Hacker News Reader

Comment by WrtCdEvrydy | Hacker News Reader

I disagree with this. Signal isn't hacking Cellebrite by creating a malformed file that causes Cellebrite's software to implode.

I would be interested in seeing this go in front of a court because Signal isn't directly targeting any specific person, and the files are fine until they are processed through a specific broken pipeline.

If I put a fake USB port on my phone that was a USB zapper to kill the device it's connected to, it would not be illegal and it would be on the people seizing my phone to take responsibility for it. You cannot repackage vulnerabilities for police and then turn around and play coy because you're not able to keep your software up to date.

In the defense attorney section, the argument shouldn't be about the PoC but the fact that the PoC shows that Cellebrite's software is outdated and could be compromised. You can specifically ask for the backup that was extracted from the mobile device to be analyzed by third party software.

View on HN

I'm curious if booby-trap laws would have anything to say about this. If I can distill the arguments down to my (completely abstract) understanding:

1) Cellebrite has to interface with software to do extract data. 2) Signal is the software in some scenarios. 3) Signal can alter itself so that if Cellebrite interfaces with it, Cellebrite breaks. 4) If Cellebrite doesn't interface with Signal, Cellebrite is fine, Signal is fine, and no one is hacked.

If I trespass on someone's property, and they have a booby trap that blows my leg off, I believe in most US jurisdictions, I can take them to court and have a good chance of winning.

Isn't this the same type of thing?

On the other hand. If I have a guard dog, and a bunch of "Beware of Dog" signs, and someone trespasses on my property, and the dog attacks them, I don't believe I'm liable. So by publishing this information, has Signal avoided the important nuance of being a trap?

It is not the same type of thing because booby traps are, legally, specific about causing bodily harm to a living thing. In practice the scope and applicability of the CFAA has to be explored.

Also not the same thing because the law also considers the harm caused to innocent 3rd parties from booby traps. No firefighter or EMT is gonna be harmed by the Signal code designed to break the cellebrite device.

"Police officer executing a warrant" is another typical category of innocent 3rd party that the laws around booby traps think about. If the harm is directed at a police officer using cellebrite -- say by infecting their computer with malware -- that may not be regarded favorably by a court.

Disclosure would be an interesting precedent.

"I have Signal installed on my phone" seems a reasonable disclosure of a known potential trap.

If a police officer chooses to scan said phone with Cellebrite, it feels reasonable that you have discharged your knowledge to the extent possible.

> "I have Signal installed on my phone" seems a reasonable disclosure of a known potential trap.

No, that's a straightforward statement of fact which a software expert might realize implies there's a trap. A police officer could not reasonably be expected to know that.

A reasonable disclosure of a known potential trap is

"I have Signal installed on my phone, so if you use a Cellebrite device to pull my data your Cellebrite device might get hacked by Signal."

Unless you're an information security professional, it seems unreasonable to expect an average Signal user to know more about the security of Cellebrite than Cellebrite's user (the police).

Probably so. Thanks for pointing that out.

If you're using Signal at all, you probably care at least a little about security, so it's not a given, but probably the vast majority of Signal users wil never hear about this.

I wasn't trying to say you're automatically guilty if you don't warn the police about what Signal could do.

I was just trying to say that a statement that _implies_ a trap exists, if you know enough about a piece of software, it's not a reasonable warning that a trap exists.

If you know the trap exists, a case can be made that such an indirect statement is actually baiting the trap, rather than warning about it.

It’s more knowingly destroying evidence than causing bodily harm.

That’s the thing: It’s not evidence at the time you set the trap. There are plenty of legitimate reasons you may want to protect your computer from Celebrite users.

It’s not just cops that use this software. Bad foreign actors do. Private investigators might. Hell, Signal demonstrated that they’re falling off trucks, maybe you want to protect yourself from Moxie!

I understand the short answer is probably "Judges see it differently so the logic doesn't matter", but I don't get the difference between setting a "booby trap" to wipe a phone and the basic phone-wipe security settings that are already on phones.

In the San Bernadino iPhone case there was a lot of hand-wringing about Apple's password limits, but no one was accusing Apple of purposefully destroying evidence because it has a setting that wipes data after multiple failed login attempts.

