7 ms·

How Cops and Hackers Could Abuse California’s New Phone Kill-Switch Law

49 points by acheron 12y ago

spindritf 12y ago
Any implementation details? How will the autodestruct signal be sent? And if the consumer can opt out of the kill swtich, wouldn't the thief also be able to opt out? I have a bad feeling that 10 years from now you will have to wipe your phone and install some makeshift build from xda right after purchase just to use it confidently.
- Zikes 12y ago
  Flashing a new ROM wouldn't be enough, malicious software can still live in the firmware and even the SIM card.
byoung2 12y ago
Presumably you could purchase an unlocked phone from a jurisdiction where this law doesn't apply I bet there is a state like Nevada or Texas who won't follow California's lead, and there is always Canada.
- josu 12y ago
  Also >And although the legislation allows users to opt out of the feature after they buy the phone,
- Zikes 12y ago
  Once the phone manufacturers have implemented the software feature, do you think it's likely they would maintain two separate code branches to accommodate California vs everywhere else, or would they just roll it out to all states? I'm thinking the latter is more likely.
  - byoung2 12y ago
    I also mentioned Canada (or any other country really) as a possibility. There is already precedent for a US version vs international versions of phones, with the US versions usually being customized by the carrier, and the international version being unlocked and more vanilla. My wife's Samsung Note is a good example, rather than getting the T-Mobile one, we got an unlocked one from Amazon without all of the carrier bloat.
  - famousactress 12y ago
    There should be an "Occam's Razor"-like principal for this that argues that whatever the laziest possible fucking implementation is the one most likely to be implemented. (I'd clearly guess the latter also.)
- thaumasiotes 12y ago
  I'm intrigued by your model of the world. Have you tried buying furniture without flame retardants in the foam?
  - byoung2 12y ago
    Of course furniture is an absurd example, but I do know of smokers who loaded up on cigarette lighters from other countries with no safety after law was passed in the US requiring safety switches.
deleted 12y ago
[deleted]
golemotron 12y ago
I'd like to see a company like Samsung say "okay, we won't sell our phones in California." In an increasingly integrated world I think it's bad that a single state has the power to change an industry impacting people who are not its citizens. New York State pulls the same sort of thing too.
- justizin 12y ago
  On the other hand, a number of things that people outside of NY and CA refused to fight for on their own, they have for free because of states like this. If you go on the far end of the spectrum from electronics to schoolbooks, you find that there are only two customers for history: California and Texas. You can have the California hippie flavor or the racist civil rights denying Texas version. Since Apple already provides a feature which complies, I don't see how this is a real threat to the industry.
  - privong 12y ago
    > If you go on the far end of the spectrum from electronics to schoolbooks, you find that there are only two customers for history: California and Texas. Purportedly, Texas also has a significant influence on what goes into science textbooks.
    - justizin 12y ago
      "Purportedly, Texas also has a significant influence on what goes into science textbooks." Do they, though? Maybe under mineral sciences and alternatives to evolution. ;) < Disclaimer: I was born and raised in Texas >
      - pessimizer 12y ago
        http://www.nytimes.com/2013/11/23/education/texas-education-board-flags-biology-textbook-over-evolution-concerns.html http://www.nytimes.com/2013/11/23/education/texas-education-...
    - morgante 12y ago
famousactress 12y ago
This is great (if someone manages to kill every phone in California). We need public-understandable demonstrations that ability == eventual-reality. This seems like a perfect opportunity to open the "who-cares-if-you-don't-have-anything-to-hide-crowd"'s minds.
- lotsofmangos 12y ago
  That would be an amusing day in Cupertino for sure.
sologoub 12y ago
How's this different from the current iOS capability to remote-wipe your phone via iCloud?
- hack_edu 12y ago
  The government has the keys.
  - tzs 12y ago
    You just made that up. Here's a link to the bill [1]. It's not long, and not very complicated. You should read it. [1] http://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=201320140SB962 http://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?...
    - serf 12y ago
      "(e) Any request by a government agency to interrupt communications service utilizing a technological solution required by this section is subject to Section 7908 of the Public Utilities Code." Section 7908 : http://www.leginfo.ca.gov/cgi-bin/displaycode?section=puc&group=07001-08000&file=7901-7912 http://www.leginfo.ca.gov/cgi-bin/displaycode?section=puc&gr... It doesn't give them the keys, it just gives them yet another avenue to disrupt service if : (A) That probable cause exists that the service is being or will be used for an unlawful purpose or to assist in a violation of the law. (B) That absent immediate and summary action to interrupt communications service, serious, direct, and immediate danger to public safety, health, or welfare will result. (C) That the interruption of communications service is narrowly tailored to prevent unlawful infringement of speech that is protected by the First Amendment to the United States Constitution or Section 2 of Article I of the California Constitution, or a violation of any other rights under federal or state law.
      - tzs 12y ago
        That doesn't give them anything they didn't already have. Right now, they can go to your phone carrier and tell them to shut down your service. That's probably easier than trying to use a kill switch, since the phone carrier is the one actually providing phone service. Also, note that nothing in the law requires the phone maker to implement the kill switch in a way that makes it possible for the government to use it. As far as I can see, they are free to implement it in a secure (for the owner) way if they want.
