Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

ACLU sues Homeland Security over 'stingray' cell phone surveillance

techcrunch.com

Post reply on HN
Print view View original

101–110 of 163 posts

Re: ACLU sues Homeland Security over 'stingray' cell phone surveillance

#101

Post by vageli »

jammygit wrote: post #64
mrandish wrote: post #52

Earlier quoted context omitted.

Thanks for sharing. Sounds like a useful project. > don't make records on search warrants even remotely easily available to the public, It seems like the right reform would be for all approved search warrants to be automatically posted online one year after issuance.

If an innocent person had a warrant issued for them, and they were cleared, I bet employers would still routinely query those records if they were able to. It could affect people’s lives if it was too public

> If an innocent person had a warrant issued for them, and they were cleared, I bet employers would still routinely query those records if they were able to. It could affect people’s lives if it was too public

I know it is unlawful to ask about arrests without convictions as a precursor to employment in at least a few jurisdictions in the US. [0]

[0]: https://www.workplacefairness.org/criminal-records-workplace...

Re: ACLU sues Homeland Security over 'stingray' cell phone surveillance

#102

Post by geomark »

clSTophEjUdRanu wrote: post #34
calibas wrote: post #12

Stingray use requires a warrant and every case should be dismissed where one was used without a warrant. I'm sure that's the main reason they want to hide the use of stingrays, they know they're doing something wrong. Police having the ability to spy on everyone with little to no oversight is nightmarish authoritarianism, it's completely against the spirit of American democracy, not to mention in violation of The Con…

Any smart, ethical police department would go for a warrant. I'm friends with someone in law enforcement and they say the last thing they want is evidence tossed. Often they get warrants they don't even need just so there isn't a chance of having evidence tossed later.

They probably can't get warrants for what they are doing, which is trawling large swaths of traffic hoping to find something useful.

Re: ACLU sues Homeland Security over 'stingray' cell phone surveillance

#103

Post by PeterisP »

abeppu wrote: post #24

Some informed person can probably tell us: are there any technical developments on the horizon which could plausibly make stingrays unviable? From a lay perspective, it seems like cell tech hasn't been designed to meet some criteria that ought to be achievable. - Are there future cell technology standards being planned which would make it harder for a 3rd party device to impersonate a cell tower? (e.g. the police wou…

The key factor is the compatibility with international roaming - customers, manufacturers and operators really want the phone to "just work" when you step out of a plane in a random place where the only cell tower in range is run by an operator that was established after your phone was made. There can't be a global list of 'trusted operators' for political reasons (long story), and in order to make calls, your phone needs to work with that operator directly - it can't do end-to-end to your home provider, your data streams won't get routed halway across the world and back for no good reason, they'll route only the billing info and metadata as per the roaming agreements.

The other problem IIRC is virtual towers - when operator A gains improved coverage by renting capacity on a tower of operator B, they want the phone to seamlessly connect to that tower as if it's run by operator A (even if it's not) without the phone being able to inform the customer that hey, you're now connected to operator B - because it might rise confusion about roaming charges, and also give bad PR about coverage which might suggest the customer to switch to that competitor.

What could work is the combination of (a) your phone being able to cryptographically verify if it's really connected to your 'main' operator or someone they explicitly authorized (isn't this something that 5g and even 4g protocol supports?) and (b) requiring explicit confirmation if connecting to someone that's not. Of course, (a) would mean that police Stingrays would be recognized as legitimate cell towers, they'd need cooperation from the cell network, but's IMHO not really a problem, just some paperwork whenever they need to activate a new batch of intercepting devices.

Re: ACLU sues Homeland Security over 'stingray' cell phone surveillance

#104

Post by sebasmurphy »

fooey wrote: post #14
calibas wrote: post #12

Stingray use requires a warrant and every case should be dismissed where one was used without a warrant. I'm sure that's the main reason they want to hide the use of stingrays, they know they're doing something wrong. Police having the ability to spy on everyone with little to no oversight is nightmarish authoritarianism, it's completely against the spirit of American democracy, not to mention in violation of The Con…

The problem is knowing a Stingray was ever used in the first place. It's been documented that the police routinely utilize parallel construction when they discover things through illegal means in the first place. https://www.wired.com/story/stingray-secret-surveillance-pro...

Or when challenged they drop the charges as to not disclose the true "source".

https://arstechnica.com/tech-policy/2014/11/prosecutors-drop...

https://arstechnica.com/tech-policy/2015/04/alleged-getaway-...

Re: ACLU sues Homeland Security over 'stingray' cell phone surveillance

#105

Post by abvdasker »

no_opinions wrote: post #87

Why not focus policies around using the surveillance tools? The tools should be as powerful as possible. To keep people safe, shouldn't infrastructure be powerful enough to tap anything instantly with proper authorization, even backward in time? Why not? Then we're focused on making rules better. Isn't that the best thing to do in a system of laws and standards? Imagine if you could change any aspect of the system to…

> The tools should be as powerful as possible.

