DC Appeals Court Dumps Lawsuit Claiming Multiple Tech Companies Are Engaged In An Anti-Conservative Conspiracy

Legal Issues

from the come-back-with-something-actionable dept

Early last year, a federal court dumped a lawsuit filed by alt-right figureheads Laura Loomer and Freedom Watch (Larry Klayman’s organization) alleging multiple online platforms were engaging in a government-enabled conspiracy to silence them. Mixing and matching liberally from precedent that didn’t say what the plaintiffs thought it said, the lawsuit tried to skirt around things like Section 230 immunity by pretending this was about being unconstitutionally blocked from entering public spaces.

The lawsuit has now been rejected twice. The DC Circuit Appeals Court decision [PDF] sums up the action at the lower level, noting that it’s affirming the call made by the district court.

FreedomWatch and LauraLoomer (collectively, “FreedomWatch”) brought this suit against Google, Facebook, Twitter, and Apple (the “Platforms”) alleging that they conspired to suppress conservative political views and violated the First Amendment, the Sherman Antitrust Act, and the District of Columbia Human Rights Act. The district court dismissed the complaint, holding that Freedom Watch had standing to sue but failed to allege colorable legal claims.

The platforms being sued aren’t happy standing was even granted to Freedom Watch. But that hardly matters because standing or not, there are no actionable claims in the lawsuit. The Appeals Court points out the obvious to the plaintiffs.

Freedom Watch’s First Amendment claim fails because it does not adequately allege that the Platforms can violate the First Amendment. In general, the First Amendment “prohibits only governmental abridgment of speech.” Manhattan Cmty. Access Corp. v. Halleck, 139 S. Ct. 1921, 1928 (2019). Freedom Watch contends that, because the Platforms provide an important forum for speech, they are engaged in state action. But, under Halleck, “a private entity who provides a forum for speech is not transformed by that fact alone into a state actor.” Freedom Watch fails to point to additional facts indicating that these Platforms are engaged in state action and thus fails to state a viable First Amendment claim.

The court also says there’s no evidence of a conspiracy between the platforms that might engage antitrust law. Freedom Watch speculated some platforms are willing to lose money to shed themselves of “conservative” users to align their user base with the developers’ and owners’ political views. The court points out similar conduct by multiple platforms is not enough to substantiate a conspiracy claim.

Freedom Watch does not explain why either factor tends to show an unlawful conspiracy, rather than lawful independent action by the different Platforms.

The same goes for the plaintiffs’ anticompetitive practices claim.

The only anticompetitive conduct that Freedom Watch alleges (without supporting factual allegations) is that the Platforms conspired against it to suppress conservative content, but not that the Platforms conspired to acquire or maintain monopoly power. A § 2 claim requires the latter allegation.

And, like the lower court, the Appeals Court isn’t willing to stretch the District of Columbia’s Human Rights Act to read more like the Americans With Disabilities Act, which has seen successful claims brought against websites. But being banned from a platform isn’t the same as being discriminated against by a lack of equal access. More to the point for this case, precedent in the district has not equated social media platforms to physical public spaces.

Freedom Watch argues that we should interpret this local statute more broadly to make it consistent with the Americans with Disabilities Act. That Act also contains a provision concerning places of “public accommodation,” and several federal courts have concluded that clause sweeps wider than just physical places. See, e.g., Carparts Distribution Ctr. v. Auto. Wholesaler’s Ass’n, 37 F.3d 12, 19 (1st Cir. 1994). But as the district court noted, other federal courts have reached the opposite conclusion and held that only physical places qualify as places of public accommodation under the ADA. See Freedom Watch, 368 F.Supp.3d at 39. Moreover, the D.C. Court of Appeals is the arbiter of D.C. law and the definitions of “public accommodation” in the two laws are different from one another.

It’s not over yet, though. The plaintiffs can still attempt to waste the time of the DC Appeals Court by asking for a rehearing. Or they can take it to the top level by petitioning the Supreme Court to examine a bunch of baseless claims that couldn’t survive a motion to dismiss at the lowest level of the federal court system. Freedom Watch and Laura Loomer are free to spend their litigation money however they want. But we’re the ones on the hook for paying federal judges to peruse garbage takes masquerading as causes of action. And that’s kind of irritating.

