6 ms·

It is not the same type of thing because booby traps are, legally, specific about causing bodily harm to a living thing. In practice the scope and applicability

It is not the same type of thing because booby traps are, legally, specific about causing bodily harm to a living thing. In practice the scope and applicability of the CFAA has to be explored.

conk 5y ago
Also not the same thing because the law also considers the harm caused to innocent 3rd parties from booby traps. No firefighter or EMT is gonna be harmed by the Signal code designed to break the cellebrite device.
- seoaeu 5y ago
  "Police officer executing a warrant" is another typical category of innocent 3rd party that the laws around booby traps think about. If the harm is directed at a police officer using cellebrite -- say by infecting their computer with malware -- that may not be regarded favorably by a court.
  - ethbr0 5y ago
    Disclosure would be an interesting precedent. "I have Signal installed on my phone" seems a reasonable disclosure of a known potential trap. If a police officer chooses to scan said phone with Cellebrite, it feels reasonable that you have discharged your knowledge to the extent possible.
    - NateEag 5y ago
      > "I have Signal installed on my phone" seems a reasonable disclosure of a known potential trap. No, that's a straightforward statement of fact which a software expert might realize implies there's a trap. A police officer could not reasonably be expected to know that. A reasonable disclosure of a known potential trap is "I have Signal installed on my phone, so if you use a Cellebrite device to pull my data your Cellebrite device might get hacked by Signal."
      - ethbr0 5y ago
        Unless you're an information security professional, it seems unreasonable to expect an average Signal user to know more about the security of Cellebrite than Cellebrite's user (the police).
        NateEag 5y ago
        Probably so. Thanks for pointing that out. If you're using Signal at all, you probably care at least a little about security, so it's not a given, but probably the vast majority of Signal users wil never hear about this. I wasn't trying to say you're automatically guilty if you don't warn the police about what Signal could do. I was just trying to say that a statement that _implies_ a trap exists, if you know enough about a piece of software, it's not a reasonable warning that a trap exists. If you know the trap exists, a case can be made that such an indirect statement is actually baiting the trap, rather than warning about it.
op00to 5y ago
It’s more knowingly destroying evidence than causing bodily harm.
- furyg3 5y ago
  That’s the thing: It’s not evidence at the time you set the trap. There are plenty of legitimate reasons you may want to protect your computer from Celebrite users. It’s not just cops that use this software. Bad foreign actors do. Private investigators might. Hell, Signal demonstrated that they’re falling off trucks, maybe you want to protect yourself from Moxie!
- danShumway 5y ago
  I understand the short answer is probably "Judges see it differently so the logic doesn't matter", but I don't get the difference between setting a "booby trap" to wipe a phone and the basic phone-wipe security settings that are already on phones. In the San Bernadino iPhone case there was a lot of hand-wringing about Apple's password limits, but no one was accusing Apple of purposefully destroying evidence because it has a setting that wipes data after multiple failed login attempts. Cellebrite does not only sell its software to the US government; one of its chief criticisms is that it doesn't really care who gets its code. So the threat model to end-users is the same, the same fears that would make me want to wipe my phone if someone is trying to get into it might make me want to wipe my phone if someone is trying to automatically pull large amounts of data off of it. Is the worry here that Cellebrite's vulnerability would need to be executed on a different computer, so it's in a different category? Forget technicalities and cleverness, I don't understand even the basic logical difference between Signal destroying its own data on export and iPhones wiping their data after failed login attempts. I trust the author, but I just don't get it. What security measures are acceptable to build into software?
  - seoaeu 5y ago
    > Is the worry here that Cellebrite's vulnerability would need to be executed on a different computer, so it's in a different category? Yes, possibly. The legal system is all about trying to establish clear lines dividing the spectrum of obviously OK behavior and obviously unacceptable behavior. It is obviously OK to delete text messages off your phone. It is obviously unacceptable to break into a police station and delete evidence off their computers. Somewhere in between is the dividing line, and if this went before a judge it is entirely plausible that they would draw the line there.