Cellebrite does not only sell its software to the US government; one of its chief criticisms is that it doesn't really care who gets its code. So the threat model to end-users is the same, the same fears that would make me want to wipe my phone if someone is trying to get into it might make me want to wipe my phone if someone is trying to automatically pull large amounts of data off of it.

Is the worry here that Cellebrite's vulnerability would need to be executed on a different computer, so it's in a different category? Forget technicalities and cleverness, I don't understand even the basic logical difference between Signal destroying its own data on export and iPhones wiping their data after failed login attempts. I trust the author, but I just don't get it. What security measures are acceptable to build into software?

> Is the worry here that Cellebrite's vulnerability would need to be executed on a different computer, so it's in a different category?

Yes, possibly. The legal system is all about trying to establish clear lines dividing the spectrum of obviously OK behavior and obviously unacceptable behavior. It is obviously OK to delete text messages off your phone. It is obviously unacceptable to break into a police station and delete evidence off their computers. Somewhere in between is the dividing line, and if this went before a judge it is entirely plausible that they would draw the line there.

> no one was accusing Apple of purposefully destroying evidence because it has a setting that wipes data after multiple failed login attempts.

That’s because the feature is designed to protect your data and phone after it’s been stolen by a criminal, not to destroy evidence lawfully sought by law enforcement.

> not to destroy evidence lawfully sought by law enforcement.

But Apple's encryption does still destroy evidence lawfully sought by law enforcement. And in fact, Apple has gone out of its way to make sure that its encryption will still destroy evidence even in instances where law enforcement is trying to access it -- that was the entire controversy behind the San Bernadino case.

Apple wasn't willing to put holes in its security even knowing that their position made it harder for police officers to execute a lawful warrant.

> is designed to protect your data and phone after it’s been stolen by a criminal

I think I already talked about this above:

> Cellebrite does not only sell its software to the US government; one of its chief criticisms is that it doesn't really care who gets its code. So the threat model to end-users is the same, the same fears that would make me want to wipe my phone if someone is trying to get into it might make me want to wipe my phone if someone is trying to automatically pull large amounts of data off of it.

It's not clear to me that the threat model from Cellebrite is different than the threat model from a criminal. Cellebrite does not exclusively sell its software to the US government. And if Signal's devs could get their hands on it then there's no reason to believe that criminals couldn't get their hands on it as well. We already know their software has been leaked outside of law enforcement, because Moxie has it right now.

I'm not saying that the author is wrong, I believe them. And I can understand that exploiting a vulnerability might be treated differently than on-device data deletion. But the specific reasoning you give about intent to disrupt an investigation makes no sense to me. In both cases I'm defending against criminals who may have stolen my phone and may be trying to exfiltrate data. The police aren't who I'm worried about here.

It's not even that Apple/Signal's threat model seem to be 'technically' the same tunder some kind of narrow criteria or letter of the law, they're basically identical. As a layperson on the street or as a programmer trying to build secure software, I don't know how I would tell the two threat models apart. I don't know what test I can use here to tell when I am and am not allowed to be afraid of criminals stealing my phone and data.

Intent matters a lot in the law.

The fact that evidence is destroyed even though it is lawfully sought by law enforcement can be, as attorneys would say, incidental. The same goes for people like me who regularly shred documents. I don't do it to frustrate law enforcement; I do it to frustrate identity thieves.

BTW, companies destroy what could be future evidence as a routine matter under the guise of data retention policies. Take, for example, a policy that all incoming and outgoing emails are expunged after 90 days to conserve space and help contain the damage caused by corporate espionage. Courts aren't going to hold companies accountable for willful destruction of evidence if some evidence they would have lawfully sought is gone due to the execution of the policy. However, if a company has been given notice that they are subject to a subsequent preservation order, they must suspend the policy to the extent needed to effectuate the warrant or subpoena to avoid getting into trouble.

> I don't know what test I can use here to tell when I am and am not allowed to be afraid of criminals stealing my phone and data.

That's why we hire attorneys! Legal counsel is here to help. Ain't nothing wrong with relying on subject matter experts. For the same reason, I hire people to crawl through my attics, too.

> Intent matters a lot in the law.

