21 ms·

France passes bill to allow police remotely activate phone camera, microphone

• josh_today 3y ago
  [dead]
• sixhobbits 3y ago
  what tech does this even use? Do they mean using Pegasus or similar malware that the govt has to first get onto the suspect's devices, or is this via Google/Apple or the device manufacturers that makes 'remotely and secretly activating a microphone' even possible?
  • _kbh_ 3y ago
    > what tech does this even use? Do they mean using Pegasus or similar malware that the govt has to first get onto the suspect's devices, or is this via Google/Apple or the device manufacturers that makes 'remotely and secretly activating a microphone' even possible? It would have to be after compromise, which would mean its likely only used on a very small number of cases due to the sensitivity and cost of the technology involved.
    • chrisco255 3y ago
      Right.
    • hammock 3y ago
      Is it expensive to compromise a phone? Is it sensitive to compromise a phone, now that there is a national law allowing it, passed through a democratic process?
      • brobdingnagians 3y ago
        This might be quibbling but true democratic process could be interpreted as direct democracy where the law is directly voted for and people give a specific assent to the law (which ancient Athens did do). This is more of a democratic republic where officials elected through democratic process then make decisions, which usually works more smoothly than a pure democracy, but it does mean that the population at large does not necessarily support this specific law (though they might).
        • pantulis 3y ago
          > but it does mean that the population at large does not necessarily support this specific law If the population does not support the law, the government could be potentially replaced. But the most probable conclusion is that the population at large would not care.
      • _kbh_ 3y ago
        > Is it expensive to compromise a phone? 2-2.5+ million USD depending for a full chain with persistence (lower end of range is for iOS higher end is for Android). That is probably the lower end of the rough cost to buy that capability which you can use as many times as you want. https://zerodium.com/images/zerodium_prices_mobiles.png https://zerodium.com/images/zerodium_prices_mobiles.png > Is it sensitive to compromise a phone, now that there is a national law allowing it, passed through a democratic process? The technology itself is sensitive, when you buy a full chain exploit like the ones that have the public bounty price above, if it gets burnt it's useless for everyone else who bought it after its patched. Generally exploit brokers don't like it when you burn their exploits.
        • hammock 3y ago
          So, on the order of a dollar per person, assuming a town/municipality of a couple million people? Is that a lot? In the US the major cities have police budgets of between $200 million and $5 billion
          • _kbh_ 3y ago
            > In the US the major cities have police budgets of between $200 million and $5 billion Yeah and most didn’t have this capability generally considering both the costs and the little amount of use you'd have for it. You'd expect something more federal like the NSA, CIA or the FBI to have this kind of capability which is why its kinda a big deal when normal cops get it.
            • hammock 3y ago
              >Yeah and most didn’t have this capability generally considering both the costs and the little amount of use you'd have for it. I would say most didn't have this capability because it's illegal. In France it is now legal
    • tiborsaas 3y ago
      This bill could be step one. Step two could be a requirement for SW/HW manufacturers to add a backdoor since this is not really effective to fight crime this way. I'm not saying it is planned or there's some conspiracy for establishing a totalitarian state. But we can't really predict the future and more loose rules could be introduced by the next government with a totally different agenda who might thank for the previous one for creating this legal framework. Also, this section is weird too: > They said sensitive professions, including doctors, journalists, lawyers, judges and MPs, would not be legitimate targets. Apparently software engineering is not a sensitive job.
      • pantulis 3y ago
        > Step two could be a requirement for SW/HW manufacturers to add a backdoor since this is not really effective to fight crime this way We have already been there, it's just like good old phone calls. They can be intercepted under the proper judicial supervision. I don't have criteria to answer if this is a necessary evil or directly a blatant totalitarian push, but one needs to consider: does the French government have a bad track record of abusing the capability of eavesdropping any phone communication? has this capability been useful for law enforcement?
        • Nevermark 3y ago
          The slippery slope argument can be overused. But any surveillance capability results in “good” as well as bad actors, frustrated with the current limits, asking for just a little more formal power or finding ways to justify informal drift in practice. The only way to stop surveillance creep is openness and clear principles more coherent than a recursive “well they have been responsible so far, so far as we know” argument.
        • tiborsaas 3y ago
          Good point, most people however don't expect their phone calls to be private for this very reason. > does the French government have a bad track record of abusing the capability of eavesdropping any phone communication? I'd rather look into possible future scenarios, I don't know about past cases, but I don't really follow french politics. I know discussing politics is HN is not encouraged, so I'd just rather suggest to look up what's coming for France (and EU) if the current government fails and major powers switch. Sorry if you already know this. > has this capability been useful for law enforcement? In Hungary, Pegasus was used to eavesdrop on many citizens who were simply in an opposing position. Law enforcement is a good cover for data collection and of course can be effective, but we need transparency and safety to see if these tools are abused or not. There are no good answers I'm afraid.
