17 ms·

Met Police to extract mobile phone data; will be kept even if no charges

74 points by josscrowcroft 14y ago

Nate75Sanders 14y ago
How feasible would it be to have a device that looks like a smartphone and can interface with this police device which would produce enough current/power/voltage/whatever to fry the police device?
- ErrantX 14y ago
  Hah! I like that idea :) It would have to be pretty convincing because you have to boot the device up to acquire it with the Aceso (as phones are such proprietary tech) so it would need to pass the "boots up and looks like a mobile device". In theory, I suppose, it would be possible to fry the thing when connected. It's just a standard PC packaged in a special case (with touch screen) and you connect the phone via USB.
  - Peaker 14y ago
    If that becomes common, putting a fuse or some defense against "frying" would probably be an easy response.
- minikomi 14y ago
  Or a bomb which uses USB as the trigger.. (not condoning, only thinking out loud! best be careful..)
DanBC 14y ago
(http://news.ycombinator.com/item?id=3988253 http://news.ycombinator.com/item?id=3988253) (http://news.ycombinator.com/item?id=3990972 http://news.ycombinator.com/item?id=3990972)
Zak 14y ago
I have to wonder why mobile phones aren't better protected against this kind of attack. It doesn't seem like the default should be to allow an unauthenticated device to plug in and read/image the phone.
- dsl 14y ago
  Because consumers don't demand it. They want Facebook and pretty colors and high megapixel cameras. The people who do ask for it are obviously criminals.
  - dstorrs 14y ago
    > The people who do ask for it are obviously criminals. You're being sarcastic, but we're moving in the direction of "police need unlimited power to investigate, so let's make it illegal to ask for privacy". And yes, we're a long way off from that scenario (at least in the USA) but I can see it on the horizon. The thing that really scares me is the UK system -- CCTV cameras on every corner explicitly built for surveillance. We have a lot of cameras in the US (traffic, ATM, etc) but they generally belong to different entities and there is no comprehensive framework for getting (near)real-time footage from all of them.
    - excuse-me 14y ago
      I remember the UK when we only had the old fashioned - bombs on the streets of London - type terrorists. Then we were supposed to not give into the terrorists, but with these new hidden internet terrorists it's vital that we hand over our lives to the police.
    - skymt 14y ago
      The police chief of my city (Newport News VA, USA) recently declared his intention to set up surveillance cameras "from one end of this city to the other" because "I can't put a police officer on every corner" but "I might be able to put up a camera." http://www.dailypress.com/news/crime/dp-nws-police-cameras-20120519,0,1215351.story http://www.dailypress.com/news/crime/dp-nws-police-cameras-2...
    - hnwh 14y ago
      I don't think we're as far off from that as you think, in the US..
  - r00fus 14y ago
k-mcgrady 14y ago
Are there any quick, easy ways to destroy all the data on your phone to prevent this if you are arrested? I currently have my passcode set the wipe the iPhone if it is entered incorrectly 10 times. So, if I was arrested and I could erase all my data quickly 'just' by tapping a number on the lock screen 40 times.
- nooneelse 14y ago
  It would be cool if entering some special code erased everything but the contact info for your lawyer. Maybe it could be better still. Send out some automated texts, erase everything but the number for your lawyer, and start recording audio and video and storing them on a remote server when possible.
  - cmdkeen 14y ago