I guess this is what it would come down to (ignoring other liabilities like the CFAA): if Signal actually implemented their feature, would they be able to argue that their intent was to stop criminals abusing Cellebrite software, or would it be possible to argue that their intent was from the start to disrupt police investigations?

With Apple that's probably going to be hard to argue, they'll come out with some basic stats that talk about theft reduction, they'll point at their advertising and messaging around the feature.

I can see a distinction there, even though I don't see a super-clear reason to believe from Signal's one blog post that they're specifically trying to disrupt the police.

> That's why we hire attorneys! Legal counsel is here to help.

This is obviously good advice, and people shouldn't be looking at HN musings to figure out what is and isn't legal. But at the same time, minor sidenote:

I'm not angry at you, and this isn't anyone's fault in specific, but I low-key hate this answer because a metric ton of innovative software gets built by people who do not have the resources to hire attorneys for every decision that they make, and it's really unreasonable on a societal level to expect every Open Source dev, teenager, single-founder entrepreneur, etc... to have the resources to have legal counsel on hand. The majority of people in the US can't just go out and talk to a lawyer whenever they want.

Not really relevant to what we're talking about, and again, nothing to do with you, but I'm still unable to keep myself from ranting about that whenever this topic comes up.

> if Signal actually implemented their feature, would they be able to argue that their intent was to stop criminals abusing Cellebrite software, or would it be possible to argue that their intent was from the start to disrupt police investigations?

You should read the article again if you haven't already. The author discusses the context that would make this a hard sell to a court. Moxie Marlinspike has been around a long time, and he hasn't been particularly discreet about his opinions about law enforcement.

> etric ton of innovative software gets built by people who do not have the resources to hire attorneys for every decision that they make, and it's really unreasonable on a societal level to expect every Open Source dev, teenager, single-founder entrepreneur, etc... to have the resources to have legal counsel on hand. The majority of people in the US can't just go out and talk to a lawyer whenever they want.

Have you tried? I think there's a misconception that lawyers are resources that will only talk to you if you can verify you have $1M in the bank. Even when I was a poor student I found that I could phone up just about any lawyer and get 15 minutes of their time. This is often enough to get the gist of whether whatever I want to do is going to be legally risky. Most attorneys are nice enough to tell you what you're about to do is incredibly stupid (assuming it is, in fact, incredibly stupid) without charging you for the privilege.

And come on, we're not talking about writing a new game or a container orchestrator or some new ML algorithm here; we're talking about technology that clearly has a strong relationship to law enforcement and has a legacy of adversarial practices. Let's practice a little common sense here.

> Moxie Marlinspike has been around a long time, and he hasn't been particularly discreet about his opinions about law enforcement.

I did read the article, I don't personally see the intent that the author is attributing (although I understand how other people might, and again, this is all separate from the CFAA concerns). The author is claiming that Cellebrite's users are synonymous and interchangeable with law enforcement. But that's clearly not the case, or else Moxie wouldn't have a copy of the software since he's not a cop.

Signal never mentions law enforcement in the original post; the only mention they make to governments are non-US authoritarian countries, which... it's not illegal in the US to build software that Turkey dislikes. The only category of users that Signal's post specifically supports by name are journalists and activists -- in other words, not criminals under US investigation.

And this is part of what weirds me out about this conversation. When you start talking about how obviously Moxie is trying to hack police departments because he's criticized them in the past -- my opinions about law enforcement overall shouldn't block me from writing secure code. I believe in police accountability, I publicly backed Apple's position during the San Bernadino case, which according to multiple police spokespeople apparently means that I love terrorists and hate America. Does their framing of that position mean I'm not allowed to build secure software now?

You don't see it as problematic that being critical of the government would mean that you have less legal leeway to write secure code? "Hasn't been particularly discrete about his opinions of law enforcement" to me reads as "he's going to face increased legal scrutiny and have fewer legal protections purely because of 1st Amendment protected speech."

> Have you tried? I think there's a misconception that lawyers are resources that will only talk to you if you can verify you have $1M in the bank.

It's entirely possible that I'm bad at looking around at stuff like this. I haven't seen specialist law offices that aren't charging more than a hundred dollars an hour, but... I am not going to pretend I'm an expert on this stuff, at all. I'm not an expert on anything we're talking about.

