3 ms·

unfortunately it seems pretty clear to me that it'd be a CFAA violation: "(A)knowingly causes the transmission of a program, information, code, or command, and

unfortunately it seems pretty clear to me that it'd be a CFAA violation: "(A)knowingly causes the transmission of a program, information, code, or command, and as a result of such conduct, intentionally causes damage without authorization, to a protected computer;" if Signal downloaded Cellebrite-pwning shellcode to its app, that shows intent.. it's "knowingly causing transmission" in the sense that worm authors knowingly cause transmission of their viruses by equipping them with exploits (and are thus responsible for damage wherever the worm goes.) if that shellcode does anything at all - deleting files, adding files, bricking the device, that falls under the CFAA's definition of "damage," since it affects the integrity of the extracted files. you could argue that Signal doesn't knowingly intend to infect "protected computers," but unless these updates are, say, geofenced to not hit the US, it'll be obvious to the court that they could anticipate government machines getting hit. the smartest thing would be for Signal to follow through on delivering these files, but have them be cat pictures. troll Cellebrite and muddy the waters for prosecutors. no CFAA violation, but Cellebrite can't ever be sure (and prosecutors can't ever prove.)

Sephr 5y ago
> if Signal downloaded Cellebrite-pwning shellcode to its app The transmission in this legal context is the other way imo. Cellebrite's device is transmitting Signal data out, and Signal is not intentionally sending data to these devices.
- zerocrates 5y ago
  So, let's say for the sake of argument that Signal does download files that are intended to exploit these Cellebrite vulns to users' phones. The part of the statute we're talking about triggers when someone: - knowingly causes the transmission of a program, information, code, or command - and as a result of such conduct, intentionally causes damage without authorization to a protected computer Notice: this didn't require someone to transmit code to the victim machine: they knowingly cause code to be transmitted somewhere, and that intentionally causes damage as a result. Isn't that what you have here? In our assumed world, Signal's devs have written the app to pull down the exploit to the users' phones, thereby knowingly causing it to be transmitted. I think it'd be hard to claim with a straight face that your Cellebrite-targeting code (that you told the world about) wasn't intentionally targeting Cellebrite. Under your rule of "you have to intentionally send data to the victim device," what result if you write malware and post it, say, on Facebook: just as you intended, anyone who clicks is infected, but the payload is inert as to Facebook's servers. Are you in the clear because the harmed users all initiated the download themselves?
  - trickstra 5y ago
    But those are two separate actions: - Signal transmits a code (exploit) and keeps it in its cache, the code is dormant, nothing is being damaged here, it could stay like this forever, no harm. - Cellebrite transmits Signal's files and cache, including the exploit, and gets hacked by reading it with their scanner. The key is that the first action is harmless, and the second action is performed by Cellebrite, so can't blame Signal for it. I don't think these two actions can be consider as one. And the main difference from the malware scenario is that this Signal code is not meant for reading, it is inaccessible and harmless for anyone except the Cellebrite hackers. The exploit is activated by unauthorized use, unlike the malware.
  - daniellarusso 5y ago
    Are you trying to convince a jury, or just bring charges?
    - zerocrates 5y ago
      I'm not going to pretend it's a 100% open-and-shut case: the CFAA in its great broadness is a fairly controversial area, and this is a "weird" case. And as always, who knows what a jury will do. On the other hand, in the hypothetical scenario where this actually happened and damaged some law-enforcement-owned machines, I don't see the average jury being too sympathetic. It's certainly problematic enough that it's a legitimate concern, I'd say.
zerocrates 5y ago
A "protected computer" as defined in the CFAA is, to a first approximation, any computer. Particularly if it's connected to the Internet.
daniellarusso 5y ago
What about the other countries?
bopbeepboop 5y ago
This is entirely wrong. You don’t have a right to steal my malware collection and run it through your own software without getting malware. There simply is no right for other people to take my phone and “safely extract” the files — which your argument depends on. I do, however, have a right to put malware on my phone, for my own amusement. If anyone is violating the CFAA, it’s Cellbrite who does hack my phone on behalf of a number of unauthorized users.

Sephr 5y ago

> if Signal downloaded Cellebrite-pwning shellcode to its app The transmission in this legal context is the other way imo. Cellebrite's device is transmitting Signal data out, and Signal is not intentionally sending data to these devices.

zerocrates 5y ago
So, let's say for the sake of argument that Signal does download files that are intended to exploit these Cellebrite vulns to users' phones. The part of the statute we're talking about triggers when someone: - knowingly causes the transmission of a program, information, code, or command - and as a result of such conduct, intentionally causes damage without authorization to a protected computer Notice: this didn't require someone to transmit code to the victim machine: they knowingly cause code to be transmitted somewhere, and that intentionally causes damage as a result. Isn't that what you have here? In our assumed world, Signal's devs have written the app to pull down the exploit to the users' phones, thereby knowingly causing it to be transmitted. I think it'd be hard to claim with a straight face that your Cellebrite-targeting code (that you told the world about) wasn't intentionally targeting Cellebrite. Under your rule of "you have to intentionally send data to the victim device," what result if you write malware and post it, say, on Facebook: just as you intended, anyone who clicks is infected, but the payload is inert as to Facebook's servers. Are you in the clear because the harmed users all initiated the download themselves?
- trickstra 5y ago
  But those are two separate actions: - Signal transmits a code (exploit) and keeps it in its cache, the code is dormant, nothing is being damaged here, it could stay like this forever, no harm. - Cellebrite transmits Signal's files and cache, including the exploit, and gets hacked by reading it with their scanner. The key is that the first action is harmless, and the second action is performed by Cellebrite, so can't blame Signal for it. I don't think these two actions can be consider as one. And the main difference from the malware scenario is that this Signal code is not meant for reading, it is inaccessible and harmless for anyone except the Cellebrite hackers. The exploit is activated by unauthorized use, unlike the malware.
- daniellarusso 5y ago
  Are you trying to convince a jury, or just bring charges?
  - zerocrates 5y ago
    I'm not going to pretend it's a 100% open-and-shut case: the CFAA in its great broadness is a fairly controversial area, and this is a "weird" case. And as always, who knows what a jury will do. On the other hand, in the hypothetical scenario where this actually happened and damaged some law-enforcement-owned machines, I don't see the average jury being too sympathetic. It's certainly problematic enough that it's a legitimate concern, I'd say.

zerocrates 5y ago

A "protected computer" as defined in the CFAA is, to a first approximation, any computer. Particularly if it's connected to the Internet.

daniellarusso 5y ago

What about the other countries?

bopbeepboop 5y ago

This is entirely wrong. You don’t have a right to steal my malware collection and run it through your own software without getting malware. There simply is no right for other people to take my phone and “safely extract” the files — which your argument depends on. I do, however, have a right to put malware on my phone, for my own amusement. If anyone is violating the CFAA, it’s Cellbrite who does hack my phone on behalf of a number of unauthorized users.