25 ms·

My entry point into this whole fiasco was finding a bug that let anyone track anybody with just a cellphone number: https://arstechnica.com/information-technolo

My entry point into this whole fiasco was finding a bug that let anyone track anybody with just a cellphone number: https://arstechnica.com/information-technology/2018/05/service-leaked-locations-of-us-cell-phones-for-free-no-password-required/ https://arstechnica.com/information-technology/2018/05/servi... In this case, the site was selling real-time location data from cell carriers, meaning that there was virtually nothing that an individual could use to protect themselves (short of using a burner or no phone at all). It’s great to see some strong action is being taken here against the sale of location data, and I hope the bans can be extended more broadly (and to Canada, please!)

deleted 3y ago
[deleted]
uggabuggalives 3y ago
> (short of using a burner or no phone at all). Not carrying a phone won't help you. Pulling the SIM won't help you. Look around you. See all those cameras? Not just the ones above your head in the supermarket that advertise HERE I AM, I'M A CAMERA, but every camera on every phone in the hands of every person you see can identify you and identify your exact location to the meter instantly based on your face and x other biometrics. Everytime you speak, your voice pattern identifies you instantly. Burner phones are a thing of the distant past. The moment you speak, the moment the camera "sees" you, your burner phone's IMEI is/can be mapped to your identity in double time. The methods in use today are just way more sophisticated than the tech you've read about. A drone at 20,000 feet can identify you in a crowd of 2,000 people based on the sound of your heart, your respiration, the shape of your head, your ears, your nose, your face, your facial profile, the shadow your body casts at x time of day, and/or the uniqueness of your gate. Combine them altogether with a scant amount of stat analysis and you can't hide even with effort. Think darkness will hide you? Nope.
- bradgessler 3y ago
  This is why I think technical solutions alone to privacy are mostly pointless. There’s 7 billion people in the world—at some point (if we haven’t already reached it) monitoring all of us in real-time will be trivial. Even people who live “off the grid” in a cabin in the woods will be trackable. What’s needed is an agreement between all of us, in the form of privacy laws, that make certain uses of this data illegal. In the future if you’re caught committing a crime by data captured in a manner illegal under these laws, it would have to be thrown out and can’t be used against you. Corps would also be banned from collecting, storing, and using personal data in an unlawful manner. Feels like a pipe dream since there’s so much money in the industrial advertising complex, but I’m pretty sure that’s what it will take achieve reasonable levels of privacy.
  - deleted 3y ago
    [deleted]
  - deleted 3y ago
    [deleted]
  - uggabuggalives 3y ago
    [flagged]
  - bilalq 3y ago
    Agreed that this is not a problem that can be solved via a technical solution. However, I don't think a political solution is possible either. Even in the US, police can literally get away with murder today. Why would they have any difficulty getting away with privacy violations? Big Brother is inevitable. All you can do at this point is teach children and future generations to live with the understanding that they are being monitored at all times. This isn't me trying to be edgy or cynical. The genie's out of the bottle at this point and it's just reality.
    - xapata 3y ago
      The way to fight back is ubiquitous public monitoring of the state. We should understand that the state is always watching, but the state should also be aware that all its actions will be public knowledge. Note the increased awareness brought by widely available cameras with immediate upload capability. The commenter above implied this is dystopian, but the opposite seems to have occurred -- as the public gains the capability to surveil the state, it constrains the state.
      - handity 3y ago
        WikiLeaks tried that, Assange is still in Belmarsh and the MSM is still largely allowing him to rot there.
        ncphil 3y ago
        This is a good point. Of course anyone who thought the MSM, or print journalism, were in business to reveal the actual truth really needs to review their history. The worst part is that Julian (whether intentionally or not) probably made that sacrifice for nothing. At least here in the US most people don't know or care. That's a shame. And an embarrassment.
- LakeBoat 3y ago
  Gonna need a source on this. The US has trouble solving simple murders when people are present, let alone some sci-fi stuff you’re talking about.
  - doublerabbit 3y ago
    Maybe in the Metro parts of the USA, but China is next level scary: https://www.youtube.com/watch?v=Oo_FM3mjBCY https://www.youtube.com/watch?v=Oo_FM3mjBCY It's all possible.
    - jbm 3y ago
      The more disorder we see, the more people are going to reach for these extremist solutions. It's all scary - until one is the victim of a crime and the police don't think it's worth following up, or the presiding judge decides your time and suffering is less important than the future prospects of the criminal.
      - trompetenaccoun 3y ago
