9 ms·

British man appears in court over bomb joke sent in private message

95 points by tommoor 3y ago

LordShredda 3y ago
This is quite dumb, if he was actually going to do it he wouldn't announce it so clearly on a non-encrypted channel. Does the UK really think state supported agents talk on snapchat?
- spuz 3y ago
  As far as I know, Snapchat messages are encrypted. Just not end-to-end.
- ptaipale 3y ago
  Actual terrorists are, in fact, sometimes quite dumb and naive.
vdaea 3y ago
It doesn't explain how the authorities got ahold of that message, since it was sent in private allegedly. Also the entire process is happening in Spain and he has British citizenship - can't he just ignore the courts?
- smeej 3y ago
  It was sent over the airport's WiFi. Snapchat doesn't even claim their messages are encrypted end-to-end or anything, do they?
  - vdaea 3y ago
    Even then I'm sure they are sent over TLS.
    - llacb47 3y ago
      Probably a root certificate that you need to install to browse on the airport wifi.
      - klmr 3y ago
        I’m not saying this doesn’t happen but I can’t remember ever having been asked to install a root certificate when joining an airport wifi. And I am confident that this has never happened when I’ve flown out from Gatwick.
        llacb47 3y ago
        Perhaps the GCHQ have a backdoor in snapchat then, which is comforting
      - aaix 3y ago
        snapchat uses certificate pinning so i dont think this would work anyways
    - troupe 3y ago
      Right, so either the airport is running something that can break TLS, or snapchat is feeding a stream of private messages to the government with location information provided.
      - RajT88 3y ago
        Almost certainly the second.
- bemusedthrow75 3y ago
  Why would you think he can ignore the courts? Britain and Spain have an extradition treaty.
- deleted 3y ago
  [deleted]
avg_dev 3y ago
i don't understand. i thought TLS or some other form of end-to-end encryption would prevent this sort of thing from happening. it seems like someone has access to the plaintext message other than the participants of the conversation. how does this happen? (i am not a snapchat user) not even to begin talking about the political ramifications...
- __m 3y ago
  Snapchat texts are not end to end encrypted. I think we know exactly how that happens since Snowden. There won’t be political ramifications. Though this might be more tangible to the average users that don’t care about privacy.
  - spuz 3y ago
    But is there any claim that Snapchat automatically filters messages and alerts the UK security services?
    - lukeschlather 3y ago
      Snapchat messages being surreptitiously downloaded and monitored by the NSA at some point where they are unencrypted (possibly only within Snapchat's datacenters) is consistent with what was revealed in Prism. I know that most companies have updated their standards to treat any network traffic as insecure since Prism but it's possible Snapchat doesn't. Also as I understand it the NSA also has no legal issues with sharing any messages intercepted with the UK so long as one of the parties to the conversation is not a US national or on US soil.
- gtvwill 3y ago
  Errr phones aren't safe. They are backdoored up the wazoo. Same with all your messaging companies. Any that are decent in size have had a visit from authorities and aren't allowed to disclose to you they have. Iphones, android it doesn't matter. Your phones about the least safe tech device you own. It literally hacks itself if sent the right messages. Edit: OK so it seems a fair few folks don't understand how spying across borders and things like the 5 eyes mean your tracked without a warrant legally. So here's how it works. All 5 eyes countries are not allowed to spy on their own citizens in their countries without a warrant. All 5 eyes countries are allowed to surveil info about foreign individuals without a warrant. 5 eyes intel agencies basically just have to pipe a copy of local data say fb or in this case snapchat out via a friend in a another country then back to themselves and they don't need a warrant. As the data has now come from Intel sharing from your 5 eyes peers. The 5 eyes intel agencies between them all have deals and flex with just about every other intel agency in the world except the obvious few. Intel sharing these days is as much as a treasure hunt for legal loopholes to get the data as it is hunting the data itself.
tommoor 3y ago
I feel like they are being vague on how the message was sourced purposefully. It's a shame it's a kid that doesn't have the resources to fight this, the UK public has already been conditioned to expect that all their messages are being tracked and read it seems.
- hanniabu 3y ago
  > I feel like they are being vague on how the message was sourced purposefully. Why does it matter? If he's innocent he shouldn't have anything to hide! /s
  - g-b-r 3y ago
    Yeah but if you send a message like that before boarding a plane you should know what you can get... (not a prosecution though maybe, if it wasn't members of the group who thought it could be true)
- tivert 3y ago
  > I feel like they are being vague on how the message was sourced purposefully. I'm reminded that, years ago, an unsecured MongoDB instance was discovered on the internet, and it turned out be part of a feed of private social network activity to the Chinese police/government agencies. I wonder if the UK government has a similar feed of Snapchat messages. I'm also reminded of a video (apparently originally posted to Chinese social media by the police), of some schmuck locked in a tiger chair at a police station being forced to apologize for talking smack about the police in a private WeChat group (it was nothing political, the police were apparently confiscating motorcycles or something at the time and he didn't like it).