  • orangepurple 3y ago
    Looks like any app can be installed silently behind your back with GTalkService that is running on your Android phone https://github.com/CellularPrivacy/Android-IMSI-Catcher-Detector/issues/151 https://github.com/CellularPrivacy/Android-IMSI-Catcher-Dete... https://jon.oberheide.org/blog/2010/06/28/a-peek-inside-the-gtalkservice-connection/ https://jon.oberheide.org/blog/2010/06/28/a-peek-inside-the-... --------------------- Google Play Services spyware discussion https://forum.xda-developers.com/t/guide-insanely-better-battery-life-when-idle-battery-life-thread.2357417/page-119 https://forum.xda-developers.com/t/guide-insanely-better-bat... https://forum.xda-developers.com/t/app-disable-service-guide-android-2-2.2455525/ https://forum.xda-developers.com/t/app-disable-service-guide... --------------------- "...the cellular carrier can send blobs of FORTH code right to the radio. The radio firmware also seems to have an IP stack (with TCP) so it can do its own interesting things (both bad and good)..." https://boston.conman.org/2013/01/22.2 https://boston.conman.org/2013/01/22.2 "...easily spotted loads and loads of bugs, scattered all over the place, each and every one of which could lead to exploits – crashing the device, and even allowing the attacker to remotely execute code. Remember: all over the air. One of the exploits he found required nothing more but a 73 byte message to get remote code execution. Over the air..." "... It’s kind of a sobering thought that mobile communications, the cornerstone of the modern world in both developed and developing regions, pivots around software that is of dubious quality, poorly understood, entirely proprietary, and wholly insecure by design." https://www.osnews.com/story/27416/the-second-operating-system-hiding-in-every-mobile-phone/ https://www.osnews.com/story/27416/the-second-operating-syst... (archive: https://archive.is/FOR5V https://archive.is/FOR5V) https://news.ycombinator.com/item?id=6722539 https://news.ycombinator.com/item?id=6722539 https://news.ycombinator.com/item?id=6722732 https://news.ycombinator.com/item?id=6722732 https://news.ycombinator.com/item?id=6722648 https://news.ycombinator.com/item?id=6722648 https://news.ycombinator.com/item?id=6738066 https://news.ycombinator.com/item?id=6738066 https://news.ycombinator.com/item?id=6724034 https://news.ycombinator.com/item?id=6724034 <-- Seems to be higher risk with Qualcomm basebands where everything is integrated ------------------- SIM card reader chips have their own operating system https://en.wikipedia.org/wiki/SIM_card#Design https://en.wikipedia.org/wiki/SIM_card#Design Rooting SIM cards https://archive.is/3ZohQ https://archive.is/3ZohQ https://news.ycombinator.com/item?id=6722896 https://news.ycombinator.com/item?id=6722896 https://news.ycombinator.com/item?id=6724215 https://news.ycombinator.com/item?id=6724215 https://news.ycombinator.com/item?id=6723236 https://news.ycombinator.com/item?id=6723236 -------------------
  • somerandomqaguy 3y ago
    > The bill allows the geolocation of crime suspects, covering other devices like laptops, cars and connected devices, just as it could be remotely activated to record sound and images of people suspected of terror offences, as well as delinquency and organised crime. Not just phones looks like.
    • mdp2021 3y ago
      > cars For the very strange who accept driving the new "smartphones with wheels". Including, note, the cars with the embedded telephone as mandated by the european union past 2018 - the e-call systems. Some articles went "there could be privacy issues, but it is a remote eventuality": now you see that someone could push as normal an eavesdropper in your car.
      • stavros 3y ago
        "A remote eventuality" my ass, I bet that's the primary reason behind the push.
        • mdp2021 3y ago
          Sometimes, Stavros, it is a painful choice to decide in assessment between malice and the various shades of stupidity - the perspective of the latter can be a tad more difficult to digest. But the last time I read reported unhandable blabbering devoid of awareness and mental competence, attributed to a "minister of the republic", was just minutes ago. When you hear utterings like "it will save lives" - completely alien to conscience of quality of life, good reason, cleanness and propriety, rejection of absurdity, collaterals etc. - I am afraid they may actually "believe" that (or, better, just "sit on that", "hold on that", "cling to that" in some internal economy).
          • stavros 3y ago
            Hm, yeah, you're right. It's a difficult choice because both options are so dire, but I guess they have to be when you have a decision like this.
  • lloeki 3y ago
    Is this even possible on an iPhone? My memory may be failing me or confusing things so please correct me, but I seem to recall reading somewhere that the baseband lives segregated (with only a narrow communication cannel, kinda as if it were a remote machine) from the remainder of the hardware, so while it could be made to run stuff itself it has no way to physically access to main cpu, ram, mic, nor cams (barring, of course, any vulnerability on the comm channel that would land an exploit in the main OS+hardware). GPS is another matter, but then again it's baseband so it gotta communicates with towers, so that's a done deal already that does not even require baseband access.
    • switch007 3y ago
      Apple is good at /marketing/ their security, not being good at security.
      • lloeki 3y ago
        I take pride in striving to form my opinions based on verifiable facts as discovered by third party sources, such as via work done by the Asahi Linux team†. If I were buying into marketing I would not even have asked the question above in hopes of getting a hard reference to these kinds of details. † e.g the following tidbits: > The SEP is designed to be mutually isolated from the main CPU (AP); neither can compromise the other. > No runtime blobs are designed to have total system access (no ME, no PSP, no TrustZone, nothing of that sort). Almost all blobs are running behind IOMMUs or similar firewalls, with the sole exception of the GPU firmware*. All code running on the main CPUs is under the control of the OS. > AS machines use a large number of auxiliary firmware blobs, each dedicated to a specific purpose and running on a separate CPU core. This is better than having a smaller number of kitchen sink blobs (like Intel ME), since each blob can only affect a particular subsystem (e.g. display, storage, camera), which makes it harder for multiple blobs to collude in order to compromise the user in a meaningful way. For example, the blob running inside the keyboard controller has no mechanism to communicate with the blob running on the WiFi card, and thus cannot implement a keylogger surreptitiously; the blob running on the display controller similarly has no way to communicate with the network, and thus can't implement a secret screen scraper. > From a security perspective, these machines may possibly qualify as the most secure general purpose computers available to the public which support third-party OSes, in terms of resistance to attack by non-owners. This is, of course, predicated on some level of trust in Apple, but some level of trust in the manufacturer is required for any system (there is no way to prove the non-existence of hardware backdoors on any machine, so this is not as much of a sticking point as it might initially seem). > *it's worth pointing out that this firmware is not particularly large, is shipped in plain text and even with some symbols, does not have any functionality to talk via questionable interfaces (network, etc.), and is optional and not running when the OS boots (the OS must explicitly start it) Which is an entirely different league than, say, Intel ME which completely owns the machine at the design level. https://github.com/AsahiLinux/docs/wiki/Introduction-to-Apple-Silicon https://github.com/AsahiLinux/docs/wiki/Introduction-to-Appl... https://github.com/AsahiLinux/docs/wiki/Apple-Platform-Security-Crash-Course https://github.com/AsahiLinux/docs/wiki/Apple-Platform-Secur...