> And come on, we're not talking about writing a new game or a container orchestrator or some new ML algorithm here; we're talking about technology that clearly has a strong relationship to law enforcement and has a legacy of adversarial practices. Let's practice a little common sense here.

I'm not sure I follow, is your argument that security code is in a separate category from other Open Source software? I don't understand what you're implying. Signal is a messaging app, shouldn't ordinary people be able to build those?

There aren't a ton of consumer-facing projects I can build that won't have to care about security and privacy. You don't think that games, or music storage/tagging, or backup systems have to care about this stuff? It's not only banks that do encryption, any system that touches user data should be able to protect that data from criminals.

Is it considered evidence before law enforcement knows the contents of the device?

Yes. At least in a civil context, the doctrine around spoliation requires a party to preserve evidence when they know, or should know, that the evidence is likely to be relevant to pending or future litigation.

I strongly doubt it's anything to do with booby-trapping. The article was less focused on the physical act of data destruction and more the context of destroying data related to an investigation, which arguably constitutes Destruction, Alteration, or falsification of records as per https://www.law.cornell.edu/uscode/text/18/1519

I say arguably of course as I doubt that this is a scenario that has really been carefully tested in law, but the article seemed more focused on how such an act would be interpreted by the courts if it really came to it. And the important part of such a situation is mentioned here:

"... (if the user gets blamed for what her phone does to a Cellebrite machine, she will be plunged into a world of pain, irrespective of whether she would ultimately be held culpable for the design of an app she had installed on her phone)... "

My layperson read of all this situation is that it doesn't really matter whether or not you know at the time of such a file existing whether or not you're under investigation, if the end effect the file will have on a process used by a Government Agency in a legal search is known, the fear seems to be that even if ultimately you end up inculpable, it's a very long and rocky road to get there legally speaking, as the Government will likely not even try to argue about the quality of code or whether it's you or Cellebrite (or whoever) that is responsible, but that you had a file which had a known effect which in turn impeded an investigation.

Remember that criminal cases have specific challenges that the prosecution accuses of and that the defendant protects against; if the challenge is that "[you] knowingly put data on your computer which impedes investigations by Agencies of the US Government by means of corrupting data", the mechanism of how the data got corrupted is not nearly as important as the actual act/intention.

If Signal really is doing this, I think their intent was trying to undermine this with the random users part (so that users couldn't feasible know if they had a trap or not), but personally, I think this is kind of weak as with the announcement, there's knowledge that an application you have has a non-0 chance of causing such disruption, and probably it's enough to at least waste a lot of your time and money. (Especially if it really did a number on a Cellebrite device that damaged a lot of other investigations...probably they'd go after a person just out of spite at that point.)

This also highlights what should be considered a disqualification for overly broad legislative statute. It seems to me that CFAA was put into practice with woefully little thought as to how computing systems, and by extension, how the legal system interacts with them.

This results in an incredibly powerful tool landing in the prosecutions hands that can be used to quite literally drive a person to death by legal system while everyone non-technical has to be brought up to speed on how this stuff works and doesn't work.

Realistically speaking, I don't think the CFAA has actually been driven by real concerted attention from tge public. If it had been, I don't think the software industry would be anywhere near as big as it is, because when you really understand what you're doing when accepting a EULA, and then comparing that expectation with what programs actually do, there'd be an awful lot of software that actually falls under CFAA used for official purposes than anyone not in an official capacity would feel comfortable with; nevermind software for private use.

"Booby trap" laws aren't relevant because they're specific to physical injury.

However, there are explicit laws against tampering with evidence or things that you'd expect are likely become evidence.

Blowing your leg up is not the right comparison, this is closer to a lock that breaks your lockpick if you try to pick it.

No one is harmed but the tool being used to break in.

I would guess that it is way simpler than that. What will be gauged is the intent.

This file is targetted to damage LE property, it is hard to argue that they are random bytes.

The intent is to protect the content of the user’s device from unauthorized access by poorly written forensic extraction code. It’s not offensive but defensive, as Cellebrite has to actively read the file, a file which is not theirs. Technically, Signal owns the copyright and does not authorize Cellebrite to read it (I’d assume, legally).

Signal payloads don’t prevent competent, properly implemented seizure and forensic analysis.

