France passes bill to allow police remotely activate phone camera, microphone

edit: Over a stolen phone, no less, not even a person being in danger.

I wouldn’t be surprised if many jurisdictions around the world had similar systems.

if the information they gather is to be admissible in court as evidence against a person. Police do not need a warrant to save the life of a person.

That was about what LTE could do. With 4G, they got it down to 20-50 meters. Now they can do much better.

https://www.ericsson.com/en/blog/2020/12/5g-positioning--wha...

From https://en.wikipedia.org/wiki/Enhanced_9-1-1:

  To locate a mobile telephone geographically, there are two general approaches. One is to use some form of radiolocation from the cellular network; the other is to use a Global Positioning System receiver built into the phone itself. Both approaches are described by the Radio resource location services protocol (LCS protocol).

NB I worked in a such place, my phone would be in low 40-50% at the end of the work day, despite being able to endure two days easily if I would be at some other place.

Abusing emergency location services is a much better explanation here. They can ping the device for a short time and it'll do its best (using A-GPS and WiFi) to provide an accurate position, without involving anyone since it's fully automated. Collecting positions from a carrier's network infrastructure is a more complex and slow task in comparison.

Phone triangulation works by getting signal strength on 3 or more towers, and getting location from that. That's how it works on WiFi as well. Access points see the clients, and each other, and if you have enough data points, you don't even have to configure the locations of the access points. Of course, the location you get back is relative to the access points and the distance between them, so systems provide a quick way to convert to distances based on one or two measurements.

So please don't think 3G is going to protect you from triangulation. It isn't. Now they're decommissioned but even hospital pagers can be triangulated (some of them aren't even 1G, though anything remotely recent is just a cell phone in disguise)

Because of the "emergency services" mandate from governments it works without the sim being registered. Phones MUST be able to immediately call emergency services so sim or no sim, they are registered on the cell phone network using the number of the cellular modem hardware in the phone, the IMEI number. Phones without a SIM or eSIM can be triangulated. Phones that have never had a sim can be triangulated. Phones that had a sim, but now don't (you keep your phone on but have taken the sim out), can be triangulated based on the phone number of the sim (by looking up the IMEI that last used that SIM, then triangulating the IMEI). These systems can track mobile phones as they move, even in places where the signal is so weak phone service doesn't work (though of course, this doesn't exactly help with accuracy)

Of course whether all this works depends on the competence of the large telcos and the police in a specific country. What I said above is what's possible, not what is actually done. What another poster said is true: telcos have internet portals, accessible to the police (and ...) where you enter some information and get location back. This is generally demanded by governments, as the telco is not allowed to know WHO gets tracked by the police in most countries. Yes, in the US telcos are allowed to know, and they can even legally refuse to track someone, but in most of the EU this is not true.

Whether airplane mode prevents your location from being monitored depends on the phone.

In other words, if you found yourself in a dark room with a thousand English speakers who all sounded like Jesse Pinkman, what country would you assume you were in?

If you turn your phone off and immediately put it in a Faraday bag, how would it receive a remote command to turn on and start recording audio?

Google don’t index sites which contain that kind of information. :)

More seriously, I too would have bought a Fairphone (for ethical reasons) to replace the crap second-hand Android phone that I’d been using for the past 8 years. However, I recently received a gift of a new iPhone so I probably won’t be getting a new phone for another 8 years or so. The iPhone doesn’t have any bloatware and it does have lots of options for security and privacy so I’m happy to use it from that point of view. Aside from not being able to remove the battery, I don’t think the average user can do much better than that, given that they have no insight into or control over the baseband layer.

I’ve never owned a Pixel but I’d expect (hope) that one purchased directly from Google would be similar to in iPhone bought from Apple.

If the population does not support the law, the government could be potentially replaced.

But the most probable conclusion is that the population at large would not care.

Is that a lot?

In the US the major cities have police budgets of between $200 million and $5 billion

But any surveillance capability results in “good” as well as bad actors, frustrated with the current limits, asking for just a little more formal power or finding ways to justify informal drift in practice.

The only way to stop surveillance creep is openness and clear principles more coherent than a recursive “well they have been responsible so far, so far as we know” argument.

> does the French government have a bad track record of abusing the capability of eavesdropping any phone communication?

I'd rather look into possible future scenarios, I don't know about past cases, but I don't really follow french politics. I know discussing politics is HN is not encouraged, so I'd just rather suggest to look up what's coming for France (and EU) if the current government fails and major powers switch. Sorry if you already know this.

> has this capability been useful for law enforcement?

In Hungary, Pegasus was used to eavesdrop on many citizens who were simply in an opposing position. Law enforcement is a good cover for data collection and of course can be effective, but we need transparency and safety to see if these tools are abused or not. There are no good answers I'm afraid.

But the last time I read reported unhandable blabbering devoid of awareness and mental competence, attributed to a "minister of the republic", was just minutes ago. When you hear utterings like "it will save lives" - completely alien to conscience of quality of life, good reason, cleanness and propriety, rejection of absurdity, collaterals etc. - I am afraid they may actually "believe" that (or, better, just "sit on that", "hold on that", "cling to that" in some internal economy).

I just did some brief research, and it seems that it was the case prior to some point in time between 2008 and 2019, but it is now hard-wired. It is discussed near the end of https://daringfireball.net/2019/02/on_covering_webcams

The engineer quoted in the article pointed out that it may be possible (at least in 2019) to briefly turn the camera on - flashing the led too quickly for someone to see.

I didn't find a discussion of this issue in the May 2022 Apple Platform Security guide.

A lot of firmware, and firmware signature validation, is ... not very well done.

Practically it's often not worth it (you already had root+ access. It's doable, but not simple and less uniform applicable.).

But there have been known cases of viruses tryign to persist themself in the firmware of connected devices (which in this context includes all internal devices including the motherboard).

You mean, a conspiracy in the past to allow governments to sample/siphon data has been proven. That's a pretty different thing than having the entire market physically designing their product so that the government can use it to spy on people.

I don't doubt at all that the government would like companies to do that (they've already openly asked for it regarding encryption after all), but jumping to "it's a(nother) conspiracy!" when there are some pretty damn good explanations that are much closer to Occam's Razor seems irrational to me.

I don't think the tech companies deserve our trust, but I also think that if we go around seeing ghosts and conspiracies in every shadow and under every rock, it's not going to mean anything when the *next Prism happens because everyone will see "the boy who cried wolf" or say "those people always think it's a conspiracy."