  • dathinab 3y ago
    This bill AFIK only covers the "they are allowed to do it" part but not the "how do they gain the capability to do it" part. But spyware which can do so exists in endless amounts, including from companies focused on selling it to governments. Hence also why in recent years physical microphone switches, or e.g. stuff like (I think it was) Apple laptops "physically" disconnecting the microphone/camera if you close the lid have been become increasingly more common and in demand. (Through the demand comes more from bad actors using it then from people being afraid the government spies on them AFIK, but technically there is 100% no difference)
    • dunham 3y ago
      Also, I recall that the green light on the apple camera is controlled by the camera's firmware, making it more difficult to turn on without the light come on. (You'd need to overwrite the camera firmware.)
      • internetter 3y ago
        Why does this even need to be controlled with firmware? Can't it be a simple circuit? (I know nothing about this)
        • MartijnBraam 3y ago
          It could be simple, just hook the led to the reset line of the camera and you'll know if the camera is in use. Downside is that the led will blink on boot when linux probes the driver.
          • internetter 3y ago
            > Downside is that the led will blink on boot when linux probes the driver. Sounds like an upside to me.
        • dunham 3y ago
          I should have included the caveat that my comment was from memory. I just did some brief research, and it seems that it was the case prior to some point in time between 2008 and 2019, but it is now hard-wired. It is discussed near the end of https://daringfireball.net/2019/02/on_covering_webcams https://daringfireball.net/2019/02/on_covering_webcams The engineer quoted in the article pointed out that it may be possible (at least in 2019) to briefly turn the camera on - flashing the led too quickly for someone to see. I didn't find a discussion of this issue in the May 2022 Apple Platform Security guide.
  • mlkmt 3y ago
    part of it is already being done: judges in France just ask companies like FAANG for location data, including live location. E2E encryption is the only way for companies to be able to refuse (and this is why there’s been a strong governmental push against it). The scary new part is the turning on the camera/mic.
  • akikoo 3y ago
    E.U. is planning to purchase Pegasus for law enforcement purposes: https://www.europarl.europa.eu/news/en/press-room/20230609IPR96217/spyware-meps-call-for-full-investigations-and-safeguards-to-prevent-abuse https://www.europarl.europa.eu/news/en/press-room/20230609IP... "They want EU rules on the use of spyware by law enforcement, which should only be authorised in exceptional cases for a pre-defined purpose and a limited time."
• debacle 3y ago
  > They noted that a judge must approve any use of the provision We tried the same in the US. Our intel agencies just lied to the judges, who mostly otherwise were hip to the con and acted as a rubber stamp.
  • sschueller 3y ago
    While the intel community in the United States seems to be above the law I don't think lying to a judge in France is ignored to the same extent.
    • SteveNuts 3y ago
      How can a judge possibly have all the context required to make a decision like this, do they get access to the Intel so they can verify the claims?
  • ibejoeb 3y ago
    We think they lied to the judges. Or maybe there are no judges, because the entire thing is a secret system, so we can't know who the judges are or how they've ruled on the matters brought before them. All we know is that it is only used against foreign adversaries, except in the cases when it's used on Americans.
    • Loughla 3y ago
      Of all of the issues in the US, I genuinely believe FISA and FISC are the largest issues today. There can be no secret courts in a real democracy (or republic or whatever else you want to call it). The government can't be by, for, and of the people if they have a recourse to lock away people that can't have the sun shine on it. It astounds me that this is just accepted as a practice in the US. Or am I being naive?
      • ibejoeb 3y ago
        You're not being naive. It happened in a flash, without a referendum, and nobody asked for it. It's not that we accepted it; it's that there's nothing we can do about it.
• superdevius 3y ago
  [dead]
• T3RMINATED 3y ago
  [dead]
• cde-v 3y ago
  I'm sure this will stop the rioting.
  • barbariangrunge 3y ago
    I feel like this would worsen the feelings of grievance that are causing the rioting. Not that I know what's going on
    • dathinab 3y ago
      I believe it's somewhat unrelated to the rioting. If you look at France it's not all of France rioting (through all of France was protesting). Instead its a specific group of people defined by at what kind of place they live in: Banlieues. This is a form of ghetto which is historically mostly populated by people which grand parents had a migration background and which due to an economical shift had en-mass lost their jobs (the grand or grand grand parents). This people grew up as French where told all the social norms and expectations of French society etc. At the same time they are often not treated as French have close very little chances to get any job at all. Just having a address at the border of a Banlieues is enough for you not even be considered for a job. Over the last decades this has gotten so bad that by often police isn't really present in the Ghettos at all, and if only in larger groups. At the same time this distress is frequently abused by extremists, e.g. religious ones. But that also means that most people in Banlieues probably do not care too much about this law as it is unlikely to ever affect them anyway. At the same time it's also true the other way around, the police cares too little about the Banlieues to abuse it to target the huge majority of people there. Similar if they move against people there they know very well that this people do not have good ways to properly legally defend themself. But who will be targeted by this are e.g. environmental activists. For example France has in the past already (many times) declared some environmental activists as domestic terrorists and used anti-terrorist laws to spy on them in various ways. I probably are wrong in some points at least somewhat, but I think it might be still worth to consider some of the arguments.
  • hinata08 3y ago
    idk it's not exactly the bill we needed in the middle a crisis of confidence in the police. it's just conservatives shrugging off what is happening, and making their point this law doesn't make sense otherwise
• karaterobot 3y ago
  > But lawmakers agreed to the bill late Wednesday as Justice Minister Eric Dupond-Moretti insisted the bill would affect only “dozens of cases a year.” Technically he is not lying or naive, because any number, including large numbers like 66 million, can be expressed in units of dozens.
