Hacker News Reader

Comment by rideontime | Hacker News Reader

What amazed me most from the FBI affidavit[0] was the sheer arrogance of these people. Baugh seriously thought he could make up some story on the spot to explain eBay employees being on the opposite side of the country and the police would just drop it.

[0] https://www.scribd.com/document/465728291/FBI-Affidavit-agai...

View on HN

Another insider threat program gone rogue...

How many insider threat programs at various firms are really being used to implement systemic discrimination?

I thought it was becoming common knowledge many Silicon Valley campuses and other corporations use an IMSI catcher/Stringray to capture personal cellular communications of its employees...

https://www.businessinsider.com/ex-tesla-employee-claims-the...

https://www.theverge.com/2017/10/3/16408724/waymo-uber-lewan...

https://www.reuters.com/article/us-apple-nuvia-lawsuit/apple...

I am pretty sure none of these people used their corporate issued cell phones...

I would not be surprised if ebay hired a firm to park an IMSI catcher machine close enough to the home of these people.

The reason they felt secure enough to deny these accusations implies they have all done this before.

Lots of my coworkers use their corporate phone as their personal phone. There’s a process for porting your phone number over when you get the corp phone. People do it because it’s simpler to have one phone, or just to save money. I would never do this but I understand why someone with a different background and worldview would.

Myself and probably most of my coworkers just use our personal phones as company phones. Not sure if you see that as different. Also don't do activities on them that are... criminal.

Suppose I buy an iPhone from Apple, and load up a work profile on it. I need to trust that Apple doesn’t give my personal data to the employer profile, and my employer doesn’t have a zero-day to circumvent those controls. I also need to trust that the phone company (or my VPN) provider doesn’t give my browsing history to my employer. I’m pretty comfortable with all of those assumptions.

Now instead suppose my employer gives me an iPhone with a cell plan they are paying for. Now there are more questions - is this a vanilla iPhone or is some kind of tracking software installed on it? Perhaps the phone company will freely give up my browsing history to my employer? I’m a lot less comfortable with this. It feels like my employer has legal authority and technical capability to see a lot of what I’m doing on the phone.

Edit:

> Also don't do activities on them that are... criminal.

I’d not worried that employer would get me in trouble with the government for criminal activity. My behavior is a little more constrained by worries that somebody at company could be analyzing my browsing history for violations of company policy, which in a worst-case scenario could get me terminated or cause me to face civil litigation, especially if I were to do a startup.

I generally agree although you may still be asked to install MDM on that phone to access, say, work email. How obtrusive that MDM is depends on your company’s policies.

This has nothing to do with corporate supplied cellular phones. There are corporate campuses where your personal cellular phones will be tracked with an IMSI catcher/Stingray. All incoming and outgoing texts will get captured by a Stingray for the Insider Threat program to monitor. Voice calls as well. Maybe even data...

I am not saying anything criminal was discussed on these phones...

If you look for higher paying jobs and discuss the matter on your personal phone with a recruiter during lunch time... Insider Threat programs will report you to your boss and HR.

If you are socially active in your private time and receive a text about a meeting, these activities will be reported to your Insider Threat program and hinder your career.

If you are having an affair (not with any coworkers) and receive a text... This will be tracked by Insider Threat program.

If you get called on your personal phone by a VC firm or competitor for a new position, this will be tracked by Insider Threat program...

If there is a full disclosure upfront, then I don't think it's that bad... But if disclosure is only given to favorites allowing some to modify their behavior... That's horrible

Do you have evidence that this is happening? In the moonlighting, IP theft, noncompete etc. stories you posted higher in the thread, I didn’t see any mention of a stingray. I think it would have been mentioned because a company would have to disclose where they got the data during discovery in litigation, and it would be newsworthy if they used a stingray.

I can believe some companies would use a stringray, but I don’t think the average line manager would be brought into the loop on this. It would be reserved to intelligence operations that never see the light of day, and therefore couldn’t inform low level operations like performance management of the average employee.

I didn’t find any reference to stingrays in any of those articles. Did I miss them?

On April 20, 2019, discussing the Wall Street Journal's coverage of Executive 1, Executive 1 texted to Executive 2, "F[xxx] them. The journal is next on the list after [Victim 1]."

Uhh...

We don't often get to peek behind the courtain, but it is hard not to feel repelled by this.

The arrogance is pretty amazing. That they didn't cut and run at the first whiff of the victims and police being on to them takes a special kind of delusional chutzpah.

One thing I was curious about was how the feds got the data from Apple. I'm guessing because they were eBay-owned phones and eBay gave permission but I don't think it actually says anywhere.

[To say nothing of the fact that, for supposed security people, their operational security was... not good. Just more arrogance I guess.]

I was struck by that too. Somehow the feds obtained WhatsApp messages from Apple. Maybe WhatsApp was getting backed up to iCloud, and that message store isn’t part of the e2e encryption.

It looks from some of the images that the feds had access to the unlocked phone(s). But, yeah, in my admittedly fairly quick read of the affidavit, it wasn't particularly clear--perhaps deliberately--how exactly the feds gained access to all the messages they're using as evidence. (Assuming the defendants challenge how the FBI obtained that info, IANAL but it may make sense to give as few details as possible at this stage.)

If I read the affidavit right, there were confidential witnesses who may have shared their WhatsApp screens with investigators.

