23 ms·

The FBI's internal guide for getting data from AT&T, T-Mobile, Verizon

818 points by arkadiyt 5y ago

ab_testing 5y ago
Reading through these charts, it looks like MetroPCS is the most secure provider.
- ramesh31 5y ago
  I love Metro, have used them for years. $60 for unlimited everything with 20GB tethered 4G hotspot data, and you get free Amazon Prime with your account. This chart has just solidified how great they are to me.
- lotsofpulp 5y ago
  Metro is owned by T-Mobile, and operates using T-Mobile’s network. Why would it be any more secure than T-Mobile? As far as I understand, there are 3 mobile networks in the US (Verizon, ATT, T-Mobile), and the MVNO’s are just a mechanism to price discriminate. Different customers are sliced into various priorities and willingness/ability to pay, so the 3 mobile networks can most accurately collect the most money according to each individual’s ability and willingness to pay for a certain level of priority on the network.
jenny91 5y ago
> CASTViz has the ability to quickly plot call detail records and tower data for lead generation and investigative purposes What's the arrest funnel? Do they use Salesforce to store all their leads as well?
- paxys 5y ago
  That seems more in Palantir's wheelhouse
A4ET8a8uTh0 5y ago
The oddly fascinating piece of trivia from all this is the following: voicemail has more protection ( requires an actual warrant ) than your internet searches.
- willhinsa 5y ago
  And much more protection against being banned from using it!
m0zg 5y ago
Now _this_ is a federal agency badly in need of "abolishing", not the inner city police.
- deleted 5y ago
  [deleted]
pkpioneer 5y ago
Should You Use Airbnb or Vrbo? https://pkpioneer.blogspot.com/2021/10/should-you-use-airbnb-or-vrbo.html https://pkpioneer.blogspot.com/2021/10/should-you-use-airbnb...
beckman466 5y ago
"The slide also shows that AT&T retains “cloud storage internet/web browsing” data for 1 year. When asked what this detail entails exactly, such as websites visited by customers on the AT&T network, AT&T spokesperson Margaret Boles said in an email that “Like all companies, we are required by law to comply with mandatory legal demands, such as warrants based on probable cause. Our responses comply with the law.” The document also mentions that law enforcement can request records related to wearable devices from AT&T." do you know what this “cloud storage internet/web browsing” data looks like?
- badkitty99 5y ago
  beta version of social scoring system?
- gruez 5y ago
  probably dns/sni logs? with most sites using https that's all they're really going to get.
  - JumpCrisscross 5y ago
    And with VPNs like Apple Private Relay being broadly pushed, likely less than that.
    - dkdk8283 5y ago
      Never assume- carriers can mandate data collection or sharing.
  - Scoundreller 5y ago
    Is there any way to change dns servers on lte/3G? Odd that iPhones let you change it for wifi, but not cellular. Can I even find out it’s using? What about android?
    - gruez 5y ago
      >Is there any way to change dns servers on lte/3G? probably doesn't matter because regular dns is performed in the clear. There's nothing preventing them from logging/intercepting your requests even if you changed them. >Odd that iPhones let you change it for wifi, but not cellular. >What about android? AFAIK on both changing DNS can be done by using an app that acts like a VPN, and intercepts the DNS requests.
Scoundreller 5y ago
So, I’m currently in North America but with a foreign SIM, so I have that country’s IP, most ads are in a language I can’t understand, and McDonalds app won’t let me login unless I switch to wifi with a local IP. This is all great, but does this mean that the local provider has no access to my traffic? I guess DNS is all resolved overseas too? How does the tunnelling work?
- nickff 5y ago
  This really depends on what you mean by "my traffic"; keeping in mind that your local provider is the ultimate man-in-the-middle.
  - Scoundreller 5y ago
    I guess that’s a part of the question: is my phone encrypting (with whatever gsm standard) to the overseas provider and the local provider can’t really see anything, or does it go to the local provider in the clear and they tunnel it over to the overseas provider?
    - nickff 5y ago
      My understanding is that the A5/1 (GSM) encryption is applied to the communication between the device and the local service provider. The local service provider then decrypts and routes the packets.
      - xxpor 5y ago
        Where local service provider is just the tower. https://www.firstnet.com/power-of-firstnet/firstnet-advantages/security.html https://www.firstnet.com/power-of-firstnet/firstnet-advantag... >FirstNet is designed with a defense-in-depth security strategy that goes well beyond standard commercial network security measures, providing protection without sacrificing usability. And now, we’ve gone farther than anyone in the industry to secure public safety communications. FirstNet will be the first-ever network with comprehensive, tower-to-core encryption based on open industry standards. Which implies every other network doesn't encrypt that traffic (or does it with some proprietary scheme... which wouldn't give me a lot of confidence)
1cvmask 5y ago
Joseph Nacchio, the CEO of Qwest, was jailed for not complying with the illegal requests of the surveillance state: https://www.businessinsider.com/the-story-of-joseph-nacchio-and-the-nsa-2013-6 https://www.businessinsider.com/the-story-of-joseph-nacchio-... https://www.denverpost.com/2014/03/27/former-qwest-ceo-nacchio-claims-on-tv-his-jail-time-was-nsa-payback/ https://www.denverpost.com/2014/03/27/former-qwest-ceo-nacch... https://en.wikipedia.org/wiki/Joseph_Nacchio https://en.wikipedia.org/wiki/Joseph_Nacchio And let's not forget the number of people put the jail without the government disclosing the use of stingrays to the defense attorneys: https://en.wikipedia.org/wiki/Stingray_use_in_United_States_law_enforcement https://en.wikipedia.org/wiki/Stingray_use_in_United_States_... https://theintercept.com/2020/07/31/protests-surveillance-stingrays-dirtboxes-phone-tracking/ https://theintercept.com/2020/07/31/protests-surveillance-st...
- LogonType10 5y ago
  >jailed for not complying with the illegal requests of the surveillance state From the wiki page: >On March 15, 2005, Nacchio and six other former Qwest executives were sued by the U.S. Securities and Exchange Commission. They were accused of a $3 billion financial fraud between 1999 and 2002 and of benefiting from an inflated stock price.