tzs 12y ago
> The law raises concerns about how the switch might be used or abused, because it also provides law enforcement with the authority to use the feature to kill phones. This law does no such thing. What they are basing this on is a misunderstanding of this section of the law: "Any request by a government agency to interrupt communications service utilizing a technological solution required by this section is subject to Section 7908 of the Public Utilities Code". That does not grant any authority to law enforcement. It's just saying in effect that they cannot use this new kill switch to bypass the restrictions 7908 imposes on government interruption of communication services. It's simply making sure that the new law is not introducing a loophole that would give law enforcement MORE ability to interrupt communications than they already have. It's kind of like when schools teach kids in sex ed that they should always use a condom when they have sex. That's not supposed to be taken as granting the kids permission to go out and have sex.
- fenomas 12y ago
  No, the article is right. The law mandates kill-switches into existence and then says law enforcement can't violate the utilities code when using them. This is equivalent to saying law enforcement can use the switch so long as it's in accordance with the utilities code. Either way access to the feature comes from the law. The EFF letter even makes this same point: > ..the presence of such a mechanism in every phone by default would not be available but for the existence of the kill switch bill. In essence, SB 962 mandates the technical ability to disable every phone sold in California, and PUC § 7908 provides the necessary legal roadmap to do the same.
  - tzs 12y ago
    I'll comment on you argument in a moment, but first I want to comment on your EFF quote. I don't know what is going on with the EFF, but they are seriously botching it on this. I have a hard time believing that whoever wrote the excerpt you quote from their letter even read the law. They say, "In essence, SB 962 mandates the technical ability to disable every phone sold in California". Every phone? The bill only applies to smartphones. It explains what a smartphone is thusly: -------- begin quote (1) (A) “Smartphone” means a cellular radio telephone or other mobile voice communications handset device that includes all of the following features: (i) Utilizes a mobile operating system. (ii) Possesses the capability to utilize mobile software applications, access and browse the Internet, utilize text messaging, utilize digital voice service, and send and receive email. (iii) Has wireless network connectivity. (iv) Is capable of operating on a long-term evolution network or successor wireless data network communication standards. (B) A “smartphone” does not include a radio cellular telephone commonly referred to as a “feature” or “messaging” telephone, a laptop, a tablet device, or a device that only has electronic reading capability. -------- end quote (It's interesting that under that definition, no iPhone prior to the iPhone 5 is a smartphone). The original article says "The law raises concerns about how the switch might be used or abused, because it also provides law enforcement with the authority to use the feature to kill phones". What does "authority" mean? I generally take it as something more positive or more active than "not forbidden". Suppose the bill said nothing at all about government agency use of the kill switch. Would you say that the bill gives them authority to use the kill switch. I would say no. The provision in the bill adds a restriction to what might be allowed if the bill was silent on this. (I say "might" because I think one can reasonably read 7908 as applying even if the bill were silent on this). Since I think silence would not be a grant of authority, I don't see how allowing less than what silence would allow can be a grant of authority.
tzs 12y ago
> “It’s great for the consumer, but it invites a lot of mischief,” says Hanni Fakhoury, staff attorney for the Electronic Frontier Foundation, which opposes the law. “You can imagine a domestic violence situation or a stalking context where someone kills [a victim's] phone and prevents them from calling the police or reporting abuse. It will not be a surprise when you see it being used this way.” This will depend on how the phone manufacturer or operating system manufacturer chooses to implement it. The law only requires rendering "essential features" of the smartphone inoperable. The law defines "essential features" thusly: • "'Essential features' of a smartphone are the ability to use the smartphone for voice communications, text messaging, and the ability to browse the Internet, including the ability to access and use mobile software applications. 'Essential features' do not include any functionality needed for the operation of the technological solution, nor does it include the ability of the smartphone to access emergency services by a voice call or text to the numerals '911,' the ability of a smartphone to receive wireless emergency alerts and warnings, or the ability to call an emergency number predesignated by the owner." Note that 911 ability is specifically not an "essential feature". Anyone happen to know how Apple handles this? I have not been able to find anything about what works on an iOS 7 phone after you use the activation lock feature from iCloud to kill it.
- justizin 12y ago
  I've used the activation lock, but I didn't really record what was there. IIRC, something like a lock screen, probably with the ability to make emergency calls.
ryanmarsh 12y ago
How Cops and Hackers Will Abuse California’s New Phone Kill-Switch Law FTFY
deleted 12y ago
[deleted]
deleted 12y ago
[deleted]

49 points by acheron 12y ago

Any implementation details? How will the autodestruct signal be sent? And if the consumer can opt out of the kill swtich, wouldn't the thief also be able to opt out? I have a bad feeling that 10 years from now you will have to wipe your phone and install some makeshift build from xda right after purchase just to use it confidently.

