15 ms·
A phone the FBI sold to criminals
- sergiomattei 5y agoAight, this is some next-level stuff. Hell, I'd even call it badass. The FBI created a tech startup (even with the .io domain!) and sold devices with a custom Android distribution. It's funny because you can search for the XDA-Developers thread mentioned in the article, they were pretty shocked to find a phone with modded software and a locked bootloader.
- swiley 5y agoNot really. If you use an OS built by someone else with no publicly available code then they own you. Always. That's hardly news.
- titzer 5y agoMost consumer Android phones come with Google Play Services installed by default. Note that that is a completely different thing than the Google Play Store. It's intentionally branded to be confusing and sound like it has something to do with applications. Google Play Services is an entire closed-source operating system living above the kernel, but has hooks all the way down, into every subsystem. It offers a ton of juicy APIs to make Android development "easier", but one of the things that it does (called Google Location Services, or GLS) is interpose between GPS and other ways of location and offer a location API to applications, becoming the location provider for the device. All requests for location go through it. GLS has scary[1] privacy implications and you cannot uninstall it. You can disable most of the scary stuff it does by not agreeing to use "high accuracy" mode for location, aka "device only". You must "consent" to this data collection because Google's lawyers believe this consent dialog meets legal requirements for this data collection. Their verbiage is horribly vague and absolutely does not communicate what data collection you are agreeing to by enabling this mode. It calls this data "anonymous" but location data, particularly traces, is anything but anonymous. At the high resolution of GPS these days, it cannot be anonymized. [1] by "scary", I actually mean absolutely dystopian.
- swiley 5y agoYup. Unfortunately we're training children and college students to accept this. OS vendors are now effectively pseudo governments due to this kind of thing.
- goodpoint 5y agopseudo governments without any trace of public accountability
- pyuser583 5y agoCan you go into more detail about the scary parts of Google Play Services? Or include a link?
- titzer 5y ago> Can you go into more detail about the scary parts of Google Play Services? Unfortunately, I cannot. > include a link? That I can do. Here is their official policy: https://policies.google.com/technologies/location-data?hl=en-US https://policies.google.com/technologies/location-data?hl=en... "On most Android devices, Google, as the network location provider, provides a location service called Google Location Services (GLS), known in Android 9 and above as Google Location Accuracy. This service aims to provide a more accurate device location and generally improve location accuracy. Most mobile phones are equipped with GPS, which uses signals from satellites to determine a device’s location – however, with Google Location Services, additional information from nearby Wi-Fi, mobile networks, and device sensors can be collected to determine your device’s location. It does this by periodically collecting location data from your device and using it in an anonymous way to improve location accuracy." Consider the implications of Google collecting "anonymous" data from billions of Android phones. The technical details of scale, regularity, which sensors, their resolution, etc are highly germane here, but unfortunately not public. This is a very large blind spot in public scrutiny IMHO.
- BelenusMordred 5y ago> GLS has scary privacy implications and you cannot uninstall it. I have an Android without Google Location Services, the alternative location service is a Mozilla backend instead. I doubt that's much better for privacy and more likely stands out like a red flag to the Data Hoover collection agencies, but it is certainly possible to not use GLS. I've only come across one small app that didn't play well with the Mozilla backend.
- bserge 5y agoIt is pretty impressive, they made a whole company marketing secure phones, except the devices were wiretapped. Aside from that, it sounds like a pretty decent secure phone, too. Did they hire one of those TV show genius detectives to plan all this? It sure seems more advanced than the usual FBI operations (or maybe we don't hear much about the good ones).
- cronix 5y agoNext we'll be hearing about all the fake VPN companies they're running. "Sign up for our secure VPN and keep your traffic away from prying eyes! Do you know how many companies are spying on you and selling your data?" I've always thought that would be an excellent mitm vector. Then get a bunch of youtubers to promote it.
- mr-wendel 5y agoAfter that, we'll hear about the security companies they "own" whose agents and kernel modules are mandated all across corporate America. Why go through the trouble of running a VPN company yourself? That is sooooo 5-10 years ago.
- pxeboot 5y agoDidn't Facebook already do this?
- the_other 5y agoI already read VPN ads and even positive Tor press as if it’s shilling for Three Letter Agencies.
- Enginerrrd 5y agoThis is why I don't trust VPN companies that advertise.
- kilroy123 5y agoWhich ones are good then?
- 34679 5y agoThere are few limits to what one can accomplish with legal impunity and other people's money.
- fedreserved 5y agoThe 4th amendments probable cause requirement of a crime, prevented the 4 (from memory) American users from being charged.
- nradov 5y agoMexican drug cartels have set up complete private cell phone networks. https://www.reuters.com/article/us-mexico-telecoms-cartels-specialreport-idUSKCN24G1DN https://www.reuters.com/article/us-mexico-telecoms-cartels-s...
