Grand jury subpoena for Signal user data, Central District of California • Hacker News Board

Re: Grand jury subpoena for Signal user data, Central District of California

#51

Post by raverbashing » Wed, Apr 28, 2021, 11:21 AM UTC

tialaramex wrote: post #50

roflc0ptic wrote: post #46

Earlier quoted context omitted.

The structure of grand juries makes it so that the defense is unable to mount a defense. The fact that grand juries often result in indictment has vanishing little relevance for whether or not it’s a fishing expedition. Further, no one is saying it is a fishing expedition. It’s a request for information that Signal isn’t designed to be able to answer. You’re also just speculating about the nature of the crime, but sa…

Grand Juries are a really weird American thing†. The Grand Jury is entirely dependant on the prosecutor for guidance, so as an outsider it appears to me that their real purpose is to enable politically appointed prosecutors to pretend this anonymous "Grand jury" decided not to prosecute somebody when in reality what happened is that the prosecutor didn't want to. So now it's not the prosecutor's fault an obviously gu…

But trial by jury continues to be used in several countries (maybe in more restricted ways but it still a thing) or is there something special about a "Grand Jury"?

Re: Grand jury subpoena for Signal user data, Central District of California

#52

Post by homero » Wed, Apr 28, 2021, 11:25 AM UTC

raverbashing wrote: post #51

tialaramex wrote: post #50

Earlier quoted context omitted.

Grand Juries are a really weird American thing†. The Grand Jury is entirely dependant on the prosecutor for guidance, so as an outsider it appears to me that their real purpose is to enable politically appointed prosecutors to pretend this anonymous "Grand jury" decided not to prosecute somebody when in reality what happened is that the prosecutor didn't want to. So now it's not the prosecutor's fault an obviously gu…

But trial by jury continues to be used in several countries (maybe in more restricted ways but it still a thing) or is there something special about a "Grand Jury"?

Yes a grand jury is just the prosecutor and jury. It's secret and the defendant doesn't even know. It's a way to start a case, not sure when a prosecutor needs or doesn't need a grand jury.

Re: Grand jury subpoena for Signal user data, Central District of California

#53

Post by tialaramex » Wed, Apr 28, 2021, 11:27 AM UTC

giords wrote: post #34

capableweb wrote: post #31

Earlier quoted context omitted.

Surprisingly, the response from the Signal team hints that Signal is sometimes P2P. This is the first time I hear about this, what is it referring to exactly? I, like you, thought Signal was 100% centralized. > [...] because the data is transmitted peer-to-peer or relayed through a third-party server [...] Attachment A, Section 2C

I believe that voice and video calls work using WebRTC, which is a P2P technology

The options are, either you do peer-to-peer and so your peer must learn the IP address they can reach you on, or Signal sits in the middle of the traffic relaying between the parties.

This trades two different privacy risks, would you prefer that a hypothetical adversary who has successfully seized control of Signal can see which IP addresses are communicating or would you prefer if people you accept realtime calls from or make calls to learn your IP address?

You get to pick which you prefer in the Signal app preferences. [Edited to add: Specifically, if either of you insists on having Signal relay the traffic, then that's what has to happen, otherwise it is peer-to-peer.]

As with anything else involving IP addresses, you could choose to go via Tor, with all the consequences of that.

Re: Grand jury subpoena for Signal user data, Central District of California

#54

Post by danpalmer » Wed, Apr 28, 2021, 11:28 AM UTC

Interesting that they provide last login dates as Unix milliseconds, but rounded to day boundaries (each of these is at midnight UTC). I'd assume that's what they store, which is good, but it's odd that they provide the data with such unnecessary precision if so.

I wondered originally if this would help disambiguate accounts, perhaps if two numbers last logged in at the same timestamp one could guess that they were on the same device or something, but this doesn't look possible.

Re: Grand jury subpoena for Signal user data, Central District of California

#55

Post by krageon » Wed, Apr 28, 2021, 11:30 AM UTC

chippiewill wrote: post #43

swiley wrote: post #27

Earlier quoted context omitted.

Even if it's decentralized there's only one client and they can always push updates to male it send keys/messages back for targeted users. Smartphones in their current form cannot have secure messaging.

> Even if it's decentralized there's only one client and they can always push updates to male it send keys/messages back for targeted users. The clients are open source, presumably you can compile and install the client from source to avoid a bad update being pushed.

You cannot reproducibly build signal, what you get in the play store is effectively closed.