- dharmab 3y ago
  The simplest explanation is someone in the Snapchat group tipped the police and provided screenshots.
  - troupe 3y ago
    Simple, but it seems unlikely, and it is also the scenario that the government would be mostly likely to be up front about sharing.
whatshisface 3y ago
It sounds like he's being held liable for sending a private message that scared the people spying on him into arresting him unnecessarily. It never occurred to me that end to end encryption would eventually have the use case of preventing security services from scaring themselves and then blaming you for a false alarm...
- colpabar 3y ago
  Or, encryption will be a red flag that gives those services cause to go after someone without even knowing the content of the message.
  - whatshisface 3y ago
    Going by what happened, it's the other way.
- pengaru 3y ago
  > It never occurred to me that end to end encryption would eventually have the use case of preventing security services from scaring themselves and then blaming you for a false alarm... It never occurred to you that incompetence/stupidity is rampant? Allow me to introduce you to Mr. Hanlon: https://en.wikipedia.org/wiki/Hanlon%27s_razor https://en.wikipedia.org/wiki/Hanlon%27s_razor and his close friend, Peter: https://en.wikipedia.org/wiki/Peter_principle https://en.wikipedia.org/wiki/Peter_principle
  - deleted 3y ago
    [deleted]
- g-b-r 3y ago
  With him already on a plane you would have taken chances?
curtis3389 3y ago
Accused of public disorder because the government read his private message. Seems legit.
simmerup 3y ago
Wonder how many of the people here complaining about text messages actually read the article and know it was a snapchat. He probably got dobbed in by someone for such a shit joke
- spuz 3y ago
  A private Snapchat. If someone dobbed him in it would have to have been one of his friends which assuming those friends know him well would be an even crazier thing to do than to make the joke.
  - ithkuil 3y ago
    Them being a group of friends doesn't rule out the possibilities. I've seen stupid pranks being played between friends; sometimes people are curious to see if the consequences are real
gridspy 3y ago
Seems like charging people for what they write or say in a private setting is like ThoughtCrime. Monitoring all communications for keywords and reacting is going to throw up a lot of false positives, that is in the nature of casting a wide net. Persecuting the victims of this snooping (the defendant in this case) seems a bit harsh.
neom 3y ago
I guess Snapchat isn't E2EE. There are various articles online that say it is, but if you view their privacy stuff, the have nothing about it and in this video they say they share your private messages with law enforcement when required: https://www.youtube.com/watch?v=0lj4xjCaCXU https://www.youtube.com/watch?v=0lj4xjCaCXU Interesting that the British government is packet sniffing at airports. Imo they should pay the $90k to the Spanish government.
- deleted 3y ago
  [deleted]
- RajT88 3y ago
  Everything talks over TLS these days. They aren't packet sniffing in airports, they probably have a closet of servers in the Snapchat datacenter.
unsupp0rted 3y ago
> A court in Madrid heard it was assumed the message triggered alarm bells after being picked up via Gatwick's Wi-Fi network. Sent a message to the friend he's traveling with openly over the airport's public wifi = public nuisance?
Dig1t 3y ago
>Mr Verma's message was picked up by the UK security services who flagged it to Spanish authorities while the easyJet plane was still in the air. It sounds like the UK government is spying on citizens’ private messages to each other. The article says it was sent only to people he was traveling with on the day of his flight. This strikes me as extremely authoritarian and scary. Europeans: why are there not mass protests about this? Is this the kind of world that you actually want to live in? Is it just apathy? Or is this seen as a good thing?
- timmb 3y ago
  Not the constitutional protection like in the US. It just creeps in bit by bit.
- klmr 3y ago
  > why are there not mass protests about this? Because we hadn’t heard about this case before. — At all. If the vague information in this article is actually corroborated there’ll be an outcry alright.
  - neom 3y ago
    I learned about it 2 years ago: https://www.dailymail.co.uk/news/article-11002673/Chess-playing-economics-genius-arrested-EasyJet-bomb-hoax-says-sorry-moment-madness.html https://www.dailymail.co.uk/news/article-11002673/Chess-play... "The message was picked up by their mobiles on Gatwick airport's Wi-Fi servers and immediately triggered alarm bells with security because of the sensitive words used." I thought that was weird then and I still think it's weird now, either there is a pretty big problem or the daily mail is inaccurate. This whole article is lala land from a tech perspective and I'm quite curious about it.
    - ghaff 3y ago
      From that article it seems like it's the kid who assumed it was the WiFi that caused the leak. 'But I was using the data on my phone and they were using the Wi-Fi at Gatwick and so the message was picked up by the security people.' As far as I know, it doesn't seem like anyone in the UK has said where they got the info from. And the Daily Mail may just be assuming the kid's right and is jumping to a conclusion.
