The StingRay Is Why the 4th Amendment Was Written (2017)
fee.org
fee.org
First, I just want to highlight that reason cell site simulators (the more general term for StingRays/IMSI-catchers) exist is because cell phones cannot authenticate all messages coming from cell towers. I'm seeing some vague comments about "a lack of encryption", but it's primarily more of an authentication issue.
You can read more about why it's primarily an authentication issue + how some of the relevant types of cell network attacks work in this technical post I wrote for EFF: https://www.eff.org/wp/gotta-catch-em-all-understanding-how-...
There are some interesting proposals for fixing this lack of authentication using a certificate-based PKI system, the most promising being this paper from Purdue: https://relentless-warrior.github.io/index.php/publications/.... This solution is very far from production-ready, but it's a much-needed step in the right direction.
Also, why couldn't law enforcement simply coerce the cellular carriers to sign their stingray cert? It's been known to happen for SSL: https://arstechnica.com/information-technology/2010/03/govts...
A warrant is suppose to prevent either of the two cases from resulting in lengthy court battles or death from confusion, and it’s very simple:
YOU SHOW THE PERSON BEING SEARCHED THE WARRANT IN ADVANCE!
That is how you gain authorization... somehow people are being searched and the warrant is either kept secret entirely or not shown to them prior to the search!
That’s literally the fundamental purpose of a constitutional warrant!
Things are so backwards now, search then warrant, shoot first then ask questions, execution before trial...
The way I'm aware of history, a warrant simply allows for an individual or group to take an action on behalf of the state, specifically by statement from a judge, which would have otherwise been illegal. For some individuals and groups, specifically sworn Law Enforcement officers, they fall within warrant exceptions or broad granted "warrant authorities."
It has no relation to a suspect being notified of a warrant and there is no legal mandate to notify the suspect as far as I am aware.
Without the warrant, they have every right to shoot a strange person walking through their property without permission. Since this was before the concept of Law Enforcement officers (I feel like people forget cops haven't always been a thing in the U.S.), people wouldn't just accept some nobody in a uniform as a person of authority.
There weren't cops, so the warrant was the only way to show you had the authority of the state.
What kind of hellish "right" is that?
You should not have the right to shoot someone for merely walking on your property. That is preposterous!
I mean, what would you think?
An intruder most likely wants to steal your stuff, which hardly requires a death sentence, as you seem to want to offer.
1/4 of the time when a person is present for their burglary they are assaulted, robbed, raped, or murdered.
If someone breaks into your home and you shoot them to death they have zero chance of harming your family.
Decreasing the risk of breaking into people's homes incentivizes human trash to convert your valuables to drugs and put your family at risk in the process. Even junkies can grasp that housebreaking is dangerous which is why they try to at least avoid people most times.
Being kinder to garbage changes that dynamic.
Shooting at a burglar sounds like a great way to turn them into a robber or murderer.
In my opinion, providing legal drugs and rehabilitation to addicts, free of charge, would significantly reduce these kinds of thefts and break-ins, in addition to a lot of other huge societal benefits. The system works by only allowing the addict to consume the drug under supervision; they can't take anything outside of the clinic. It seems to work very well in some European countries.
A spree shooter killing innocent people in cold blood is garbage, and a terrorist blowing up a building is garbage, but a drug addict in awful pain due to terrible decisions acting purely on impulse to stymie the pain isn't garbage. They take their life in their hands if they break into someone's home, because that's how any break-in has to be treated, but that doesn't make them subhuman.
If you can't know the intent (and you can't), then you must assume the worst intent and act accordingly. Anything else is naive.
Because I promise you one thing, I look up and see a stranger in my house, I'm attacking them immediately with no thought towards anything except protecting myself and everyone in the house. There will be no questions until it's over with.
If they were just looking to steal something for drugs, that can be sorted out once I've subdued them.
I was just saying drug addicts aren't necessarily garbage. They face lethal force because they've broken into one's home; not because "they're garbage".
> Being kinder to garbage
See, that's where we probably don't think the same way. I consider few people "human trash". Drug addicts I don't count as "human trash", they're just victims of an addiction and in need of help.
People who are not drug addicts and are just plain evil, those would be "human trash" in my eyes (think Mengele).
The words we choose to frame a situation are important. Your mindset comes from a very aggressive mindset, at least that's how it seems to me.