  - gowld 5y ago
    > In its case, the government stated that Nacchio continued to tell Wall Street that Qwest would be able to achieve aggressive revenue targets long after he knew that they could not be achieved. Interesting that Nacchio was prosecuted for this but almost no one else is.
    - spywaregorilla 5y ago
      The very same article states that he was found to have produced false accounting records and talked up the company's outlook despite knowing it was losing business and selling his own shares. He got caught on the insider trading. There's nothing noteworthy here.
hammock 5y ago
When it comes to retention periods, AT&T (who I imagine most iPhone users here have, by default) is REALLY bad: https://video-images.vice.com/_uncategorized/1634930279896-retentionperiods.png?resize=1600:\ https://video-images.vice.com/_uncategorized/1634930279896-r...* They also have the longest and deepest history of working with the government on surveillance.
- slg 5y ago
  >AT&T (who I imagine most iPhone users here have, by default) AT&T lost iPhone exclusivity a decade ago.
  - kkirsche 5y ago
    Your point? Most customers in the marketplace are averse to change across any service. It’s not uncommon for users to stay with single providers due to momentum.
    - slg 5y ago
      My point is that saying iPhone users are by default AT&T users rests on the assumption that people have stuck with the same decisions they made about mobile network and phone operating system that they made over a decade ago. That isn't even factoring in the growth of the market overall and the people who have bought their first smartphone within the last decade.
    - annoyingnoob 5y ago
      The churn rate for wireless carriers is around 2% per year in the US, give or take. There are about 300M wireless subscribers in the US. Meaning that around 6M wireless subscribers per year switch carriers.
- _jal 5y ago
  > They also have the longest and deepest history of working with the government on surveillance. I've long considered ATT to be an extension of the US intelligence apparatus. Ownership doesn't matter, it is who they answer to.
1970-01-01 5y ago
Why are stingrays missing from the guide? Aren't they the most useful tool in the toolbox?
- fractal618 5y ago
  Clearly they are ubiquitous at this point, and I bet their data goes back to inception.
- kjaftaedi 5y ago
  This is an interesting point. My guess is that this looks like training material for low-level desk jockeys to help do all of the legwork gathering evidence that would be presented in court cases. Stingrays you would think would be more of a targeted operation and likely handled by a different group of people.
- gzer0 5y ago
  My claims are without evidence, but it certainly seems as if this document was created with the intentions/hope that it would be eventually leaked. The second slide seems rather suspicous in its placement of "CAST members are not qualified to testify after reading this"; almost as if they were not speaking to an audience of CAST members, but rather, the public. Perhaps a decoy? to draw attention away from STINGRAY and other intricacies?
  - dragonwriter 5y ago
    > The second slide seems rather suspicous in its placement of "CAST members are not qualified to testify after reading this"; almost as if they were not speaking to an audience of CAST members, but rather, the public. Sounds like they are doing advance witness tampering by trying to get CAST members to evade calls to testify on material facts known to them should they receive such, not lobbying the public via anticipated future leak. (I’m not even sure how the statement about testimony would be expected to manipulate the public.)
    - gzer0 5y ago
travoc 5y ago
You can download some of the data that Verizon retains from your own cellular use here: https://www.verizon.com/support/download-and-view-vpd-file/ https://www.verizon.com/support/download-and-view-vpd-file/ When I did it, I could see they recorded IP addresses, time stamps and data transfer volume of every web site that I visited over their network, along with cell tower connections. It was fascinating.
- murat124 5y ago
  Does anyone know the AT&T equivalent of this URL?
- hpoe 5y ago
  Just out of curiosity do you use a VPN, I always browse with a VPN on my phone for precisely that reason and am wondering if it actually works to help protect my privacy.
  - travoc 5y ago
    Using a VPN would protect the privacy of your IP sessions from Verizon, although your VPN provider would now be able to see all of your session information. I suspect a VPN user would show up in the Verizon data file with many large TCP sessions to a very small number of IPs.
    - gzer0 5y ago
      I suspect that the effort required to succesfully produce viable evidence from a VPN provider such as Mullvad are significantly higher than the effort we see here from ATT, T-mobile, Sprint, and Verizon.
      - travoc 5y ago
        That is probably true in most cases. Choose your poison.
      - flowerwolf 5y ago
flotzam 5y ago
Sprint is extra chatty - from page 57 of https://propertyofthepeople.org/document-detail/?doc-id=21088576 https://propertyofthepeople.org/document-detail/?doc-id=2108...: > Ping: The network sends a message to the phones internal GPS receiver to report it's location (must see min. of 4 satellites. GPS coordinates of device and suspected radius from tower e-mailed(or through L-Site website) every 15 minutes for 30 days. Can be done manually every 5 minutes. I wonder if this is facilitated by one of those infamous "carrier app" backdoors included in stock OS but not e.g. in GrapheneOS: https://grapheneos.org/faq#cellular-tracking https://grapheneos.org/faq#cellular-tracking https://gist.github.com/thestinger/171b5ffdc54a50ee44497028aa137ed8 https://gist.github.com/thestinger/171b5ffdc54a50ee44497028a... https://github.com/dan-v/rattlesnakeos-stack/issues/69#issuecomment-438972720 https://github.com/dan-v/rattlesnakeos-stack/issues/69#issue...
- bhhaskin 5y ago
  Could also be an app that runs on the sim. That would make the most sense.
  - flotzam 5y ago
    Do SIM apps really have direct access to the GPS?
    - ranger_danger 5y ago
      the baseband radio does, so, yes. also the camera and mic in many cases.
  - gruez 5y ago
    that works even if location is turned off in the OS itself?
- ranger_danger 5y ago
  You don't even need a traditional app backdoor to do this. The carrier can just send the message to the baseband radio itself, which has a direct connection to your GPS receiver, among other things (usually) like the camera and microphone. That means these peripherals are accessible (in theory, Snowden says it has been done in the past) even if the main app OS is shut down.
