This may be a dumb question, but is there any reason why these crime groups don't just use Signal? I understand a phone number is required upon registration but a burner sim could be used and discarded for that purpose.
I'd also wonder if there's an element of buying access. If all the top people in some criminal industry use it, it may be a way to signal membership.
[0] not that there haven't been numerous whatsapp zerodays and expecting the Signal honeymoon to last makes about as much sense as "there's no Linux/Mac malware"
This was largely how the Mob operated for decades and why RICO was created.
Communications security against national state level organisations in the current environment is a no-win situation for the defending side, you can make their life more difficult but for you to go truly dark means using nothing that shuffles electrons around.
I'd also question how many highly hierarchical criminal organizations exist today and how many have in the recent past. Media and governments love to overemphasize the organized element for simplicity. Likewise many "terrorist organizations" aren't organized either. In practice you mostly see very lose networks that operate a lot like the rest of the economy. There may be some emergent structure but it's usually not deliberate.
> If you where a really high level criminal you wouldn't use a phone at all, you'd pass all your instructions in person to lieutenants who'd pass them on down the chain.
> This was largely how the Mob operated for decades and why RICO was created.
That would be a legal strategy not a communications security one. It may have been more feasible to proxy away legal responsibility before RICO and such.
Yeah, because they want the world to know they are successful criminals. Just wondering: do they also wear a Beagle Boys mask?
There was a case where a company was selling a "PGP phone" where it turned out that, to save having to bother the customer with key generation on the phone, they were doing it on the servers[1]. So the police grabbed the servers with all the private keys and there were a lot of sad customers.
To do end to end encryption in a way that works, there is a minimum level of understanding required. These "secure" phones are really a type of scam that preys on the not sufficiently informed.
Note that Signal on a smart phone is not anywhere near the most secure way to communicate over the internet. Smart phones themselves are not particularly secure and are vulnerable any time they are unlocked. Instant messaging is inherently insecure because it is always on and thus makes it impossible to keep the secret key information locked up securely when the user is not in a safe environment.
[1] https://securityaffairs.co/wordpress/57036/cyber-crime/black...
Sky ECC wipes messages after 30 seconds, meaning a seized phone is of limited value to investigators.
I don't know about Sky ECC, but Signal requires a Phone # to register, as far as I remember. It's increasingly hard to get anonymous Phone # in the EU. That might be an argument against using it.
They will not always be shown, but they are downloaded.
National security letters are still very much a thing there. Signal has fought at least one and won (https://signal.org/bigbrother/) we can only know about ones they've won against.
Plus say you use Signal, how are you connecting? If that's through an app store then your binary has been replaced. A similar thing happened with Hushmail and their 'client side pgp' jar file: https://archive.is/IRYoh.
Then you have to consider the sealed-sender stuff, and other metadata. If your crime group isn't specializing in tech crime in general then outsourcing to a third-party (that could use the Signal code internally) probably makes more sense then trying to figure this stuff out yourself.
Also I was just wondering, albeit maybe ridiculous, if criminals have the same issues with messenger apps as the rest of us, in so far that you are kinda forced to use whichever app is the most popular. I reckon there is not much criming to be done, if everyone in your gangster-circle is using a different app.
I don't think criminals lower down the hierarchies have or have access to much security knowledge, so they might just pick the currently most popular or use multiple apps depending who they talk to.
Maybe I've been watching too much TV, but would it be better to pay some random person to go into a store and buy my sim/chromebook/phone in cash and then bring it to me at a location I know does not have video surveillance?
If you want a Signal-like app that doesn't need a phone number you can use www.groupsapp.online
E2EE is implemented with RSA+AES. iOS uses keychain and CommonCrypto. Android uses a modified BouncyCastles. I'll probably open source the code once I've figured out the licensing details
Because anyone who can do that wouldn't waste their lives workin for criminals when they can make safe money legally.
The skills required to set up a secure communications network aren't that valued (as in it won't make you a millionaire) in the legal world, and even less so in Europe where IT salaries are absolutely terrible.
Look I know because I've been between those two worlds. When I was around criminals I had the option of working for them for money and would probably make more than I do today because it would be tax free. But it wouldn't be millions because I'd be in the background helping out with IT infra and policy. So if you're smart you take less money to be left as far outside as possible.
The problem is that it's not possible to be outside of that world. You will be taken advantage of. You will be a golden goose that everyone wants a part of just because you can manage their IT securely.
So I was smart and got a safe IT job where I make enough to live very comfortably, work where I want, practically when I want and with people who are not openly sociopaths.
I know as well because when starting my career I had to make a choice - if it wasn't for a stroke of luck I may have had to pick the wrong path out of desperation (whether I would've made it anywhere is another question - sounds like you looked into it farther than I did).
Thankfully everything worked out and I haven't needed to be on the wrong side of the law, but this was down to luck - you can very well have the skills that would pay well in the criminal world while being stuck in a situation where you can't get much out of those skills in the legal world, so I disagree with the idea that having those skills automatically gives you the option to make a good living legally.
Not only EU perspective but Swedish one too where it's very difficult to launder cash.
So it's just not a smart decision to get in bed with crazy criminals. It was a decision I pondered as a young and short sighted 20 year old.
In retrospect it's much easier to make a comfortable living as a simple SRE, Sysadmin or Devops consultant. What ever basic knowledge you must have to setup a proper PKI is enough skill to become at least one of those professions.