  • blamazon 3y ago
    66 million is 5.5 million dozens for anyone else wondering. Or, 5,076,923.08 baker's dozens.
  • dathinab 3y ago
    it most likely really will only be a small number of cases BUT that doesn't matter it being abused against just one or two times in very important contexts (political, human right activists, etc.) can already be a major negative impact for laws like that the "it's just a few" argument was always worthless even if true
    • freedomben 3y ago
      Exactly. The total number of cases doesn't really matter that much, it's the capability and willingness.
    • karaterobot 3y ago
      I dunno, I think the number will increase above dozens. They certainly won't start out doing dozens a year, then pare it down to one or two, and eventually realize the don't even really need it. More likely, the number of uses per year will creep up, until eventually it's not as controversial as it used to be, at which point it'll jump dramatically. As a comparison, in the U.S., no-knock warrants were controversial when they were first implemented, and they were stated as being only for very special circumstances—ya know, terrorists and such—and now they happen about 70,000 times a year, mostly for dangerous activities like marijuana possession or distribution. The ratchet only goes one way, which is why it's dangerous to grant the premise of "we'll only use this in exigent circumstances, we pinky swear".
• msoad 3y ago
  [flagged]
  • blueprint 3y ago
    let's just activate his mic for a little while then we can parallel construct
  • rythmshifter 3y ago
    Saying all cops are anything is exactly the same thing as saying all blacks are thieves, all Jews are greedy, or any of the other blanket statements that can never apply to any large group of people. It’s disgusting.
    • Lalabadie 3y ago
      The statement becomes true when all good cops avoid policing the bad ones, which is the whole point of it.
    • byteknight 3y ago
      This is someone who has been fortunate to never need assistance.
    • input_sh 3y ago
      Absolutely not. It's a profession, every cop out there can just... not be a cop. Comparing that to skin color or someone's ethnicity is absolutely ridiculous.
      • boeingUH60 3y ago
        Technically speaking, all cops can’t be bad, so the phrase is pretty dumb anyways even if one has issues with their country’s policing system.
        • OldManRyan 3y ago
          The idea behind the phrase is that cops are either bastards or they sit by and let other cops be bastards and are themselves bastards. Any cop who doesn't sit by and let other cops abuse citizens isn't a cop for very long.
• foobarian 3y ago
  I misread that as "retroactively" at first and am feeling relieved now. Which I shouldn't be!
• flenserboy 3y ago
  Physical switches are necessary on devices.
  • briandon 3y ago
    And easily physically removable batteries, which used to be the norm and are still available for some devices (like the Nokia C30). It isn't mere coincidence that device manufacturers have made it impossible to power off mobile phones (short of refusing to charge a device) and impossible to positively disconnect ripe-for-abuse subsystems like the microphone(s) or cameras at the same time that governments and other entities are using them as tracking devices.
    • freedomben 3y ago
      Are you suggesting widespread conspiracy between governments and tech companies? I'm strongly in favor of physical switches and I detest where technology is nowadays, but it seems pretty likely to me that they removed the physical switches because: 1. It simplifies (cheapens) production costs 2. It eliminates points of failure 3. It reduces user error opportunities 4. It makes it easier to waterproof devices 5. It makes it easier to make devices smaller And surely others that don't require a major conspiracy.
      • devsda 3y ago
        There may not be an outright conspiracy, but I will not be surprised if OEMs are discouraged from (re)introducing physical switches on popular and mass market devices.
      • weberer 3y ago
        Widespread conspiracy between governments and tech companies has already been proven. https://en.wikipedia.org/wiki/PRISM https://en.wikipedia.org/wiki/PRISM
        • freedomben 3y ago
          > Widespread conspiracy between governments and tech companies has already been proven. You mean, a conspiracy in the past to allow governments to sample/siphon data has been proven. That's a pretty different thing than having the entire market physically designing their product so that the government can use it to spy on people. I don't doubt at all that the government would like companies to do that (they've already openly asked for it regarding encryption after all), but jumping to "it's a(nother) conspiracy!" when there are some pretty damn good explanations that are much closer to Occam's Razor seems irrational to me. I don't think the tech companies deserve our trust, but I also think that if we go around seeing ghosts and conspiracies in every shadow and under every rock, it's not going to mean anything when the *next Prism happens because everyone will see "the boy who cried wolf" or say "those people always think it's a conspiracy."
• hoyd 3y ago
  https://archive.is/y8cUj https://archive.is/y8cUj
• LocalH 3y ago
  From the French Revolution, to this. How far the mighty have fallen.
  • kemayo 3y ago
    I mean, the French Revolution was very-shortly-followed by the Terror, so we can hardly present this as a simple slow decline from a golden age.
    • ericd 3y ago
      And very shortly thereafter, an emperor :-)
      • hinata08 3y ago
        the emperor did an empire on behalf of the republic, and to fight off the british to save the republic over monarchy these times were ironic and still up to your own understanding, because nobody got what really happened then
    • charles_f 3y ago
      The terror was fully part of the revolution, and was notably when the vote for France to proclame itself a Republic happened. Support for and against the king came and went throughout the revolution. The vote for abolition of monarchy in 92 (so, 3 years after it began!) and then for death penalty of the king in 93 was heavily influenced by the fear of retribution for whom may vote against. France would likely still be a monarchy if not for the terror. FWIW, France became an empire, then was restored as a monarchy, then back an empire and monarchy before it became a republic durably. Revolution was not a series of peasants and commoner ridding themselves of their despots, it was much more dirtier, political and complex than that, which doesn't prevent to still be behind the ideals that drove the events and find it beautiful.