gzer0 5y ago
Sprint cannot currently translate IPV4 addresses (ex. 152.138.17.240) to an actual phone number Sprint may be able to translate IPV6 addresses (ex. 001:0db8:0000:0042:0000:8a2e:0370:7334) to a phone number. Interesting, anyone know which aspect of the IPV6 protocol allows for this?
- itsthecourier 5y ago
  there are so many possible ipv6 public ips that absence of overlapping on assignation is doable and thus individual client determination
- bibaheu 5y ago
  Probably IPv4 is on CGNAT and Sprint doesn't keep the logs of the translation. On IPv6 there's no NAT, and there might be a deterministic relationship between subscription and IP
  - glogla 5y ago
    That, or they don't give devices IPv4 addresses at all and run 464XLAT - according to Wikipedia, quite a few telcos do it that way.
    - keneda7 5y ago
      I believe you are correct. https://news.ycombinator.com/item?id=16440850 https://news.ycombinator.com/item?id=16440850
    - p1mrx 5y ago
      464XLAT is a form of CGNAT. The main difference is whether the subscriber side uses an IPv6 or private IPv4 address, but on the internet side they are equivalent.
unixhero 5y ago
It is more interesting what their procedures are for getting data on citizens or any user for that matter, from FAANG. And bonus question for what they do when they need to pull put bank statements.
ramesh31 5y ago
I've never understood why they try to "disguise" these things. They always stick out like a sore thumb. How would anyone know the difference from a normal cell tower?
- miloignis 5y ago
  I think you've misunderstood - the disguised towers are normal cell towers, and normal cell towers are normally disguised to be less of an eyesore.
mldonahue 5y ago
For anyone who wants to know more about how companies can more ethically, and transparently, engage with law enforcement/governments: https://news.ycombinator.com/item?id=28156465 https://news.ycombinator.com/item?id=28156465 Establishing a best practice for public/private sector communication keeps the govt in check and helps companies ensure compliance & transparency.
- einpoklum 5y ago
  That's neither ethical nor transparent. And the guy writing that post is ex-FBI. An ethical and transparent way to handle such subpoenas would include: 1. If possible, not being a US company so you might be able to avoid the subpoena in the first place. 2. Have a policy of not keeping user data at all, or keeping it with a third party that is not legally bound by US government subpoenas, so that it can't (?) be subpoenaed. 3. Publish any subpoena you get from the government. 4. Moreover, arrange it so that subpoenas are published before being read, so that if you get a National Security Letter, you would not be able to comply with the non-disclosure requirement. Another way to go about this may be to only open subpoenas in a public forum, preferably with journalists present. Try to consult ACLU/EFF lawyers about this particular issue. 5. If the government somehow gets its hands on user data, inform the users immediately.
  - johnsillings 5y ago
    so basically change all the laws around how this stuff works, got it
  - mldonahue 5y ago
    Can you elaborate how you think a tool like this is neither ethical nor transparent? And why is it bad the writer is ex-FBI? You appear to be passionate about the issue at hand, but your knowledge on this process seems to be limited. 1. Not being a US company doesn't matter - international agencies send subpoenas just like the US agencies. US govt can send subpoenas to international companies just the same. 2. Not having PII or user data doesn't prevent subpoenas (i.e. Reddit, 4chan, Whisper, etc.) 3. Subpoena’s often come with Non-Disclosure Orders (NDO). Even without NDOs, publication of the actual subpoena is arguably more irresponsible just by the shear fact you could be publicizing PII, and subjecting this user to unfair, and non-contextualized public opinion. Big tech has adopted transparency reports for this reason. User notice is the goal - not publicly shaming your user just to make a point to the government. 4. Non-compliance and willful disregard for the legal order will not change the overall problem. Ironically, you're right that the best way to prevent data requests from the govt might be non-compliance...then the company would get shut down for said non-compliance...so there would be no company for the government to subpoena. 5. User notice is obviously a legal department best practice, but if there is a NDO it puts legal repercussions on a company for disclosing such info. Keeping this process clunky/messy/disorganized hurts the user, and the company. You say this company is not ethical, yet Kodex automatically informs users about data requests pertinent to them, and if there is an NDO, the user is notified immediately upon expiration rather than relying on a legal department employee to remember to manually do it months or years later. Would it be more ethical to keep the process unchanged and prone to human error? These guides for Law Enforcement (LE) to get data are actually meant to streamline the process for the company, so companies don’t have to deal with non-valid subpoenas. The subpoena is coming regardless…why waste time/resources dealing with non-valid subpoenas when educating LE will help streamline things. Obfuscation is never going to prevent these legal orders…if the FBI wants to send your company a subpoena they are going to whether you tell them how to do it properly or not. Kodex is a best practice that standardizes how the govt can interact with companies, to keep the govt in check, while keeping companies compliant, transparent, and accountable about the process. As the writer said: “There is a lot that can be fixed in government. This process is one of them. The goal is not to ‘help the FBI do their job more easily’… making the process easier for the company, forces the government to do their job BETTER, and helps society move forward.”
gonehome 5y ago
In the US people are more pro-company and anti-government so retention policies tend to require the companies to retain the data for a period of time so warrants can request it if necessary. In the EU people are more pro-government and anti-company so the government is more likely to have access. The US process for access is sometimes tied to FISA. I'm not an expert on this stuff, but I think I'd generally prefer companies handling retention and government having to request access rather than the other way around. Assuming (probably a big assumption) that the companies do it securely and don't fuck it up. The chart does make me pretty happy with T-Mobile though, and their 5GUC speeds are wild! https://twitter.com/zachalberico/status/1449049818857459718?s=20 https://twitter.com/zachalberico/status/1449049818857459718?...