Filed Under: 1st amendment, anti-conservative bias, antitrust, bias, content moderation, dc circuit, free speech, freedom watch, laura loomer, section 230
Companies: apple, facebook, google, twitter

German Constitutional Court Says Unjustified Surveillance Of Foreign Citizens Is Illegal

Legal Issues

from the when-it's-up-to-domestic-courts-to-give-AF-about-non-citizens dept

The German government pretended to be bothered by the NSA’s spying when the Snowden leaks began, claiming surveillance of overseas allies was somehow a bit too much. It had nothing to say about its own spying, which was roughly aligned with the NSA’s “collect it all” attitude. This could be chalked up to “Five Eyes” envy, perhaps. The NSA works with four other countries to hoover up massive amounts of data directly from internet fire hoses located around the world, but Germany has never made the cut.

While the German PM made a lot of noise about being surveilled, Germany’s intelligence agencies continued to perform both domestic and foreign surveillance, resulting in legal challenges to the country’s surveillance programs. The German Constitution restricts domestic surveillance but doesn’t have nearly as much to say about subjecting foreigners to intrusive snooping. Foreigners are usually considered fair game — non-recipients of protections given to citizens of whatever country does the spying.

One legal challenge dead-ended when a German court decided a service provider couldn’t sue on behalf of its spied-upon users. But others continued, and there’s good news to report.

The German government must come up with a new law regulating its secret services, after the country’s highest court ruled that the current practice of monitoring telecommunications of foreign citizens at will violates constitutionally-enshrined press freedoms and the privacy of communications.

The ruling said that non-Germans were also protected by Germany’s constitutional rights, and that the current law lacked special protection for the work of lawyers and journalists. This applied both to the collection and processing of data as well as passing on that data to other intelligence agencies.

The recognition of the extension of domestic rights to foreign citizens is the end result of a lawsuit filed by journalists against the German government. The lawsuit alleged BND’s all-encompassing spying made targets out of everyone, including those normally protected by their own countries’ laws preventing the surveillance of protected speech.

The German government argued that foreigners are not protected by anything — not even the rights granted to them by their governments. The Constitutional Court disagreed, finding that allowing the BND (Germany’s NSA equivalent) cannot be allowed to unilaterally decide who could be targeted by its surveillance programs. Current “best practices” allow the BND to roll up on the nearest internet trunk to collect everything: communications routed through a Frankfurt interchange that handles data flowing from France, Russia, and the Middle East.

If the government wishes to continue hoovering up everything flowing through Frankfurt (and internet exchanges elsewhere in the country), it will need to to codify the process with some guardrails in place — guidelines that will hopefully include some respect for the rights of foreign citizens, including journalists, activists, and lawyers who generally cannot be targeted by their own countries.

Now, all everyone has to do is wait. The German government has until 2021 to amend the law. Presumably, the BND will do whatever it can to appeal this decision that extends domestic rights to foreigners. And it will likely delay any modifications as long as possible to allow for maximum snoopage. Bureaucratic delays aside, this ruling sends a message: the stuff that was considered just normal stuff for maximum national security is no longer acceptable. The judicial system in Germany is unwilling to sacrifice foreigners’ rights for the surveillance whims of an agency that hasn’t shown a compelling reason why it should have access to everything people from other countries talk about.

Filed Under: bnd, collect it all, foreign citizens, germany, surveillance

Former NSO Employees Says The Company Impersonated Facebook To Deploy Malware

(Mis)Uses of Technology

from the so-much-for-the-innocent-middleman-theory dept

As Facebook’s lawsuit against Israeli malware purveyor, NSO Group, continues, more facts are coming to light that undercut the spyware vendor’s claims that it’s just a simple software developer that can’t be blamed for the malicious acts of its customers.

NSO Group argued in court that the sovereign immunity that insulates the governments it sells to (including such abusive regimes as the United Arab Emirates and Saudi Arabia) similarly shields it from Facebook’s desire to prevent it from using WhatsApp to deploy malware. Facebook has since pointed out NSO uses US servers that it owns or rents to deploy the malware it claims it has no involvement in deploying.

More information has come to light, thanks to a whistleblower of sorts who spoke to Joseph Cox of Motherboard. The statements made by a former NSO employee further implicate the company in the dirty doings of its customers (who have targeted journalists, activists, and lawyers).

