4 ms·

I understand the short answer is probably "Judges see it differently so the logic doesn't matter", but I don't get the difference between setting a "booby trap"

I understand the short answer is probably "Judges see it differently so the logic doesn't matter", but I don't get the difference between setting a "booby trap" to wipe a phone and the basic phone-wipe security settings that are already on phones. In the San Bernadino iPhone case there was a lot of hand-wringing about Apple's password limits, but no one was accusing Apple of purposefully destroying evidence because it has a setting that wipes data after multiple failed login attempts. Cellebrite does not only sell its software to the US government; one of its chief criticisms is that it doesn't really care who gets its code. So the threat model to end-users is the same, the same fears that would make me want to wipe my phone if someone is trying to get into it might make me want to wipe my phone if someone is trying to automatically pull large amounts of data off of it. Is the worry here that Cellebrite's vulnerability would need to be executed on a different computer, so it's in a different category? Forget technicalities and cleverness, I don't understand even the basic logical difference between Signal destroying its own data on export and iPhones wiping their data after failed login attempts. I trust the author, but I just don't get it. What security measures are acceptable to build into software?

seoaeu 5y ago
> Is the worry here that Cellebrite's vulnerability would need to be executed on a different computer, so it's in a different category? Yes, possibly. The legal system is all about trying to establish clear lines dividing the spectrum of obviously OK behavior and obviously unacceptable behavior. It is obviously OK to delete text messages off your phone. It is obviously unacceptable to break into a police station and delete evidence off their computers. Somewhere in between is the dividing line, and if this went before a judge it is entirely plausible that they would draw the line there.
otterley 5y ago
> no one was accusing Apple of purposefully destroying evidence because it has a setting that wipes data after multiple failed login attempts. That’s because the feature is designed to protect your data and phone after it’s been stolen by a criminal, not to destroy evidence lawfully sought by law enforcement.
- danShumway 5y ago
  > not to destroy evidence lawfully sought by law enforcement. But Apple's encryption does still destroy evidence lawfully sought by law enforcement. And in fact, Apple has gone out of its way to make sure that its encryption will still destroy evidence even in instances where law enforcement is trying to access it -- that was the entire controversy behind the San Bernadino case. Apple wasn't willing to put holes in its security even knowing that their position made it harder for police officers to execute a lawful warrant. > is designed to protect your data and phone after it’s been stolen by a criminal I think I already talked about this above: > Cellebrite does not only sell its software to the US government; one of its chief criticisms is that it doesn't really care who gets its code. So the threat model to end-users is the same, the same fears that would make me want to wipe my phone if someone is trying to get into it might make me want to wipe my phone if someone is trying to automatically pull large amounts of data off of it. It's not clear to me that the threat model from Cellebrite is different than the threat model from a criminal. Cellebrite does not exclusively sell its software to the US government. And if Signal's devs could get their hands on it then there's no reason to believe that criminals couldn't get their hands on it as well. We already know their software has been leaked outside of law enforcement, because Moxie has it right now. I'm not saying that the author is wrong, I believe them. And I can understand that exploiting a vulnerability might be treated differently than on-device data deletion. But the specific reasoning you give about intent to disrupt an investigation makes no sense to me. In both cases I'm defending against criminals who may have stolen my phone and may be trying to exfiltrate data. The police aren't who I'm worried about here. It's not even that Apple/Signal's threat model seem to be 'technically' the same tunder some kind of narrow criteria or letter of the law, they're basically identical. As a layperson on the street or as a programmer trying to build secure software, I don't know how I would tell the two threat models apart. I don't know what test I can use here to tell when I am and am not allowed to be afraid of criminals stealing my phone and data.
  - otterley 5y ago
    Intent matters a lot in the law. The fact that evidence is destroyed even though it is lawfully sought by law enforcement can be, as attorneys would say, incidental. The same goes for people like me who regularly shred documents. I don't do it to frustrate law enforcement; I do it to frustrate identity thieves. BTW, companies destroy what could be future evidence as a routine matter under the guise of data retention policies. Take, for example, a policy that all incoming and outgoing emails are expunged after 90 days to conserve space and help contain the damage caused by corporate espionage. Courts aren't going to hold companies accountable for willful destruction of evidence if some evidence they would have lawfully sought is gone due to the execution of the policy. However, if a company has been given notice that they are subject to a subsequent preservation order, they must suspend the policy to the extent needed to effectuate the warrant or subpoena to avoid getting into trouble. > I don't know what test I can use here to tell when I am and am not allowed to be afraid of criminals stealing my phone and data. That's why we hire attorneys! Legal counsel is here to help. Ain't nothing wrong with relying on subject matter experts. For the same reason, I hire people to crawl through my attics, too.