deleted 5y ago
[deleted]
NN88 5y ago
Anyone get the sense we're in a post-Wikileaks era? These leaks seem... like they would get someone indicted...
aetherspawn 5y ago
MetroPCS looks to be the most private cell provider.
einpoklum 5y ago
And as for the NSA internal guide for getting data from AT&T, T-Mobile and Verizon - that's a bit shorter: > Do nothing, we already have this data loaded and indexed.
sillycross 5y ago
> The slide also shows that AT&T retains “cloud storage internet/web browsing” data for 1 year. I never thought before that ISPs would really keep track of every user's browsing history, but apparently as cheap as the disks are today, this has become true. Can't think of any use of this data other than for mass surveillance.
- pedalpete 5y ago
  I believe they can also sell the data, though there may be some regulations on anonymized, or sold as a group to develop profiles and understanding for advertising purposes. Perhaps that's what you mean by "mass surveillance", but I took that to mean specifically government surveillance.
efitz 5y ago
Essentially the government has built a surveillance state by outsourcing it to private enterprise. I think it would be interesting to know how people really feel about this. I would love to see a survey that actually truly explained the trade-offs and see how people felt about it, eg avoiding the “ should government be able to subpoena records from private business” but actually ask questions like “is it OK with you that with a subpoena that the government can get a list every website that you have visited?” And then present the trade offs and abuse cases. I really think that we’ve allowed the surveillance state to form without actually having a meaningful public debate about it.
- DeathArrow 5y ago
  >Essentially the government has built a surveillance state by outsourcing it to private enterprise. How long until the government finish outsourcing of all its attributions to private entities and corporations take ownership of governance? Then instead of voting, the citizens can manifest their interests through buying shares.
  - bjarneh 5y ago
    > the citizens can manifest their interests through buying shares. Isn't this sort of how it already works? Although only a few (very rich) citizens hold enough shares to actually have any clout.
- datavirtue 5y ago
  I like how ATT skirted around the question and lied. Well, not answering the question is...nevermind, they lied.
- NoImmatureAdHom 5y ago
  I have hope that we here in the U.S. will be able to get out in front of this one. Despite all the complaining the justice system still mostly works and we have a libertarian streak a mile wide. Perhaps the thing to do is show those in power that they haven't escaped the dragnet...
sathackr 5y ago
There exists a similar guide to this for obtaining subscriber information for an IP address. Including a table that listed which providers would hand over data without a subpoena and what the retention period was for each provider. One of the interesting things I remember seeing was that it was noted that T-Mobile had never been able to supply such information to LEO. I have seen it before but never had direct access to it.
breput 5y ago
I thought this was interesting and might involve some handset manufacturer involvement? Under the "Location Based Services" chart, US Cellular is listed "No. However, you can force a call without a ring to the target device to determine tower/sector"
- flowerwolf 5y ago
  The "force a call without a ring" is just basic GSM. I don't know, but I'm guessing 3G, 4G or 5G support requesting the GPS position from the ME/handset.
  - breput 5y ago
    That might be true (I don't know), but US Cellular is a CDMA/4G/5G carrier so there is at least some non-GSM functionality in there.
    - flowerwolf 5y ago
      Yeah, by "basic GSM" I mean a common subset that is available regardless of 2G/3G/4G/5G, as in, you can still ping the mobile equipment to see which BTS it's connecting to. (And even if you don't get the TA with CDMA/OFDMA you still get signal strength and/or can force a downgrade if necessary, to get a rough location.)
      - Forbo 5y ago
        I'm not sure if you're shadow banned or what, but every comment of yours I have encountered has been marked dead. I vouched for this and another one I saw elsewhere in the thread.
        flowerwolf 5y ago
        Made the account an hour ago, maybe that's why. Thanks for the heads up
Threeve303 5y ago
Well it is definitely more than “metadata”…
forgingahead 5y ago
With all this information collected and available, and with pretty basic technology tools (keyword alerts, fast searching, location data to pinpoint pretty accurate positioning) - how come there is still crime and other "bad things" that happen? I'm not talking about heat-of-the-moment things, but literally anything requiring any sort of planning or organisation (kidnapping, gangsterism, etc) should be solvable with this. So why isn't it? *Note, I don't want an uber-surveillance state - my point is that we already have one, and any feeble excuses from law enforcement about solving 10s of thousands of crimes with "ooops we can't figure it out" seems utterly hollow and untrue.
zw123456 5y ago
So if I know someone's Google password, I could go search on all those keywords and basically SWAT them right ?
DeathArrow 5y ago
Having lived a part of my childhood in a poor communist country from Eastern Europe and a part of my younghood in a poor country from Eastern Europe I had some moments when I asked myself if it wouldn't be better for me to move to US. I quit asking myself this some time ago.
_gohp 5y ago
Indeed, often people have said the FBI runs this and that. But this is not cost efficient, the agencies can just subpoena the businesses for data, simple as that. No hacking, no developing etc. It's pretty efficient, if the government announced they would save some files on all citizens, it would be widely unpopular. So let the people use the services they consent to use, let the businesses collect as much data as possible, the more, the merrier. And when the need for these resources arises, subpoena the business, they'll even do the search for them.