I think a lot of people would disagree with this premise. The argument against it is basically that abuse of powerful surveillance technologies is inevitable precisely because the technology is so powerful. In reality, law enforcement is only incentivized to catch criminals, not necessarily to protect people's privacy or personal freedoms, so LE will abuse these capabilities 100% of the time they have access to them.

A more subtle argument is that bureaucratic oversight of LE is almost always impotent to reign them in and has every reason not to due so due to a lack of accountability. A "fair, ethical" system is fundamentally incompatible with one in which law enforcement has sweeping surveillance capabilities and the lack of oversight which always results from any sufficiently large/slow/complex legal system.

Re: ACLU sues Homeland Security over 'stingray' cell phone surveillance

#106

Post by BloominOnion »

pacala wrote: post #50
calibas wrote: post #12

Stingray use requires a warrant and every case should be dismissed where one was used without a warrant. I'm sure that's the main reason they want to hide the use of stingrays, they know they're doing something wrong. Police having the ability to spy on everyone with little to no oversight is nightmarish authoritarianism, it's completely against the spirit of American democracy, not to mention in violation of The Con…

OTOH, Google and Facebook, with annual incomes larger than the GDP of a medium European country, can log everyone’s every breath, on the internet and, more recently, in real life, with impunity. I just can’t wrap my head how the municipal police doing it is “nightmarish authoritarianism”, but big adtech, de facto way more powerful, gets a cursory pass.

I think most people would view it from the lens of Police inherently having legislated power over people and the ability to detain, arrest and/or charge people.

Big adtech have insane amounts of data and deep pockets but realistically no means to carry out the above, however that doesn't mean big adtech should get a pass.

Re: ACLU sues Homeland Security over 'stingray' cell phone surveillance

#107

Post by blotter_paper »

0x0aff374668 wrote: post #88
blotter_paper wrote: post #62

Earlier quoted context omitted.

> Why can't we encrypt calls and texts in a way which doesn't let all this stuff get read? Like (handwaving) either trust the network and encrypt with a key they provide, or else some form end-to-end encryption (where maybe generating keys is part of what happens when you activate a sim card or something)? We can have E2E encryption on cellphones today, just make calls and send texts over Signal (with other people wh…

Interestingly, at DefCon last year, a presentation was talking about how in Africa there are interposer SIM shims that slip over the top of the simcard and provide additional functionality. Citation needed, but I was impressed they could fit a small MCU in such a thin form factor!

Oooh, I like that idea. I've seen those used to bypass carrier locks, but never considered the possibility of restricting write access with one.

Re: ACLU sues Homeland Security over 'stingray' cell phone surveillance

#108

Post by nitrogen »

cartoonworld wrote: post #100
toomuchtodo wrote: post #93

Earlier quoted context omitted.

Tower data is public record. Here’s a search aggregator: http://www.antennasearch.com The issue is that the baseband should be handshaking cryptographically with your provider’s towers to prevent MITM attempts, and no downgrade should be possible. Between eSIM and 5G, honestly surprised it’s not a standard yet.

Antennasearch is a good resource, and somehow the database update functions still work, but it appears unmaintained, somewhat janky, and the copyright notice reads 2004-2009. I resent the popup windows and the google maps integration is broken. Luckily, there are several community efforts to map the cell coverage. Check out https://opencellid.org/ which is an open source WiGLE-esque cell location collection. You can…

Are they not registered with the FCC?

Re: ACLU sues Homeland Security over 'stingray' cell phone surveillance

#109

Post by Teknoman117 »

notlukesky wrote: post #95
bootlooped wrote: post #39

Earlier quoted context omitted.

I don't think American carriers care at all about preventing government spying.

The CEO of Qwest did and he was subsequently jailed. https://www.washingtonpost.com/news/the-switch/wp/2013/09/30... From a YCombinator comment: "The way that Qwest CEO Joseph Nacchio so meaningfully resisted the government that he was convicted of insider trading for telling people his company would be successful when it actually relied on a government contract that was pulled in retaliation, which he couldn't use a…

If he's telling the truth, major props to that guy for sticking to his principles regardless of what he had to lose.

Re: ACLU sues Homeland Security over 'stingray' cell phone surveillance

#110

Post by zw123456 »

Generally if the RSRP or RSSI increases significantly that is a dead give away you are on a stingray. You don't really need an app to see that (google how to see it for your phone type). Of course, it is always possible that your carrier just turned up a new site closer to you but that is not something that happens often and you can usually notice it.

Some comments about mm-wave 5G, keep in mind that mm-wave != 5G. But on mm-wave stingray becomes more difficult due to the high directionality of short wavelengths. But at lower bands, there is no advantage of 5G over 4G in terms of resilience over stingray types of attacks (which are basically a L1 middleman attack, similar to age old wifi types of spoofs).

Post reply on HN