Infamous Israeli surveillance firm NSO Group created a web domain that looked as if it belonged to Facebook’s security team to entice targets to click on links that would install the company’s powerful cell phone hacking technology, according to data analyzed by Motherboard.

“Pegasus” is the name of the malware deployed via WhatsApp — the preferred tool of governments the company sells to. (It’s branded as “Phantom” when NSO pitches to US law enforcement agencies.) Once successfully deployed, the malware grants government agencies almost complete access to phone data, communications, and functions. Messages can be intercepted, making encryption irrelevant and the phone’s mic and camera can be surreptitiously accessed to record conversations and take pictures.

It’s easier to get targets to activate the malware if it looks like it came from a legitimate source. That’s where the impersonation comes in.

The IP address provided to Motherboard related to a 1-click installation of Pegasus, the former employee said. Motherboard reviewed multiple databases of so-called passive DNS records from cybersecurity services DomainTools and RiskIQ, which show what web domain an IP address related to at different points in time. Throughout 2015 and 2016, the IP address resolved to 10 domains. Some of these seem to have been designed to appear innocuous, such as a link a person could click on to unsubscribe themselves from emails or text messages. Others impersonated Facebook’s security team and package tracking links from FedEx.

The IP address impersonating Facebook is no longer under NSO’s control. Infamous IP protection firm MarkMonitor apparently took control of the domain in late 2016, handing control of it to Facebook to prevent further misuse.

Facebook is also suing domain registrars for allowing customers to purchase domains that appear to be associated with the social media service. This isn’t an unusual move, but it does appear to indicate most purchasers of Facebook-adjacent domains are using them for malicious purposes. Until now, no one’s linked any of these domains to a malware vendor. This is only going to further harm NSO’s assertions that its involvement in malware deployment begins and ends at the point of sale.

Filed Under: impersonation, malware, spyware, surveillance
Companies: facebook, nso group, whatsapp

Hell Hath No Fury Like A Federal Law Enforcement Agency That Keeps Finding Some Way To Break Into IPhones

(Mis)Uses of Technology

from the flow-my-angry-tears dept

Nothing has made the FBI more irritated than its ability to break into phones it swears (often in court!) it cannot possibly get into without the device maker’s assistance. The agency doesn’t want third-party vendors to offer solutions and it doesn’t seem to want its own technical staff to find ways to get stuff from encrypted devices. It wants the government to tell companies like Apple to do what they’re told. It will accept any solution that involves a mandate, whether it’s from a federal court or our nation’s legislators. It will accept nothing else.

The FBI and DOJ’s foul mood over its phone-cracking success and its courtroom failures came to a head recently. A joint press conference announcing not-so-breaking news about the contents of the Pensacola air base shooter’s phones contained a whole lot of off-target griping about a company whose only crime was selling consumer products. Here’s Rianna Pfefferkorn for TechCruch:

You’d think the FBI’s success at a tricky task (remember, one of the phones had been shot) would be good news for the Bureau. Yet an unmistakable note of bitterness tinged the laudatory remarks at the press conference for the technicians who made it happen. Despite the Bureau’s impressive achievement, and despite the gobs of data Apple had provided, Barr and Wray devoted much of their remarks to maligning Apple, with Wray going so far as to say the government “received effectively no help” from the company.

If the FBI’s ultimate aim was to bury the lede — that it could either break encryption or exfiltrate contents without cracking devices — it succeeded. Everyone talked about Apple and how its unhelpfulness led to this petulant press conference where it was stated clearly and repeatedly that Apple was harming the nation’s security by… um… temporarily delaying the discovery of evidence linking the shooter to the terrorist group that had already claimed responsibility for the attack months ago.

As Pfefferkorn points out, Bill Barr and Chris Wray’s roughly concurrent tantrums allowed them to avoid discussing something that should have been much bigger news.

By reviving the old blame-Apple routine, the two officials managed to evade a number of questions that their press conference left unanswered. What exactly are the FBI’s capabilities when it comes to accessing locked, encrypted smartphones? Wray claimed the technique developed by FBI technicians is “of pretty limited application” beyond the Pensacola iPhones. How limited? What other phone-cracking techniques does the FBI have, and which handset models and which mobile OS versions do those techniques reliably work on? In what kinds of cases, for what kinds of crimes, are these tools being used?