818 points by arkadiyt 5y ago

ab_testing 5y ago

Reading through these charts, it looks like MetroPCS is the most secure provider.

ramesh31 5y ago
I love Metro, have used them for years. $60 for unlimited everything with 20GB tethered 4G hotspot data, and you get free Amazon Prime with your account. This chart has just solidified how great they are to me.
lotsofpulp 5y ago
Metro is owned by T-Mobile, and operates using T-Mobile’s network. Why would it be any more secure than T-Mobile? As far as I understand, there are 3 mobile networks in the US (Verizon, ATT, T-Mobile), and the MVNO’s are just a mechanism to price discriminate. Different customers are sliced into various priorities and willingness/ability to pay, so the 3 mobile networks can most accurately collect the most money according to each individual’s ability and willingness to pay for a certain level of priority on the network.

jenny91 5y ago

> CASTViz has the ability to quickly plot call detail records and tower data for lead generation and investigative purposes What's the arrest funnel? Do they use Salesforce to store all their leads as well?

paxys 5y ago
That seems more in Palantir's wheelhouse

A4ET8a8uTh0 5y ago

The oddly fascinating piece of trivia from all this is the following: voicemail has more protection ( requires an actual warrant ) than your internet searches.

willhinsa 5y ago
And much more protection against being banned from using it!

m0zg 5y ago

Now _this_ is a federal agency badly in need of "abolishing", not the inner city police.

deleted 5y ago
[deleted]

pkpioneer 5y ago

Should You Use Airbnb or Vrbo? https://pkpioneer.blogspot.com/2021/10/should-you-use-airbnb-or-vrbo.html https://pkpioneer.blogspot.com/2021/10/should-you-use-airbnb...

beckman466 5y ago

"The slide also shows that AT&T retains “cloud storage internet/web browsing” data for 1 year. When asked what this detail entails exactly, such as websites visited by customers on the AT&T network, AT&T spokesperson Margaret Boles said in an email that “Like all companies, we are required by law to comply with mandatory legal demands, such as warrants based on probable cause. Our responses comply with the law.” The document also mentions that law enforcement can request records related to wearable devices from AT&T." do you know what this “cloud storage internet/web browsing” data looks like?

badkitty99 5y ago
beta version of social scoring system?
gruez 5y ago
probably dns/sni logs? with most sites using https that's all they're really going to get.
- JumpCrisscross 5y ago
  And with VPNs like Apple Private Relay being broadly pushed, likely less than that.
  - dkdk8283 5y ago
    Never assume- carriers can mandate data collection or sharing.
- Scoundreller 5y ago
  Is there any way to change dns servers on lte/3G? Odd that iPhones let you change it for wifi, but not cellular. Can I even find out it’s using? What about android?
  - gruez 5y ago
    >Is there any way to change dns servers on lte/3G? probably doesn't matter because regular dns is performed in the clear. There's nothing preventing them from logging/intercepting your requests even if you changed them. >Odd that iPhones let you change it for wifi, but not cellular. >What about android? AFAIK on both changing DNS can be done by using an app that acts like a VPN, and intercepts the DNS requests.

Scoundreller 5y ago

So, I’m currently in North America but with a foreign SIM, so I have that country’s IP, most ads are in a language I can’t understand, and McDonalds app won’t let me login unless I switch to wifi with a local IP. This is all great, but does this mean that the local provider has no access to my traffic? I guess DNS is all resolved overseas too? How does the tunnelling work?

nickff 5y ago
This really depends on what you mean by "my traffic"; keeping in mind that your local provider is the ultimate man-in-the-middle.
- Scoundreller 5y ago
  I guess that’s a part of the question: is my phone encrypting (with whatever gsm standard) to the overseas provider and the local provider can’t really see anything, or does it go to the local provider in the clear and they tunnel it over to the overseas provider?
  - nickff 5y ago
    My understanding is that the A5/1 (GSM) encryption is applied to the communication between the device and the local service provider. The local service provider then decrypts and routes the packets.
    - xxpor 5y ago
      Where local service provider is just the tower. https://www.firstnet.com/power-of-firstnet/firstnet-advantages/security.html https://www.firstnet.com/power-of-firstnet/firstnet-advantag... >FirstNet is designed with a defense-in-depth security strategy that goes well beyond standard commercial network security measures, providing protection without sacrificing usability. And now, we’ve gone farther than anyone in the industry to secure public safety communications. FirstNet will be the first-ever network with comprehensive, tower-to-core encryption based on open industry standards. Which implies every other network doesn't encrypt that traffic (or does it with some proprietary scheme... which wouldn't give me a lot of confidence)

1cvmask 5y ago

Joseph Nacchio, the CEO of Qwest, was jailed for not complying with the illegal requests of the surveillance state: https://www.businessinsider.com/the-story-of-joseph-nacchio-and-the-nsa-2013-6 https://www.businessinsider.com/the-story-of-joseph-nacchio-... https://www.denverpost.com/2014/03/27/former-qwest-ceo-nacchio-claims-on-tv-his-jail-time-was-nsa-payback/ https://www.denverpost.com/2014/03/27/former-qwest-ceo-nacch... https://en.wikipedia.org/wiki/Joseph_Nacchio https://en.wikipedia.org/wiki/Joseph_Nacchio And let's not forget the number of people put the jail without the government disclosing the use of stingrays to the defense attorneys: https://en.wikipedia.org/wiki/Stingray_use_in_United_States_law_enforcement https://en.wikipedia.org/wiki/Stingray_use_in_United_States_... https://theintercept.com/2020/07/31/protests-surveillance-stingrays-dirtboxes-phone-tracking/ https://theintercept.com/2020/07/31/protests-surveillance-st...

