15 ms·

Aight, this is some next-level stuff. Hell, I'd even call it badass. The FBI created a tech startup (even with the .io domain!) and sold devices with a custom

Aight, this is some next-level stuff. Hell, I'd even call it badass. The FBI created a tech startup (even with the .io domain!) and sold devices with a custom Android distribution. It's funny because you can search for the XDA-Developers thread mentioned in the article, they were pretty shocked to find a phone with modded software and a locked bootloader.

swiley 5y ago
Not really. If you use an OS built by someone else with no publicly available code then they own you. Always. That's hardly news.
- titzer 5y ago
  Most consumer Android phones come with Google Play Services installed by default. Note that that is a completely different thing than the Google Play Store. It's intentionally branded to be confusing and sound like it has something to do with applications. Google Play Services is an entire closed-source operating system living above the kernel, but has hooks all the way down, into every subsystem. It offers a ton of juicy APIs to make Android development "easier", but one of the things that it does (called Google Location Services, or GLS) is interpose between GPS and other ways of location and offer a location API to applications, becoming the location provider for the device. All requests for location go through it. GLS has scary[1] privacy implications and you cannot uninstall it. You can disable most of the scary stuff it does by not agreeing to use "high accuracy" mode for location, aka "device only". You must "consent" to this data collection because Google's lawyers believe this consent dialog meets legal requirements for this data collection. Their verbiage is horribly vague and absolutely does not communicate what data collection you are agreeing to by enabling this mode. It calls this data "anonymous" but location data, particularly traces, is anything but anonymous. At the high resolution of GPS these days, it cannot be anonymized. [1] by "scary", I actually mean absolutely dystopian.
  - swiley 5y ago
    Yup. Unfortunately we're training children and college students to accept this. OS vendors are now effectively pseudo governments due to this kind of thing.
    - goodpoint 5y ago
      pseudo governments without any trace of public accountability
  - pyuser583 5y ago
    Can you go into more detail about the scary parts of Google Play Services? Or include a link?
    - titzer 5y ago
      > Can you go into more detail about the scary parts of Google Play Services? Unfortunately, I cannot. > include a link? That I can do. Here is their official policy: https://policies.google.com/technologies/location-data?hl=en-US https://policies.google.com/technologies/location-data?hl=en... "On most Android devices, Google, as the network location provider, provides a location service called Google Location Services (GLS), known in Android 9 and above as Google Location Accuracy. This service aims to provide a more accurate device location and generally improve location accuracy. Most mobile phones are equipped with GPS, which uses signals from satellites to determine a device’s location – however, with Google Location Services, additional information from nearby Wi-Fi, mobile networks, and device sensors can be collected to determine your device’s location. It does this by periodically collecting location data from your device and using it in an anonymous way to improve location accuracy." Consider the implications of Google collecting "anonymous" data from billions of Android phones. The technical details of scale, regularity, which sensors, their resolution, etc are highly germane here, but unfortunately not public. This is a very large blind spot in public scrutiny IMHO.
  - BelenusMordred 5y ago
    > GLS has scary privacy implications and you cannot uninstall it. I have an Android without Google Location Services, the alternative location service is a Mozilla backend instead. I doubt that's much better for privacy and more likely stands out like a red flag to the Data Hoover collection agencies, but it is certainly possible to not use GLS. I've only come across one small app that didn't play well with the Mozilla backend.
bserge 5y ago
It is pretty impressive, they made a whole company marketing secure phones, except the devices were wiretapped. Aside from that, it sounds like a pretty decent secure phone, too. Did they hire one of those TV show genius detectives to plan all this? It sure seems more advanced than the usual FBI operations (or maybe we don't hear much about the good ones).
- cronix 5y ago
  Next we'll be hearing about all the fake VPN companies they're running. "Sign up for our secure VPN and keep your traffic away from prying eyes! Do you know how many companies are spying on you and selling your data?" I've always thought that would be an excellent mitm vector. Then get a bunch of youtubers to promote it.
  - mr-wendel 5y ago
    After that, we'll hear about the security companies they "own" whose agents and kernel modules are mandated all across corporate America. Why go through the trouble of running a VPN company yourself? That is sooooo 5-10 years ago.
  - pxeboot 5y ago
    Didn't Facebook already do this?
  - the_other 5y ago
    I already read VPN ads and even positive Tor press as if it’s shilling for Three Letter Agencies.
  - Enginerrrd 5y ago
    This is why I don't trust VPN companies that advertise.
    - kilroy123 5y ago
      Which ones are good then?
34679 5y ago
There are few limits to what one can accomplish with legal impunity and other people's money.
- fedreserved 5y ago
  The 4th amendments probable cause requirement of a crime, prevented the 4 (from memory) American users from being charged.
nradov 5y ago
Mexican drug cartels have set up complete private cell phone networks. https://www.reuters.com/article/us-mexico-telecoms-cartels-specialreport-idUSKCN24G1DN https://www.reuters.com/article/us-mexico-telecoms-cartels-s...
- jasonwatkinspdx 5y ago
  I read about an instance where one of the cartels kidnapped a couple telcom engineers working in Brownsville to force them to help set up this kind of infrastructure. Truly scary and ruthless people.
  - jayess 5y ago
    You have no idea. Al Qaeda has nothing on the cartels.
    - jasonwatkinspdx 5y ago
      I do, I'm just not willing to say more to lionize them further.
moistbar 5y ago
I have to agree. This is a clever way to catch criminals that doesn't particularly harm non-criminals. I'll take this over the anti-encryption campaign the FBI has been on for the past 10 or 20 years.
- sneak 5y ago
  Anyone who wasn't a criminal who bought one of these phones for privacy was harmed.
  - Denvercoder9 5y ago
    Non-criminal privacy focused people are much more likely to use standard devices with publicly known apps such as Signal. You couldn't buy this phone in stores, it was specifically distributed on the black market. It wasn't a good choice if you're privacy-conscious anyway, since there was no source code available, so you couldn't check it actually does what it claimed.
    - sneak 5y ago
      This is victim blaming. Innocent (and clueless) people seeking privacy had their privacy violated by this action.
      - Denvercoder9 5y ago
        > Innocent (and clueless) people seeking privacy had their privacy violated by this action. You state this as fact without any proof. The AFP and FBI assert that 100% of the users were engaged in criminal activity. Given the distribution method, which included vetting by a known criminal organization, the requirement to have an account created by administrators that are again known to be criminal, and the ability to only contact others on the same network, I tend to believe that assertion until I see proof otherwise.
        sneak 5y ago