After all of this, we don’t know what the FBI is capable of and how often these previously unmentioned techniques are used to bypass or break device encryption. With the only suspect dead, it’s obvious FBI agents didn’t beat the passcode out of him. But that’s all we really know.

The FBI can break into iPhones. But it won’t celebrate that victory because — without a federal government derived mandate — it doesn’t feel like a victory. This “sick of winning” attitude dates back to the FBI’s efforts in the San Bernardino shooting where agency officials were upset a third party solved their access problem before they could talk a court into precedent compelling assistance from cell phone manufacturers.

By portraying this victory as a loss to a tech company, the FBI can avoid talking about its tools and techniques. It can bypass its oversight by glossing over this breakthrough as a very limited success that won’t scale and possibly cannot be used against any other phones. It can also keep its secrets from our nation’s courts, ensuring defendants are left in the dark about the true origin of evidence being used against them.

And that’s if we’re thinking positively. Here’s where we’re at if we bring to bear all the distrust and cynicism the government (at all levels) has earned:

The worst-case scenario would be that, between in-house and third-party tools, pretty much any law enforcement agency can now reliably crack into everybody’s phones, and yet nevertheless this turns out to be the year they finally get their legislative victory over encryption anyway. I can’t wait to see what else 2020 has in store.

USA! USA! USA!

We, the people, are going to get what’s coming to us, even if we haven’t earned it or asked for it. Encryption is public enemy number one, right behind device manufacturers and developers of encrypted communication services. If the first enemy is killed dead, the rest will be manageable. And the general public will be forced into sacrificing their personal security for jingoism-spouting opportunists who will never see the United States as safe enough to entrust citizens with their own decisions about the level of protection they want for their communications and data.

Filed Under: backdoors, doj, encryption, fbi, phone cracking
Companies: apple

Florida Government Decides To Fire Its Data Chief Rather Than Be Honest About Its COVID Numbers

Failures

from the 'we've-found-a-cure-that's-worse-than-the-disease!' dept

We were promised no more deaths by May 15th, but that hasn’t happened. With no one 100% sure what the best options are going forward, this is how states are handling the task of (lol) cautiously “reopening.” A long press conference held by the Trump administration said states could reopen if they hit a number of checkpoints, including a certain amount of testing and a plateau/drop in positive cases.

A number of states appear to have stopped listening after the word “reopen.” Whether or not they’ve hit the CDC’s checkpoints does not appear to matter. A collective shrug about deaths and infections was issued by a number of governors, some of whom are (justifiably) tired of gun-toting residents showing up at the state house to protest their lack of access to haircuts and house parties.

When the data doesn’t match the narrative, there’s only one thing to do: fuck up the data. And the person who’s compiling it. Florida has lots of sunny beaches that are currently too empty to satisfy sun junkies who wish to take advantage of the lengthy shorelines contained in America’s Penis. COVID stats weren’t exactly lending themselves to the “it’s fine” narrative the governor wanted to push. So, the state government did some pushing of its own.

Late last Friday, the architect and manager of Florida’s COVID-19 dashboard — praised by White House officials for its accessibility — announced that she had been removed from her post, causing outcry from independent researchers now worried about government censorship.

[…]

Citing “reasons beyond my division’s control,” Jones said her office is no longer managing the dashboard, is no longer involved in publication, fixing errors or answering questions “in any shape or form.”

She warned that she does not know what the new team’s intentions are for data access, including “what data they are now restricting.”

The means of impartial COVID stat reporting have been seized. Power to the (powerful) people! The dashboard that used to provide an easy-to-understand breakdown of the state’s infection and death rates is being replaced with something that aligns more closely with the aura of sunny healthiness the state government wants to project. Dance through the droplets or whatever. Want to check the state’s new math? Well, you can fuck right off, apparently.

When [researchers] tried requesting the previously available underlying data, DOH officials said that because the data are “provisional” no such requests would be considered until May 2021.

Yet the state regularly publishes provisional data, including for infectious diseases such as influenza.

Here’s the governor’s literally unbelievable defense of his indefensible actions: when someone asks for time off, they’re clearly asking to be fired and for their work to be destroyed.