    Which is why you get handcuffed and not allowed to use your phone. You think you're being big and clever but if the phone contained evidence you'd be looking at attempting to pervert the course of justice (cf Rebecca Brooks right now). Pretty much every police van already has constantly running video, all the custody areas of police stations do. And unlike the US that video doesn't get "lost" if you make any complaint.
    - Proleps 14y ago
      If they ask you for the password you could give them the one that erases all data :P.
- dsl 14y ago
  Wiping your device is justification enough for them to subpoena the iCloud backups in most cases.
  - hnwh 14y ago
    any historical case of that actually working?
  - 14y ago
dstorrs 14y ago
Jebus. Ok, I need to look into disk encryption (and maybe TrueCrypt) for my phone. AFAIK, there is nothing incriminating on it, but the cops can always find something if they really want to.
- ErrantX 14y ago
  > but the cops can always find something if they really want to. Forensic analyst here :) Genuinely the vast majority of cops don't. And indeed IMO sending this sort of thing off to contractors is the necessary sort of separation to make sure that dirty cops can't incriminate you. So on one hand I defend my profession; which I have always found to be supremely ethical and approach cases from the perspective of innocence. And on the other hand I entirely agree; this move removes an important separation of evidence retrieval that means it could well be abused.
  - smashing 14y ago
    What would happen if the police retain the data, presumably on a hard drive, then don't follow properly dispose of the equipment after a hardware upgrade? It would be possible for criminals to acquire the information somehow, right?
    - excuse-me 14y ago
      It's easier than that, a copy of a celebs phone records was about £10-25 so a dump of their smart phone should be yours for a pony
- jahmed 14y ago
  Everyone has done/is doing/will do something illegal. The question is if we or someone in charge cares. As told to me by some friendly police officers I would chat with.
  - shill 14y ago
    Show me the man and I'll find you the crime. --Lavrentiy Beria
ErrantX 14y ago
> Under the new system, content will be extracted using purpose built terminals in police stations. So the device in the screenshot is a Radio Tactics Aceso, there is one sat across the room from my desk. It has been around for quite a while. They are pretty good pieces of kit; but there is something of a limit in terms of the information they can extract (i.e. because phones are so "proprietary" it's only logical data they can easily recover). > Until now, officers had to send mobiles off for forensic examination in order to gather and store data, a process which took several weeks. Hilarious. Anyway: In a sense this is very old news (over the stuff HN is likely to be interested in); before if your tech was seized and sent of for analysis the data would be retained, no matter what the outcome. I can't remember the exact length of time but it is measured in years. This appears to be extending the technical ability to "acquire" mobile phones down to the police station level. My thoughts: * Despite how simplistic (and the Aceso is brain dead simple to use) they make it, there will still be mass confusion * No one at police station level will understand how to secure digital evidence effectively (no matter how much training they hand out - it took me several years to get to grips with the minutae), I hope they have a plan to mitigate this. * This is all part of the govt. plan to in-source as much of their forensics as possible. Which just ends up putting the technical stuff in the hands of people ill-trained to handle it, and risks more people being convicted * It's not discussed, but I would be interested to see if this means they will be acquiring more data than usual. i.e. does this mean every phone will be analysed, or will they only do it for phones they could (in the past) justify sending off for detailed examination. * In