I also regard violation of a family home as such a crime as to render the person difficult to redeem. The kind of people that make such choices aren't just high right now they are also bad unethical people.
The poster above made a conjecture that it was incorrect to assume one was in mortal danger from a robber and that shooting such a person was an overreaction.
I considered that. Actual stats say that 1/4 robbers that break in while individuals are home victimize the people therein and 39% had a weapon.
https://www.bjs.gov/content/pub/ascii/vdhb.txt
This says to me that a house breaker is a substantial risk refuting the prior posters expressed idea.
You will note that both the original poster and I had a point regardless of whether you agree with either.
I'm not even sure what idea
>constant regurgitation of a corporatized and hateful memecomplex
Is supposed to express. What is the memecomplex and wherein is it puked up repeatedly?
Would you like to try to express yourself more clearly and respectfully?
Unless you miss, and take out your family member (or others) yourself.
Also, if you do take out someone in your house... they likely have relatives too. Who may become fairly interested in you and/or your family afterwards. Aka that "violence begets violence" thing. :/
Even if their goal was purely to steal something, things progress very quickly in chaotic situations like those; especially when their state of mind could be affected by drugs or mental illness. And you have no idea what their goals actually were or are.
Milliseconds matter, so there isn't really a better way to handle that situation, in my opinion. It'd be nice if there existed non-lethal weapons which could incapacitate as effectively as lethal ones, but they don't seem to exist yet.
If it were a death sentence, then you'd be allowed to shoot someone in the back after they've exited the house and are running away. And obviously you aren't; that'd be murder.
Why would you assume this? Do you have any studies that back this up? My default assumption, way more logical I'd say, would be that they want to steal stuff. Stealing is logical and rational, under some circumstances. Attacking someone (so putting yourself at risk as the attacker) or killing someone (again, putting yourself at risk immediately and after) are not rational.
Why would you assume that they want to kill or harm you? I'd say that I have Occam's razor on my side with this one. Stealing stuff makes waaaay more sense and again, can be quite logical in many circumstances.
Of course it's not in their rational interest to kill anyone, but what if they're suddenly surprised by a homeowner armed with a baseball bat while they have a gun? They're probably going to shoot and kill the homeowner.
And there is a significant chance they're not in any sort of rational state of mind at that time.
So even if they don't want to kill or harm anyone, they easily may end up doing so due to the circumstances. And then there's the added possibility that they want to steal but would also not turn down the opportunity to sexually assault someone while they're there. And then also the additional possibility that they do intend to harm or kill people while there. That's far too great a risk to treat it as anything but a lethal threat.
You are perpetuating that danger. Now the would-be thief knows you will attack him if you see him, so he has to be ready to shoot you. By powertrippig and "protecting" your home, you are making a banal situation more dangerous for everyone, including yourself.
If you didn't have a gun you might do the more logical thing. Calm the intruder down, and run away.
Its hard for some to imagine standing up for themselves. They fantasize about retreat; rational conversations with thieves; happy outcomes when one has already broken all social constraints.
Finally, by definition, an intruder who's shot on sight isn't going to know, later, that you're going to shoot them. They'll not be robbing anybody, later.
For example, "Manson Family" could not get death penalty for the murder of Sharon Tate and others because California banned death penalty at the time of their trial.
Would you really argue that, if they had means to kill the intruders, victims had no right to do so because whatever happened to them was not punishable by death?
It's not quite that simple. Self-defense must be proportionate, so you can only use deadly force against an imminent deadly threat.
This varies by locale. In Texas, in a situation where the use of force is permitted, the use of deadly force is permitted to stop arson, burglary, robbery, aggravated robbery, theft during the nighttime, or criminal mischief during the nighttime.
Most states permit the use of deadly force to protect against serious injury, not just a deadly threat.
Specific facts of each case will matter, but things that cause serious injury tend to get into the life-threatening realm.
We have a word for this, it's called naive.
That's not being naive, it's being reasonable.
Someone wanting to steal from you doesn't mean the death penalty. Stealing is malicious.
I dislike the term 'bleeding heart liberal', but I think it applies here. There's a difference between 'love thy fellow man' and 'worry about the health of an intruder in your home at 3am'.
Is New York a state where you are allowed to shoot someone for just being on your property or do they have show some hostile behavior. You should probably find out the relevant law before you tell someone he was standing in my kitchen unexpectedly and I shot them, it's self-defense because it might not pass the test.