When first asked about Jones’ dismissal, [Governor Ron] DeSantis on Monday called it a “nonissue.” He said he understood from an email she sent her supervisor that “she was tired and needed a break.”

He then went on to claim — after being given a few days to compose his thoughts — that this firing was due to “repeated insubordination” rather than the researcher just being tired. “Insuboridination” apparently means publishing actual COVID stats rather than manipulated data that provides post hoc justification for the state government’s reopening plans.

The state is now open. Whether or not that’s good for residents and visitors remains to be seen. The state has taken control of a narrative. Since the real numbers aren’t aligned with the state’s official OPEN FOR BUSINESS pitch, the state apparently felt its only option was to fire the person compiling the data.

Now, residents and visitors will have only the state-approved numbers to rely on. Let’s hope they don’t. If this turns into another pandemic nightmare that the state could have avoided by being honest, citizens are going to start wondering why government entities are immunized against manslaughter charges. And those who demanded at gunpoint that the government take the brakes off the state economy are welcome to discover firsthand why an overabundance of caution is preferable to caution that’s been carried off by the wind.

This is a state that has decided to lie to everyone, starting with itself. Govern yourself accordingly.

Filed Under: cdc, covid-19, data, florida, guidelines, rebekah jones, reopening, ron desantis, transparency

Senate Talking Points Say Warrantless Collection Of Internet Use Data Keeps Terrorists From Killing Us

Overhype

from the it-doesn't-say-HOW-it-does-this dept

The Senate tried and failed to erect a warrant requirement for the FBI’s collection of US citizens’ internet browsing data. The amendment to the FISA reauthorization fell one vote short — something that could have been avoided by having any of the four missing Senate supporters show up and actually support the thing. The House has a chance to pass this amendment before sending the bill to the president, but they’ve decided to engage in some unproductive infighting instead.

As it stands now, it still stands the way it has always stood: the FBI can get this information without a warrant. If we can’t have this amendment, maybe we can have some answers about the FBI’s use of this power. Senator Ron Wyden has sent a letter to the Director of National Intelligence asking how often government agencies have spied on Americans’ internet usage. The answer will probably arrive sometime between “years from now” and “never,” given how enthused the DNI usually is about discussing domestic surveillance originating from the Foreign Intelligence Surveillance Act.

Since there doesn’t seem to be any good reason to allow the FBI to continue this warrantless collection, surveillance supporters in Washington have decided to craft some bad ones. Dell Cameron reports for Gizmodo that certain Senators think a warrant requirement allows the terrorists to win.

Requiring federal agents to have “probable cause” to eavesdrop on the internet activities of American citizens poses a direct threat to national security and would force the FBI to stand by while terrorist plots unfold on U.S. soil, according to a leaked copy of talking points distributed to Senate lawmakers this month.

Those talking points appear to have originated in Sen. Mitch McConnell’s office and began circulating prior to the Senate vote on the FISA reauthorization. The talking points aren’t very convincing, though. As Cameron points out, they’re riddled with legal errors and give the appearance that the author(s) believes ginning up a little fear should be all that’s needed to sway legislators who still think the Fourth Amendment should mean something.

At one point, the document erroneously claims that legally requiring the FBI to get a warrant to view U.S. citizens’ web browser data would hinder federal agents from investigating a “known foreign” spy caught photographing a power plant on U.S. soil “over the course of several days.” In this hypothetical, the spy goes on to blow up the Hoover Dam as helpless FBI agents presumably observe from a distance.

Whoa if true. One wonders how the FBI ever manages to investigate anyone. Of course, at some point in the several days between the detainment and the eventual blowing up of stuff the FBI could probably have obtained a search warrant to collect this information. Not that it would necessarily need to since this hypothetical involves a “known foreign spy” the FBI already has under surveillance and whose internet data could be legally obtained from NSA collections without doing anything at all to the Fourth Amendment.

Somehow, the talking points manage to get even dumber than this.

Unbelievably, the leaked documents go on to claim that search warrants for browser data would effectively mean the end of all domestic internet surveillance by the U.S. government: “Internet web browsing and search history information comprise data that forms the building blocks for national security investigations,” it says. “To require probable cause for the Government to obtain the Internet data effectively prohibits any Internet data collection.”