Zikes 12y ago
Flashing a new ROM wouldn't be enough, malicious software can still live in the firmware and even the SIM card.

byoung2 12y ago

Presumably you could purchase an unlocked phone from a jurisdiction where this law doesn't apply I bet there is a state like Nevada or Texas who won't follow California's lead, and there is always Canada.

josu 12y ago
Also >And although the legislation allows users to opt out of the feature after they buy the phone,
Zikes 12y ago
Once the phone manufacturers have implemented the software feature, do you think it's likely they would maintain two separate code branches to accommodate California vs everywhere else, or would they just roll it out to all states? I'm thinking the latter is more likely.
- byoung2 12y ago
  I also mentioned Canada (or any other country really) as a possibility. There is already precedent for a US version vs international versions of phones, with the US versions usually being customized by the carrier, and the international version being unlocked and more vanilla. My wife's Samsung Note is a good example, rather than getting the T-Mobile one, we got an unlocked one from Amazon without all of the carrier bloat.
- famousactress 12y ago
  There should be an "Occam's Razor"-like principal for this that argues that whatever the laziest possible fucking implementation is the one most likely to be implemented. (I'd clearly guess the latter also.)
thaumasiotes 12y ago
I'm intrigued by your model of the world. Have you tried buying furniture without flame retardants in the foam?
- byoung2 12y ago
  Of course furniture is an absurd example, but I do know of smokers who loaded up on cigarette lighters from other countries with no safety after law was passed in the US requiring safety switches.

deleted 12y ago

[deleted]

golemotron 12y ago

I'd like to see a company like Samsung say "okay, we won't sell our phones in California." In an increasingly integrated world I think it's bad that a single state has the power to change an industry impacting people who are not its citizens. New York State pulls the same sort of thing too.

justizin 12y ago
On the other hand, a number of things that people outside of NY and CA refused to fight for on their own, they have for free because of states like this. If you go on the far end of the spectrum from electronics to schoolbooks, you find that there are only two customers for history: California and Texas. You can have the California hippie flavor or the racist civil rights denying Texas version. Since Apple already provides a feature which complies, I don't see how this is a real threat to the industry.
- privong 12y ago
  > If you go on the far end of the spectrum from electronics to schoolbooks, you find that there are only two customers for history: California and Texas. Purportedly, Texas also has a significant influence on what goes into science textbooks.
  - justizin 12y ago
    "Purportedly, Texas also has a significant influence on what goes into science textbooks." Do they, though? Maybe under mineral sciences and alternatives to evolution. ;) < Disclaimer: I was born and raised in Texas >
    - pessimizer 12y ago
      http://www.nytimes.com/2013/11/23/education/texas-education-board-flags-biology-textbook-over-evolution-concerns.html http://www.nytimes.com/2013/11/23/education/texas-education-...
  - morgante 12y ago

famousactress 12y ago

This is great (if someone manages to kill every phone in California). We need public-understandable demonstrations that ability == eventual-reality. This seems like a perfect opportunity to open the "who-cares-if-you-don't-have-anything-to-hide-crowd"'s minds.

lotsofmangos 12y ago
That would be an amusing day in Cupertino for sure.

sologoub 12y ago

How's this different from the current iOS capability to remote-wipe your phone via iCloud?

hack_edu 12y ago
The government has the keys.
- tzs 12y ago
  You just made that up. Here's a link to the bill [1]. It's not long, and not very complicated. You should read it. [1] http://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=201320140SB962 http://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?...
  - serf 12y ago
    "(e) Any request by a government agency to interrupt communications service utilizing a technological solution required by this section is subject to Section 7908 of the Public Utilities Code." Section 7908 : http://www.leginfo.ca.gov/cgi-bin/displaycode?section=puc&group=07001-08000&file=7901-7912 http://www.leginfo.ca.gov/cgi-bin/displaycode?section=puc&gr... It doesn't give them the keys, it just gives them yet another avenue to disrupt service if : (A) That probable cause exists that the service is being or will be used for an unlawful purpose or to assist in a violation of the law. (B) That absent immediate and summary action to interrupt communications service, serious, direct, and immediate danger to public safety, health, or welfare will result. (C) That the interruption of communications service is narrowly tailored to prevent unlawful infringement of speech that is protected by the First Amendment to the United States Constitution or Section 2 of Article I of the California Constitution, or a violation of any other rights under federal or state law.
    - tzs 12y ago
      That doesn't give them anything they didn't already have. Right now, they can go to your phone carrier and tell them to shut down your service. That's probably easier than trying to use a kill switch, since the phone carrier is the one actually providing phone service. Also, note that nothing in the law requires the phone maker to implement the kill switch in a way that makes it possible for the government to use it. As far as I can see, they are free to implement it in a secure (for the owner) way if they want.

