5 ms·

Imagine physical vault in your house. This vault has mechanism within it such that if anyone forces it open it will destroy all its contents. It may have defens

Imagine physical vault in your house. This vault has mechanism within it such that if anyone forces it open it will destroy all its contents. It may have defense mechanisms triggered to act as deterrence – it may spill/spew very bad odor and permanent ink – on anything nearby and that odor and color will be very hard to get rid of. Is such a vault legal? If someone breaks into your house and steals such a vault and in the process of trying to open it, if they suffer damage, is the owner of the vault liable? What's the principle being applied here? How would the same principle be applied in the case of digital property?

saagarjha 5y ago
The issue here is not "someone" breaking into your house and stealing it, it is the authorities doing it. Destruction/sabotage of the evidence collection process is very possibly going to be held against you.
- vinay_ys 5y ago
  Yeah, and the authorities have to do it the right way. There's a reason why this is such a big issue and not as straightforward as you make it to be. https://www.vox.com/recode/2020/2/24/21133600/police-fbi-phone-search-protests-password-rights https://www.vox.com/recode/2020/2/24/21133600/police-fbi-pho...
  - saagarjha 5y ago
    I agree that the overall situation around evidence recovery from locked devices is not straightforward, but I don't think I referenced this in my comment–I merely provided insight into why the specific actions might be considered to be illegal (using the argument in the blog post, I might add).
- Certhas 5y ago
  But all Signal is (threatening to be) doing is blowing up devices that parse all files using insecure software. Let's look at another case, I remember that some people had USB drivers that detected "wrigglers" and shut down the computer in response to such a wiggler. Would that also be illegal? If I install anti scan files and anti mouse wrigglers when travelling to China do they become legal then?
  - sjy 5y ago
    The article quotes the part of the Signal blog that said “a real exploit payload would likely seek to undetectably alter previous reports, compromise the integrity of future reports (perhaps at random!), or exfiltrate data from the Cellebrite machine.” A complex exploit like that would say much more about the author’s intent than a driver that shuts down the computer when a “wiggler” is detected.
    - thayne 5y ago
      But what if Signal's (or anyone else's) exploitation simply locked the device when the file was read, preventing further data extraction?
- pseudo0 5y ago
  It seems like there's a bit of a logical leap in that argument. As the article notes, Cellebrite isn't exactly discerning when it comes to their customer base. It seems like they sell their tools to just about anyone willing to pay their steep fee, not just US law enforcement. I'd argue it's more akin to a specialized crowbar or blowtorch in the safe analogy. Sure, law enforcement might use it to try to crack your safe, but so could various other bad actors. There would be a legitimate non-spoilation purpose in protecting political dissidents who have their phones seized at a foreign border or stolen, for example.
- MikeUt 5y ago
  Well if it's the authorities, they can present you with a warrant and request that you disable your defenses. You should not be required to roll over and present your defenseless underbelly to everyone that wants to break in, in case some of them are "the authorities".
- brigandish 5y ago
  You don’t have to help anyone collect evidence against you, you’re innocent until proven guilty, it’s up to others to prove their case- why would you help implicate yourself? Presumption of innocence is the most fundamental cornerstone of common law.
sjy 5y ago
The parts of the article quoted above suggest that the principle is a CFAA violation – someone who distributes an exploit tailored to destroy evidence captured by Cellebrite probably “knowingly causes the transmission of a program, information, code, or command, and as a result of such conduct, intentionally causes damage without authorization, to a protected computer.” Difficult philosophical questions arise with the phrases “knowingly causes” and “intentionally causes damage,” but a jury can use common sense to resolve them on the evidence in a particular case. The same issues arise when trying to determine intent and causation when someone fires a gun or carries a bag full of white powder. The details matter.
- Certhas 5y ago
  I think the crucial point glossed over in the analysis of the blog post is "knowingly causes the transmission". The user of Cellebrite causes the transmission. I would really like to see a proper legal analysis of the situation, and this doesn't seem to be it. The author also misses the point of the "show me yours I'll show you mine". Cellebrite is, from what I understand, knowingly leaving everyone's machine vulnerable in order to conduct their business.' This is something that _should_ be illegal. Not disclosing (and actively benefiting from) vulnerabilities in other peoples products is what we should have laws against.
