7 ms·

> Following through on it is probably illegal I'm curious how? If they announce publicly that they will place files on devices that may exploit a publicly anno

> Following through on it is probably illegal I'm curious how? If they announce publicly that they will place files on devices that may exploit a publicly announced vulnerability in Cellebrite, then it's Cellebrite's prerogative to fix the vulnerability. If they knowingly ignore a publicly disclosed risk, then they have only themselves to blame.

asddubs 5y ago
TFA: >Uh, is that legal? >No, intentionally spoiling evidence — or “spoliating,” to use the legal term — is definitely not legal. >Neither is hacking somebody’s computer, which is what Signal’s blog post is saying a “real exploit payload” could do. It said, “a real exploit payload would likely seek to undetectably alter previous reports, compromise the integrity of future reports (perhaps at random!), or exfiltrate data from the Cellebrite machine.” All of those things are a violation of the federal anti-hacking law known as the Computer Fraud and Abuse Act, or CFAA, and probably also of many state-law versions of the CFAA. (If the computer belongs to a federal law enforcement agency, it’s definitely a CFAA violation. If it’s a state, local, or tribal government law enforcement agency, then, because of how the CFAA defines “protected computers” covered by the Act, it might depend on whether the Windows machine that’s used for Cellebrite extractions is connected to the internet or not. That machine should be segmented apart from the rest of the police department’s network, but if it has an internet connection, the CFAA applies. And even if it doesn’t, I bet there are other ways of easily satisfying the “protected computer” definition.)
- vinay_ys 5y ago
  Imagine physical vault in your house. This vault has mechanism within it such that if anyone forces it open it will destroy all its contents. It may have defense mechanisms triggered to act as deterrence – it may spill/spew very bad odor and permanent ink – on anything nearby and that odor and color will be very hard to get rid of. Is such a vault legal? If someone breaks into your house and steals such a vault and in the process of trying to open it, if they suffer damage, is the owner of the vault liable? What's the principle being applied here? How would the same principle be applied in the case of digital property?
  - saagarjha 5y ago
    The issue here is not "someone" breaking into your house and stealing it, it is the authorities doing it. Destruction/sabotage of the evidence collection process is very possibly going to be held against you.
    - vinay_ys 5y ago
      Yeah, and the authorities have to do it the right way. There's a reason why this is such a big issue and not as straightforward as you make it to be. https://www.vox.com/recode/2020/2/24/21133600/police-fbi-phone-search-protests-password-rights https://www.vox.com/recode/2020/2/24/21133600/police-fbi-pho...
      - saagarjha 5y ago
        I agree that the overall situation around evidence recovery from locked devices is not straightforward, but I don't think I referenced this in my comment–I merely provided insight into why the specific actions might be considered to be illegal (using the argument in the blog post, I might add).
    - Certhas 5y ago
      But all Signal is (threatening to be) doing is blowing up devices that parse all files using insecure software. Let's look at another case, I remember that some people had USB drivers that detected "wrigglers" and shut down the computer in response to such a wiggler. Would that also be illegal? If I install anti scan files and anti mouse wrigglers when travelling to China do they become legal then?
      - sjy 5y ago
        The article quotes the part of the Signal blog that said “a real exploit payload would likely seek to undetectably alter previous reports, compromise the integrity of future reports (perhaps at random!), or exfiltrate data from the Cellebrite machine.” A complex exploit like that would say much more about the author’s intent than a driver that shuts down the computer when a “wiggler” is detected.
- indigochill 5y ago
  >No, intentionally spoiling evidence — or “spoliating,” to use the legal term — is definitely not legal. My point is Cellebrite/the Cellebrite user would be the one spoiling the evidence. The evidence is sitting there on the device unspoiled, and only if the user decides to charge ahead without heeding the public warning that doing so without the necessary precautions will spoil the evidence will the evidence actually be spoiled. Signal itself has no knowledge of which files constitute evidence (it applies this completely indiscriminately), so I don't think you could argue that it is knowingly spoiling evidence.
  - nearbuy 5y ago
    > Signal itself has no knowledge of which files constitute evidence (it applies this completely indiscriminately), so I don't think you could argue that it is knowingly spoiling evidence. The article, written by a legal scholar with a specialty in precisely these issues, directly contradicts this. Signal coyly threatened to make their app hack Cellebrite machines with the intent of spoiling evidence. It doesn't matter that they aren't targeting specific evidence. Blanket spoiling all Cellebrite evidence would apparently be enough to get them in legal trouble.
    - feanaro 5y ago
      Where is this special status for Cellebrite coming from? Just because they're one of the vendors whose software happens to be used by some governments, I'm suddenly forbidden from having an arbitrary sequence of bytes on my device in case someone else happens to connect and run some arbitrary software on it? I'm having a hard time imagining this being a viable argument. Seems like the vendor should just fix their software if they expect it to work reliably. Anything else would be too large of a transgression on civil freedom.
      - acdha 5y ago
        There’s no special status for Cellebrite: it comes down to intent and, especially, that judges are not computers rigidly executing code. If you do something which is designed to damage equipment used by law enforcement, a judge is going to ask what your intention was, not just throw up their hands and say anyone could have had those random bytes. As a real-world analogy, consider for the sake of argument how having a trap on your home safe might look if you were a) in a very high-crime neighborhood or b) engaged in criminal activities and had written of your desire to harm cops – even if the action is exactly the same (and illegal in your jurisdiction), I’d expect the latter situation to go a lot worse because you’re knowingly targeting law enforcement engaged in (at least from the court’s perspective) legitimate activities. Since Signal would be deploying that exploit to millions of devices to combat surveillance tech, I would expect that to at least result in a suit even if they were able to defend themselves successfully. It would be especially interesting to see how Cellebrite’s use by various repressive regimes entered into that: an American court might, for example, be sympathetic to a campaign trying to protect dissidents in China which happens to impact an American police agency using the same tool.