- jasonwatkinspdx 5y agoI read about an instance where one of the cartels kidnapped a couple telcom engineers working in Brownsville to force them to help set up this kind of infrastructure. Truly scary and ruthless people.
- jayess 5y agoYou have no idea. Al Qaeda has nothing on the cartels.
- jasonwatkinspdx 5y agoI do, I'm just not willing to say more to lionize them further.
- moistbar 5y agoI have to agree. This is a clever way to catch criminals that doesn't particularly harm non-criminals. I'll take this over the anti-encryption campaign the FBI has been on for the past 10 or 20 years.
- sneak 5y agoAnyone who wasn't a criminal who bought one of these phones for privacy was harmed.
- Denvercoder9 5y agoNon-criminal privacy focused people are much more likely to use standard devices with publicly known apps such as Signal. You couldn't buy this phone in stores, it was specifically distributed on the black market. It wasn't a good choice if you're privacy-conscious anyway, since there was no source code available, so you couldn't check it actually does what it claimed.
- sneak 5y agoThis is victim blaming. Innocent (and clueless) people seeking privacy had their privacy violated by this action.
- Denvercoder9 5y ago> Innocent (and clueless) people seeking privacy had their privacy violated by this action. You state this as fact without any proof. The AFP and FBI assert that 100% of the users were engaged in criminal activity. Given the distribution method, which included vetting by a known criminal organization, the requirement to have an account created by administrators that are again known to be criminal, and the ability to only contact others on the same network, I tend to believe that assertion until I see proof otherwise.
- sneak 5y ago
- Judgmentality 5y agoI'm confused. I understand these phones were (very likely) used by the FBI to surveil suspected criminals. What I don't understand is how the FBI got the phones to those people, and even stranger why those people would trust these phones to be safe?
- hooplah 5y agoOne article at the time said they had an informant that convinced top level criminals to use it and it spread from there. Will try to find it, but it was awhile back. edit: https://slate.com/news-and-politics/2021/06/encrypted-messaging-app-anom-fbi-organized-crime.html https://slate.com/news-and-politics/2021/06/encrypted-messag... > The operation came into being after the FBI took down a Canadian-based encryption service called Phantom Secure. Phantom Secure was marketing its services to criminal elements, offering secure communications through the encrypted cellphones that the company provided to syndicates. When the company was dismantled in 2018, the FBI sought to fill the void in the black market for secure criminal communications. To make that happen, the agency recruited a former distributor of Phantom Secure as an informant who, in return for reduced jail time, not only helped develop an encrypted communications system called ANOM, but helped market it to insular networks of criminal buyers.
- mr-wendel 5y agoIt's touched on in the article, and https://www.vice.com/en/article/m7e733/anom-fbi-andrew-young-encryption-honeypot https://www.vice.com/en/article/m7e733/anom-fbi-andrew-young... explains it more. The FBI's plan was even more bold. Rather than penetrate an existing encrypted phone company used by criminals, it would secretly start and market its own encrypted phone firm. While criminals used the devices, the FBI would be able to read what they were saying. The challenge was that running a fake encrypted phone company was not that different from running a real encrypted phone company. "We can't just run a good investigation; we have to run a good company," ... It was essentially a problem of marketing, Young said. The FBI needed to imbue this fake company with credibility so that criminals would buy and use the phones.
- chrisco255 5y ago
- Multicomp 5y agoMaybe I'm dumb. Why would a user who bought a phone that turned out to be an Anom device need their identity protected from 'retaliation'? To be clear: I'm perfectly happy for them to be anonymous for any reason or no reason. I'm specifically wondering who theoretically would want to retaliate against someone purchasing said devices and why. First sale doctrine still applies even to known honeypotted devices, right?
- Miner49er 5y agoMaybe the FBI? They've been known to assassinate people.
- PhasmaFelis 5y agoI can't see the FBI actually killing someone for passing on a used phone. That's a lot of risk for zero benefit. I can see just generally wanting to stay off their radar, though. Even law-abiding folks can get arrested for being in the wrong place at the wrong time, and you don't want someone to see "passed an FBI-tapped phone to a tech media site" in your file. Or maybe their work requires a security clearance, that could hurt you there.
- Miner49er 5y agoYeah, I didn't mean that they would kill someone over this, just was giving an example of what they are capable of.
- kube-system 5y agoI'm guessing that the first person who owned the phone could potentially be a character who doesn't want global attention on their burner phone.
- brewdad 5y agoThat's why they make hammers. For the use case of needing to ensure your burner phone never draws global attention.
- fallingknife 5y agoHow is this not wiretapping without a warrant?
- owlbynight 5y agoProbably had to agree to an EULA that bones your privacy rights as much as every other company's
- gruez 5y agoProbably the same reason why planting a bug in someone's home is illegal, but selling an always a smart speaker (aka always on microphone) to them and getting them to install isn't.