  - sjy 5y ago
    The DOJ publishes legal guidance on prosecuting computer crimes [1], which includes this relevant passage: > An attacker need not directly send the required transmission to the victim computer in order to violate this statute. In one case, a defendant inserted malicious code into a software program he wrote to run on his employer's computer network. United States v. Sullivan, 40 Fed. Appx. 740 (4th Cir. 2002) (unpublished) [2]. After lying dormant for four months, the malicious code activated and downloaded certain other malicious code to several hundred employee handheld computers, making them unusable. Id. at 741. The court held that the defendant knowingly caused transmission of code in violation of the statute. Id. at 743. The CFAA is notoriously broad, which is probably why Pfefferkorn didn’t feel the need to undertake a detailed analysis of exactly how it prohibits the deployment of a targeted exploit which would “undetectably alter previous reports, compromise the integrity of future reports (perhaps at random!), or exfiltrate data from the Cellebrite machine.” [1] https://www.justice.gov/sites/default/files/criminal-ccips/legacy/2015/01/14/ccmanual.pdf https://www.justice.gov/sites/default/files/criminal-ccips/l... [2] https://www.anylaw.com/case/united-states-v-sullivan/fourth-circuit/02-28-2002/tYJVPmYBTlTomsSB8cc0 https://www.anylaw.com/case/united-states-v-sullivan/fourth-...
tsimionescu 5y ago
If the vault hurts police officers who had a legal warrant for opening it, through a feature that was purposefully designed for this, I would bet that yes, it would be completely illegal, and both the manufacturer AND owner (if it can be proved they were aware) may be held responsible for the injuries. Similarly, if your app/device damages government property and tampers with legal evidence, both you and the creators would likely be held responsible. Even if the law may be unclear, you will definitely face charges for this, given how defensive police departments are in these cases (there was one case where a person they beat up had extra charges brought against him for dirtying the officers' uniforms with his blood... ). Furthermore, simply creating exploit code and releasing it into the wild is illegal, so Signal, if it were ever found to have done what they let us believe they could do, could be held legally responsible, even if the code never made it to exploit a live system at all.
hutzlibu 5y ago
"Is such a vault legal? " You definitely are not allowed to have traps in your house with the intention of hurting potential thieves. So definitely no bear traps etc. Permanent ink would probably still fall under that category. And below that it becomes grey area.
- richardwhiuk 5y ago
  That depends on the state in the US. Stand Your Ground and Castle doctrine make it substantially less clear.
  - hutzlibu 5y ago
    Less clear, maybe, but as far as I understand the various regulations, they all refer to personal self defense. So to protect yourself from harm, you may use (deadly) force. That would not apply to protecting your vault from theft, by using physical - automated - violence against the thief.
- dylan604 5y ago
  What about dye packs from banks?
  - hutzlibu 5y ago
    You are probably not a bank, so not the same rules apply.
- mannerheim 5y ago
  https://www.youtube.com/watch?v=h4T_LlK1VE4 https://www.youtube.com/watch?v=h4T_LlK1VE4
smallnamespace 5y ago
The purported hack here would specifically target Cellebrite, not anyone accessing these files in general. Also, if you know someone is stealing your lunch from the shared work fridge, so you add rat poison to your lunch, do you get to walk away scot free on the theory that it’s the thief’s fault?
- thayne 5y ago
  But cellebrite could be used by an oppressive regime, or criminals that got their hands on it. I'm doubtful such an argument would hold up in court, but I don't think you can honestly say targeting cellebrite is the same as targeting US law enforcement.
_Algernon_ 5y ago
Physical booby traps tend to be illegal if they aren't supervised. Not sure if that's only for physical damages / injuries or applies to other damage as well. https://en.wikipedia.org/wiki/Katko_v._Briney https://en.wikipedia.org/wiki/Katko_v._Briney
- mannerheim 5y ago
  There's a fellow on YouTube who leaves bait boxes that shoot glitter and spray stink spray.
  - LinuxBender 5y ago
    Not a lawyer but if I was a lawyer, I would tell my client to never do that. Should something go wrong and the glitter gets into someones eyes, that's a case. Even worse, glitter dispenses while person is operating a vehicle and pedestrians are injured, that's a case.