        It sounds logical but at least in the case of China there was no disorder to begin with, it's always been relatively safe in terms of violent crime. In China, the violent criminals are the government and the police. You can become a torture victim for as much as splashing ink on a Xi poster or just being Uyghur and existing. The cameras are not there to protect you from crime, they're there for control, to protect the CCP from the people. I'm not principally against surveillance for public security but it's very hard to not have it abused - for a start you need authorities and a police force that have good intentions and work for the people, not against them. In most countries that's not a given.
        5m17h 3y ago
        is American, watch everyone in the world to WWW3
  - AnthonyMouse 3y ago
- wnevets 3y ago
  aren't you describing a plot point of The Dark Knight
- ThePowerOfFuet 3y ago
  Your tinfoil hat is on far too tight.
1vuio0pswjnm7 3y ago
"Krebs went on to cite an official at the Electronic Frontier Foundation who said cellular carriers by law are required to know the approximate location of customers in the event it's needed by emergency 911 services. Whether the carriers are permitted to sell or otherwise provide the information to other third parties is less clear. Expect there to be much more scrutiny about this in the coming weeks and months." To see this in practice, check out MVNOs offering prepaid mobile service. Some will disable certain features unless this physical E911 address is submitted by the customer. What if there were a limitation on how that data can be used.
- Terr_ 3y ago
  > Krebs went on to cite an official at the Electronic Frontier Foundation who said cellular carriers by law are required to know the approximate location of customers in the event it's needed by emergency 911 services. IANAL but the RAY BAUM’S act (yes, it's all caps because it's a silly initialism) only applies to location data that goes "with" a particular 911 call. Not your location before the call, nor your location after the call. So if your cell-carrier is recording your location at all moments and persisting it indefinitely, or sharing anything beyond the data generated for that particular 911 call, no law is forcing them to do that, they are choosing to disrespect your privacy for their own profits or laziness.
- sacnoradhq 3y ago
  E911 came about to address lost and immobilized callers. Unfortunately, it's inconsistently deployed and not universally usable. This is likely the result of a lack of a sufficiently-staffed regulatory body auditing for compliance and correctness because it doesn't work everywhere with all phones on all carriers even when there is the technical ability, e.g., phone has a fix. It hasn't delivered completely on its promise because it's an under-funded, under-audited mandate that needs serious carrots and sticks to ensure it's reliable.
  - smcin 3y ago
    No, "finding lost and immobilized callers" was the cover-story nominally used when E911 legislation was pushed hard in Congress in 1999/2000 (by the wireless industry, not directly by law enforcement). Do we really believe that Congress authored a law to improve "safety" but that had enormous negative privacy implications, while accidentally forgetting to even speak to the other 99.999+% of the time that the average person's location data is not involved with an emergency? Why were the legislation (and debate) conspicuously silent on limiting (let alone criminalizing) use and retention of location data, let alone resale (e.g. to data brokers or private parties?) Let's not pretend this exact outcome wasn't predicted and raised in strenuous objections by consumer advocates back in 1999; the following reads like a to-do list from lobbyists (why e.g. did the industry push for immunity for non-911 calls?) > 10/4/1999 WIRELESS 911 BILL HITS LIABILITY, PRIVACY OBSTACLES > Failure to pass the 911 bill-the centerpiece of the wireless industry’s lobbying campaign in 1999-would be a serious setback for carriers and 911 vendors that want immunity from lawsuits before rolling out... caller identification and position location. > Holding the bill over until 2000 could prove highly problematic for industry, given it is an election year. Moreover, a delay would buy time for consumer groups and others that are beginning to surface and speak out on wireless liability issues pending before Congress, the Federal Communications Commission and state courts. > In addition to liability protection for 911 and non-911 wireless calls... > Such broad liability immunity for wireless carriers has caused an uproar from consumer advocates who claim 911 legislation is part a master plan by industry to secure shielding from virtually all lawsuits. > In some state courts, consumers have brought litigation against wireless firms for being charged for rounded up and dropped calls, fraudulent advertising and other carrier practices. [boo hoo hoo] https://www.rcrwireless.com/19991004/archived-articles/wireless-911-bill-hits-liability-privacy-obstacles https://www.rcrwireless.com/19991004/archived-articles/wirel...
rkagerer 3y ago
Great job on exposing this. Do you think Canadian carriers are providing access to this type of information to third parties? Are there any you would expect are not, eg. who have a track record of ethical behaviour and consumer advocacy (eg. like tbe TekSavvy of carriers)?
- nneonneo 3y ago
  They definitely were at the time I found the bug, since I could track some Canadian numbers. However, I don’t know if that’s still the case.