I was wondering whether Target Subjects whose names aren't capitalized in the FBI complaint had cooperated. But then, the complaint states that most of them are defendants in the Massachusetts case.

Decrypted iCloud backup? Inspecting the WhatsApp sql database file is straightforward if you have the lockscreen pin.

How did they get past the lockscreen? Corp phone has some MDM policy that let's them bypass/reset the lock screen?

Wow, that was a thrilling read into the mind of a group of psychopaths who all happened to find each other.

I wonder how many times similar things like this have happened (maybe even by the same people) but they covered their tracks successfully.

One final note - I'm very impressed with the professionalism and skill of the NPD(the local police department of the victims).

Also the gall to make up Samoans to frame as cover for their sloppy operations.

They read too much Hunter S Thompson

Not familiar with the reference, can you please elaborate this is fascinating to say the least.

Raoul Duke: I want you to understand that this man at the wheel is my attorney. He's not just some dingbat I found on the strip, man. He's a foreigner. I think he's probably Samoan. But that doesn't matter, though, does it? Are you prejudiced?

Hitchhiker: Hell no.

Raoul Duke: I didn't think so. Because in spite of his race, this man is very valuable to me. Oh, shit. I forgot about the beer. You want one?

Hitchhiker: No.

Raoul Duke: How 'bout some ether?

Hitchhiker: What?

Raoul Duke: Never mind.

-- Fear & Loathing In Las Vegas

https://www.latimes.com/archives/la-xpm-1998-jun-05-ca-56718...

Wow. Sheer arrogance, and absolute stupidity. Or at least, horrible OPSEC.

I'm reminded of that 1993 cartoon by Peter Steiner in The New Yorker: https://upload.wikimedia.org/wikipedia/en/f/f8/Internet_dog....

What I extracted from that is that corporate security people investigating random members of the public isn't considered weird.

It's not that uncommon. You have people making crazy threats (which they probably don't intend to carry out, but it only takes one..) all the time, and the police won't do anything but take a report because frankly, that's all they can do. So you end up at a certain scale having to investigate some of these things yourself.. by hiring probably somewhat sketchy ex-military types.

Yeah, having a threat intelligence and investigations team is very common for big companies.

If nothing else, it's probably safe to assume that someone like Mark Zuckerberg or Larry Page regularly get emails or other messages saying things like "im gunna go to ur house nd kill ur dog and ur hot wife"

Law enforcement doesn't have the resources to investigate every one of these, absent a credible threat of it actually happening, so corporate security / executive protection exists to, well, investigate.

Have you read about Zuckerberg’s personal security? It’s nuts. He’s probably second only to the president in terms of security.

Considering the necessary exposure the president has, he might be even more secure.

I"ve seen Mark's security when he's out and about on campus. They're reasonably discrete about their jobs, given that on any given (pre-Covid) day there were probably hundreds of business and personal visitors on campus.

Personal security for CEOs (never mind billionaire CEOs) is hardly anything new. If I were Mark, received the amount of hate/threat messages he does, and had a young daughter, I'd do everything short of hiring the 82nd Airborne to follow me around.

https://www.businessinsider.com/how-much-silicon-valley-ceos...

Taylor Swift once said "I don't have security to look cool. I have security because people want to take me home and chain me to a pipe in their basement."

TSwift isn't even a billionaire.

She wouldn't last five minutes chained in my basement because she'd start singing and I'd throw her out! Next if be looking for the person who put her there because that is not an acceptable practical joke! I'm glad she has security.

Retired police officers & feds of various flavors aren't uncommon in California. Their retired LE status lets them carry concealed without issue, even in downtown San Francisco.

https://en.wikipedia.org/wiki/Law_Enforcement_Officers_Safet...

For some positions, the ability to carry concealed was mandatory (e.g. the CEO's driver/bodyguard). Related aside: the CEO I'm thinking of wasn't allowed to drive himself in order to avoid any stock hits if they whapped into a kid running into the street after a ball (or what have you).

I've had some experience at a corporate security team at a fairly large (non-tech) firm, including internal and external investigations, and I can confirm I never saw or heard of anything remotely like this. Any time we did any sort of research into a non-employee (which was very rare), it was because they were explicitly making threats, or because we received reports from employees that someone was directly harassing them.

And typically it was just to gather information to provide to law enforcement, when necessary, and to provide information to our physical security team when we thought there may be some increased risk of a belligerent person trying to come to our premises. Very definitely not to take matters into our own hands and act like a dystopian quasi-paramilitary cabal terrorizing random people with obsessive psychological warfare campaigns. It was the total opposite; we were constantly walking on eggshells to do as little as possible and to defer as much as possible to law enforcement, as we should've been.

Never once did I see the slightest inkling of a desire to go after critics of the company from anyone on our team or from management. We would get some visibility into that from dashboards showing mentions of the company on social media and stuff like that, but we'd just ignore or occasionally chuckle at (or agree with...) any criticism we saw.

I'd like to think this hyper-paranoid, authoritarian, power-tripping attitude (let alone the abject psychopathy and psychosis) isn't too common in corporate security teams, but I have no clue and only have my n = 1 sample to go off of. And maybe the distribution is different for tech companies dedicated to rapid growth/monopolization, compared to more traditional, "boring" companies.

Reply on news.ycombinator.com