6 ms·

I’m not reading the article as a criticism of the work Signal has done, but their “lol u got pwned” way of announcing it — in particular, their coy threat about

I’m not reading the article as a criticism of the work Signal has done, but their “lol u got pwned” way of announcing it — in particular, their coy threat about exploiting the vulnerability. Specifically: - The threat is likelier to annoy judges than garner sympathy - Following through on it is probably illegal - Worse, following through could put their users in legal (and/or physical) jeopardy - More generally, Signal should consult with lawyers before doing things like this

indigochill 5y ago
> Following through on it is probably illegal I'm curious how? If they announce publicly that they will place files on devices that may exploit a publicly announced vulnerability in Cellebrite, then it's Cellebrite's prerogative to fix the vulnerability. If they knowingly ignore a publicly disclosed risk, then they have only themselves to blame.
- asddubs 5y ago
  TFA: >Uh, is that legal? >No, intentionally spoiling evidence — or “spoliating,” to use the legal term — is definitely not legal. >Neither is hacking somebody’s computer, which is what Signal’s blog post is saying a “real exploit payload” could do. It said, “a real exploit payload would likely seek to undetectably alter previous reports, compromise the integrity of future reports (perhaps at random!), or exfiltrate data from the Cellebrite machine.” All of those things are a violation of the federal anti-hacking law known as the Computer Fraud and Abuse Act, or CFAA, and probably also of many state-law versions of the CFAA. (If the computer belongs to a federal law enforcement agency, it’s definitely a CFAA violation. If it’s a state, local, or tribal government law enforcement agency, then, because of how the CFAA defines “protected computers” covered by the Act, it might depend on whether the Windows machine that’s used for Cellebrite extractions is connected to the internet or not. That machine should be segmented apart from the rest of the police department’s network, but if it has an internet connection, the CFAA applies. And even if it doesn’t, I bet there are other ways of easily satisfying the “protected computer” definition.)
  - vinay_ys 5y ago
    Imagine physical vault in your house. This vault has mechanism within it such that if anyone forces it open it will destroy all its contents. It may have defense mechanisms triggered to act as deterrence – it may spill/spew very bad odor and permanent ink – on anything nearby and that odor and color will be very hard to get rid of. Is such a vault legal? If someone breaks into your house and steals such a vault and in the process of trying to open it, if they suffer damage, is the owner of the vault liable? What's the principle being applied here? How would the same principle be applied in the case of digital property?
    - saagarjha 5y ago
      The issue here is not "someone" breaking into your house and stealing it, it is the authorities doing it. Destruction/sabotage of the evidence collection process is very possibly going to be held against you.
      - vinay_ys 5y ago
        Yeah, and the authorities have to do it the right way. There's a reason why this is such a big issue and not as straightforward as you make it to be. https://www.vox.com/recode/2020/2/24/21133600/police-fbi-phone-search-protests-password-rights https://www.vox.com/recode/2020/2/24/21133600/police-fbi-pho...
        saagarjha 5y ago
        I agree that the overall situation around evidence recovery from locked devices is not straightforward, but I don't think I referenced this in my comment–I merely provided insight into why the specific actions might be considered to be illegal (using the argument in the blog post, I might add).
      - Certhas 5y ago
        But all Signal is (threatening to be) doing is blowing up devices that parse all files using insecure software. Let's look at another case, I remember that some people had USB drivers that detected "wrigglers" and shut down the computer in response to such a wiggler. Would that also be illegal? If I install anti scan files and anti mouse wrigglers when travelling to China do they become legal then?
mrmanner 5y ago
> - Worse, following through could put their users in legal (and/or physical) jeopardy This bit is very relevant, and I agree. It’s ethically dubious to put unknowing users at risk in that way, whether from democratic or authoritarian governments. The other points, though, very much assume that the goal is to change the outcomes of American court processes. The focus is almost entirely on what a judge in the US would think, on evidence rules in American courts, etc. Maybe American law and law enforcement isn’t as relevant as an American lawyer thinks it is, and Signal is betting that the PR and politics game is more important. If they did make that bet, which I think is likely, then the article has some valid arguments at the end – this hack(or non-hack) may lead politicians to introduce stronger laws – and _that’s_ where the focus should be. Is this a god move, politically? And, to reiterate from the beginning: Does this put end users in danger? If it does, it’s likely not worth the price even if there was some political victory in the end.