the former case (acquiring everything) how, legally, are they justifying it. As a forensic analyst this whole thing seems to verge on violating every ethical and moral rule I would ascribe too. It increases the chances of abuse by many factors and reduces the effectiveness of forensic mobile phone work. > The cost of leasing the 16 terminals for 12 months and training the officers will be £50,000, the Met said. They are being ridiculously fleeced. I am unsure of the exact volume of phones they might process, but I suspect they could sub-contract it to actual experts for much less. I could process 10's of phones a week, for example. Mostly this is a Radio Tactics press release. Even in the best case scenario they are reducing effectiveness, increasing error rate and costing themselves more money. From my side of the fence this is not the first idiotic thing I have seen the public forces do in recent months - and it won't be the last. As a member of the public I don't feel paranoia and insecurity, but I am certainly cautious about the way this is going. (disclaimer; this sort of thing is what is making my profession redundant) p.s. put a PIN code on your SIM and phone. From a practical perspective that basically renders Aceso useless (they can try and make you give up the PIN of course).
ck2 14y ago
Well this is probably become the standard in the USA within a few years. Also I could imagine the rise of planted phones - take a drug dealer's prepaid phone and plant it in your car if they want to frame you and make your life hell even if a conviction is eventually overturned.
user23409 14y ago
With the amount of risqué pictures teens are sending each-other these days, I bet this becomes the worlds largest kiddie porn database. Oh, law enforcement. Gonna be a lot of pervy police officers getting exactly what they want. Not dissimilar to the airport Body-Scanner pictures that TSA agents were caught taking home.
alan_cx 14y ago
Same as a DNA samples then. We Brits let them get away with that one, why would we be bothered by mere phone data? The battle is well and truly over. Well, I say over, it never really started. I really don't know why we don't just have random home searches, you know, just in case, and of course, what have we got to hide? What I would like to know is what will the tipping point be? When will the general public say no, enough is enough?
- yequalsx 14y ago
  I don't think there is a tipping point. People are already trained to give up their data to Google, Microsoft, Facebook, etc. Governments will share this data eventually and amass a great deal of its own curated data. People in general don't care and I don't foresee a time where they will. The surveillance era is here and it's not going away.
jerlam 14y ago
Looks like a great attack vector to get into a system that has other people's personal information.
anthonyu 14y ago
John Singleton wrote HurtLocker for Android (available at https://play.google.com/store/apps/details?id=com.featureproof.hurtlocker https://play.google.com/store/apps/details?id=com.featurepro...) for this exact reason. It allows you to surreptitiously wipe your phone when you are coerced or intimidated into involuntarily unlocking it.
furyg3 14y ago
How well do these devices work against encryption (like that on the iPhone)?
cmdkeen 14y ago
It is worth pointing out this merely enables you to get your phone back quicker in cases where the police could already seize your phone. It won't be a case of everyone who gets arrested having it scanned. Firstly there isn't any authority to do so, secondly it isn't worth it time wise. I used to be a cop in Scotland and I never arrested anyone where there was a need to do anything with their phone other than try and work out how to turn the damn thing off...
Mordor 14y ago
It's ironic that the Met Police, fresh out of a phone hacking scandal have proposed making things easier.