      • r00fus 3y ago
        This entirely. The truth is messy and doesn’t make for an easy story.
• meerita 3y ago
  I think it's unpracticable unless they install a backdoor on each phone.
  • mmastrac 3y ago
    The backdoor is already there as zero day exploits.
    • imjonse 3y ago
      One can only hope that not also part of the design since day zero.
      • mmastrac 3y ago
        It's sad, but the quality of baseband software is bad enough that these bugs may as well be explicit backdoors.
  • imjonse 3y ago
    They don't have to install the backdoor themselves since that is clearly beyond the French police's reach. But if backdoors are already there they (France) only have to get access.
  • rtkwe 3y ago
    The baseband modem has been a huge security concern because it is largely separate from and not monitorable by the phone OS.
  • 0xbadc0de5 3y ago
    Zero-touch OTA exploiting a cellular baseband processor in a phone is 100% possible if you control the network (which governments absolutely do). From there, it's just a matter of pivoting over to the application processor in order to enable the camera and mic. This path will almost certainly be less hardened than a userland to kernel privesc since the application-to-baseband interface will already be considered a trusted channel by the OS.
  • 3y ago
• hinata08 3y ago
  I regret getting a pixel, and not a fairphone with a removable battery With the current level of oversight on the police (police of police is a meme by now), and the level of cybersecurity at the government, everyone's phones will be activated within a few months. At least some government agent will have fun watching what ppl visit on the internet during their spare time, and can enable the camera to watch what they're doing when they review the content. The fight against crime is ramping up ! I don't get why they don't hire back more detectives and accountants to really investigate actual evidence, instead of just listening to potential criminals for hours. They have been reducing the force for 15 years (especially the forces that investigated financial and workplace crimes) That would be more effective.
  • noisy_boy 3y ago
    Who knows if Framework[0] survive long enough, they might create a phone with choices like GrapheneOS[1] etc. Their 16" laptop reminds me of Project Ara[2]. [0]: https://frame.work/ https://frame.work/ [1]: https://grapheneos.org/ https://grapheneos.org/ [2]: https://en.wikipedia.org/wiki/Project_Ara https://en.wikipedia.org/wiki/Project_Ara
  • rtkwe 3y ago
    There's always the faraday bag or simply not taking it to your meeting/activity that have been the recommended options for opsec even when phones had removable batteries.
    • dismalpedigree 3y ago
      Faraday bags are not effective against all frequencies. Specifically the 5G frequencies are known to be very difficult to block with a cage ( but do have relatively short ranges)
      • bagels 3y ago
        It also is ineffective at blocking audio which can be shipped out as soon as it comes out of the bag.
• nimbius 3y ago
  reminder that fdroid offers apps that will monopolize the microphone so it cannot be used by other programs (pilfershush for example.) electrical tape on your camera should take care of the rest, and developer mode lets you feed the system bogus GPS data at will.
  • x3m157 3y ago
    All good ideas for general opsec, however the last one is moot if you're connecting to cell networks - tower connection and triangulation data is not local to your phone and is already relatively easy for police to access with a warrant.
  • aembleton 3y ago
    Does that also stop the baseband from accessing the microphone? How would I test that?
• Animatronio 3y ago
  Meanwhile China is bad.
  • bunga-bunga 3y ago
    I haven't seen "reeducation camps" in the west in a few decades
    • imjonse 3y ago
      That is true, luckily. OTOH, to be fair the west has been good at "offshoring" its abuses for quite a few centuries.
    • caditinpiscinam 3y ago
      The US imprisons tons of people, with a strong bias towards certain races. Are our prisons meaningfully different from "reeducation camps"? Are they any less biased, brutal, or damaging? You can argue that prisoners in the US are "criminals", but states can call whoever they want a criminal.
      • xcdzvyn 3y ago
        This is totally ridiculous. China is literally committing genocide. They are kidnapping innocent people and harvesting their organs.
        • Animatronio 3y ago
          What is ridiculous is that China is vigurously criticised in every news outlet in the West on every occasion, while the French gov't gets away with almost everything. Can you explain that?
          • bunga-bunga 3y ago
            They’re literally protesting right now in the streets in France, so I don’t know what you’re talking about. No country is a saint, but you should stop with the whataboutism.
• le_pet 3y ago
  That sounds very reasonable, similar to installing a bugging device in the house of a suspect, to gather more evidence. The neat thing about mobile phones is that such a bugging capability comes built-in. The police should certainly be allowed to use this in the course of investigative duties.
  • javajosh 3y ago
    Yes, it sounds reasonable. It also sounds reasonable to allow police to enter anyone's home at any time - consider all the crime they might prevent if only they didn't have to wait for a warrant! It sounds reasonable to let the police shoot a fleeing suspect, because why are they running if they aren't guilty? It sounds reasonable to let the police look through any computer - how much CP is missed because they have to wait for a warrant? Lots of things sound reasonable which are not. One must consider the downside, particularly the downside of abuse of power.
    • le_pet 3y ago
      Just as the police aren't allowed to install a bugging device in the house of a suspect without judicial permission, they're not permitted to remotely surveil a suspect's phone without such permission either. So your comparison of this limited additional capability to "allow police to enter anyone's home at any time" is not relevant. And trying to draw a parallel to "let the police shoot a fleeing suspect" is absurd.
      • hellojesus 3y ago
        But the NSA has been proven to be doing it without warrant, at will, and then lying to Congress and the American people about doing it, and then saying it was a good thing they did the thing they said they didn't do which was also illegal that they did. It will be abused instantly.
        • le_pet 3y ago
          That is a US intelligence agency, whose mission is by necessity shrouded in secrecy. They are not the French police, the work of whom typically will be presented in an open court for scrutiny.
• m-p-3 3y ago
  Can we get the European Union to mandate physical toggles and shutters for mic and camera, now that they're also pushing for user-replaceable batteries?