timmb 3y ago
I’m guessing this wouldn’t have had the same response if the guy was white. Feels like the guy should be due compensation by the Spanish government. Is there really a law that prohibits private jokes that may alarm an unknown surveillance system?
legitster 3y ago
> He said that the plane's pilot made an announcement, telling passengers that the fighter jets had been scrambled because of a distress signal that had been sent by mistake. > Mr Verma's message was picked up by the UK security services who flagged it to Spanish authorities while the easyJet plane was still in the air. > A court in Madrid heard it was assumed the message triggered alarm bells after being picked up via Gatwick's Wi-Fi network. Emphasis mine. Something is really fishy here. We know that a fighter escort was dispatched for this flight, but it sounds like no one is on record that his message is what actually triggered the escort or how they would have even found it. There's a non-zero chance that the Spanish authorities themselves do not know where the distress signal came from, and only found out about the message after they searched his phone. And they are trying to pin the cost of scrambling the jets on him when they really should be ringing up the UK government.
- mortenjorck 3y ago
  Most likely scenario I can imagine: While everything was TLS encrypted between all conversation participants and the Snapchat server (airport Wi-Fi is a non-sequitur here), Snapchat has some kind of PRISM-style setup that at least starts with a global keyword scanner for natsec-related triggers. That alone seems unlikely to have resulted in fighter jets scrambling. More likely, that keyword system feeds into a much more complex Palantir deployment or something that's cross-referencing a bunch of other factors and assigning a risk score. In this case, it was enough to get flagged for immediate review, someone thought the contextual elements were enough to escalate, and this set off a chain of actions leading to the fighter jets. There are likely thousands of terrorism jokes made over back-doored messaging systems every day, but sending one of those messages buys you a lottery ticket you certainly don’t want to win.
  - whatshisface 3y ago
    You seem to know a lot about security for someone with no interest in evading it. Good luck with your lottery ticket...
  - dogma1138 3y ago
    Snapchat does not encrypt text messages only photos and video. Also the question of how many of those joke messages are being sent from an airport and have account meta data that can be tied to travel information (name, email, phone number). I wager far fewer that it may not make it into as much of a game of chance as you think.
wonderwonder 3y ago
Reminds me of this: https://news.met.police.uk/news/former-met-officers-sentenced-for-sending-offensive-whatsapp-messages-476538#:~:text=Six%20former%20Metropolitan%20Police%20officers,the%20Met's%20professional%20standards%20team https://news.met.police.uk/news/former-met-officers-sentence.... Europe is determined to control your thoughts and punish you for wrong think
lelag 3y ago
It's a really interesting story. The message was sent privately. After reading about Snapchat security at https://courses.csail.mit.edu/6.857/2016/files/11.pdf https://courses.csail.mit.edu/6.857/2016/files/11.pdf, it's clear that even in the absence of E2E encryption, all message are sent to the Snapchat API using TLS and even if using a public airport Wifi, this message should not have been easy to intercept. This leaves only a few options about what is happening here: Option 1: Big Intel has totally broken TLS and can see all TLS traffic in the clear in real-time Likelihood: very unlikely, I don't think this would stay secret for long. Option 2: Big Intel got itself a certificate for the Snapchat domains and use it to MITM Snapchat traffic. Likelihood: very possible but unlikely to be the source as I don't think they would use it too openly on random users as it's too easy to get noticed if used widely. Option 3: Snapchat is actually monitoring all messages and reported the message to authorities themselves. Alternatively, Big Intel is in bed with Snapchat and all message get processed by an intelligence system. Likelihood: I think this is the only explanation that makes sense. Since it would not be very good PR for Snapchat to admit that they are monitoring all messages, the authorities must have invented that airport wifi monitoring story. Who even use an airport wifi in their home country anyway... Pretty sure he had 4G and no need to use the crappy airport wifi. Anyway, that's the only way I can make sense of that story.
- deleted 3y ago
  [deleted]
- squarefoot 3y ago
  Option 4: there is zero privacy and security on devices, as many vital parts of their OS are closed source, from firmware to apps through the OS. It takes only one rogue closed program with the right permissions to render insecure a 99.9% open phone and read data before it is being encrypted or after it is decrypted, then send it somewhere.
  - solarkraft 3y ago
    Likelihood: Certainly possible (and out in the wild, see Triangulation and Pegasus), but it seems brazen to waste 0-days and PR issues on the low chance someone might text a bomb threat.
jareklupinski 3y ago