indigochill 5y ago

> Following through on it is probably illegal I'm curious how? If they announce publicly that they will place files on devices that may exploit a publicly announced vulnerability in Cellebrite, then it's Cellebrite's prerogative to fix the vulnerability. If they knowingly ignore a publicly disclosed risk, then they have only themselves to blame.

asddubs 5y ago
TFA: >Uh, is that legal? >No, intentionally spoiling evidence — or “spoliating,” to use the legal term — is definitely not legal. >Neither is hacking somebody’s computer, which is what Signal’s blog post is saying a “real exploit payload” could do. It said, “a real exploit payload would likely seek to undetectably alter previous reports, compromise the integrity of future reports (perhaps at random!), or exfiltrate data from the Cellebrite machine.” All of those things are a violation of the federal anti-hacking law known as the Computer Fraud and Abuse Act, or CFAA, and probably also of many state-law versions of the CFAA. (If the computer belongs to a federal law enforcement agency, it’s definitely a CFAA violation. If it’s a state, local, or tribal government law enforcement agency, then, because of how the CFAA defines “protected computers” covered by the Act, it might depend on whether the Windows machine that’s used for Cellebrite extractions is connected to the internet or not. That machine should be segmented apart from the rest of the police department’s network, but if it has an internet connection, the CFAA applies. And even if it doesn’t, I bet there are other ways of easily satisfying the “protected computer” definition.)
- vinay_ys 5y ago
  Imagine physical vault in your house. This vault has mechanism within it such that if anyone forces it open it will destroy all its contents. It may have defense mechanisms triggered to act as deterrence – it may spill/spew very bad odor and permanent ink – on anything nearby and that odor and color will be very hard to get rid of. Is such a vault legal? If someone breaks into your house and steals such a vault and in the process of trying to open it, if they suffer damage, is the owner of the vault liable? What's the principle being applied here? How would the same principle be applied in the case of digital property?
  - saagarjha 5y ago
    The issue here is not "someone" breaking into your house and stealing it, it is the authorities doing it. Destruction/sabotage of the evidence collection process is very possibly going to be held against you.
    - vinay_ys 5y ago
      Yeah, and the authorities have to do it the right way. There's a reason why this is such a big issue and not as straightforward as you make it to be. https://www.vox.com/recode/2020/2/24/21133600/police-fbi-phone-search-protests-password-rights https://www.vox.com/recode/2020/2/24/21133600/police-fbi-pho...
      - saagarjha 5y ago
        I agree that the overall situation around evidence recovery from locked devices is not straightforward, but I don't think I referenced this in my comment–I merely provided insight into why the specific actions might be considered to be illegal (using the argument in the blog post, I might add).
    - Certhas 5y ago
      But all Signal is (threatening to be) doing is blowing up devices that parse all files using insecure software. Let's look at another case, I remember that some people had USB drivers that detected "wrigglers" and shut down the computer in response to such a wiggler. Would that also be illegal? If I install anti scan files and anti mouse wrigglers when travelling to China do they become legal then?

mrmanner 5y ago

> - Worse, following through could put their users in legal (and/or physical) jeopardy This bit is very relevant, and I agree. It’s ethically dubious to put unknowing users at risk in that way, whether from democratic or authoritarian governments. The other points, though, very much assume that the goal is to change the outcomes of American court processes. The focus is almost entirely on what a judge in the US would think, on evidence rules in American courts, etc. Maybe American law and law enforcement isn’t as relevant as an American lawyer thinks it is, and Signal is betting that the PR and politics game is more important. If they did make that bet, which I think is likely, then the article has some valid arguments at the end – this hack(or non-hack) may lead politicians to introduce stronger laws – and _that’s_ where the focus should be. Is this a god move, politically? And, to reiterate from the beginning: Does this put end users in danger? If it does, it’s likely not worth the price even if there was some political victory in the end.