It is not the same type of thing because booby traps are, legally, specific about causing bodily harm to a living thing. In practice the scope and applicability of the CFAA has to be explored.

conk 5y ago

Also not the same thing because the law also considers the harm caused to innocent 3rd parties from booby traps. No firefighter or EMT is gonna be harmed by the Signal code designed to break the cellebrite device.

seoaeu 5y ago
"Police officer executing a warrant" is another typical category of innocent 3rd party that the laws around booby traps think about. If the harm is directed at a police officer using cellebrite -- say by infecting their computer with malware -- that may not be regarded favorably by a court.
- ethbr0 5y ago
  Disclosure would be an interesting precedent. "I have Signal installed on my phone" seems a reasonable disclosure of a known potential trap. If a police officer chooses to scan said phone with Cellebrite, it feels reasonable that you have discharged your knowledge to the extent possible.
  - NateEag 5y ago
    > "I have Signal installed on my phone" seems a reasonable disclosure of a known potential trap. No, that's a straightforward statement of fact which a software expert might realize implies there's a trap. A police officer could not reasonably be expected to know that. A reasonable disclosure of a known potential trap is "I have Signal installed on my phone, so if you use a Cellebrite device to pull my data your Cellebrite device might get hacked by Signal."
    - ethbr0 5y ago
      Unless you're an information security professional, it seems unreasonable to expect an average Signal user to know more about the security of Cellebrite than Cellebrite's user (the police).
      - NateEag 5y ago
        Probably so. Thanks for pointing that out. If you're using Signal at all, you probably care at least a little about security, so it's not a given, but probably the vast majority of Signal users wil never hear about this. I wasn't trying to say you're automatically guilty if you don't warn the police about what Signal could do. I was just trying to say that a statement that _implies_ a trap exists, if you know enough about a piece of software, it's not a reasonable warning that a trap exists. If you know the trap exists, a case can be made that such an indirect statement is actually baiting the trap, rather than warning about it.

op00to 5y ago

It’s more knowingly destroying evidence than causing bodily harm.

furyg3 5y ago
That’s the thing: It’s not evidence at the time you set the trap. There are plenty of legitimate reasons you may want to protect your computer from Celebrite users. It’s not just cops that use this software. Bad foreign actors do. Private investigators might. Hell, Signal demonstrated that they’re falling off trucks, maybe you want to protect yourself from Moxie!
danShumway 5y ago
I understand the short answer is probably "Judges see it differently so the logic doesn't matter", but I don't get the difference between setting a "booby trap" to wipe a phone and the basic phone-wipe security settings that are already on phones. In the San Bernadino iPhone case there was a lot of hand-wringing about Apple's password limits, but no one was accusing Apple of purposefully destroying evidence because it has a setting that wipes data after multiple failed login attempts. Cellebrite does not only sell its software to the US government; one of its chief criticisms is that it doesn't really care who gets its code. So the threat model to end-users is the same, the same fears that would make me want to wipe my phone if someone is trying to get into it might make me want to wipe my phone if someone is trying to automatically pull large amounts of data off of it. Is the worry here that Cellebrite's vulnerability would need to be executed on a different computer, so it's in a different category? Forget technicalities and cleverness, I don't understand even the basic logical difference between Signal destroying its own data on export and iPhones wiping their data after failed login attempts. I trust the author, but I just don't get it. What security measures are acceptable to build into software?
- seoaeu 5y ago
  > Is the worry here that Cellebrite's vulnerability would need to be executed on a different computer, so it's in a different category? Yes, possibly. The legal system is all about trying to establish clear lines dividing the spectrum of obviously OK behavior and obviously unacceptable behavior. It is obviously OK to delete text messages off your phone. It is obviously unacceptable to break into a police station and delete evidence off their computers. Somewhere in between is the dividing line, and if this went before a judge it is entirely plausible that they would draw the line there.