tzs 12y ago

> The law raises concerns about how the switch might be used or abused, because it also provides law enforcement with the authority to use the feature to kill phones. This law does no such thing. What they are basing this on is a misunderstanding of this section of the law: "Any request by a government agency to interrupt communications service utilizing a technological solution required by this section is subject to Section 7908 of the Public Utilities Code". That does not grant any authority to law enforcement. It's just saying in effect that they cannot use this new kill switch to bypass the restrictions 7908 imposes on government interruption of communication services. It's simply making sure that the new law is not introducing a loophole that would give law enforcement MORE ability to interrupt communications than they already have. It's kind of like when schools teach kids in sex ed that they should always use a condom when they have sex. That's not supposed to be taken as granting the kids permission to go out and have sex.

fenomas 12y ago
No, the article is right. The law mandates kill-switches into existence and then says law enforcement can't violate the utilities code when using them. This is equivalent to saying law enforcement can use the switch so long as it's in accordance with the utilities code. Either way access to the feature comes from the law. The EFF letter even makes this same point: > ..the presence of such a mechanism in every phone by default would not be available but for the existence of the kill switch bill. In essence, SB 962 mandates the technical ability to disable every phone sold in California, and PUC § 7908 provides the necessary legal roadmap to do the same.
- tzs 12y ago
  I'll comment on you argument in a moment, but first I want to comment on your EFF quote. I don't know what is going on with the EFF, but they are seriously botching it on this. I have a hard time believing that whoever wrote the excerpt you quote from their letter even read the law. They say, "In essence, SB 962 mandates the technical ability to disable every phone sold in California". Every phone? The bill only applies to smartphones. It explains what a smartphone is thusly: -------- begin quote (1) (A) “Smartphone” means a cellular radio telephone or other mobile voice communications handset device that includes all of the following features: (i) Utilizes a mobile operating system. (ii) Possesses the capability to utilize mobile software applications, access and browse the Internet, utilize text messaging, utilize digital voice service, and send and receive email. (iii) Has wireless network connectivity. (iv) Is capable of operating on a long-term evolution network or successor wireless data network communication standards. (B) A “smartphone” does not include a radio cellular telephone commonly referred to as a “feature” or “messaging” telephone, a laptop, a tablet device, or a device that only has electronic reading capability. -------- end quote (It's interesting that under that definition, no iPhone prior to the iPhone 5 is a smartphone). The original article says "The law raises concerns about how the switch might be used or abused, because it also provides law enforcement with the authority to use the feature to kill phones". What does "authority" mean? I generally take it as something more positive or more active than "not forbidden". Suppose the bill said nothing at all about government agency use of the kill switch. Would you say that the bill gives them authority to use the kill switch. I would say no. The provision in the bill adds a restriction to what might be allowed if the bill was silent on this. (I say "might" because I think one can reasonably read 7908 as applying even if the bill were silent on this). Since I think silence would not be a grant of authority, I don't see how allowing less than what silence would allow can be a grant of authority.

tzs 12y ago

> “It’s great for the consumer, but it invites a lot of mischief,” says Hanni Fakhoury, staff attorney for the Electronic Frontier Foundation, which opposes the law. “You can imagine a domestic violence situation or a stalking context where someone kills [a victim's] phone and prevents them from calling the police or reporting abuse. It will not be a surprise when you see it being used this way.” This will depend on how the phone manufacturer or operating system manufacturer chooses to implement it. The law only requires rendering "essential features" of the smartphone inoperable. The law defines "essential features" thusly: • "'Essential features' of a smartphone are the ability to use the smartphone for voice communications, text messaging, and the ability to browse the Internet, including the ability to access and use mobile software applications. 'Essential features' do not include any functionality needed for the operation of the technological solution, nor does it include the ability of the smartphone to access emergency services by a voice call or text to the numerals '911,' the ability of a smartphone to receive wireless emergency alerts and warnings, or the ability to call an emergency number predesignated by the owner." Note that 911 ability is specifically not an "essential feature". Anyone happen to know how Apple handles this? I have not been able to find anything about what works on an iOS 7 phone after you use the activation lock feature from iCloud to kill it.

justizin 12y ago
I've used the activation lock, but I didn't really record what was there. IIRC, something like a lock screen, probably with the ability to make emergency calls.

ryanmarsh 12y ago

How Cops and Hackers Will Abuse California’s New Phone Kill-Switch Law FTFY

deleted 12y ago

[deleted]

deleted 12y ago

[deleted]