swiley 5y ago

Not really. If you use an OS built by someone else with no publicly available code then they own you. Always. That's hardly news.

titzer 5y ago
Most consumer Android phones come with Google Play Services installed by default. Note that that is a completely different thing than the Google Play Store. It's intentionally branded to be confusing and sound like it has something to do with applications. Google Play Services is an entire closed-source operating system living above the kernel, but has hooks all the way down, into every subsystem. It offers a ton of juicy APIs to make Android development "easier", but one of the things that it does (called Google Location Services, or GLS) is interpose between GPS and other ways of location and offer a location API to applications, becoming the location provider for the device. All requests for location go through it. GLS has scary[1] privacy implications and you cannot uninstall it. You can disable most of the scary stuff it does by not agreeing to use "high accuracy" mode for location, aka "device only". You must "consent" to this data collection because Google's lawyers believe this consent dialog meets legal requirements for this data collection. Their verbiage is horribly vague and absolutely does not communicate what data collection you are agreeing to by enabling this mode. It calls this data "anonymous" but location data, particularly traces, is anything but anonymous. At the high resolution of GPS these days, it cannot be anonymized. [1] by "scary", I actually mean absolutely dystopian.
- swiley 5y ago
  Yup. Unfortunately we're training children and college students to accept this. OS vendors are now effectively pseudo governments due to this kind of thing.
  - goodpoint 5y ago
    pseudo governments without any trace of public accountability
- pyuser583 5y ago
  Can you go into more detail about the scary parts of Google Play Services? Or include a link?
  - titzer 5y ago
    > Can you go into more detail about the scary parts of Google Play Services? Unfortunately, I cannot. > include a link? That I can do. Here is their official policy: https://policies.google.com/technologies/location-data?hl=en-US https://policies.google.com/technologies/location-data?hl=en... "On most Android devices, Google, as the network location provider, provides a location service called Google Location Services (GLS), known in Android 9 and above as Google Location Accuracy. This service aims to provide a more accurate device location and generally improve location accuracy. Most mobile phones are equipped with GPS, which uses signals from satellites to determine a device’s location – however, with Google Location Services, additional information from nearby Wi-Fi, mobile networks, and device sensors can be collected to determine your device’s location. It does this by periodically collecting location data from your device and using it in an anonymous way to improve location accuracy." Consider the implications of Google collecting "anonymous" data from billions of Android phones. The technical details of scale, regularity, which sensors, their resolution, etc are highly germane here, but unfortunately not public. This is a very large blind spot in public scrutiny IMHO.
- BelenusMordred 5y ago
  > GLS has scary privacy implications and you cannot uninstall it. I have an Android without Google Location Services, the alternative location service is a Mozilla backend instead. I doubt that's much better for privacy and more likely stands out like a red flag to the Data Hoover collection agencies, but it is certainly possible to not use GLS. I've only come across one small app that didn't play well with the Mozilla backend.