I'm simply explaining the reasoning behind warrants back then. They were a lot more important because you had to explain "What the hell are you doing here, and what gives you the right?"
This is not a great strategy for defence. You should defend yourself first if you are not able to get away. Or here in my state you may stand you ground and protect your life and property with deadly force. Anyone who truly feels in danger should not call the cops and wait for them to come shoot a stranger in their home...
Response time in an emergency in major cities ranges from 5-10 minutes. Longer the further out from the city.
In many cases, you could call the cops and then make yourself a hamburger, eat it, and finish up the dishes before they arrived.
FYI. My opinion is you don't shoot people on your property. It's bad.
When I was growing in a less than ideal neighborhood, someone purporting to be police rang the doorbell at around midnight on a Saturday night. My father opened the door with his .22 rifle in hand. These supposed cops were "looking for a missing child." My dad wasn't buying it and they left in a hurry, never taking their eyes off the rifle. My father called the police department afterwards and it turns out no child had been reported missing in the area. No, my father didn't shoot anyone - but you can be sure he was ready to do so if necessary.
If someone rings my doorbell in the middle of the night, they're going to meet me with a gun in hand. If someone is so bold as to break into my house while my loved ones are home - I'm not going to wait for the police to show up to protect them. The rational assumption is these individuals are a threat to the safety of my family. I'd rather go to jail than see my family hurt. While rare, home invasions are a thing - this is probably the worst/most-gruesome example:
https://en.wikipedia.org/wiki/Cheshire,_Connecticut,_home_in...
Victimization During Household Burglary https://www.bjs.gov/content/pub/ascii/vdhb.txt
An estimated 3.7 million burglaries occurred each year on average from 2003 to 2007.
A household member was present in roughly 1 million burglaries and became victims of violent crimes in 266,560 burglaries.
Shooting the postman is illegal.
For god's sake I'm not saying this is good, or this is how I want the world to work. I sure as hell don't and I'm not some conspiratorial militiaman.
Historically, i.e. in early America. There were no pigs, so you defended your own property. Typically with a gun. Warrants partly exist to stop someone from doing that, which is what the parent comment is all about.
This sounds revisionist. Bounties, paid on warrants calling for the suspect dead or alive, were common and legal through American history.
Someone tried breaking into my apartment just a few months ago in the middle of the night. I fear for my safety. Surely that's something these people can relate to.
Now that they're a leftist/social justice group I have nowhere to donate.
You realize that the term regulated is different than governed or ruled. The closest approximation for regulated would be to supply in a measured fashion or a pattern which follows a rule. It is from the Latin Regula. A SCUBA regulator does not rule you, it supplies, in measured order, breathable air, which your lungs survival depends on the supply by the regulator.
You need armed men to supply a militia or army. Regulated does not imply government run or even being associated with a militia it implies having armed men available should the militia (we had no standing army at that time) need them.
for reference:
"A well regulated Militia, being necessary to the security of a free State, the right of the people to keep and bear Arms, shall not be infringed."
Regulated armies aside, the right of the people to keep and bear arms shall not be infringed.
It's actually hard to think of an issue where Republicans have been on the right side of protecting Civil liberties in recent history other than gun control.
Are the ACLU leftists or are leftists the ones protecting civil liberties? Sort of a chicken and the egg situation.
Let go of the partisanship please.
Where do you get your information?
If it does, another option would be malicious compliance. Have anyone who's interested run their own StingRay and collect information on Law Enforcement and government representatives. I think the laws around it would change very quickly if you leveraged the loophole against the government.
> Kyllo then petitioned the Supreme Court for a writ of certiorari, which was granted.
- your location in time and space
- the numbers you contacted
- the duration of contact
If you were spying on someone, what would you rather know: all the above metadata you listed, or a full recording of all their calls?
That depends entirely on the purpose of the spying.
If you're spying with a goal of assassination, the location data from their morning commute might be far more valuable.
The only secure option is using an external WiFi or cellular data router for Internet connectivity. The router can of course be geolocated. And adversaries may gain some access. But it should be possible to prevent access through it to the phone. That is, it's a firewall.
Then do end-to-end encrypted Internet stuff, messaging and VoIP. And by using some mix of VPNs and Tor, adversaries won't even see most metadata. Except for communication timing, of course.
See https://blog.torproject.org/mission-improbable-hardening-and...
Edit: But this still doesn't protect from some third party with root rights on the phone. For Android, the Copperhead OS might be enough. But I don't know enough to know. And for iOS, I suspect that you're stuck trusting Apple.