74 points by josscrowcroft 14y ago

How feasible would it be to have a device that looks like a smartphone and can interface with this police device which would produce enough current/power/voltage/whatever to fry the police device?

ErrantX 14y ago
Hah! I like that idea :) It would have to be pretty convincing because you have to boot the device up to acquire it with the Aceso (as phones are such proprietary tech) so it would need to pass the "boots up and looks like a mobile device". In theory, I suppose, it would be possible to fry the thing when connected. It's just a standard PC packaged in a special case (with touch screen) and you connect the phone via USB.
- Peaker 14y ago
  If that becomes common, putting a fuse or some defense against "frying" would probably be an easy response.
minikomi 14y ago
Or a bomb which uses USB as the trigger.. (not condoning, only thinking out loud! best be careful..)

DanBC 14y ago

(http://news.ycombinator.com/item?id=3988253 http://news.ycombinator.com/item?id=3988253) (http://news.ycombinator.com/item?id=3990972 http://news.ycombinator.com/item?id=3990972)

Zak 14y ago

I have to wonder why mobile phones aren't better protected against this kind of attack. It doesn't seem like the default should be to allow an unauthenticated device to plug in and read/image the phone.

dsl 14y ago
Because consumers don't demand it. They want Facebook and pretty colors and high megapixel cameras. The people who do ask for it are obviously criminals.
- dstorrs 14y ago
  > The people who do ask for it are obviously criminals. You're being sarcastic, but we're moving in the direction of "police need unlimited power to investigate, so let's make it illegal to ask for privacy". And yes, we're a long way off from that scenario (at least in the USA) but I can see it on the horizon. The thing that really scares me is the UK system -- CCTV cameras on every corner explicitly built for surveillance. We have a lot of cameras in the US (traffic, ATM, etc) but they generally belong to different entities and there is no comprehensive framework for getting (near)real-time footage from all of them.
  - excuse-me 14y ago
    I remember the UK when we only had the old fashioned - bombs on the streets of London - type terrorists. Then we were supposed to not give into the terrorists, but with these new hidden internet terrorists it's vital that we hand over our lives to the police.
  - skymt 14y ago
    The police chief of my city (Newport News VA, USA) recently declared his intention to set up surveillance cameras "from one end of this city to the other" because "I can't put a police officer on every corner" but "I might be able to put up a camera." http://www.dailypress.com/news/crime/dp-nws-police-cameras-20120519,0,1215351.story http://www.dailypress.com/news/crime/dp-nws-police-cameras-2...
  - hnwh 14y ago
    I don't think we're as far off from that as you think, in the US..
- r00fus 14y ago

k-mcgrady 14y ago

Are there any quick, easy ways to destroy all the data on your phone to prevent this if you are arrested? I currently have my passcode set the wipe the iPhone if it is entered incorrectly 10 times. So, if I was arrested and I could erase all my data quickly 'just' by tapping a number on the lock screen 40 times.

nooneelse 14y ago
It would be cool if entering some special code erased everything but the contact info for your lawyer. Maybe it could be better still. Send out some automated texts, erase everything but the number for your lawyer, and start recording audio and video and storing them on a remote server when possible.
- cmdkeen 14y ago
  Which is why you get handcuffed and not allowed to use your phone. You think you're being big and clever but if the phone contained evidence you'd be looking at attempting to pervert the course of justice (cf Rebecca Brooks right now). Pretty much every police van already has constantly running video, all the custody areas of police stations do. And unlike the US that video doesn't get "lost" if you make any complaint.
  - Proleps 14y ago
    If they ask you for the password you could give them the one that erases all data :P.
dsl 14y ago
Wiping your device is justification enough for them to subpoena the iCloud backups in most cases.
- hnwh 14y ago
  any historical case of that actually working?
- 14y ago

dstorrs 14y ago

Jebus. Ok, I need to look into disk encryption (and maybe TrueCrypt) for my phone. AFAIK, there is nothing incriminating on it, but the cops can always find something if they really want to.

ErrantX 14y ago
> but the cops can always find something if they really want to. Forensic analyst here :) Genuinely the vast majority of cops don't. And indeed IMO sending this sort of thing off to contractors is the necessary sort of separation to make sure that dirty cops can't incriminate you. So on one hand I defend my profession; which I have always found to be supremely ethical and approach cases from the perspective of innocence. And on the other hand I entirely agree; this move removes an important separation of evidence retrieval that means it could well be abused.
- smashing 14y ago
  What would happen if the police retain the data, presumably on a hard drive, then don't follow properly dispose of the equipment after a hardware upgrade? It would be possible for criminals to acquire the information somehow, right?
  - excuse-me 14y ago
    It's easier than that, a copy of a celebs phone records was about £10-25 so a dump of their smart phone should be yours for a pony
jahmed 14y ago
Everyone has done/is doing/will do something illegal. The question is if we or someone in charge cares. As told to me by some friendly police officers I would chat with.
- shill 14y ago
  Show me the man and I'll find you the crime. --Lavrentiy Beria