bserge 5y ago

It is pretty impressive, they made a whole company marketing secure phones, except the devices were wiretapped. Aside from that, it sounds like a pretty decent secure phone, too. Did they hire one of those TV show genius detectives to plan all this? It sure seems more advanced than the usual FBI operations (or maybe we don't hear much about the good ones).

cronix 5y ago
Next we'll be hearing about all the fake VPN companies they're running. "Sign up for our secure VPN and keep your traffic away from prying eyes! Do you know how many companies are spying on you and selling your data?" I've always thought that would be an excellent mitm vector. Then get a bunch of youtubers to promote it.
- mr-wendel 5y ago
  After that, we'll hear about the security companies they "own" whose agents and kernel modules are mandated all across corporate America. Why go through the trouble of running a VPN company yourself? That is sooooo 5-10 years ago.
- pxeboot 5y ago
  Didn't Facebook already do this?
- the_other 5y ago
  I already read VPN ads and even positive Tor press as if it’s shilling for Three Letter Agencies.
- Enginerrrd 5y ago
  This is why I don't trust VPN companies that advertise.
  - kilroy123 5y ago
    Which ones are good then?

34679 5y ago

There are few limits to what one can accomplish with legal impunity and other people's money.

fedreserved 5y ago
The 4th amendments probable cause requirement of a crime, prevented the 4 (from memory) American users from being charged.

nradov 5y ago

Mexican drug cartels have set up complete private cell phone networks. https://www.reuters.com/article/us-mexico-telecoms-cartels-specialreport-idUSKCN24G1DN https://www.reuters.com/article/us-mexico-telecoms-cartels-s...

jasonwatkinspdx 5y ago
I read about an instance where one of the cartels kidnapped a couple telcom engineers working in Brownsville to force them to help set up this kind of infrastructure. Truly scary and ruthless people.
- jayess 5y ago
  You have no idea. Al Qaeda has nothing on the cartels.
  - jasonwatkinspdx 5y ago
    I do, I'm just not willing to say more to lionize them further.

moistbar 5y ago

I have to agree. This is a clever way to catch criminals that doesn't particularly harm non-criminals. I'll take this over the anti-encryption campaign the FBI has been on for the past 10 or 20 years.

sneak 5y ago
Anyone who wasn't a criminal who bought one of these phones for privacy was harmed.
- Denvercoder9 5y ago
  Non-criminal privacy focused people are much more likely to use standard devices with publicly known apps such as Signal. You couldn't buy this phone in stores, it was specifically distributed on the black market. It wasn't a good choice if you're privacy-conscious anyway, since there was no source code available, so you couldn't check it actually does what it claimed.
  - sneak 5y ago
    This is victim blaming. Innocent (and clueless) people seeking privacy had their privacy violated by this action.
    - Denvercoder9 5y ago
      > Innocent (and clueless) people seeking privacy had their privacy violated by this action. You state this as fact without any proof. The AFP and FBI assert that 100% of the users were engaged in criminal activity. Given the distribution method, which included vetting by a known criminal organization, the requirement to have an account created by administrators that are again known to be criminal, and the ability to only contact others on the same network, I tend to believe that assertion until I see proof otherwise.
      - sneak 5y ago