assuming TLS isn't broken and E2E is working as intended... isn't it more likely that someone saw the message while looking over their shoulder, was reasonably worried and alerted a security officer: "hey someone over there is messaging about harming the plane", and then things got muddled from there about technology? even going past a ceiling camera pointing down straight at you writing a message would probably give enough resolution to see an emoji.... but it's not like airport security wants to reveal their abilities
mellosouls 3y ago
The headline here is very misleading and different from the article - has the article changed or been editorialised here? "On my way to blow up the plane (I'm a member of the Taliban)." British man, but - going by the name - presumably of Indian (?) heritage. The article doesn't give his actual background (which seems like craven reporting), but crap joke or not you don't get to make those comments as a young British Asian male in a "private" group chat (neither are the number of individuals in the group described) in that context and not expect there to be repercussions. I'm suspicious also of the idea this was intercepted by gchq, it's quite believable that's a cover for somebody in the group being (rightfully) worried and doing their civic duty. Perhaps it's an overreaction and security overreach but there's more complexity than indicated in the simplistic headline here.
- YeGoblynQueenne 3y ago
  He says it was an in-joke with his friends about the way he looked. From that I would like to abduce the fact that the friends the message was addressed to were not in the airport (at least not all of them) otherwise he wouldn't be informing them he's going to his flight. Based on that, I have a hunch the message was "intercepted" by one of his friends' parents who freaked out and told the cops who raised the alarm. That would be the easiest way to explain how the message was "picked up" in the first place.
- tommoor 3y ago
  I think the original BBC headline is more misleading to be honest, a joke in a private message is not a bomb hoax.
vlod 3y ago
Time to seriously use Signal for everything (I've not heard it's been broken).
g-b-r 3y ago
It's incredible that even on Hacker News so many people expect that Snapchat messages are not monitored I guess that explains why it's so used. It's a centralized, non E2EE system, you don't expect them to flag something with "blow up", "plane" and "taliban" in the same message? It's more likely than one of the group members reported it, but if it got flagged, sent to some five eyes system and there they noticed (manually or automatically) that the guy just boarded a plane, it doesn't sound surprising ! And actually Snapchat gets the users' position as well, it might well be that a reviewer at Snapchat itself saw that he was in an airport and reported it. Being an immediate threat it's not surprising they acted like that. The weird wifi story means that they know people expect privacy on Snapchat, I guess.
robbiewxyz 3y ago
Snap explicitly claims to "work to proactively escalate any content that could involve imminent threats to life" [1]. Given this, it seems almost certain that the Wi-Fi explanation is miscommunication, misunderstanding, or misdirection. On a broader note, two days in jail, two years in courts, and possibly over $100k in fines will make a mess out of a college kid's life. All that for a common joke is downright negligence on the part of the authorities simply because of the high risk of instilling a resentment toward society in the accused. Ugh. [1] https://web.archive.org/web/20230606001918/https://values.snap.com/privacy/transparency/legal-requests https://web.archive.org/web/20230606001918/https://values.sn...
gravitypool 3y ago
For those who have said that text messages aren't encrypted, I'm pretty sure this is inaccurate. You can almost guarantee the big social media platforms used TLS encryption on all their data in transit. A quick and dirty packet capture confirmed this, no messages can be seen in plain text. Also, a quick test sending messages from an iPhone with the latest iOS through Burpsuite will cause the app to not work properly. Messages aren't sent or received, and we can see the logs in SSL fatal errors "certificate_unknown". This is even after the cert was installed as a Trusted Root CA. This seems to be evident of SSL pinning, also as expected. There are many variables here, way too many to account for, but I would probably rule out the "This was captured on Airport wifi". With this and the information from the other messages here, I'm personally going to lean towards it was an internal Snapchat flag that alerted law enforcement, or GCHQ has a Snowdenesque backdoor.
ijhuygft776 3y ago
I sometime make bomb jokes in private messages to throw off mass spying... everyone should do that.
penguin_booze 3y ago
> Shortly after, the court was told two Spanish F-18 fighter jets were sent to flank the aircraft. Genuine question: what's the point of scrambling fighter jets to escort a passenger one? Is the intent to shoot the plane down, if it comes to that? But if the bomb were to go off, what are the fighter jets supposed to do? Won't they, too, get damaged in the blast?
- gridspy 3y ago
  Visual confirmation of who is in the cockpit Standard way to establish contact with someone who is not responding on the radio and is violating a nation's airspace Possible way to shoot down a (hijacked) plane prior to it impacting a significant site on the ground.
ROLAND1470 3y ago
[dead]
TMTRIMX 3y ago
[dead]
TMTRIMX1 3y ago
[dead]
johnryan147 3y ago
[flagged]