- kube-system 5y agoBecause the FBI only needs a warrant to wiretap people in the US. Nobody in the US was arrested as a result of this. The 4th amendment to the US constitution doesn't protect, for instance, Australians in Australia. https://www.abc.net.au/news/2021-06-15/no-one-in-america-arrested-in-operation-ironside/100213036 https://www.abc.net.au/news/2021-06-15/no-one-in-america-arr... > The AFP made more than 500 arrests but US privacy laws stopped the same from happening there.
- sneak 5y agoIt's a real bummer that the US doesn't recognize that human rights apply to all human beings.
- kube-system 5y agoLiterally speaking, the 4th Amendment is just a legal right. Most human rights declarations don't require warrants either, they're mostly much more loosely worded than legal rights documents.
- boomboomsubban 5y ago> The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, It specifically says that the natural right will not be violated, how is that a legal right?
- imwillofficial 5y agoAnyone know where I can grab one of these phones? I'd love to tear into it.
- sergiomattei 5y agoGo to eBay, likely a surplus of these Pixel 4a devices with ArcaneOS.
- imwillofficial 5y agoI didn’t see anything there with ArcaneOS. Are there other online stores where something liked this might be acquired?
- scrps 5y agoCould try contacting Vice, they might be interested in providing one in exchange for the analysis.
- imwillofficial 5y agoThat’s a great idea! Thanks!
- jmkni 5y agoThey aren't being advertised as such, you're looking for Android devices (ideally Pixel 4a's) which are suspiciously cheap. They are being sold by criminals trying to get rid of them, so they will probably have vague descriptions.
- rizpanjwani 5y agoThis is awesome. Wish Canada could do something even remotely effective like this to catch the Chinese money launderers and drug suppliers here.
- walrus01 5y agoFor some back story on an actual black market predecessor to these, which almost certainly inspired the FBI project, google "phantom secure vancouver" https://www.google.com/search?client=firefox-b-1-d&q=phantom+secure+vancouver https://www.google.com/search?client=firefox-b-1-d&q=phantom...
- lrvick 5y agoA project I started, aosp-build, makes it easy to rapidly customize and compile Android images for Pixel devices where you can lock the bootloader. I have had a few different, sometimes anonymous, groups reach out trying to hire me based on this work or use my build system for unusual use cases. One, for instance, wanted advice for their own private fork of my project where they disabled the camera and similar things to supposedly meet requirements for a high security environment. It is weird considering my open source project might have been used directly or as a reference by the FBI.
- BelenusMordred 5y agoAny reason you didn't take the work? Seriously locking down a phone seems like a rewarding cross-domain engineering challenge. I'm honestly shocked at how most ultra-high risk people just use off the shelf products, sure they are addictive devices yes, but every few months there's another story of military, celebrity or political compromise because of their phones. It seems like a ripe field if you can somehow convince the end-user it's in their interest to reduce functionality.
- lrvick 5y agoWorking on an open source project in public is one thing, but doing private work where I don't have any idea what the target use case is, is generally a non starter for me regardless of pay. Could be FBI, could be terrorists. My personal mission is to help bring more privacy, security, and freedom to people so I don't really have an interest in work that does not further those goals. I started my own security consulting firm largely so I can make a good living but also pick and choose my projects. If I just wanted money without caring about ethics I know where to find high paying jobs at surveillance capitalism companies.
- davemp 5y agoThere is a good chance you could be violating ITAR as well.
- 5y ago
- akersten 5y agoI'm very confused by: > The Department of Justice has charged multiple people who allegedly worked for Anom in part for obstructing law enforcement by using this [remote] wipe feature. I thought anom was a government company the whole time- why would they be charging themselves? Is this simply a case of the right hand not knowing what the left is doing, or did the company used to be actually a sketchy outfit and got acquired/pressured to play along with the sting operation?
- mhh__ 5y agohttps://en.wikipedia.org/wiki/Operation_Trust https://en.wikipedia.org/wiki/Operation_Trust for the modern age
- _carbyau_ 5y agoSo, in the same way that corporations support Open Source projects to use to their own ends, organised crime will now be donating substantially to Open Source Encrypted-End-to-End messaging software right? ... Right? In a way, privacy advocates could be thanking crime lords for their support in the future.
- BLKNSLVR 5y agoCriminals and the porn industry, the two classic early adopters.
- malwarebytess 5y agoIt seems out of scope for the FBI to be working to catch criminals abroad, especially at this scale. I don't like it. It reminds me of the J. Edgar Hoover days.
- deanclatworthy 5y agoIs there any information on how the FBI captured the messages? It says they caught millions. I'm surprised large criminal networks nowadays don't have grey hats on tap to be able to analyse the devices they use, the packets they send etc.