deleted 3y ago

[deleted]

uggabuggalives 3y ago

> (short of using a burner or no phone at all). Not carrying a phone won't help you. Pulling the SIM won't help you. Look around you. See all those cameras? Not just the ones above your head in the supermarket that advertise HERE I AM, I'M A CAMERA, but every camera on every phone in the hands of every person you see can identify you and identify your exact location to the meter instantly based on your face and x other biometrics. Everytime you speak, your voice pattern identifies you instantly. Burner phones are a thing of the distant past. The moment you speak, the moment the camera "sees" you, your burner phone's IMEI is/can be mapped to your identity in double time. The methods in use today are just way more sophisticated than the tech you've read about. A drone at 20,000 feet can identify you in a crowd of 2,000 people based on the sound of your heart, your respiration, the shape of your head, your ears, your nose, your face, your facial profile, the shadow your body casts at x time of day, and/or the uniqueness of your gate. Combine them altogether with a scant amount of stat analysis and you can't hide even with effort. Think darkness will hide you? Nope.

bradgessler 3y ago
This is why I think technical solutions alone to privacy are mostly pointless. There’s 7 billion people in the world—at some point (if we haven’t already reached it) monitoring all of us in real-time will be trivial. Even people who live “off the grid” in a cabin in the woods will be trackable. What’s needed is an agreement between all of us, in the form of privacy laws, that make certain uses of this data illegal. In the future if you’re caught committing a crime by data captured in a manner illegal under these laws, it would have to be thrown out and can’t be used against you. Corps would also be banned from collecting, storing, and using personal data in an unlawful manner. Feels like a pipe dream since there’s so much money in the industrial advertising complex, but I’m pretty sure that’s what it will take achieve reasonable levels of privacy.
- deleted 3y ago
  [deleted]
- deleted 3y ago
  [deleted]
- uggabuggalives 3y ago
  [flagged]
- bilalq 3y ago
  Agreed that this is not a problem that can be solved via a technical solution. However, I don't think a political solution is possible either. Even in the US, police can literally get away with murder today. Why would they have any difficulty getting away with privacy violations? Big Brother is inevitable. All you can do at this point is teach children and future generations to live with the understanding that they are being monitored at all times. This isn't me trying to be edgy or cynical. The genie's out of the bottle at this point and it's just reality.
  - xapata 3y ago
    The way to fight back is ubiquitous public monitoring of the state. We should understand that the state is always watching, but the state should also be aware that all its actions will be public knowledge. Note the increased awareness brought by widely available cameras with immediate upload capability. The commenter above implied this is dystopian, but the opposite seems to have occurred -- as the public gains the capability to surveil the state, it constrains the state.
    - handity 3y ago
      WikiLeaks tried that, Assange is still in Belmarsh and the MSM is still largely allowing him to rot there.
      - ncphil 3y ago
        This is a good point. Of course anyone who thought the MSM, or print journalism, were in business to reveal the actual truth really needs to review their history. The worst part is that Julian (whether intentionally or not) probably made that sacrifice for nothing. At least here in the US most people don't know or care. That's a shame. And an embarrassment.
LakeBoat 3y ago
Gonna need a source on this. The US has trouble solving simple murders when people are present, let alone some sci-fi stuff you’re talking about.
- doublerabbit 3y ago
  Maybe in the Metro parts of the USA, but China is next level scary: https://www.youtube.com/watch?v=Oo_FM3mjBCY https://www.youtube.com/watch?v=Oo_FM3mjBCY It's all possible.
  - jbm 3y ago
    The more disorder we see, the more people are going to reach for these extremist solutions. It's all scary - until one is the victim of a crime and the police don't think it's worth following up, or the presiding judge decides your time and suffering is less important than the future prospects of the criminal.
    - trompetenaccoun 3y ago
      It sounds logical but at least in the case of China there was no disorder to begin with, it's always been relatively safe in terms of violent crime. In China, the violent criminals are the government and the police. You can become a torture victim for as much as splashing ink on a Xi poster or just being Uyghur and existing. The cameras are not there to protect you from crime, they're there for control, to protect the CCP from the people. I'm not principally against surveillance for public security but it's very hard to not have it abused - for a start you need authorities and a police force that have good intentions and work for the people, not against them. In most countries that's not a given.
      - 5m17h 3y ago
        is American, watch everyone in the world to WWW3
- AnthonyMouse 3y ago
wnevets 3y ago
aren't you describing a plot point of The Dark Knight
ThePowerOfFuet 3y ago
Your tinfoil hat is on far too tight.