95 points by tommoor 3y ago

This is quite dumb, if he was actually going to do it he wouldn't announce it so clearly on a non-encrypted channel. Does the UK really think state supported agents talk on snapchat?

spuz 3y ago
As far as I know, Snapchat messages are encrypted. Just not end-to-end.
ptaipale 3y ago
Actual terrorists are, in fact, sometimes quite dumb and naive.

vdaea 3y ago

It doesn't explain how the authorities got ahold of that message, since it was sent in private allegedly. Also the entire process is happening in Spain and he has British citizenship - can't he just ignore the courts?

smeej 3y ago
It was sent over the airport's WiFi. Snapchat doesn't even claim their messages are encrypted end-to-end or anything, do they?
- vdaea 3y ago
  Even then I'm sure they are sent over TLS.
  - llacb47 3y ago
    Probably a root certificate that you need to install to browse on the airport wifi.
    - klmr 3y ago
      I’m not saying this doesn’t happen but I can’t remember ever having been asked to install a root certificate when joining an airport wifi. And I am confident that this has never happened when I’ve flown out from Gatwick.
      - llacb47 3y ago
        Perhaps the GCHQ have a backdoor in snapchat then, which is comforting
    - aaix 3y ago
      snapchat uses certificate pinning so i dont think this would work anyways
  - troupe 3y ago
    Right, so either the airport is running something that can break TLS, or snapchat is feeding a stream of private messages to the government with location information provided.
    - RajT88 3y ago
      Almost certainly the second.
bemusedthrow75 3y ago
Why would you think he can ignore the courts? Britain and Spain have an extradition treaty.
deleted 3y ago
[deleted]

avg_dev 3y ago

i don't understand. i thought TLS or some other form of end-to-end encryption would prevent this sort of thing from happening. it seems like someone has access to the plaintext message other than the participants of the conversation. how does this happen? (i am not a snapchat user) not even to begin talking about the political ramifications...

__m 3y ago
Snapchat texts are not end to end encrypted. I think we know exactly how that happens since Snowden. There won’t be political ramifications. Though this might be more tangible to the average users that don’t care about privacy.
- spuz 3y ago
  But is there any claim that Snapchat automatically filters messages and alerts the UK security services?
  - lukeschlather 3y ago
    Snapchat messages being surreptitiously downloaded and monitored by the NSA at some point where they are unencrypted (possibly only within Snapchat's datacenters) is consistent with what was revealed in Prism. I know that most companies have updated their standards to treat any network traffic as insecure since Prism but it's possible Snapchat doesn't. Also as I understand it the NSA also has no legal issues with sharing any messages intercepted with the UK so long as one of the parties to the conversation is not a US national or on US soil.
gtvwill 3y ago
Errr phones aren't safe. They are backdoored up the wazoo. Same with all your messaging companies. Any that are decent in size have had a visit from authorities and aren't allowed to disclose to you they have. Iphones, android it doesn't matter. Your phones about the least safe tech device you own. It literally hacks itself if sent the right messages. Edit: OK so it seems a fair few folks don't understand how spying across borders and things like the 5 eyes mean your tracked without a warrant legally. So here's how it works. All 5 eyes countries are not allowed to spy on their own citizens in their countries without a warrant. All 5 eyes countries are allowed to surveil info about foreign individuals without a warrant. 5 eyes intel agencies basically just have to pipe a copy of local data say fb or in this case snapchat out via a friend in a another country then back to themselves and they don't need a warrant. As the data has now come from Intel sharing from your 5 eyes peers. The 5 eyes intel agencies between them all have deals and flex with just about every other intel agency in the world except the obvious few. Intel sharing these days is as much as a treasure hunt for legal loopholes to get the data as it is hunting the data itself.

tommoor 3y ago

I feel like they are being vague on how the message was sourced purposefully. It's a shame it's a kid that doesn't have the resources to fight this, the UK public has already been conditioned to expect that all their messages are being tracked and read it seems.

hanniabu 3y ago
> I feel like they are being vague on how the message was sourced purposefully. Why does it matter? If he's innocent he shouldn't have anything to hide! /s
- g-b-r 3y ago
  Yeah but if you send a message like that before boarding a plane you should know what you can get... (not a prosecution though maybe, if it wasn't members of the group who thought it could be true)
tivert 3y ago
> I feel like they are being vague on how the message was sourced purposefully. I'm reminded that, years ago, an unsecured MongoDB instance was discovered on the internet, and it turned out be part of a feed of private social network activity to the Chinese police/government agencies. I wonder if the UK government has a similar feed of Snapchat messages. I'm also reminded of a video (apparently originally posted to Chinese social media by the police), of some schmuck locked in a tiger chair at a police station being forced to apologize for talking smack about the police in a private WeChat group (it was nothing political, the police were apparently confiscating motorcycles or something at the time and he didn't like it).
dharmab 3y ago
The simplest explanation is someone in the Snapchat group tipped the police and provided screenshots.
- troupe 3y ago
  Simple, but it seems unlikely, and it is also the scenario that the government would be mostly likely to be up front about sharing.