saagarjha 5y ago

The issue here is not "someone" breaking into your house and stealing it, it is the authorities doing it. Destruction/sabotage of the evidence collection process is very possibly going to be held against you.

vinay_ys 5y ago
Yeah, and the authorities have to do it the right way. There's a reason why this is such a big issue and not as straightforward as you make it to be. https://www.vox.com/recode/2020/2/24/21133600/police-fbi-phone-search-protests-password-rights https://www.vox.com/recode/2020/2/24/21133600/police-fbi-pho...
- saagarjha 5y ago
  I agree that the overall situation around evidence recovery from locked devices is not straightforward, but I don't think I referenced this in my comment–I merely provided insight into why the specific actions might be considered to be illegal (using the argument in the blog post, I might add).
Certhas 5y ago
But all Signal is (threatening to be) doing is blowing up devices that parse all files using insecure software. Let's look at another case, I remember that some people had USB drivers that detected "wrigglers" and shut down the computer in response to such a wiggler. Would that also be illegal? If I install anti scan files and anti mouse wrigglers when travelling to China do they become legal then?
- sjy 5y ago
  The article quotes the part of the Signal blog that said “a real exploit payload would likely seek to undetectably alter previous reports, compromise the integrity of future reports (perhaps at random!), or exfiltrate data from the Cellebrite machine.” A complex exploit like that would say much more about the author’s intent than a driver that shuts down the computer when a “wiggler” is detected.
  - thayne 5y ago
    But what if Signal's (or anyone else's) exploitation simply locked the device when the file was read, preventing further data extraction?
pseudo0 5y ago
It seems like there's a bit of a logical leap in that argument. As the article notes, Cellebrite isn't exactly discerning when it comes to their customer base. It seems like they sell their tools to just about anyone willing to pay their steep fee, not just US law enforcement. I'd argue it's more akin to a specialized crowbar or blowtorch in the safe analogy. Sure, law enforcement might use it to try to crack your safe, but so could various other bad actors. There would be a legitimate non-spoilation purpose in protecting political dissidents who have their phones seized at a foreign border or stolen, for example.
MikeUt 5y ago
Well if it's the authorities, they can present you with a warrant and request that you disable your defenses. You should not be required to roll over and present your defenseless underbelly to everyone that wants to break in, in case some of them are "the authorities".
brigandish 5y ago
You don’t have to help anyone collect evidence against you, you’re innocent until proven guilty, it’s up to others to prove their case- why would you help implicate yourself? Presumption of innocence is the most fundamental cornerstone of common law.

sjy 5y ago

The parts of the article quoted above suggest that the principle is a CFAA violation – someone who distributes an exploit tailored to destroy evidence captured by Cellebrite probably “knowingly causes the transmission of a program, information, code, or command, and as a result of such conduct, intentionally causes damage without authorization, to a protected computer.” Difficult philosophical questions arise with the phrases “knowingly causes” and “intentionally causes damage,” but a jury can use common sense to resolve them on the evidence in a particular case. The same issues arise when trying to determine intent and causation when someone fires a gun or carries a bag full of white powder. The details matter.