Re: Grand jury subpoena for Signal user data, Central District of California

#56

Post by timmattison » Wed, Apr 28, 2021, 11:34 AM UTC

danpalmer wrote: post #54

Interesting that they provide last login dates as Unix milliseconds, but rounded to day boundaries (each of these is at midnight UTC). I'd assume that's what they store, which is good, but it's odd that they provide the data with such unnecessary precision if so. I wondered originally if this would help disambiguate accounts, perhaps if two numbers last logged in at the same timestamp one could guess that they were o…

I’d guess that’s just how it’s stored and they’re not going to go through any additional effort to make it look nice for a request like this.

Re: Grand jury subpoena for Signal user data, Central District of California

#57

Post by airhead969 » Wed, Apr 28, 2021, 11:43 AM UTC

andix wrote: post #3

Let's see if they try to search the Signal servers for any evidence. And if there is really no information stored. Or if that will disrupt Signal services. The central, non-distributed architecture is always a big concern against Signal.

Yep. Lavabit. Centralized is never raid/DDoS-proof.

Okay boys, take all these servers because evidence is hiding on them and these lefty pinkos aren't helping us find it. Let's get them back to the lab to find out what that evidence is.

Re: Grand jury subpoena for Signal user data, Central District of California

#58

Post by Khaine » Wed, Apr 28, 2021, 11:47 AM UTC

mike_d wrote: post #23

The subpoena is from Homeland Security Investigations at LAX airport. They deal specifically with crimes that involve international transport. So this is human trafficking, drug smuggling, money mules, etc. To be honest the rest of it is just standard "we have some phone numbers" boilerplate. Same thing was probably sent to Facebook, Twitter, etc. with the hopes that someone was dumb enough to login and check their m…

There’s a facetious saying in legal circles about the ease with which prosecutors can secure indictments in grand jury cases: You can get a grand jury to “indict a ham sandwich.”

The legal aphorism has long been attributed to Sol Wachtler, former chief judge of New York’s Court of Appeals, based on a piece that appeared in the New York Daily News in January 1985. Mr. Wachtler told the paper that the state should scrap the grand jury system for bringing criminal indictments. The piece summarized his view, with brief quotes: “district attorneys now have so much influence on grand juries that ‘by and large’ they could get them to ‘indict a ham sandwich.’”

Mr. Wachtler became even more firmly linked to the saying two years later, when Tom Wolfe, a classmate of the judge at Washington and Lee University, credited him with the “ham sandwich” line in “The Bonfire of the Vanities.”

From https://www.wsj.com/articles/indict-a-ham-sandwich-remains-o....

I remember hearing it on Law and Order!

Re: Grand jury subpoena for Signal user data, Central District of California

#59

Post by baryphonic » Wed, Apr 28, 2021, 11:52 AM UTC

tialaramex wrote: post #50

roflc0ptic wrote: post #46

Earlier quoted context omitted.

The structure of grand juries makes it so that the defense is unable to mount a defense. The fact that grand juries often result in indictment has vanishing little relevance for whether or not it’s a fishing expedition. Further, no one is saying it is a fishing expedition. It’s a request for information that Signal isn’t designed to be able to answer. You’re also just speculating about the nature of the crime, but sa…

Grand Juries are a really weird American thing†. The Grand Jury is entirely dependant on the prosecutor for guidance, so as an outsider it appears to me that their real purpose is to enable politically appointed prosecutors to pretend this anonymous "Grand jury" decided not to prosecute somebody when in reality what happened is that the prosecutor didn't want to. So now it's not the prosecutor's fault an obviously gu…

The original idea of a grand jury was to prevent the state (really, the king) from maliciously defaming citizens/subjects, especially ones living far away from the power centers. The system has evolved into one where grand juries will "indict a ham sandwich," as the saying goes. I don't mind the idea of a meaningful check on prosecutors, given that in Common Law they have near total discretion, but the current system ain't it.

Re: Grand jury subpoena for Signal user data, Central District of California

#60

Post by tialaramex » Wed, Apr 28, 2021, 11:52 AM UTC

krageon wrote: post #55

chippiewill wrote: post #43

Earlier quoted context omitted.

> Even if it's decentralized there's only one client and they can always push updates to male it send keys/messages back for targeted users. The clients are open source, presumably you can compile and install the client from source to avoid a bad update being pushed.

You cannot reproducibly build signal, what you get in the play store is effectively closed.

You can build the core code, reproducibly.

As I understand it if you take this code, and the binary blobs of the code that does stuff like video calls, you can verify that's what is inside your Play Store APK.

Now, if you're a tinfoil hat wearer obviously you can consider that maybe the video call code secretly reads your messages and sends them to the FBI, or indeed that the Android OS just ignores this APK and when you install it you get something else entirely anyway.

But it sure looks like the source code is in fact for the app you get.