And technically if the LEO user of Cellebrite has a warrant, they are legally authorized to look at that data no matter what Signal or the phone's owner thinks. So, in that sense, it's the ultimate 'authorized access'.

Yes, I agree LEO with authorization to seize and search someone’s property (with a warrant or similar due process) is authorized to utilize a forensics tool chain that adheres to application security best practices (without which taints chain of custody). None of my comments should be construed as supporting the evasion of a legal law enforcement act.

I take issue with LEO overreach when it occurs and vendors shoveling garbage (paid for with tax dollars) to the justice system.

IANAL but I’m pretty sure that’s not how it works. A judge won’t throw out evidence just because a tool doesn’t “adhere to application security best practices”. They’ll need to be convinced that the specific evidence they’re reviewing is compromised or unreliable.

Agreed! I’d like to see it tested in court. Tools used in the justice process must be held in the highest regard considering someone’s freedom hangs in the balance.

The courts forced a breathalyzer manufacturer to release their source code, so there is precedent for critical review of such tools.

https://nccriminallaw.sog.unc.edu/breathalyzer-source-code/

I would like to see that as well. But I think that sidesteps what I’m saying, which is that it’s probably not sufficient to show that the tool used to gather evidence might, under certain circumstances, be susceptible to malicious interference.

Nope. As soon as one case has reasonable doubt introduced, it's precedent. Now judges will balk at backpropagating it to previous cases before the exploit possibility was made public knowledge; however, one could make the case a recheck effort should be initiated, because in the grand scheme of things, Moxie is technocally a disinterested party. Those who have direct stake may have been keeping this potential capability in their back pocket for strategic use.

Well, we won’t know until this actually gets tested in court. But frankly, I’m putting my money on the analysis from the Stanford lawyer with subject matter expertise, not random armchair lawyers on HN.

> A judge won’t throw out evidence just because a tool doesn’t “adhere to application security best practices”. They’ll need to be convinced that the specific evidence they’re reviewing is compromised or unreliable.

If the tool doesn’t “adhere to application security best practices” then the evidence is compromised and unreliable. Take a wild guess at how many states and other well-funded actors have been quietly deploying their anti-Cellebrite defences in the wild until Signal has made theirs public. If Signal was able to obtain Cellebrite, what is the chance they weren’t?

Maybe in the USA. In Europe, evidence in criminal court cases needs to adhere to standards such as chain of custody. Which Cellebrite obviously fails given this research - their tool's output could be manipulated.

And someone could have opened an evidence bag and resealed it, but my guess is you don’t see courts throwing out evidence unless there’s reason to believe that actually happened.

There is, in fact, a current court case around a Sheriff's deputy accused of planting methamphetamine related paraphenelia in over 162 cases. See the ongoing Zachary Wester affair.

That's falsely implicating 162 innocents of a felonius crime, tarnishing their future prospects for life, which reulted in plea bargains being accepted because the accused could not get sufficient legal representation to make the prospect of a successful legal defense doable, and a completely innocent of the charge individual didn't want to run the risk of amplification of sentence just for exercising a civil right. Besides being an example of why plea bargains make a mockery of our legal system; "just take this lesser charge that we don't have to really work at proving it so we can be done with it, because think of how bad the sentence will be if you make us work at it", it demonstrates that even procedures as they are now are such that an officer/prosecutor have and are willing to exploit their capability to manufacture suffering for those they serve for personal gain.

The System is getting shocked by it's vulnerability to the untrustworthy agent currently. So I wouldn't discount some fundamental reassessments of procedure down the road.

It is a travesty but I think that case works more for the person you’re replying to: it was evidence of misconduct (the prosecutor noticing his body cam footage didn’t match his reports) which called that into question, not just saying someone _could_ have tampered with the evidence.

This will work the same way: if there’s corroborating evidence, it’s likely to be as futile as the original article’s author predicts, but if there is something speculative which has only unconfirmed evidence from Cellebrite it might be enough to get that thrown out.

Actually the opposite: you would expect courts to toss out (and/or: opposition to successfully challenge) all evidence unless chain of custody is guaranteed.

That's a very important part of "innocent till proven guilty".