asddubs 5y ago

TFA: >Uh, is that legal? >No, intentionally spoiling evidence — or “spoliating,” to use the legal term — is definitely not legal. >Neither is hacking somebody’s computer, which is what Signal’s blog post is saying a “real exploit payload” could do. It said, “a real exploit payload would likely seek to undetectably alter previous reports, compromise the integrity of future reports (perhaps at random!), or exfiltrate data from the Cellebrite machine.” All of those things are a violation of the federal anti-hacking law known as the Computer Fraud and Abuse Act, or CFAA, and probably also of many state-law versions of the CFAA. (If the computer belongs to a federal law enforcement agency, it’s definitely a CFAA violation. If it’s a state, local, or tribal government law enforcement agency, then, because of how the CFAA defines “protected computers” covered by the Act, it might depend on whether the Windows machine that’s used for Cellebrite extractions is connected to the internet or not. That machine should be segmented apart from the rest of the police department’s network, but if it has an internet connection, the CFAA applies. And even if it doesn’t, I bet there are other ways of easily satisfying the “protected computer” definition.)

vinay_ys 5y ago
Imagine physical vault in your house. This vault has mechanism within it such that if anyone forces it open it will destroy all its contents. It may have defense mechanisms triggered to act as deterrence – it may spill/spew very bad odor and permanent ink – on anything nearby and that odor and color will be very hard to get rid of. Is such a vault legal? If someone breaks into your house and steals such a vault and in the process of trying to open it, if they suffer damage, is the owner of the vault liable? What's the principle being applied here? How would the same principle be applied in the case of digital property?
- saagarjha 5y ago
  The issue here is not "someone" breaking into your house and stealing it, it is the authorities doing it. Destruction/sabotage of the evidence collection process is very possibly going to be held against you.
  - vinay_ys 5y ago
    Yeah, and the authorities have to do it the right way. There's a reason why this is such a big issue and not as straightforward as you make it to be. https://www.vox.com/recode/2020/2/24/21133600/police-fbi-phone-search-protests-password-rights https://www.vox.com/recode/2020/2/24/21133600/police-fbi-pho...
    - saagarjha 5y ago
      I agree that the overall situation around evidence recovery from locked devices is not straightforward, but I don't think I referenced this in my comment–I merely provided insight into why the specific actions might be considered to be illegal (using the argument in the blog post, I might add).
  - Certhas 5y ago
    But all Signal is (threatening to be) doing is blowing up devices that parse all files using insecure software. Let's look at another case, I remember that some people had USB drivers that detected "wrigglers" and shut down the computer in response to such a wiggler. Would that also be illegal? If I install anti scan files and anti mouse wrigglers when travelling to China do they become legal then?
    - sjy 5y ago
      The article quotes the part of the Signal blog that said “a real exploit payload would likely seek to undetectably alter previous reports, compromise the integrity of future reports (perhaps at random!), or exfiltrate data from the Cellebrite machine.” A complex exploit like that would say much more about the author’s intent than a driver that shuts down the computer when a “wiggler” is detected.
indigochill 5y ago
>No, intentionally spoiling evidence — or “spoliating,” to use the legal term — is definitely not legal. My point is Cellebrite/the Cellebrite user would be the one spoiling the evidence. The evidence is sitting there on the device unspoiled, and only if the user decides to charge ahead without heeding the public warning that doing so without the necessary precautions will spoil the evidence will the evidence actually be spoiled. Signal itself has no knowledge of which files constitute evidence (it applies this completely indiscriminately), so I don't think you could argue that it is knowingly spoiling evidence.
- nearbuy 5y ago
  > Signal itself has no knowledge of which files constitute evidence (it applies this completely indiscriminately), so I don't think you could argue that it is knowingly spoiling evidence. The article, written by a legal scholar with a specialty in precisely these issues, directly contradicts this. Signal coyly threatened to make their app hack Cellebrite machines with the intent of spoiling evidence. It doesn't matter that they aren't targeting specific evidence. Blanket spoiling all Cellebrite evidence would apparently be enough to get them in legal trouble.
  - feanaro 5y ago
    Where is this special status for Cellebrite coming from? Just because they're one of the vendors whose software happens to be used by some governments, I'm suddenly forbidden from having an arbitrary sequence of bytes on my device in case someone else happens to connect and run some arbitrary software on it? I'm having a hard time imagining this being a viable argument. Seems like the vendor should just fix their software if they expect it to work reliably. Anything else would be too large of a transgression on civil freedom.
    - acdha 5y ago
      There’s no special status for Cellebrite: it comes down to intent and, especially, that judges are not computers rigidly executing code. If you do something which is designed to damage equipment used by law enforcement, a judge is going to ask what your intention was, not just throw up their hands and say anyone could have had those random bytes. As a real-world analogy, consider for the sake of argument how having a trap on your home safe might look if you were a) in a very high-crime neighborhood or b) engaged in criminal activities and had written of your desire to harm cops – even if the action is exactly the same (and illegal in your jurisdiction), I’d expect the latter situation to go a lot worse because you’re knowingly targeting law enforcement engaged in (at least from the court’s perspective) legitimate activities. Since Signal would be deploying that exploit to millions of devices to combat surveillance tech, I would expect that to at least result in a suit even if they were able to defend themselves successfully. It would be especially interesting to see how Cellebrite’s use by various repressive regimes entered into that: an American court might, for example, be sympathetic to a campaign trying to protect dissidents in China which happens to impact an American police agency using the same tool.