The only exception to this is the checkm8 vulnerability, which can be performed on an A11 and older chips (so iPhone XR/XS/XS+ and 11/11 pro/11 pro max aren't vulnerable) from DFU mode, which doesn't need the device passcode.
Is that true?
Could one somehow enable updates through pure TCP/IP?
Maybe same for Android?
Except that you'd arguably want to update it locally with the Copperhead OS.
> If your computer can’t communicate with Apple's software update server, you might see one of these messages.
The carrier setting thing hasn't ever been use for a jailbreak exploit AFAIK so chances are it's not a good attack vector.
From your other comment:
> But it mentions the option of wiping baseband firmware
iOS also has signature verification for its baseband, since trying to load an incompatible one during a downgrade[0] breaks Face ID / Touch ID.
But ya, this is all "trust apple to not do anything". They've made a good stance with refusing the FBI request[1], but the FBI got into the phone anyways[2].
0: https://github.com/tihmstar/futurerestore
1: https://news.ycombinator.com/item?id=11116274
2: https://venturebeat.com/2016/03/28/u-s-government-gains-acce...
And under what circumstances does the phone leave airplane mode, and go back online.
But even if that were solid, you'd still be ~unable to install apps that Apple doesn't provide. Unless you play the developer game, and I gather that's limited in app number, and how long they'll stay functional.
I mean, if Apple says airplane mode turns off the cell radio, that’s a falsifiable claim, so you don’t have to take it entirely on faith. It might be possible to hide it in the UI, but you can’t hide a radio signal.
Say you set airplane mode. And then the phone sleeps. Will it still be in airplane mode after you wake it?
Or say you shut the phone off, and restart it. Is it still in airplane mode?
That's an issue because, as soon as it's not in airplane mode, it knows where it is.
And that reminds me, does airplane mode disable GPS? Because if it doesn't, it's more or less pointless, from a geolocation perspective.
>Or say you shut the phone off, and restart it. Is it still in airplane mode?
Yes.
>And that reminds me, does airplane mode disable GPS? Because if it doesn't, it's more or less pointless, from a geolocation perspective.
Why does that matter? You can turn location services off. Moreover, GPS functions passively. Turning it on doesn't transmit your location to anyone.
> Why does that [GPS] matter?
GPS matters because it's important that the phone doesn't know where it is. I mean, if it doesn't know where it is, there's no need to worry that adversaries will access the information.
> You can turn location services off.
Off entirely? Even for the OS? Or for rogue apps?
> Turning it on doesn't transmit your location to anyone.
No, but it generates location information that could leak. And if the phone uses WiFi to supplement GPS, it necessarily communicates with some remote server.
So your threat model is that you can't trust the device itself? If that's your threat model, you'd probably need a phone with hardware kill switches. Also, if you can't trust the device itself, why would you be carrying the device around? What would you use it for?
>No, but it generates location information that could leak. And if the phone uses WiFi to supplement GPS, it necessarily communicates with some remote server.
On android you can explicitly disable that ("device only" in location settings). There's no such option on ios, although you could still disable wifi/bluetooth and still have working gps.
Yes. I don't trust a phone OS where I lack root privileges. And I entirely don't trust the baseband.
> If that's your threat model, you'd probably need a phone with hardware kill switches.
Yes. Or with disabled GPS, baseband and WiFi. And with Internet connectivity via external WiFi router, or cellular modem/router.
> Also, if you can't trust the device itself, why would you be carrying the device around? What would you use it for?
I'd use it as a phone. Albeit just using VoIP.
And if I had all the iffy stuff in a separate device, connected via USB, I could trust the phone as much as I trust the host machine I'm using now.
I mean, I'm working in a Debian VM that hits the Internet through a nested VPN chain. And the Debian host has no access to GPS or WiFi. So I'd want to replicate that on a phone.
With that in mind, there's not really any kind of reasonable way to hide what devices are connecting to what tower. This is where location information comes from. It's really an inescapable part of how cellular devices work.
Inbound / outbound numbers are something that has to be available for similar reasons. There's also clear legal precedent making those accessible to law enforcement and not requiring a warrant. There's little to be gained by trying to encrypt them, even if it was possible.
Call and text comments are the things here that can be encrypted. It's not something the phone companies are in a rush to do.