whatshisface 3y ago

It sounds like he's being held liable for sending a private message that scared the people spying on him into arresting him unnecessarily. It never occurred to me that end to end encryption would eventually have the use case of preventing security services from scaring themselves and then blaming you for a false alarm...

colpabar 3y ago
Or, encryption will be a red flag that gives those services cause to go after someone without even knowing the content of the message.
- whatshisface 3y ago
  Going by what happened, it's the other way.
pengaru 3y ago
> It never occurred to me that end to end encryption would eventually have the use case of preventing security services from scaring themselves and then blaming you for a false alarm... It never occurred to you that incompetence/stupidity is rampant? Allow me to introduce you to Mr. Hanlon: https://en.wikipedia.org/wiki/Hanlon%27s_razor https://en.wikipedia.org/wiki/Hanlon%27s_razor and his close friend, Peter: https://en.wikipedia.org/wiki/Peter_principle https://en.wikipedia.org/wiki/Peter_principle
- deleted 3y ago
  [deleted]
g-b-r 3y ago
With him already on a plane you would have taken chances?

curtis3389 3y ago

Accused of public disorder because the government read his private message. Seems legit.

simmerup 3y ago

Wonder how many of the people here complaining about text messages actually read the article and know it was a snapchat. He probably got dobbed in by someone for such a shit joke

spuz 3y ago
A private Snapchat. If someone dobbed him in it would have to have been one of his friends which assuming those friends know him well would be an even crazier thing to do than to make the joke.
- ithkuil 3y ago
  Them being a group of friends doesn't rule out the possibilities. I've seen stupid pranks being played between friends; sometimes people are curious to see if the consequences are real

gridspy 3y ago

Seems like charging people for what they write or say in a private setting is like ThoughtCrime. Monitoring all communications for keywords and reacting is going to throw up a lot of false positives, that is in the nature of casting a wide net. Persecuting the victims of this snooping (the defendant in this case) seems a bit harsh.

neom 3y ago

I guess Snapchat isn't E2EE. There are various articles online that say it is, but if you view their privacy stuff, the have nothing about it and in this video they say they share your private messages with law enforcement when required: https://www.youtube.com/watch?v=0lj4xjCaCXU https://www.youtube.com/watch?v=0lj4xjCaCXU Interesting that the British government is packet sniffing at airports. Imo they should pay the $90k to the Spanish government.

deleted 3y ago
[deleted]
RajT88 3y ago
Everything talks over TLS these days. They aren't packet sniffing in airports, they probably have a closet of servers in the Snapchat datacenter.

unsupp0rted 3y ago

> A court in Madrid heard it was assumed the message triggered alarm bells after being picked up via Gatwick's Wi-Fi network. Sent a message to the friend he's traveling with openly over the airport's public wifi = public nuisance?

Dig1t 3y ago

>Mr Verma's message was picked up by the UK security services who flagged it to Spanish authorities while the easyJet plane was still in the air. It sounds like the UK government is spying on citizens’ private messages to each other. The article says it was sent only to people he was traveling with on the day of his flight. This strikes me as extremely authoritarian and scary. Europeans: why are there not mass protests about this? Is this the kind of world that you actually want to live in? Is it just apathy? Or is this seen as a good thing?

timmb 3y ago
Not the constitutional protection like in the US. It just creeps in bit by bit.
klmr 3y ago
> why are there not mass protests about this? Because we hadn’t heard about this case before. — At all. If the vague information in this article is actually corroborated there’ll be an outcry alright.
- neom 3y ago
  I learned about it 2 years ago: https://www.dailymail.co.uk/news/article-11002673/Chess-playing-economics-genius-arrested-EasyJet-bomb-hoax-says-sorry-moment-madness.html https://www.dailymail.co.uk/news/article-11002673/Chess-play... "The message was picked up by their mobiles on Gatwick airport's Wi-Fi servers and immediately triggered alarm bells with security because of the sensitive words used." I thought that was weird then and I still think it's weird now, either there is a pretty big problem or the daily mail is inaccurate. This whole article is lala land from a tech perspective and I'm quite curious about it.
  - ghaff 3y ago
    From that article it seems like it's the kid who assumed it was the WiFi that caused the leak. 'But I was using the data on my phone and they were using the Wi-Fi at Gatwick and so the message was picked up by the security people.' As far as I know, it doesn't seem like anyone in the UK has said where they got the info from. And the Daily Mail may just be assuming the kid's right and is jumping to a conclusion.