  • imjonse 3y ago
    It's going to be hard as long as the european MEPs own phones have no such shutters...
  • Longhanks 3y ago
    Are you talking about the European Union that wants to permanently dismantle end to end encryption and full access to any and all texts sent between any number parties?
    • LovinFossilFuel 3y ago
      Exactly. Don't count on the next-gen mega-state to have a long-term positive effect on your life.
  • ffhhttt 3y ago
    I would be less surprised if they actually banned things like this given their attitude to E2E encryption..
• knaik94 3y ago
  From an opsec standpoint, would leaving the phone in airplane mode and turning off location services effectively block access to the phone? From my understanding airplane mode disables the sim, wifi, gps, and bluetooth entirely, but it's possible to re-enable wifi, gps, and bluetooth. It's something I got into the habit of doing because my phone searching for 4g cellular data ate into my battery.
  • puttycat 3y ago
    Not if the phone has been rooted and airplane mode has been tampered with from below.
  • dheera 3y ago
    For the camera your best bet is to just put a physical cover. There are a lot of sliding adhesive ones you can buy online that are convenient. I stick them on laptops as well, especially work-issued laptops. For the microphone ... ideally build and install LineageOS yourself on an Android device. Don't trust iOS or Google's official Android builds, they have closed source software that may have France-specific backdoors.
    • PartiallyTyped 3y ago
      Or CalyxOS. calyxos.org
      • internetter 3y ago
        Firmware and stuff even lower level still is unchanged right?
        • PartiallyTyped 3y ago
          Yes. It offers only OS code and the Linux kernel updates.
    • knaik94 3y ago
      From what I've read, the current theory is that access is initially possible using the cellular modem. Building and running a custom Android wouldn't necessarily help in that case, because the modem/baseband firmware is completely isolated and runs independently of the OS. It seems like general camera/audio recording would need a secondary exploit. https://android.stackexchange.com/questions/219230/where-is-the-baseband-firmware-stored-and-how-does-android-interact-with-it https://android.stackexchange.com/questions/219230/where-is-...
• 5350-uiop-1130 3y ago
  i'm going to assume they've been doing this probably for many years (5-eyes at least). from the wikileaks, if they can do it, they will do it. and this bill is just a formality imo.
• littlestymaar 3y ago
  France has been slowly drifting away from the democratic countries for the past decade, it's disheartening to watch it in real time…
  • pessimizer 3y ago
    > the democratic countries Which are those, and how is France worse?
    • littlestymaar 3y ago
      Almost all EU, the UK, US, Australia, NZ, etc. Even though all of them are far from perfect, it's still significantly better than in most places elsewhere. France is currently following a path close to what Hungary did before, with a steady reduction in press freedom, political freedom, and individual freedom, coupled to a progressive erosion of the rule of law (a significant recent example came from the protests regarding the pension reforms: the government started banning most protests, but the ban was almost systematically lifted by courts. Then the government took a shady approach: the protests were banned, but the official text for the ban weren't published anymore as they should, so it could not be contested in front of courts, and people who still went to the protests got arrested for “attending to a banned protest”, and detained up to 48 hours (no justification needed, no recourse) before being released with no charge). For sure France isn't PRC, but there's a full spectrum between ideal democracies and totalitarian dystopia, and France is much closer to what's called “Illiberal democracies” than to the former.
• qwertyuiop_ 3y ago
  Never let a crisis go to waste.
• chillbill 3y ago
  And here ladies and gents we see the reason why the riots were allowed to stay as long and why they were so violent. Expect the riots to end in a couple of days.
• s1k3s 3y ago
  Doesn't the iPhone have a hardwired thing that displays the red dot when the camera is on? I guess they can say goodbye to all that "privacy first" marketing.
  • kemayo 3y ago
    It's hardwired on the laptops, but it must be controlled by software on the phones because the dot is within the screen area.
• cm2187 3y ago
  I am confused. Are they mandating a backdoor, or is there already a backdoor, or are they allowing the police to exploit zero days? If it is the latter, it is sad that the authorities assume weak security as a given.
  • deleted 3y ago
    [deleted]
  • freedomben 3y ago
    Governments regularly have a steady flow of zero days to use, but once it's used it's "burned" so it's not something they throw around willy nilly. I would guess they are going to force manufacturers to play ball, and I would gues that the manufacturers will.
    • tbrock 3y ago
      Or the manufacturers will just not sell their phones in France. Ultimately it’s the French citizens that will miss out.
      • voytec 3y ago
        My guess is that France will soon have followers in form of other EU states. Both left and right are contesting who can be more authoritarian these days.
        • orwin 3y ago
          The only left wing governments in the western world are Portugal and Spain. And PSOE is barely left-wing imho (I won't fall into the 'no true scottman' here, but I really wanted to).
      • whywhywhywhy 3y ago
        Manufacturers already throw their principles out of the window to sell in China, Russia and UAE so I don't think they'll have a problem selling in France after this either.
• FollowingTheDao 3y ago
  I have purchased Faraday bags just for this occasion!
  • timbit42 3y ago
    What if the phone records audio and then uploads it when you remove it from the bag?
• jayess 3y ago
  Time for phones to have a solid-state switch for microphones and cameras.
  • dredmorbius 3y ago
    De-solder internal mics, use a headset. This is already common practice among some communities.
• adamc 3y ago
  Just stop carrying your phone. Problem solved.
  • fsflover 3y ago
    What if I need to call emergency?
    • adamc 3y ago
      Then you are out of luck, of course. I didn't claim it would be without drawbacks. But it's basically your only good recourse.
      • fsflover 3y ago
        It's not: https://news.ycombinator.com/item?id=36618432 https://news.ycombinator.com/item?id=36618432.
