trying to automatically pull large amounts of data off of it. Is the worry here that Cellebrite's vulnerability would need to be executed on a different computer, so it's in a different category? Forget technicalities and cleverness, I don't understand even the basic logical difference between Signal destroying its own data on export and iPhones wiping their data after failed login attempts. I trust the author, but I just don't get it. What security measures are acceptable to build into software?
  - seoaeu 5y ago
    > Is the worry here that Cellebrite's vulnerability would need to be executed on a different computer, so it's in a different category? Yes, possibly. The legal system is all about trying to establish clear lines dividing the spectrum of obviously OK behavior and obviously unacceptable behavior. It is obviously OK to delete text messages off your phone. It is obviously unacceptable to break into a police station and delete evidence off their computers. Somewhere in between is the dividing line, and if this went before a judge it is entirely plausible that they would draw the line there.

csydas 5y ago

I strongly doubt it's anything to do with booby-trapping. The article was less focused on the physical act of data destruction and more the context of destroying data related to an investigation, which arguably constitutes Destruction, Alteration, or falsification of records as per https://www.law.cornell.edu/uscode/text/18/1519 https://www.law.cornell.edu/uscode/text/18/1519 I say arguably of course as I doubt that this is a scenario that has really been carefully tested in law, but the article seemed more focused on how such an act would be interpreted by the courts if it really came to it. And the important part of such a situation is mentioned here: "... (if the user gets blamed for what her phone does to a Cellebrite machine, she will be plunged into a world of pain, irrespective of whether she would ultimately be held culpable for the design of an app she had installed on her phone)... " My layperson read of all this situation is that it doesn't really matter whether or not you know at the time of such a file existing whether or not you're under investigation, if the end effect the file will have on a process used by a Government Agency in a legal search is known, the fear seems to be that even if ultimately you end up inculpable, it's a very long and rocky road to get there legally speaking, as the Government will likely not even try to argue about the quality of code or whether it's you or Cellebrite (or whoever) that is responsible, but that you had a file which had a known effect which in turn impeded an investigation. Remember that criminal cases have specific challenges that the prosecution accuses of and that the defendant protects against; if the challenge is that "[you] knowingly put data on your computer which impedes investigations by Agencies of the US Government by means of corrupting data", the mechanism of how the data got corrupted is not nearly as important as the actual act/intention. If Signal really is doing this, I think their intent was trying to undermine this with the random users part (so that users couldn't feasible know if they had a trap or not), but personally, I think this is kind of weak as with the announcement, there's knowledge that an application you have has a non-0 chance of causing such disruption, and probably it's enough to at least waste a lot of your time and money. (Especially if it really did a number on a Cellebrite device that damaged a lot of other investigations...probably they'd go after a person just out of spite at that point.)

salawat 5y ago
This also highlights what should be considered a disqualification for overly broad legislative statute. It seems to me that CFAA was put into practice with woefully little thought as to how computing systems, and by extension, how the legal system interacts with them. This results in an incredibly powerful tool landing in the prosecutions hands that can be used to quite literally drive a person to death by legal system while everyone non-technical has to be brought up to speed on how this stuff works and doesn't work. Realistically speaking, I don't think the CFAA has actually been driven by real concerted attention from tge public. If it had been, I don't think the software industry would be anywhere near as big as it is, because when you really understand what you're doing when accepting a EULA, and then comparing that expectation with what programs actually do, there'd be an awful lot of software that actually falls under CFAA used for official purposes than anyone not in an official capacity would feel comfortable with; nevermind software for private use.

PeterisP 5y ago

"Booby trap" laws aren't relevant because they're specific to physical injury. However, there are explicit laws against tampering with evidence or things that you'd expect are likely become evidence.

ric2b 5y ago

Blowing your leg up is not the right comparison, this is closer to a lock that breaks your lockpick if you try to pick it. No one is harmed but the tool being used to break in.