Let’s see if we have this straight: seeking a warrant will irrevocably terminate an investigation. Limiting the government to things it has probable cause to basically sets fire to the national security fabric, leaving us completely at the mercy of terrorists, domestic and otherwise. It’s as if the person writing this believes Constitutional rights and protections are something the government only extends to violent criminals and if they’re respected, the end result is dead Americans.

I guess we should be grateful for these Senators and their efforts. After all, if we, the general public, hadn’t allowed terrorists to attack the US back in 2001, we wouldn’t be in the position we are now: being warrantlessly surveilled by our own government for our own good.

Filed Under: 4th amendment, doj, fbi, fisa, mitch mcconnell, nsa, patriot act, probable cause, ron wyden, surveillance, terrorism, warrants

Arkansas Can't Secure Financial Assistance Site So Governor Decides To Call The Person Discovering The Breach A Criminal

News

from the bless-your-soul,-Governor-Fuckwit dept

The best place for a messenger is six feet under, according to the governor of Arkansas, Asa Hutchinson. Despite being a founding chair of Governors for CS [Computer Science] (according to Slashdot), Hutchinson has decided to blame a security researcher for the state’s inability to properly secure one of its websites. Lindsey Millar, who reported the breach exposing the sensitive information of the site’s users, reports that Governor Hutchinson is trying to villainize the person who stumbled upon the unexpected data flow.

It all started innocently enough when a programmer, who had attempted to apply for financial aid via Arkansas’ Pandemic Unemployment Assistance website, discovered it was exposing Social Security numbers and bank account numbers. This person got in touch with Millar, who brought it to the attention of the state.

That’s where things went extremely wrong.

Beginning on Saturday at a news conference and continuing Monday, Hutchinson has framed the applicant who sounded the alarm as acting illegally. He announced Monday that the FBI was investigating the matter. He said he understood personal information had been “exploited.”

Wat…

“Exploited” how? By informing the press after the state had ignored efforts by the programmer to get the government to fix the problem? Millar says the programmer reached out to two state agencies and received nothing in response. Obviously concerned about this very dangerous data leak, the programmer talked to the press. That’s “exploitation?” I guess it is, if you’re the governor and co-founder of a foundation that claims to be all about that tech stuff and whatnot.

The governor offered up a nonsensical statement that was supposed to reassure assistance applicants that their private financial stuff hadn’t actually been compromised. I’m sorry, but I cannot explain the following:

“We don’t believe that the data was manipulated,” Hutchinson said. “In other words, where someone would go in and change a bank account number, which is what criminals would do…”

WHAT EVEN THE FUCK

No one needs to alter actual, useful, goddamn usable routing numbers to do damage… especially when they have the Social Security numbers to work with as well. The governor followed up this bizarre explanation with one that was even worse: a justification for calling someone, who discovered a data breach, a criminal.

Asked about his rationale for framing the programmer’s actions as illegal, the governor said, “When you go in and manipulate a system in order to gain an access that you’re not allowed to have permission to access, that is a violation of the security that we want to have in place in these systems, and it would be a violation of the law as well, I would think.”

THINK HARDER.

This is baseline CFAA thinking — the kind the federal government engages in when it’s convenient. A person who gains access to data on a website an entity thought was secure is a criminal because it’s assumed that, just because someone browsing the front page of a website wouldn’t stumble across the data breach, any other discovery method must be unethical… if not actually illegal.

Adding “I would think” doesn’t mean the person saying those words is actually thinking. It just means that if they decided to engage in actual thinking, it wouldn’t lead to much insight. The fact of the matter is the applicant only had to alter the URL to gain access to information the website should have locked down tight. This isn’t “manipulation.” It’s Pen Test 101 — something the government should have engaged in before allowing a site collecting bank account and Social Security info to go live.

Trying to kill the messenger doesn’t make you look any less culpable. It just makes you look like a tin pot dictator trying to execute news-makers before it can become news — with the added benefit that it make others think twice before coming forward with information that might embarrass the State.

Filed Under: arksansas, asa hutchinson, blaming the messenger, breach, breach notification, lindsey millar

On The Same Day The FBI Claimed No Vendor Could Crack IPhones, Another Way To Crack IPhones Made The News

(Mis)Uses of Technology

from the way-to-stay-ahead-of-the-news-cycle,-Chris dept

At the same time the FBI director was claiming the private sector (other than Apple) couldn’t help agents break into encrypted iPhones, the private sector was once again demonstrating it could do exactly that. Chris Wray’s remarks to the press centered less on the underwhelming news that the FBI had conclusively linked the Pensacola Air Base shooter to al Qaeda than on Apple’s supposed unhelpfulness.