Your suggestion flips this around, thus leading to "guilty till proven innocent". Perhaps that is how things stand in practice in the USA. I don't think that that is how things should be.

It’s not “guilty until proven innocent” to keep evidence if the defense can’t show it’s been compromised.

As a logical extreme example, you are suggesting that courts forbid eyewitness testimony, since it’s always possible that they are mistaken or lying.

Not GP, but I would highly prefer they give eye witness testimony much less weight than they do today.

Cellebrite sells their hardware to lots of non-LEO, including corporate security, law firms, private investigators and regimes that have no respect for human rights. Cellebrite's UFED hardware even shows up on eBay and other online sales platforms.

If someone has a Cellebrite, they do not necessarily have a lawful right to access. Could just be a $16/hr Pinkerton (a wholly owned subsidiary of Securitas) using UFED on a phone they stole from an employee or contractor of the organization they contract with.

I feel like this is a key point for the entire discussion. The legality of deliberately foiling lawful investigations is debatable, but protecting yourself against wild-west malware decidedly less so.

That being said - if it's all fine and dandy, I don't see why a Cellebrite-foiler couldn't be a separate app. Moxie (threatening to) piggy-back it onto Signal, purely because it's the app he controls, is a deeply user-hostile move.

> Cellebrite's UFED hardware even shows up on eBay and other online sales platforms.

I'm surprised Cellebrite allows for this. I would have assumed that the sales contract would include a "this is a lease, not a purchase" type of wording so that "you may not sale this device to anyone" with a buy back clause provided instead.

You'd be surprised but older generation UFEDs end up on eBay for under $1000 often.

I have one at home but yeah, there's no EULA preventing you from selling something that's yours.

I'm not surprised that it is happening at all. Of course someone that paid a large sum of money for something that they no longer need/want will result in them trying to sell it to recoup some money. My surprise is that Cellebrite does not buy them back to keep the demand/supply artificial.

But are you obliged to consent? Do you have to give them all your passwords too? Can they use "data exfiltration tools" on humans? If the focus of your exploit payload is specifically to neutralize the attack and not cause extended or arbitrary damage, could this be counted as "self defense" or just protecting your privacy?

Now you're asking the important questions. We're getting to a point where we have so much of our personal memory, effects, and essence on our phones that there is no reasonable substitute to seperate the data on our devices as being seperate from our mind. That implies 5th Amendment should apply to electronic testimony, which will be fought tooth and nail against by the judiciary. This will have to be tested sooner rather than later as we get closer to realistic and functional Brain/computer interfaces.

Yes, you're obliged to consent - you don't necessarily have to help them, but you're also prohibited to obstruct or delay them, especially destroy or hide the evidence. A lawful warrant overrides any expectations of privacy. Furthermore, there's no "self-defence" concept in any computer-related statutes; protecting a life can be an excuse for certain otherwise illegal actions, but protecting your data or devices is not; a "hack-back" is a crime on its own even if it would run on a criminal's computer, but in the Cellebrite case it's presumed that when law enforcement runs the data collection, they have full legal rights to access that device and data.

For a physical world analogy, let's suppose that someone gets shot, and you run away with the gun used and throw it into a river. Even if you'd be acquitted for the shooting itself (due to e.g. self-defence, or perhaps someone else did that shooting), you can be convicted for throwing the gun into the river as tampering with physical evidence, as hiding that gun is a crime by itself if the jury assumes that you did it so that it wouldn't get used as evidence. That applies even if there wasn't any warrant yet, as the investigation hadn't yet started; it's sufficient that you would have expected that this might get used as evidence.

I think a better physical analogy is a tamper proof safe which destroys its contents. With such a safe (or the signal hack), if I disclosed the presence of the safeguard and LE either 1) failed to open the device without triggering the safeguard 2) trigger the safeguard unintentionally, is it really any different from not providing a password? Because the password would be the operable piece of information preventing them from getting the desired data without my consent.

A tamper proof safe which destroys its contents indeed seems like a good analogy.

