11 ms·
British intelligence able to read and flag private Snapchat messages
- raxxorraxor 3y agoRidiculous to demand a fine from him being the victim of bad surveillance. Snapchat text is often used to prosecute people, I think the message being forwarded is a likely explanation, despite chats not being thoroughly encrypted and the article saying it would be unlikely. Could have been an anonymous tip.
- 01acheru 3y agoMy exact thought. If the Spanish prosecutors want somebody to pay for those expenses it should be the British gov or whatever other agency as it is the same as if I warned the police of some fake bomb threat.
- raxxorraxor 3y agoCertainly. Of course then governments would share less information if they are culpable for any false positives. But penalizing the wrongly accused is a special way of worsening an already significant fuckup.
- mromanuk 3y agoWas this text captured due to something like Echelon doing mass surveillance?
- jackweirdy 3y agoNot clear if it was message interception or (maybe more likely) Snapchat have their own moderation that can refer outward. The text is not e2e encrypted
- deleted 3y ago[deleted]
- tommoor 3y agoPreviously here: https://news.ycombinator.com/item?id=39094306 https://news.ycombinator.com/item?id=39094306
- 5350-uiop-1130 3y agoi'm certain that the feds can read my whatsapp. 100% zuck is ratting me out. every message. considering xkeyscore and prism are over 10 years old. can only imagine what things are like now.
- mohon 3y agoespecially with the push of whatsapp business, orgs can freely store ur messages to them. also by relying on the whatsapp metadata (the one where you can export by urself), it should be already good enough for feds agent to locate u. for the E2E itself, as non crypto guy, seems the open whisper paper implemented on whatsapp alr good enough?
- 5350-uiop-1130 3y ago> the open whisper paper implemented on whatsapp alr good enough? i think wikileaks showed us that we cannot really trust anything when it comes to the sophistication of tech surveillance.
- frickinLasers 3y agoWhat did wikileaks show about the sophistication of tech surveillance?
- goda90 3y ago> He suggested one of the chat's other members could have warned the police, but if that were the case, that other member would have to be charged, not Verma This doesn't make sense to me. Why would that other member be charged for reporting a threat?
- timmb 3y agoBecause they would have obviously known it was their friend making a joke.
- lolyyy2 3y agoI don't think they could have known for sure it was a joke.
- cal85 3y agoThe judge’s point is that if they want to sue anyone for misleading them, it should be whoever sent them the message. He’s not saying they would necessarily win that hypothetical case.
- chatmasta 3y agoSo why shouldn't Snapchat (who presumably reported it to the government) be charged for the same offense of reporting a non-threat? I'm not suggesting they should be, but just following the same logic as your comment.
- cypherpunks01 3y agoI thought they might have been talking about reporting a false threat, or something of that nature? If you are a comedian working on a joke and write one about a political assassination in your private journal, certainly you can't be charged with communicating a threat, because you did not communicate it. But if a friend/enemy finds your notebook, knows you have no intent to harm, but reports the journal to authorities out of spite anyways, then the friend could be culpable for communicating a false threat, even though the joke is in your handwriting. Maybe they were getting at something like that? In any case, it was very awkward wording at best for a report from Reuters, it should have been either explained or left out.
- aaron695 3y agoThere is no way British intelligence could have acted so quick, if it was true. Maybe if he/they were already being watched. This is an interesting theory, if it's technically possible would be it. For sure airports would watch such traffic if they technically can. "It was previously thought the WiFi network at London Gatwick Airport could have intercepted it, but an airport spokesperson told the BBC it didn't have that capability." Else it's the 'friends'
- siilats 3y agoor maybe, hear me out, there was a person sitting next to him at the airport and saw his snapchat messages and freaked out?
- KoolKat23 3y agoThe WiFi network in one of the London airports had this weird phone time error when connecting, it wanted to update time definitions, I always wondered if it's had to do with certificate validation, or just a simple misconfiguration, or even if it was just my personal device.
- lolyyy2 3y agoI don't know much about hashing but is it possible five eyes just has a zettabyte-scale rainbow table covering scary words? They could use that to score encrypted messages and act on the scary ones.
- PhilipRoman 3y agoI don't see any use for hashing here, and encrypted messages have padding (otherwise you could trivially decrypt simple messages like yes/no)
- WhatsName 3y agoStrong encryption has properties that make "known plaintext" attacks impossible. You should not be able to tell the message from pure randomness. Breaking End-to-End-Encryption is not impossible but rather far fetched. If they read Snapchat, my bets would not be on broken crypto, but rather a lack thereof.
- speedgoose 3y agoI don’t know. Without even going in normal standard crypto, if you XOR a few words with a random initialisation vector, is it possible to flag those messages?
- creer 3y agoA more serious problem with the story is if they had any kind of advanced (or magical) brute force or mathematical path against some standard encryption scheme - they would not waste that major secret on some random 18yo joker. (Although in the background, fuckups are always possible and they did send a fighter jet initially so there was some pressure to follow through. Still not enough to risk a major secret.)