timmb 3y ago

I’m guessing this wouldn’t have had the same response if the guy was white. Feels like the guy should be due compensation by the Spanish government. Is there really a law that prohibits private jokes that may alarm an unknown surveillance system?

legitster 3y ago

> He said that the plane's pilot made an announcement, telling passengers that the fighter jets had been scrambled because of a distress signal that had been sent by mistake. > Mr Verma's message was picked up by the UK security services who flagged it to Spanish authorities while the easyJet plane was still in the air. > A court in Madrid heard it was assumed the message triggered alarm bells after being picked up via Gatwick's Wi-Fi network. Emphasis mine. Something is really fishy here. We know that a fighter escort was dispatched for this flight, but it sounds like no one is on record that his message is what actually triggered the escort or how they would have even found it. There's a non-zero chance that the Spanish authorities themselves do not know where the distress signal came from, and only found out about the message after they searched his phone. And they are trying to pin the cost of scrambling the jets on him when they really should be ringing up the UK government.

mortenjorck 3y ago
Most likely scenario I can imagine: While everything was TLS encrypted between all conversation participants and the Snapchat server (airport Wi-Fi is a non-sequitur here), Snapchat has some kind of PRISM-style setup that at least starts with a global keyword scanner for natsec-related triggers. That alone seems unlikely to have resulted in fighter jets scrambling. More likely, that keyword system feeds into a much more complex Palantir deployment or something that's cross-referencing a bunch of other factors and assigning a risk score. In this case, it was enough to get flagged for immediate review, someone thought the contextual elements were enough to escalate, and this set off a chain of actions leading to the fighter jets. There are likely thousands of terrorism jokes made over back-doored messaging systems every day, but sending one of those messages buys you a lottery ticket you certainly don’t want to win.
- whatshisface 3y ago
  You seem to know a lot about security for someone with no interest in evading it. Good luck with your lottery ticket...
- dogma1138 3y ago
  Snapchat does not encrypt text messages only photos and video. Also the question of how many of those joke messages are being sent from an airport and have account meta data that can be tied to travel information (name, email, phone number). I wager far fewer that it may not make it into as much of a game of chance as you think.

wonderwonder 3y ago

Reminds me of this: https://news.met.police.uk/news/former-met-officers-sentenced-for-sending-offensive-whatsapp-messages-476538#:~:text=Six%20former%20Metropolitan%20Police%20officers,the%20Met's%20professional%20standards%20team https://news.met.police.uk/news/former-met-officers-sentence.... Europe is determined to control your thoughts and punish you for wrong think

lelag 3y ago

It's a really interesting story. The message was sent privately. After reading about Snapchat security at https://courses.csail.mit.edu/6.857/2016/files/11.pdf https://courses.csail.mit.edu/6.857/2016/files/11.pdf, it's clear that even in the absence of E2E encryption, all message are sent to the Snapchat API using TLS and even if using a public airport Wifi, this message should not have been easy to intercept. This leaves only a few options about what is happening here: Option 1: Big Intel has totally broken TLS and can see all TLS traffic in the clear in real-time Likelihood: very unlikely, I don't think this would stay secret for long. Option 2: Big Intel got itself a certificate for the Snapchat domains and use it to MITM Snapchat traffic. Likelihood: very possible but unlikely to be the source as I don't think they would use it too openly on random users as it's too easy to get noticed if used widely. Option 3: Snapchat is actually monitoring all messages and reported the message to authorities themselves. Alternatively, Big Intel is in bed with Snapchat and all message get processed by an intelligence system. Likelihood: I think this is the only explanation that makes sense. Since it would not be very good PR for Snapchat to admit that they are monitoring all messages, the authorities must have invented that airport wifi monitoring story. Who even use an airport wifi in their home country anyway... Pretty sure he had 4G and no need to use the crappy airport wifi. Anyway, that's the only way I can make sense of that story.

deleted 3y ago
[deleted]
squarefoot 3y ago
Option 4: there is zero privacy and security on devices, as many vital parts of their OS are closed source, from firmware to apps through the OS. It takes only one rogue closed program with the right permissions to render insecure a 99.9% open phone and read data before it is being encrypted or after it is decrypted, then send it somewhere.
- solarkraft 3y ago
  Likelihood: Certainly possible (and out in the wild, see Triangulation and Pegasus), but it seems brazen to waste 0-days and PR issues on the low chance someone might text a bomb threat.