ErrantX 14y ago

> Under the new system, content will be extracted using purpose built terminals in police stations. So the device in the screenshot is a Radio Tactics Aceso, there is one sat across the room from my desk. It has been around for quite a while. They are pretty good pieces of kit; but there is something of a limit in terms of the information they can extract (i.e. because phones are so "proprietary" it's only logical data they can easily recover). > Until now, officers had to send mobiles off for forensic examination in order to gather and store data, a process which took several weeks. Hilarious. Anyway: In a sense this is very old news (over the stuff HN is likely to be interested in); before if your tech was seized and sent of for analysis the data would be retained, no matter what the outcome. I can't remember the exact length of time but it is measured in years. This appears to be extending the technical ability to "acquire" mobile phones down to the police station level. My thoughts: * Despite how simplistic (and the Aceso is brain dead simple to use) they make it, there will still be mass confusion * No one at police station level will understand how to secure digital evidence effectively (no matter how much training they hand out - it took me several years to get to grips with the minutae), I hope they have a plan to mitigate this. * This is all part of the govt. plan to in-source as much of their forensics as possible. Which just ends up putting the technical stuff in the hands of people ill-trained to handle it, and risks more people being convicted * It's not discussed, but I would be interested to see if this means they will be acquiring more data than usual. i.e. does this mean every phone will be analysed, or will they only do it for phones they could (in the past) justify sending off for detailed examination. * In the former case (acquiring everything) how, legally, are they justifying it. As a forensic analyst this whole thing seems to verge on violating every ethical and moral rule I would ascribe too. It increases the chances of abuse by many factors and reduces the effectiveness of forensic mobile phone work. > The cost of leasing the 16 terminals for 12 months and training the officers will be £50,000, the Met said. They are being ridiculously fleeced. I am unsure of the exact volume of phones they might process, but I suspect they could sub-contract it to actual experts for much less. I could process 10's of phones a week, for example. Mostly this is a Radio Tactics press release. Even in the best case scenario they are reducing effectiveness, increasing error rate and costing themselves more money. From my side of the fence this is not the first idiotic thing I have seen the public forces do in recent months - and it won't be the last. As a member of the public I don't feel paranoia and insecurity, but I am certainly cautious about the way this is going. (disclaimer; this sort of thing is what is making my profession redundant) p.s. put a PIN code on your SIM and phone. From a practical perspective that basically renders Aceso useless (they can try and make you give up the PIN of course).

ck2 14y ago

Well this is probably become the standard in the USA within a few years. Also I could imagine the rise of planted phones - take a drug dealer's prepaid phone and plant it in your car if they want to frame you and make your life hell even if a conviction is eventually overturned.

user23409 14y ago

With the amount of risqué pictures teens are sending each-other these days, I bet this becomes the worlds largest kiddie porn database. Oh, law enforcement. Gonna be a lot of pervy police officers getting exactly what they want. Not dissimilar to the airport Body-Scanner pictures that TSA agents were caught taking home.

alan_cx 14y ago

Same as a DNA samples then. We Brits let them get away with that one, why would we be bothered by mere phone data? The battle is well and truly over. Well, I say over, it never really started. I really don't know why we don't just have random home searches, you know, just in case, and of course, what have we got to hide? What I would like to know is what will the tipping point be? When will the general public say no, enough is enough?

yequalsx 14y ago
I don't think there is a tipping point. People are already trained to give up their data to Google, Microsoft, Facebook, etc. Governments will share this data eventually and amass a great deal of its own curated data. People in general don't care and I don't foresee a time where they will. The surveillance era is here and it's not going away.

jerlam 14y ago

Looks like a great attack vector to get into a system that has other people's personal information.

anthonyu 14y ago

John Singleton wrote HurtLocker for Android (available at https://play.google.com/store/apps/details?id=com.featureproof.hurtlocker https://play.google.com/store/apps/details?id=com.featurepro...) for this exact reason. It allows you to surreptitiously wipe your phone when you are coerced or intimidated into involuntarily unlocking it.

furyg3 14y ago

How well do these devices work against encryption (like that on the iPhone)?

cmdkeen 14y ago

It is worth pointing out this merely enables you to get your phone back quicker in cases where the police could already seize your phone. It won't be a case of everyone who gets arrested having it scanned. Firstly there isn't any authority to do so, secondly it isn't worth it time wise. I used to be a cop in Scotland and I never arrested anyone where there was a need to do anything with their phone other than try and work out how to turn the damn thing off...

Mordor 14y ago

It's ironic that the Met Police, fresh out of a phone hacking scandal have proposed making things easier.