LogonType10 5y ago
>jailed for not complying with the illegal requests of the surveillance state From the wiki page: >On March 15, 2005, Nacchio and six other former Qwest executives were sued by the U.S. Securities and Exchange Commission. They were accused of a $3 billion financial fraud between 1999 and 2002 and of benefiting from an inflated stock price.
- gowld 5y ago
  > In its case, the government stated that Nacchio continued to tell Wall Street that Qwest would be able to achieve aggressive revenue targets long after he knew that they could not be achieved. Interesting that Nacchio was prosecuted for this but almost no one else is.
  - spywaregorilla 5y ago
    The very same article states that he was found to have produced false accounting records and talked up the company's outlook despite knowing it was losing business and selling his own shares. He got caught on the insider trading. There's nothing noteworthy here.

hammock 5y ago

When it comes to retention periods, AT&T (who I imagine most iPhone users here have, by default) is REALLY bad: https://video-images.vice.com/_uncategorized/1634930279896-retentionperiods.png?resize=1600:\ https://video-images.vice.com/_uncategorized/1634930279896-r...* They also have the longest and deepest history of working with the government on surveillance.

slg 5y ago
>AT&T (who I imagine most iPhone users here have, by default) AT&T lost iPhone exclusivity a decade ago.
- kkirsche 5y ago
  Your point? Most customers in the marketplace are averse to change across any service. It’s not uncommon for users to stay with single providers due to momentum.
  - slg 5y ago
    My point is that saying iPhone users are by default AT&T users rests on the assumption that people have stuck with the same decisions they made about mobile network and phone operating system that they made over a decade ago. That isn't even factoring in the growth of the market overall and the people who have bought their first smartphone within the last decade.
  - annoyingnoob 5y ago
    The churn rate for wireless carriers is around 2% per year in the US, give or take. There are about 300M wireless subscribers in the US. Meaning that around 6M wireless subscribers per year switch carriers.
_jal 5y ago
> They also have the longest and deepest history of working with the government on surveillance. I've long considered ATT to be an extension of the US intelligence apparatus. Ownership doesn't matter, it is who they answer to.

1970-01-01 5y ago

Why are stingrays missing from the guide? Aren't they the most useful tool in the toolbox?

fractal618 5y ago
Clearly they are ubiquitous at this point, and I bet their data goes back to inception.
kjaftaedi 5y ago
This is an interesting point. My guess is that this looks like training material for low-level desk jockeys to help do all of the legwork gathering evidence that would be presented in court cases. Stingrays you would think would be more of a targeted operation and likely handled by a different group of people.
gzer0 5y ago
My claims are without evidence, but it certainly seems as if this document was created with the intentions/hope that it would be eventually leaked. The second slide seems rather suspicous in its placement of "CAST members are not qualified to testify after reading this"; almost as if they were not speaking to an audience of CAST members, but rather, the public. Perhaps a decoy? to draw attention away from STINGRAY and other intricacies?
- dragonwriter 5y ago
  > The second slide seems rather suspicous in its placement of "CAST members are not qualified to testify after reading this"; almost as if they were not speaking to an audience of CAST members, but rather, the public. Sounds like they are doing advance witness tampering by trying to get CAST members to evade calls to testify on material facts known to them should they receive such, not lobbying the public via anticipated future leak. (I’m not even sure how the statement about testimony would be expected to manipulate the public.)
  - gzer0 5y ago

travoc 5y ago

You can download some of the data that Verizon retains from your own cellular use here: https://www.verizon.com/support/download-and-view-vpd-file/ https://www.verizon.com/support/download-and-view-vpd-file/ When I did it, I could see they recorded IP addresses, time stamps and data transfer volume of every web site that I visited over their network, along with cell tower connections. It was fascinating.

murat124 5y ago
Does anyone know the AT&T equivalent of this URL?
hpoe 5y ago
Just out of curiosity do you use a VPN, I always browse with a VPN on my phone for precisely that reason and am wondering if it actually works to help protect my privacy.
- travoc 5y ago
  Using a VPN would protect the privacy of your IP sessions from Verizon, although your VPN provider would now be able to see all of your session information. I suspect a VPN user would show up in the Verizon data file with many large TCP sessions to a very small number of IPs.
  - gzer0 5y ago
    I suspect that the effort required to succesfully produce viable evidence from a VPN provider such as Mullvad are significantly higher than the effort we see here from ATT, T-mobile, Sprint, and Verizon.
    - travoc 5y ago
      That is probably true in most cases. Choose your poison.
    - flowerwolf 5y ago

flotzam 5y ago

Sprint is extra chatty - from page 57 of https://propertyofthepeople.org/document-detail/?doc-id=21088576 https://propertyofthepeople.org/document-detail/?doc-id=2108...: > Ping: The network sends a message to the phones internal GPS receiver to report it's location (must see min. of 4 satellites. GPS coordinates of device and suspected radius from tower e-mailed(or through L-Site website) every 15 minutes for 30 days. Can be done manually every 5 minutes. I wonder if this is facilitated by one of those infamous "carrier app" backdoors included in stock OS but not e.g. in GrapheneOS: https://grapheneos.org/faq#cellular-tracking https://grapheneos.org/faq#cellular-tracking https://gist.github.com/thestinger/171b5ffdc54a50ee44497028aa137ed8 https://gist.github.com/thestinger/171b5ffdc54a50ee44497028a... https://github.com/dan-v/rattlesnakeos-stack/issues/69#issuecomment-438972720 https://github.com/dan-v/rattlesnakeos-stack/issues/69#issue...