• lloeki 3y ago
  Hmm, is it a new thing or last month's bill? Without any source nor reference in TFA it's hard to tell. https://www.lemonde.fr/societe/article/2023/06/08/l-activation-a-distance-pour-certaines-enquetes-des-micros-et-cameras-des-appareils-connectes-passe-le-cap-du-senat_6176655_3224.html https://www.lemonde.fr/societe/article/2023/06/08/l-activati...
• hackandthink 3y ago
  Civil rights are a favor that can be revoked at any time. Ultimately, there are too few who stand up for them. Today I read an article by Bernard-Henri Lévy, a liberal intellectual. He downplays police violence, order must be restored, how is not so important.
  • AnimalMuppet 3y ago
    That doesn't sound very liberal. ("Liberal" meaning "in favor of freedom for people".) It doesn't even sound very politically liberal, meaning "in favor of peoples' right to protest injustice" and "in favor of peoples' right to not be shot dead by police". Isn't "order" the concern of the conservatives? I've heard a number of times that politically left and right mean different things in Europe; is this one of those situations?
    • hackandthink 3y ago
      Wikipedia is not very helpful. Try this one: https://foreignpolicy.com/2021/04/09/bernard-henri-levy-bhl-france-philosophy-public-intellectual/ https://foreignpolicy.com/2021/04/09/bernard-henri-levy-bhl-... I liked Lévy's insistence on human rights but he became an ideological crusader. And though he is as bourgois as possible he advocated in his article for social reforms (but no talking about police reforms). (and by the way: his Sartre book is great)
    • deleted 3y ago
      [deleted]
    • mcpackieh 3y ago
      It's not so simple. Without order there can be no liberty, but absolute order isn't compatible with liberty either. Liberty exists in a balance which may easily be lost.
• mytailorisrich 3y ago
  > They noted that a judge must approve any use of the provision, while the total duration of the surveillance cannot exceed six months. So essentially this is like getting a warrant to install a bugging device. Just that nowadays everyone carries said bugging device in the form of a smartphone and this law allows a judge to authorise turning it on (assuming it is technically possible).
• Awelton 3y ago
  They could at least have the decency to just secretly do it and then pretend like they aren't, like our government does. This is why physical switches and removable batteries are the only way forward.
  • jb1991 3y ago
    what is "our" government? this site is worldwide..
    • Ycdr4thfdd 3y ago
      Y Combinator is an American company and the website is hosted in the US.
      • rekoil 3y ago
        Personally I think that "X is an American site" is over-used and doesn't actually make all that much sense when applied to things that cover general world-spanning issues. But that's my opinion.
        • skyyler 3y ago
          no one implied that, stop being silly
          • PawgerZ 3y ago
            > Y Combinator is an American company and the website is hosted in the US. What else would this imply?
            • rekoil 3y ago
              I wrote a stupid message first that the person above you replied to accurately, I changed my stupid message to be less stupid while still reflecting my opinion on the matter.
• hackan 3y ago
  This is exactly why we need GrapheneOS in airplane mode w/o SIM, and a secondary phone w/ cam and mic removed as wifi hotspot
  • nextos 3y ago
    And hardware switches.
    • hackan 3y ago
      well, it has sw switches at least, but yeah, i would love to :)
• m3kw9 3y ago
  Mostly what this means is police is allowed to use Pegasus type hacks
• throwaway1777 3y ago
  Is it time to flat out abandon smartphones?
  • AnimalMuppet 3y ago
    A dumb phone might not be much better. There wouldn't be a camera for them to get, but they might still be able to get the microphone.
    • ragnese 3y ago
      Maybe fewer avenues for them to activate the microphone, though.
    • dredmorbius 3y ago
      Many dumb phones have off switches (which actually work), or better: removable batteries. (You can simply break the circuit with a piece of paper between the battery terminal and phone contact for convenience.)
  • pessimizer 3y ago
    It has always been, because they were never open systems. I'm waiting for when it isn't socially unacceptable to ask people not to bring their phones when they visit.
• lost_tourist 3y ago
  The French have a long history of fighting for freedom, I'm surprised they'd roll over and let their government have a pocket recorder on them at all times 24/7.
• m3kw9 3y ago
  iOS lockdown mode finally gets a use case
• h2odragon 3y ago
  Give up yer phones. Will it become illegal to be phoneless person, or will it just make such people into an untouchable caste?
  • theonlybutlet 3y ago
    The latter, can barely use many banks these days without two factor authentication on a phone.
  • aembleton 3y ago
    You'll collect parking fines for not being able to pay using an app
• taoufix 3y ago
  Don't forget the call to block social media sites during riots by the Frnace's president [1] [0]: https://www.france24.com/en/europe/20230705-macron-s-call-to-cut-off-social-media-during-riots-sparks-backlash https://www.france24.com/en/europe/20230705-macron-s-call-to...
  • mcpackieh 3y ago
    Same guy who likens himself to the Roman god Jupiter. Macron is an aspiring autocrat.
    • achenet 3y ago
      > aspiring he thinks he's smarter than everyone, and he therefore feels justified ramming his policies down everyone's throats.
  • taoufix 3y ago
    Submitted this story [1] earlier but didn't get traction. [1]: https://news.ycombinator.com/item?id=36615378 https://news.ycombinator.com/item?id=36615378
• cheekibreeki2 3y ago
  Lol that's cute that they asked.
• dangerboysteve 3y ago
  Time for the hardware makers to start adding physical on/off switches for the microphone and cameras.
  • fsflover 3y ago
    Here you go: https://puri.sm/products/librem-5 https://puri.sm/products/librem-5 and https://pine64.org/pinephone https://pine64.org/pinephone.
• donatj 3y ago
  United States, couple years ago my friend in his mid-thirties was feeling depressed after his mom died. Came over to hang out, and wasn’t responding to his sisters calls. His sister called in a welfare check on him and suddenly I have three cops knocking at my front door. They ask for him by name, say he isn’t in trouble. I go get him; he asks “how did you know where I was?” and the cops say “we pinged your phone”. What that entails exactly I have no clue. Later I pulled up the video of them arriving on my cameras, they didn’t approach any of my neighbors houses first. It was just right to my front door like they knew exactly where he was. Kinda spooky.