1vuio0pswjnm7 3y ago

"Krebs went on to cite an official at the Electronic Frontier Foundation who said cellular carriers by law are required to know the approximate location of customers in the event it's needed by emergency 911 services. Whether the carriers are permitted to sell or otherwise provide the information to other third parties is less clear. Expect there to be much more scrutiny about this in the coming weeks and months." To see this in practice, check out MVNOs offering prepaid mobile service. Some will disable certain features unless this physical E911 address is submitted by the customer. What if there were a limitation on how that data can be used.

Terr_ 3y ago
> Krebs went on to cite an official at the Electronic Frontier Foundation who said cellular carriers by law are required to know the approximate location of customers in the event it's needed by emergency 911 services. IANAL but the RAY BAUM’S act (yes, it's all caps because it's a silly initialism) only applies to location data that goes "with" a particular 911 call. Not your location before the call, nor your location after the call. So if your cell-carrier is recording your location at all moments and persisting it indefinitely, or sharing anything beyond the data generated for that particular 911 call, no law is forcing them to do that, they are choosing to disrespect your privacy for their own profits or laziness.
sacnoradhq 3y ago
E911 came about to address lost and immobilized callers. Unfortunately, it's inconsistently deployed and not universally usable. This is likely the result of a lack of a sufficiently-staffed regulatory body auditing for compliance and correctness because it doesn't work everywhere with all phones on all carriers even when there is the technical ability, e.g., phone has a fix. It hasn't delivered completely on its promise because it's an under-funded, under-audited mandate that needs serious carrots and sticks to ensure it's reliable.
- smcin 3y ago
  No, "finding lost and immobilized callers" was the cover-story nominally used when E911 legislation was pushed hard in Congress in 1999/2000 (by the wireless industry, not directly by law enforcement). Do we really believe that Congress authored a law to improve "safety" but that had enormous negative privacy implications, while accidentally forgetting to even speak to the other 99.999+% of the time that the average person's location data is not involved with an emergency? Why were the legislation (and debate) conspicuously silent on limiting (let alone criminalizing) use and retention of location data, let alone resale (e.g. to data brokers or private parties?) Let's not pretend this exact outcome wasn't predicted and raised in strenuous objections by consumer advocates back in 1999; the following reads like a to-do list from lobbyists (why e.g. did the industry push for immunity for non-911 calls?) > 10/4/1999 WIRELESS 911 BILL HITS LIABILITY, PRIVACY OBSTACLES > Failure to pass the 911 bill-the centerpiece of the wireless industry’s lobbying campaign in 1999-would be a serious setback for carriers and 911 vendors that want immunity from lawsuits before rolling out... caller identification and position location. > Holding the bill over until 2000 could prove highly problematic for industry, given it is an election year. Moreover, a delay would buy time for consumer groups and others that are beginning to surface and speak out on wireless liability issues pending before Congress, the Federal Communications Commission and state courts. > In addition to liability protection for 911 and non-911 wireless calls... > Such broad liability immunity for wireless carriers has caused an uproar from consumer advocates who claim 911 legislation is part a master plan by industry to secure shielding from virtually all lawsuits. > In some state courts, consumers have brought litigation against wireless firms for being charged for rounded up and dropped calls, fraudulent advertising and other carrier practices. [boo hoo hoo] https://www.rcrwireless.com/19991004/archived-articles/wireless-911-bill-hits-liability-privacy-obstacles https://www.rcrwireless.com/19991004/archived-articles/wirel...

rkagerer 3y ago

Great job on exposing this. Do you think Canadian carriers are providing access to this type of information to third parties? Are there any you would expect are not, eg. who have a track record of ethical behaviour and consumer advocacy (eg. like tbe TekSavvy of carriers)?

nneonneo 3y ago
They definitely were at the time I found the bug, since I could track some Canadian numbers. However, I don’t know if that’s still the case.