bhhaskin 5y ago
Could also be an app that runs on the sim. That would make the most sense.
- flotzam 5y ago
  Do SIM apps really have direct access to the GPS?
  - ranger_danger 5y ago
    the baseband radio does, so, yes. also the camera and mic in many cases.
- gruez 5y ago
  that works even if location is turned off in the OS itself?
ranger_danger 5y ago
You don't even need a traditional app backdoor to do this. The carrier can just send the message to the baseband radio itself, which has a direct connection to your GPS receiver, among other things (usually) like the camera and microphone. That means these peripherals are accessible (in theory, Snowden says it has been done in the past) even if the main app OS is shut down.

gzer0 5y ago

Sprint cannot currently translate IPV4 addresses (ex. 152.138.17.240) to an actual phone number Sprint may be able to translate IPV6 addresses (ex. 001:0db8:0000:0042:0000:8a2e:0370:7334) to a phone number. Interesting, anyone know which aspect of the IPV6 protocol allows for this?

itsthecourier 5y ago
there are so many possible ipv6 public ips that absence of overlapping on assignation is doable and thus individual client determination
bibaheu 5y ago
Probably IPv4 is on CGNAT and Sprint doesn't keep the logs of the translation. On IPv6 there's no NAT, and there might be a deterministic relationship between subscription and IP
- glogla 5y ago
  That, or they don't give devices IPv4 addresses at all and run 464XLAT - according to Wikipedia, quite a few telcos do it that way.
  - keneda7 5y ago
    I believe you are correct. https://news.ycombinator.com/item?id=16440850 https://news.ycombinator.com/item?id=16440850
  - p1mrx 5y ago
    464XLAT is a form of CGNAT. The main difference is whether the subscriber side uses an IPv6 or private IPv4 address, but on the internet side they are equivalent.

unixhero 5y ago

It is more interesting what their procedures are for getting data on citizens or any user for that matter, from FAANG. And bonus question for what they do when they need to pull put bank statements.

ramesh31 5y ago

I've never understood why they try to "disguise" these things. They always stick out like a sore thumb. How would anyone know the difference from a normal cell tower?

miloignis 5y ago
I think you've misunderstood - the disguised towers are normal cell towers, and normal cell towers are normally disguised to be less of an eyesore.

mldonahue 5y ago

For anyone who wants to know more about how companies can more ethically, and transparently, engage with law enforcement/governments: https://news.ycombinator.com/item?id=28156465 https://news.ycombinator.com/item?id=28156465 Establishing a best practice for public/private sector communication keeps the govt in check and helps companies ensure compliance & transparency.

einpoklum 5y ago
That's neither ethical nor transparent. And the guy writing that post is ex-FBI. An ethical and transparent way to handle such subpoenas would include: 1. If possible, not being a US company so you might be able to avoid the subpoena in the first place. 2. Have a policy of not keeping user data at all, or keeping it with a third party that is not legally bound by US government subpoenas, so that it can't (?) be subpoenaed. 3. Publish any subpoena you get from the government. 4. Moreover, arrange it so that subpoenas are published before being read, so that if you get a National Security Letter, you would not be able to comply with the non-disclosure requirement. Another way to go about this may be to only open subpoenas in a public forum, preferably with journalists present. Try to consult ACLU/EFF lawyers about this particular issue. 5. If the government somehow gets its hands on user data, inform the users immediately.
- johnsillings 5y ago
  so basically change all the laws around how this stuff works, got it
- mldonahue 5y ago
  Can you elaborate how you think a tool like this is neither ethical nor transparent? And why is it bad the writer is ex-FBI? You appear to be passionate about the issue at hand, but your knowledge on this process seems to be limited. 1. Not being a US company doesn't matter - international agencies send subpoenas just like the US agencies. US govt can send subpoenas to international companies just the same. 2. Not having PII or user data doesn't prevent subpoenas (i.e. Reddit, 4chan, Whisper, etc.) 3. Subpoena’s often come with Non-Disclosure Orders (NDO). Even without NDOs, publication of the actual subpoena is arguably more irresponsible just by the shear fact you could be publicizing PII, and subjecting this user to unfair, and non-contextualized public opinion. Big tech has adopted transparency reports for this reason. User notice is the goal - not publicly shaming your user just to make a point to the government. 4. Non-compliance and willful disregard for the legal order will not change the overall problem. Ironically, you're right that the best way to prevent data requests from the govt might be non-compliance...then the company would get shut down for said non-compliance...so there would be no company for the government to subpoena. 5. User notice is obviously a legal department best practice, but if there is a NDO it puts legal repercussions on a company for disclosing such info. Keeping this process clunky/messy/disorganized hurts the user, and the company. You say this company is not ethical, yet Kodex automatically informs users about data requests pertinent to them, and if there is an NDO, the user is notified immediately upon expiration rather than relying on a legal department employee to remember to manually do it months or years later. Would it be more ethical to keep the process unchanged and prone to human error? These guides for Law Enforcement (LE) to get data are actually meant to streamline the process for the company, so companies don’t have to deal with non-valid subpoenas. The subpoena is coming regardless…why waste time/resources dealing with non-valid subpoenas when educating LE will help streamline things. Obfuscation is never going to prevent these legal orders…if the FBI wants to send your company a subpoena they are going to whether you tell them how to do it properly or not. Kodex is a best practice that standardizes how the govt can interact with companies, to keep the govt in check, while keeping companies compliant, transparent, and accountable about the process. As the writer said: “There is a lot that can be fixed in government. This process is one of them. The goal is not to ‘help the FBI do their job more easily’… making the process easier for the company, forces the government to do their job BETTER, and helps society move forward.”