jareklupinski 3y ago

assuming TLS isn't broken and E2E is working as intended... isn't it more likely that someone saw the message while looking over their shoulder, was reasonably worried and alerted a security officer: "hey someone over there is messaging about harming the plane", and then things got muddled from there about technology? even going past a ceiling camera pointing down straight at you writing a message would probably give enough resolution to see an emoji.... but it's not like airport security wants to reveal their abilities

mellosouls 3y ago

The headline here is very misleading and different from the article - has the article changed or been editorialised here? "On my way to blow up the plane (I'm a member of the Taliban)." British man, but - going by the name - presumably of Indian (?) heritage. The article doesn't give his actual background (which seems like craven reporting), but crap joke or not you don't get to make those comments as a young British Asian male in a "private" group chat (neither are the number of individuals in the group described) in that context and not expect there to be repercussions. I'm suspicious also of the idea this was intercepted by gchq, it's quite believable that's a cover for somebody in the group being (rightfully) worried and doing their civic duty. Perhaps it's an overreaction and security overreach but there's more complexity than indicated in the simplistic headline here.

YeGoblynQueenne 3y ago
He says it was an in-joke with his friends about the way he looked. From that I would like to abduce the fact that the friends the message was addressed to were not in the airport (at least not all of them) otherwise he wouldn't be informing them he's going to his flight. Based on that, I have a hunch the message was "intercepted" by one of his friends' parents who freaked out and told the cops who raised the alarm. That would be the easiest way to explain how the message was "picked up" in the first place.
tommoor 3y ago
I think the original BBC headline is more misleading to be honest, a joke in a private message is not a bomb hoax.

vlod 3y ago

Time to seriously use Signal for everything (I've not heard it's been broken).

g-b-r 3y ago

It's incredible that even on Hacker News so many people expect that Snapchat messages are not monitored I guess that explains why it's so used. It's a centralized, non E2EE system, you don't expect them to flag something with "blow up", "plane" and "taliban" in the same message? It's more likely than one of the group members reported it, but if it got flagged, sent to some five eyes system and there they noticed (manually or automatically) that the guy just boarded a plane, it doesn't sound surprising ! And actually Snapchat gets the users' position as well, it might well be that a reviewer at Snapchat itself saw that he was in an airport and reported it. Being an immediate threat it's not surprising they acted like that. The weird wifi story means that they know people expect privacy on Snapchat, I guess.

robbiewxyz 3y ago

Snap explicitly claims to "work to proactively escalate any content that could involve imminent threats to life" [1]. Given this, it seems almost certain that the Wi-Fi explanation is miscommunication, misunderstanding, or misdirection. On a broader note, two days in jail, two years in courts, and possibly over $100k in fines will make a mess out of a college kid's life. All that for a common joke is downright negligence on the part of the authorities simply because of the high risk of instilling a resentment toward society in the accused. Ugh. [1] https://web.archive.org/web/20230606001918/https://values.snap.com/privacy/transparency/legal-requests https://web.archive.org/web/20230606001918/https://values.sn...

gravitypool 3y ago

For those who have said that text messages aren't encrypted, I'm pretty sure this is inaccurate. You can almost guarantee the big social media platforms used TLS encryption on all their data in transit. A quick and dirty packet capture confirmed this, no messages can be seen in plain text. Also, a quick test sending messages from an iPhone with the latest iOS through Burpsuite will cause the app to not work properly. Messages aren't sent or received, and we can see the logs in SSL fatal errors "certificate_unknown". This is even after the cert was installed as a Trusted Root CA. This seems to be evident of SSL pinning, also as expected. There are many variables here, way too many to account for, but I would probably rule out the "This was captured on Airport wifi". With this and the information from the other messages here, I'm personally going to lean towards it was an internal Snapchat flag that alerted law enforcement, or GCHQ has a Snowdenesque backdoor.

ijhuygft776 3y ago

I sometime make bomb jokes in private messages to throw off mass spying... everyone should do that.

penguin_booze 3y ago

> Shortly after, the court was told two Spanish F-18 fighter jets were sent to flank the aircraft. Genuine question: what's the point of scrambling fighter jets to escort a passenger one? Is the intent to shoot the plane down, if it comes to that? But if the bomb were to go off, what are the fighter jets supposed to do? Won't they, too, get damaged in the blast?

gridspy 3y ago
Visual confirmation of who is in the cockpit Standard way to establish contact with someone who is not responding on the radio and is violating a nation's airspace Possible way to shoot down a (hijacked) plane prior to it impacting a significant site on the ground.

ROLAND1470 3y ago

[dead]

TMTRIMX 3y ago

[dead]

TMTRIMX1 3y ago

[dead]

johnryan147 3y ago

[flagged]