  • paxys 3y ago
    Despite all the technology in the world the majority of police work is still plain old-fashioned knocking on doors and making phone calls. People will always voluntarily give up all the information in the world to be seen as good citizens. In your friend's case I'm willing to bet that they asked the sister for the names of his close friends and acquaintances and yours matched up.
    • neoromantique 3y ago
      or they just triangulated using his cell phone, it can be very accurate in urban settings
      • internetter 3y ago
        Seems like much more work. Based on the stories I've seen about these operations to track down phones over the years, it's a little more complicated
      • paxys 3y ago
        Police need a warrant to get location data from your cell phone provider. No department is bothering with that for a welfare check unless the situation is really dire, and the process still takes a while to carry out. "Where do you think your brother is?" "Oh probably at XYZ's place" is a much more straightforward and common process.
• faramarz 3y ago
  Well... industry taps into all your mic, gps and image library to send you personalized ads, and no one has really called it out, except be surprised when the ad shows up a minute after mentioning a product.. this to me sounds like tapping into the existing frameworks. likely the app providers giving access if not the phone manufacturer themselves.
  • pessimizer 3y ago
    Exactly. These things are literally designed to be spying devices with little or no user access. That was the goal.
• ShamelessGenius 3y ago
  Privacy and anonymity is an illusion...
• olivierduval 3y ago
  Actually it's not really a big news: * right now: Law Enforcement need the decision of a judge to do this (when they technically can, either using 0-day or maybe asking for the phone provider to upload a malicious app under their service app) * after the law: Law Enforcement will be able to do THE SAME without the need for a judge under some specific (but not really restrictive, like national security) conditions So, all in all, it will just shorten the time needed by Law Enforcement to hack some suspected citizen and it won't require a judge. Is it a shame for the democracy ? Yes, obviously. Is it a change in the way for the State to spy its people ? No, sadly. Will there be a debate about what individual freedom may be taken of citizen in the name of national/public security ? No, obviously. And sadly.
  • ElKrist 3y ago
    Right now: they don't have such right. After the law: they do have the right and it requires a judge's approval renewed every 15 days. I'm not talking about what the capacity of intelligence services to do it, I'm talking about what the police (officier de police judiciaire) can lawfully do. Source: https://www.francetvinfo.fr/societe/justice/telephones-mouchards-teleconsultations-en-garde-a-vue-perquisitions-de-nuit-on-vous-explique-pourquoi-le-projet-de-loi-sur-la-justice-est-critique_5933882.html https://www.francetvinfo.fr/societe/justice/telephones-mouch...
• throwcrptt 3y ago
  [flagged]
• LovinFossilFuel 3y ago
  ...alll the while personal mobile devices get more and more mandated by all the tech BS. Try to perform basic tasks like doing a wire transfer / SEPA transaction without in ~5 years.
• brianstorms 3y ago
  I figure the day's coming when cops will be able to remotely activate the inside camera and microphone in a Tesla, or remotely disable the car and/or have it pull over, etc. Perhaps first in China, but probably everywhere eventually.
• tempodox 3y ago
  What could possibly go wrong.
• alienicecream 3y ago
  Oops, they invited all the foreigners in and they're rebelling, now they have to spy on us to control them. Well played.
  • InCityDreams 3y ago
    Tech-nazi.
    • alienicecream 3y ago
      Sorry, I was just noticing things.
• atlantic 3y ago
  I keep my phone stored in a pouch, so the mic is muffled and the camera blocked, when not in use. If I want to go somewhere without being tracked, I leave it at home. I've done this for years. I always act on the assumption that I'm under surveillance.
• villgax 3y ago
  Time to make custom phone OSes on Pi or Arduinos now
• Iwan-Zotow 3y ago
  Putin did it!
• HashThis 3y ago
  Why does Apple (iPhone) and Google (Android OS) give software access for governments to do this? One needs to disallow this. And then we need to buy that phone over the other. Transparency, competition and the power of customers must drive this.
• bella001 3y ago
  [dead]
• deleted 3y ago
  [deleted]
• morninglight 3y ago
  Ce qui est bon pour l'oie est bon pour le jars.
  • dredmorbius 3y ago
    Trans: "What's good for the goose is good for the gander."
• Garvi 3y ago
  5 min after implementation the first corrupt cop is going to sell the software that handles the backdoor access to shady characters(criminal elements, foreign actors) for use or reverse engineering.
• LatteLazy 3y ago
  The level of government surveillance, in the EU, UK, US and elsewhere is already so massively OTT, that we have all the downsides around self-censorship, parallel construction, subversion of democracy etc. So why not actually use the possible up sides of these dangerous immoral systems?
• entriesfull 3y ago
  Can people stop pretending already that these governments actually go through legal systems to backdoor and spy on people?? These patriot act type laws are just there to normalize their spying crimes in your eyes. Also to make people self censor themselves from criticizing their government. No they don't prevent any sort of attacks because the attackers wouldn't be stupid enough to talk over their personal phones. Let that sink in. They take away your privacy while not preventing any big attacks.
• rvz 3y ago
  Like I said, you got what you voted for.
• notfed 3y ago
  > Justice Minister Eric Dupond-Moretti insisted the bill would affect only “dozens of cases a year.” Famous last words.
• Slava_Propanei 3y ago
  [dead]
• t0bia_s 3y ago
  Why are we still adopting small steps that makes our authorities like those in China?
• garfieldnate 3y ago
  So how does this work technically? Does the bill require, for example, Apple to build the capability to remotely activate the microphone and camera on their laptops? Or does it just say that the government can use their magic spy tech to do this when they want to?