seoaeu 5y ago

> Is the worry here that Cellebrite's vulnerability would need to be executed on a different computer, so it's in a different category? Yes, possibly. The legal system is all about trying to establish clear lines dividing the spectrum of obviously OK behavior and obviously unacceptable behavior. It is obviously OK to delete text messages off your phone. It is obviously unacceptable to break into a police station and delete evidence off their computers. Somewhere in between is the dividing line, and if this went before a judge it is entirely plausible that they would draw the line there.

otterley 5y ago

> no one was accusing Apple of purposefully destroying evidence because it has a setting that wipes data after multiple failed login attempts. That’s because the feature is designed to protect your data and phone after it’s been stolen by a criminal, not to destroy evidence lawfully sought by law enforcement.

danShumway 5y ago
> not to destroy evidence lawfully sought by law enforcement. But Apple's encryption does still destroy evidence lawfully sought by law enforcement. And in fact, Apple has gone out of its way to make sure that its encryption will still destroy evidence even in instances where law enforcement is trying to access it -- that was the entire controversy behind the San Bernadino case. Apple wasn't willing to put holes in its security even knowing that their position made it harder for police officers to execute a lawful warrant. > is designed to protect your data and phone after it’s been stolen by a criminal I think I already talked about this above: > Cellebrite does not only sell its software to the US government; one of its chief criticisms is that it doesn't really care who gets its code. So the threat model to end-users is the same, the same fears that would make me want to wipe my phone if someone is trying to get into it might make me want to wipe my phone if someone is trying to automatically pull large amounts of data off of it. It's not clear to me that the threat model from Cellebrite is different than the threat model from a criminal. Cellebrite does not exclusively sell its software to the US government. And if Signal's devs could get their hands on it then there's no reason to believe that criminals couldn't get their hands on it as well. We already know their software has been leaked outside of law enforcement, because Moxie has it right now. I'm not saying that the author is wrong, I believe them. And I can understand that exploiting a vulnerability might be treated differently than on-device data deletion. But the specific reasoning you give about intent to disrupt an investigation makes no sense to me. In both cases I'm defending against criminals who may have stolen my phone and may be trying to exfiltrate data. The police aren't who I'm worried about here. It's not even that Apple/Signal's threat model seem to be 'technically' the same tunder some kind of narrow criteria or letter of the law, they're basically identical. As a layperson on the street or as a programmer trying to build secure software, I don't know how I would tell the two threat models apart. I don't know what test I can use here to tell when I am and am not allowed to be afraid of criminals stealing my phone and data.
- otterley 5y ago
  Intent matters a lot in the law. The fact that evidence is destroyed even though it is lawfully sought by law enforcement can be, as attorneys would say, incidental. The same goes for people like me who regularly shred documents. I don't do it to frustrate law enforcement; I do it to frustrate identity thieves. BTW, companies destroy what could be future evidence as a routine matter under the guise of data retention policies. Take, for example, a policy that all incoming and outgoing emails are expunged after 90 days to conserve space and help contain the damage caused by corporate espionage. Courts aren't going to hold companies accountable for willful destruction of evidence if some evidence they would have lawfully sought is gone due to the execution of the policy. However, if a company has been given notice that they are subject to a subsequent preservation order, they must suspend the policy to the extent needed to effectuate the warrant or subpoena to avoid getting into trouble. > I don't know what test I can use here to tell when I am and am not allowed to be afraid of criminals stealing my phone and data. That's why we hire attorneys! Legal counsel is here to help. Ain't nothing wrong with relying on subject matter experts. For the same reason, I hire people to crawl through my attics, too.