The comment from mirimir elsewhere in this thread reminds me that this is kind of an overstatement, or at least that the details are complicated.
You could gain a lot of privacy in this regard by separating mobile data services from telephony and identity. For example, you could imagine paying for mobile data anonymously, either using existing prepaid mobile data services or using a hypothetical future service with blinded payment tokens and only extremely-ephemeral device identifiers. Then you could imagine getting all of your identity and communications services from someone totally independent of your mobile data provider. If the mobile data provider cooperated with your application-layer communications service provider more than you wanted, you could try to create your own service instead, or try to route at least the messaging setup part of the process via Tor or other proxies, so that the mobile data operator and application-layer intermediaries didn't even know about the connection.
I'm not sure anyone other than privacy advocates would consider this progress relative to the current situation; certainly carriers and governments would like it a lot less (it might already be illegal in some jurisdictions in various ways), and most users would probably find that it increased cost while decreasing reliability and usability of some services. It could also make it harder to use the network to investigate or deter device theft, as well as harder to investigate application-layer fraud and account hijacking.
To be clear about what could change, it's true that towers will always know which devices are connecting to them at a particular moment, but this could in principle be separated from billing, identity, and any kind of persistent identifier. So they don't have to know that a particular device is being used by you, or that a particular device is being used by the same person who uses a particular application-layer identity.
The other problem in trying to get there right now without carriers' and governments' cooperation is that, since you can't rotate hardware identifiers on GSM interfaces, a carrier can see your movement patterns for the lifetime of your use of a particular device, and can probably determine that those movement patterns are similar enough to another device's movements that they're probably used by the same person.
Sometime I hope to write a long article on possible non-metadata-collecting mobile communications futures. It's a really interesting topic.
You can't trust cell companies to help you against the government.
I don't buy this reasoning. It suggests that cell companies will roll over to any law enforcement demands. If that's the case, why don't law enforcement ask cell companies for their cell tower logs directly? Why spend thousands of dollars on equipment when the same information is an email away?
A service which receives information from an app reporting which cell towers are in range of the phone. The server triangulates the positions of cell towers and updates users about their authenticity.
-from definitely not a cop
So it's not about one particular organization or foreign government doing shady stuff.
So "likely fake" => "almost certainly true." FTFY.
Or site them in embassies, where the FCC can impotently yell through the locked gate.
Two can play at that game. The FCC can retaliate by setting up jammers with directional antennas pointing towards the embassy.
OTOH what's happening in the baseband processor is impenetrable, and that processor has much more control over the device than a cellular modem would.
But why did we end up with baseband radios instead of cellular modems?
Is it because they grafted "computer stuff" on phones? Instead of adding cellular capacity to computers?
Or is it just because we can't have phones without surveillance? All those wiretap-ready requirements, I mean.
All rather moot as these things are mostly used for various forms of illegal surveillance. The police have to keep their activity as secret as possible. That includes the fact that they are using them in the first place.
This whole issue isn't new. The police normally do, or get others to do, surveillance that is illegal in various ways. The existence of these sorts of devices is an expression of a kind of desperation. Privacy is getting too good. So this might actually be a good thing if this forces a long overdue discussion.
This gets into some interesting legal law. If you are a normal private citizen, wiretapping without the the caller's permission is always a crime.
However, The Government can apparently wiretap if:
1. There is an executive order allowing it from the president directly. This may or may not be a national secret. This may or may not be a 4th amendment violation. But if it's a secret, how would you know whether or not it's a 4th amendment violation?
2. There is congressional authorization (by law) in place that allows the government to perform warrantless wiretaps.
3. There is an existing wiretap warrant in effect that allows the recording of an individual or organization's telephones. This is how the FBI, DEA, etc, get their wiretaps typically.
4. A court has held the wiretapping on each of the three instances above was legal.
Edited to add:
Before 9/11 the government typically respected the 4th Amendment in day to day operations ("Look before you leap"). After 9/11 the respecting the 4th amendment was seen as "pre-9/11 thinking" and forced a shift to early interception ("Easier to ask forgiveness than permission").
I understand the case being made, but these kind of systems work by identifying broadcast messages from handsets by providing a stronger Cell Reselect Offset path and a handful of other parameters that make the phone register with the "tower."
It's the same conceptually as if you were broadcasting a low power AM radio signal and the police tuned to your station. Your broadcast signal isn't private. Maybe it should be, but I'm not sure how that would work with GSM/CDMA systems as designed.