Certhas 5y ago
I think the crucial point glossed over in the analysis of the blog post is "knowingly causes the transmission". The user of Cellebrite causes the transmission. I would really like to see a proper legal analysis of the situation, and this doesn't seem to be it. The author also misses the point of the "show me yours I'll show you mine". Cellebrite is, from what I understand, knowingly leaving everyone's machine vulnerable in order to conduct their business.' This is something that _should_ be illegal. Not disclosing (and actively benefiting from) vulnerabilities in other peoples products is what we should have laws against.
- sjy 5y ago
  The DOJ publishes legal guidance on prosecuting computer crimes [1], which includes this relevant passage: > An attacker need not directly send the required transmission to the victim computer in order to violate this statute. In one case, a defendant inserted malicious code into a software program he wrote to run on his employer's computer network. United States v. Sullivan, 40 Fed. Appx. 740 (4th Cir. 2002) (unpublished) [2]. After lying dormant for four months, the malicious code activated and downloaded certain other malicious code to several hundred employee handheld computers, making them unusable. Id. at 741. The court held that the defendant knowingly caused transmission of code in violation of the statute. Id. at 743. The CFAA is notoriously broad, which is probably why Pfefferkorn didn’t feel the need to undertake a detailed analysis of exactly how it prohibits the deployment of a targeted exploit which would “undetectably alter previous reports, compromise the integrity of future reports (perhaps at random!), or exfiltrate data from the Cellebrite machine.” [1] https://www.justice.gov/sites/default/files/criminal-ccips/legacy/2015/01/14/ccmanual.pdf https://www.justice.gov/sites/default/files/criminal-ccips/l... [2] https://www.anylaw.com/case/united-states-v-sullivan/fourth-circuit/02-28-2002/tYJVPmYBTlTomsSB8cc0 https://www.anylaw.com/case/united-states-v-sullivan/fourth-...

tsimionescu 5y ago

If the vault hurts police officers who had a legal warrant for opening it, through a feature that was purposefully designed for this, I would bet that yes, it would be completely illegal, and both the manufacturer AND owner (if it can be proved they were aware) may be held responsible for the injuries. Similarly, if your app/device damages government property and tampers with legal evidence, both you and the creators would likely be held responsible. Even if the law may be unclear, you will definitely face charges for this, given how defensive police departments are in these cases (there was one case where a person they beat up had extra charges brought against him for dirtying the officers' uniforms with his blood... ). Furthermore, simply creating exploit code and releasing it into the wild is illegal, so Signal, if it were ever found to have done what they let us believe they could do, could be held legally responsible, even if the code never made it to exploit a live system at all.

hutzlibu 5y ago

"Is such a vault legal? " You definitely are not allowed to have traps in your house with the intention of hurting potential thieves. So definitely no bear traps etc. Permanent ink would probably still fall under that category. And below that it becomes grey area.

richardwhiuk 5y ago
That depends on the state in the US. Stand Your Ground and Castle doctrine make it substantially less clear.
- hutzlibu 5y ago
  Less clear, maybe, but as far as I understand the various regulations, they all refer to personal self defense. So to protect yourself from harm, you may use (deadly) force. That would not apply to protecting your vault from theft, by using physical - automated - violence against the thief.
dylan604 5y ago
What about dye packs from banks?
- hutzlibu 5y ago
  You are probably not a bank, so not the same rules apply.
mannerheim 5y ago
https://www.youtube.com/watch?v=h4T_LlK1VE4 https://www.youtube.com/watch?v=h4T_LlK1VE4

smallnamespace 5y ago

The purported hack here would specifically target Cellebrite, not anyone accessing these files in general. Also, if you know someone is stealing your lunch from the shared work fridge, so you add rat poison to your lunch, do you get to walk away scot free on the theory that it’s the thief’s fault?

thayne 5y ago
But cellebrite could be used by an oppressive regime, or criminals that got their hands on it. I'm doubtful such an argument would hold up in court, but I don't think you can honestly say targeting cellebrite is the same as targeting US law enforcement.

_Algernon_ 5y ago

Physical booby traps tend to be illegal if they aren't supervised. Not sure if that's only for physical damages / injuries or applies to other damage as well. https://en.wikipedia.org/wiki/Katko_v._Briney https://en.wikipedia.org/wiki/Katko_v._Briney

mannerheim 5y ago
There's a fellow on YouTube who leaves bait boxes that shoot glitter and spray stink spray.
- LinuxBender 5y ago
  Not a lawyer but if I was a lawyer, I would tell my client to never do that. Should something go wrong and the glitter gets into someones eyes, that's a case. Even worse, glitter dispenses while person is operating a vehicle and pedestrians are injured, that's a case.