gonehome 5y ago

In the US people are more pro-company and anti-government so retention policies tend to require the companies to retain the data for a period of time so warrants can request it if necessary. In the EU people are more pro-government and anti-company so the government is more likely to have access. The US process for access is sometimes tied to FISA. I'm not an expert on this stuff, but I think I'd generally prefer companies handling retention and government having to request access rather than the other way around. Assuming (probably a big assumption) that the companies do it securely and don't fuck it up. The chart does make me pretty happy with T-Mobile though, and their 5GUC speeds are wild! https://twitter.com/zachalberico/status/1449049818857459718?s=20 https://twitter.com/zachalberico/status/1449049818857459718?...

deleted 5y ago

[deleted]

NN88 5y ago

Anyone get the sense we're in a post-Wikileaks era? These leaks seem... like they would get someone indicted...

aetherspawn 5y ago

MetroPCS looks to be the most private cell provider.

einpoklum 5y ago

And as for the NSA internal guide for getting data from AT&T, T-Mobile and Verizon - that's a bit shorter: > Do nothing, we already have this data loaded and indexed.

sillycross 5y ago

> The slide also shows that AT&T retains “cloud storage internet/web browsing” data for 1 year. I never thought before that ISPs would really keep track of every user's browsing history, but apparently as cheap as the disks are today, this has become true. Can't think of any use of this data other than for mass surveillance.

pedalpete 5y ago
I believe they can also sell the data, though there may be some regulations on anonymized, or sold as a group to develop profiles and understanding for advertising purposes. Perhaps that's what you mean by "mass surveillance", but I took that to mean specifically government surveillance.

efitz 5y ago

Essentially the government has built a surveillance state by outsourcing it to private enterprise. I think it would be interesting to know how people really feel about this. I would love to see a survey that actually truly explained the trade-offs and see how people felt about it, eg avoiding the “ should government be able to subpoena records from private business” but actually ask questions like “is it OK with you that with a subpoena that the government can get a list every website that you have visited?” And then present the trade offs and abuse cases. I really think that we’ve allowed the surveillance state to form without actually having a meaningful public debate about it.

DeathArrow 5y ago
>Essentially the government has built a surveillance state by outsourcing it to private enterprise. How long until the government finish outsourcing of all its attributions to private entities and corporations take ownership of governance? Then instead of voting, the citizens can manifest their interests through buying shares.
- bjarneh 5y ago
  > the citizens can manifest their interests through buying shares. Isn't this sort of how it already works? Although only a few (very rich) citizens hold enough shares to actually have any clout.
datavirtue 5y ago
I like how ATT skirted around the question and lied. Well, not answering the question is...nevermind, they lied.
NoImmatureAdHom 5y ago
I have hope that we here in the U.S. will be able to get out in front of this one. Despite all the complaining the justice system still mostly works and we have a libertarian streak a mile wide. Perhaps the thing to do is show those in power that they haven't escaped the dragnet...

sathackr 5y ago

There exists a similar guide to this for obtaining subscriber information for an IP address. Including a table that listed which providers would hand over data without a subpoena and what the retention period was for each provider. One of the interesting things I remember seeing was that it was noted that T-Mobile had never been able to supply such information to LEO. I have seen it before but never had direct access to it.

breput 5y ago

I thought this was interesting and might involve some handset manufacturer involvement? Under the "Location Based Services" chart, US Cellular is listed "No. However, you can force a call without a ring to the target device to determine tower/sector"

flowerwolf 5y ago
The "force a call without a ring" is just basic GSM. I don't know, but I'm guessing 3G, 4G or 5G support requesting the GPS position from the ME/handset.
- breput 5y ago
  That might be true (I don't know), but US Cellular is a CDMA/4G/5G carrier so there is at least some non-GSM functionality in there.
  - flowerwolf 5y ago
    Yeah, by "basic GSM" I mean a common subset that is available regardless of 2G/3G/4G/5G, as in, you can still ping the mobile equipment to see which BTS it's connecting to. (And even if you don't get the TA with CDMA/OFDMA you still get signal strength and/or can force a downgrade if necessary, to get a rough location.)
    - Forbo 5y ago
      I'm not sure if you're shadow banned or what, but every comment of yours I have encountered has been marked dead. I vouched for this and another one I saw elsewhere in the thread.
      - flowerwolf 5y ago
        Made the account an hour ago, maybe that's why. Thanks for the heads up

Threeve303 5y ago

Well it is definitely more than “metadata”…

forgingahead 5y ago

With all this information collected and available, and with pretty basic technology tools (keyword alerts, fast searching, location data to pinpoint pretty accurate positioning) - how come there is still crime and other "bad things" that happen? I'm not talking about heat-of-the-moment things, but literally anything requiring any sort of planning or organisation (kidnapping, gangsterism, etc) should be solvable with this. So why isn't it? *Note, I don't want an uber-surveillance state - my point is that we already have one, and any feeble excuses from law enforcement about solving 10s of thousands of crimes with "ooops we can't figure it out" seems utterly hollow and untrue.

zw123456 5y ago

So if I know someone's Google password, I could go search on all those keywords and basically SWAT them right ?

DeathArrow 5y ago

Having lived a part of my childhood in a poor communist country from Eastern Europe and a part of my younghood in a poor country from Eastern Europe I had some moments when I asked myself if it wouldn't be better for me to move to US. I quit asking myself this some time ago.

_gohp 5y ago

Indeed, often people have said the FBI runs this and that. But this is not cost efficient, the agencies can just subpoena the businesses for data, simple as that. No hacking, no developing etc. It's pretty efficient, if the government announced they would save some files on all citizens, it would be widely unpopular. So let the people use the services they consent to use, let the businesses collect as much data as possible, the more, the merrier. And when the need for these resources arises, subpoena the business, they'll even do the search for them.