- Daviey 3y agoIt's an /assumption/ that British intelligence able to read and flag private Snapchat messages, as the article literally states, "The trial did not make clear how the British services managed to have access to Verma's private messages, the judge stressed." The truth is, it isn't public knowledge how this unfolded and anything suggesting otherwise is conjecture. Also, this post doesn't' reflect the article title, "Spanish judge clears British teen of Menorca flight bomb hoax charges".
- chatmasta 3y agoIf we're speculating, a much more likely explanation is that Snapchat moderation teams monitor certain words in certain areas, flagging for example any message containing "bomb" sent from an airport. This is arguably even creepier than government surveillance, since it implies Snapchat employees are looking at the content of private chats and the user may never know.
- notso411 3y ago[dead]
- the_gipsy 3y agoMight be automated, but still, a corporation controls what gets flagged.
- deleted 3y ago[deleted]
- tgv 3y agoIt also means that there's no encryption, or the key is known to Snapchat employees (and therefore to everybody who has enough money).
- udev4096 3y agoI'm surprised the amount of trust you put in Snapchat and likewise companies whose sole purpose is to maximize their profit by selling user data
- _chu1 3y agoThis is why even if you aren't doing anything wrong, you should always use E2E encrypted communication.
- krisoft 3y ago> even if you aren't doing anything wrong I mean... joking about bomb threats at an airport is not "not doing anything wrong". Should we throw the person in prison for it? No, of course not. Is it a dumb thing to do? I think so. Very dumb. > you should always use E2E encrypted communication I agree with that.
- _chu1 3y agoI never said they weren't doing anything wrong though. Maybe it shouldn't be as easy to wander into an airport with a bomb.
- redeeman 3y ago> I mean... joking about bomb threats at an airport is not "not doing anything wrong". in a private message to friends? it most definitely is. also what does airports have to do with anything? are you implying its okay to do if the target is a rural farmhouse, but not an airport?
- krisoft 3y ago> what does airports have to do with anything? Happy to explain. Due to previous attacks people and law enforcement around air travel are more on edge about such threats. This is because for inherent technical reasons during a flight a relatively small explosive can have devastating consequences. This is due to the pressure difference between the cabin and the atmosphere at cruise altitude , and the inherent energies incorporated in an airliner. (Both potential energy due to altitude, kinetic energy due to speed and chemical energy in the fuel.) > are you implying its okay to do if the target is a rural farmhouse, but not an airport? I'm not implying that. I simply did not claim anything about threats agains rural farmhouses. > in a private message to friends? it most definitely is. It seems we disagree on this point then.
- clawoo 3y agoOne needs to ask themselves, what is more likely? 1. The /feds/ broke Snapschat's end to end encryption and they're monitoring for all traffic with designated stopwords, or... 2. One of his friends reported him, one way or another, or.. 3. Snapchat's end to end encryption is... not. I can't find any definitive statement that the chat messages themselves are E2EE, only that photos and videos are encrypted and the key is exchanged between users[1]. This means that Snapchat can monitor for text messages or decrypt uploaded attachments when necessary, since they have access to the message that contains the key for the attachment. Most likely Snapchat's E2EE is just a facade, they probably have a dictionary of "funny" words on the device (and/or the server) and automatically flags the message in the internal systems when certain stopwords are being used. [1] https://nordvpn.com/blog/is-snapchat-safe/ https://nordvpn.com/blog/is-snapchat-safe/
- bell-cot 3y ago2. ... friends of friends, or somebody posted his "joke" to a platform which GCHQ does real-time monitoring of, or ... 4. Compromised endpoint(s). (I also somewhat favor your #3.)
- b112 3y agoYes, such as keyboard apps.
- notso411 3y ago[dead]
- ghaff 3y agoThe almost real-time response is what makes it really hard to believe it was in response to some list of codewords that probably get mentioned in messages many thousands of times per day. (and which, as far as we know, has never triggered a response like this previously.) Someone shoulder surfing or a friend freaking out and calling see something/say something seems much more likely IMO.
- AeroNotix 3y ago> Most likely Snapchat's E2EE is just a facade, they probably have a dictionary of "funny" words on the device (and/or the server) and automatically flags the message in the internal systems when certain stopwords are being used. Reminds me of whenever I used to phone a friend during my teenage years I would always start with "BOMB QUEEN, BOMB QUEEN."
- chmod775 3y agoSo these people do not want to talk about and are generally unable to provide examples of their surveillance stopping an actual threat because "they do not want to give away their capabilities", but when they get shown up for being absolute fools by taking an obvious joke seriously, they have no problem starting noisy court proceedings? They were likely just so giddy that they finally got something, they didn't stop to think whether it was real, suing that kid in red-faced anger and embarrassment afterwards. These fuckups should be paid for out of their budget.
- throwaway49849 3y agoThe people that gravitate towards positions of unrestrained power often seem to have an authoritarian bend. If there's an opportunity to use their power to be a hero, that will scratch the itch, but in the absence of that opportunity, they seem to readily turn their power on the rest of us.