The FBI claimed it had found a way to access data on the shooter’s phones, but provided no details on its method. Maybe agents brute forced a passcode. Maybe they just found a side door that allowed them to exfiltrate the data they were looking for. Whatever it was, it wasn’t something provided by a vendor. In fact, Chris Wray went so far as to claim the media was misleading the public about the availability of encryption-breaking/bypassing tech.

We canvassed every partner, and every company, that might have had a solution to access these phones. None did, despite what some claimed in the media.

Within a few hours of this assertion by Wray, the media was again reporting on another tech solution for encrypted iPhones. Here’s Olivia Solon for NBC News:

[A]nother tool, previously unknown to the public, doesn’t have to crack the code that people use to unlock their phones. It just has to log the code as the user types it in.

Software called Hide UI, created by Grayshift, a company that makes iPhone-cracking devices for law enforcement, can track a suspect’s passcode when it’s entered into a phone, according to two people in law enforcement, who asked not to be named out of fear of violating non-disclosure agreements.

The software is deployed by existing GrayKey devices — the same ones Grayshift claims can crack iPhone passcodes by installing a user agent to bypass Apple’s lockout countdown. This would be the same software/hardware Chris Wray claims can’t do any of these things, despite extensive reporting on claims the manufacturer itself makes.

After dropping the surreptitious tracker on the targeted phone, the phone is returned to the suspect in hopes that they’ll input their passcode.

For example, a law enforcement official could tell the suspect they can call their lawyer or take some phone numbers off the device. Once the suspect has done this, even if they lock their phone again, Hide UI will have stored the passcode in a text file that can be extracted the next time the phone is plugged into the GrayKey device. Law enforcement can then use the passcode to unlock the phone and extract all the data stored on it.

The software also disables airplane mode and disables wiping of the device. A snapshot of the system is taken to track any attempted deletion of phone contents.

This seems to do all the things the FBI claims no one can actually do. Sure, it won’t scale — especially since it requires a fair bit of subterfuge on the part of investigators and relies on the trust of criminal suspects who might find it suspicious their seized phone has suddenly been returned to them. But no technique for bypassing encryption ever will. And none of them should.

Asking a suspect for the combination to a safe will only unlock that safe, not every safe seized during searches. Phones are as unique as the individuals carrying them. So are the circumstances surrounding the attempted searches. One size should not fit all and the encryption backdoors Chris Wray wants only ensure everyone — criminal or not — will be negatively affected by law enforcement’s newly-greased wheel.

Then there’s the secrecy surrounding this tech. The NDAs Grayshift force on law enforcement customers means judges, defendants, and defense lawyers aren’t being told what’s being used to open up phones and search their contents. We’ve spent years detailing the opacity shrouding the deployment of Stingray devices — something that has allowed law enforcement to avoid having warrant requirements imposed on them. The same thing is happening here. There’s a legal way to do this. But the secrecy imposed by the tech provider tends to provide the cover officers need to operate these unlawfully. Here’s the best case scenario, followed immediately by the most likely scenario.

“Law enforcement use of this ‘agent’ keylogger feature can be legal, so long as the warrant the government gets to search and seize the device spells out that the investigators are permitted to use it,” said Riana Pfefferkorn, associate director of surveillance and cybersecurity at Stanford Law School’s Center for Internet and Society. “In general, I don’t think that magistrate judges authorizing search warrants would expect that the government plans to implant malware on a device it has seized.”

There are solutions out there. And they’re not legislative mandates compelling assistance breaking encryption or backdoors for law enforcement. There are ways to bypass or crack what Bill Barr and Chris Wray have decided to call “warrant-proof encryption.” Pretending there isn’t while using an investigation press conference as a grandstand for Apple bashing isn’t moving the conversation forward. It’s just giving everyone one more reason not to trust Bill Barr or Chris Wray.

Filed Under: chris wray, cracks, encryption, fbi, hide ui, iphone
Companies: apple, grayshift