- sremani 3y agoA man's urge to be a Hero and save the day, and a bureaucrat's fear of losing reputation are a deadly cocktail.
- DaiPlusPlus 3y ago> but when they get shown up for being absolute fools by taking an obvious joke seriously, they have no problem starting noisy court proceedings Those aren't the same people, though.
- asciii 3y agoIs there any recourse for him to figure out how the message was intercepted and his false arrest?
- archsurface 3y agoI think "Intelligence" was used in the name at a time when spying was done on foreign countries. If the spying is now done on the domestic general public it seems we should change the name to something more appropriate.
- croemer 3y agoDomestic intelligence...
- deleted 3y ago[deleted]
- game_the0ry 3y agoPersonally, start from the premise that my iphone is a CIA tracking device. That changes my behavior accordingly. Though ideally I should expect privacy from the electronics I own.
- exe34 3y agoYou'd think if the CIA is so good at tracking, they'd know when you were joking.
- pregnenolone 3y agoThe only reasonable explanation I have is that he got flagged by Snapchat automatically who reported him to the authorities immediately. Even without E2E encryption, how would they intercept the message as the app is most likely communicating with the server via HTTPS or SSL?
- deleted 3y ago[deleted]
- jp42 3y agoRecently read The Making of Atomic Bomb & Skunkworks. Govt puts enormous amount of money & employees best people in given area to achieve their objectives. It's hard for me to imagine govt will be ok to have tech that they can't crack, they will find a way to crack. I am not saying we should be OK with it, but I don't see a path to make it happen. It can be made difficult with E2E and other tech but not impossible.
- Aerbil313 3y agoIt’s mathematically impossible to crack the technology of E2EE. But govts have all the power to coerce the companies into not using E2EE at all times and to lie that they do.
- KMag 3y agoIt's conjectured, but not proven, that there is no efficient algorithm on classical computers to compute discrete logarithms over elliptic curves.
- trimethylpurine 3y agoThere's no need to speculate about encryption or surveillance. "we may need to enforce our Terms and other policies. In some cases, we may also use or share your information to cooperate with law enforcement requests, escalate safety issues to law enforcement, industry partners, or others, or comply with our legal obligations." https://values.snap.com/privacy/privacy-policy https://values.snap.com/privacy/privacy-policy
- thekevan 3y agoI thought I read another article that said it was caught because he was connected to and using the airport's wifi.
- saaaaaam 3y agoThe title of this post is very misleading. This is not what the story says at all.
- AzzyHN 3y agoSince when are Snapchat messages private?
- switch007 3y agoThe MOD encourages their personnel to use Snapchat, and blocks WhatsApp (on their internal networks). What more do you need to know?
- b3nji 3y agoInteresting, I'd like to know more. What makes you say that?
- rkagerer 3y agoWith every ounce of privacy given up, each person-hour spent waiting in a security line at the airport, and each incident like this, the bad guys win a little bit more. The cultural shift wreaked in the aftermath is something I rarely see measured and weighed.
- realfeel78 3y agoOP title is not backed up by linked article whatsoever. The article says nothing at all to that effect. The article says this, however, which I don't really understand: > He suggested one of the chat's other members could have warned the police, but if that were the case, that other member would have to be charged, not Verma. Can anyone help explain this?
- yellow_lead 3y agoI believe the part you are asking about means: Verma did not make a threat, but a private joke in a group chat, so he's not liable for the police reaction. If his friend is the one who informed the police, while knowing it was a joke, the friend should be charged instead.
- Aerbil313 3y agoThis is absolutely hilarious. I myself made multiple jokes over the years on plain unencrypted cell phone with my friends, knowing full well that it’s very likely all conversations are listened to with (probably) STT and regexes, but I always thought that my country’s intelligence service has the competence to distinguish a joke from the real deal.
- dang 3y agoThe submitted title broke the HN guidelines badly. From https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html: "Please use the original title, unless it is misleading or linkbait; don't editorialize." If you want to say what you think is important about an article, that's fine, but do it by adding a comment to the thread. Then your view will be on a level playing field with everyone else's: https://hn.algolia.com/?dateRange=all&page=0&prefix=false&sort=byDate&type=comment&query=%22level%20playing%20field%22%20by:dang https://hn.algolia.com/?dateRange=all&page=0&prefix=false&so... (Normally we'd revert the title, but the comments in this thread have been so skewed by submitted title that the thread won't make sense anymore if I do that.)
- gusfoo 3y ago> The message was somehow intercepted by British security services "somehow" is doing a lot of heavy lifting there. There are multiple routes to alert the authorities by the public that don't involve randomly intercepting internet traffic.
- exabrial 3y agoIf anyone is actually surprised by this....? You do not own your device. No root = not your phone.
- amriksohata 3y agoMost intelligence orgs from most companies can read messages on any app if they comprimise your phone through existing backdoors
- smsm42 3y agoThe guy us lucky he got the sane judge. It could have easily gone very badly for him.