However, I do think that in the case of a suspect having such a tamper proof safe, it would be a valid court order to require you to open that safe without destroying the contents. It's not really good to try and look for analogies with how similar or different something is to "providing a password" since providing a password itself is a boundary case between the right to not testify against yourself and the duty to provide the evidence so the specific case matters and in multiple cases people in USA have gotten jail time for refusing to provide passwords. Locked safes predate passwords, it's well-established that the contents of the safe are fair game with a warrant, so any analogies between safes and passwords are arguments that people should be required to disclose their passwords, not that people get to keep their safes unopened.

And if the safe did actually destroy its contents, they would charge you with tampering with evidence, and in addition to that, the prosecution might be allowed to assert as fact that the destroyed evidence did actually contain all the things harmful to your case that they intended to find there - the "spoliation inference" concept.

Also, your motivation for having such a safeguard matters. If a reasonable person would believe that you chose to use such a safeguard so that it would prevent police from getting to evidence and destroy it, that may be treated as a crime even if they manage to circumvent it and no evidence is destroyed. It's not about any specific method or process, taking any willful action with such an intent itself is a crime - you're not allowed to try to prevent a warrant from getting successfully executed.

I’m not interested in the password angle and more interested in the “is signal culpable” angle. In which case we could just as easily assume there is no known password or combination. If the evidence ends up destroyed, I don’t think the maker of the safeguard is responsible. That’s more my point.

Whether or not Signal is making a valid “safeguard” is an interesting question as you point out. I think you’d be on thin ice, but I’d be curious to see how that plays out in court.

Sure, but the LEO has to ensure that their tools are not broken. This is not anyone's responsibility but theirs.

This could have been a potential line of reasoning, if they would have implemented it, and if Signal were taken to court for it.

The problem is, they wrote this article. Where they say they will put 'aesthetically pleasing' code on installations. But not all installations. So Cellebrite can claim it's a menace (sort of a booby-trap) , and not a protection (sort of a shield).

Another issue: they say they obtained then kit because it fell of a truck. Any judge knows that 'fell of a truck' is a manner of speaking. Thanks to their statement it will be possible for Cellebrite to say "We checked the last 6 months of deliveries, no truck incidents". Cellebrite can try to find civil statutes (fraud?) and ask for discovery. If that is allowed by the judge, Signal will have to show all documents and messages pertaining to the hack, or risk contempt of court or perjury.

This is what the article is about. TL;DR: great work guys, wish you had consulted a lawyer before writing the post though.

Cellebrite is not law enforcement property, I'm sure the copyright and code is still owned by Cellebrite. Additionally Cellebrite sells their tools to more than just LE.

Just so Linux is not copyright to me, but to introduce my computer to malware is crime against my property, not Linux Foundation.

The file doesn't have to damage anything owned by LE/private companies. It could protect files on the device from unauthorized tampering by wiping or encrypting files when it's executed.

Cellebrite sells their hardware to corporate security, law firms, private investigators and despotic regimes and their UFED hardware even shows up on eBay and other platforms for the general public to buy at times.

LEOs are far from the only buyers of this hardware, a good chunk of Cellebrites userbase operate extrajudically and do not have a lawful right to attempt to access the contents of phones they use UFED on.

+1. Signal was in exceptional territory with it's release, but we've seen an increasing acceptance among sophisticated legal minds of hacking hackers. The blog's analysis was pretty half-baked to me.

> Signal isn't hacking Cellebrite by creating a malformed file that causes Cellebrite's software to implode.

It absolutely is. This is the sort of "technically I didn't break the law!" nonsense that he explicitly called out in the article:

> Trying to find the edges of the law using technology will not make a judge, or prosecutors for that matter, shrug and throw up their hands and say “Wow, that’s so clever! You sure got us.” They won’t reward your cleverness with reddit coins and upvotes and retweets. They will throw the book at you.

This type of legal revisionism power in the judiciary is exactly what Thomas Jefferson and Madison were leery of, as it does come down to legislating from the bench.

When case law can take an inch given in statute, and turn it into a mile or a femtometer, you have a problem.

unfortunately it seems pretty clear to me that it'd be a CFAA violation:

"(A)knowingly causes the transmission of a program, information, code, or command, and as a result of such conduct, intentionally causes damage without authorization, to a protected computer;"

if Signal downloaded Cellebrite-pwning shellcode to its app, that shows intent.. it's "knowingly causing transmission" in the sense that worm authors knowingly cause transmission of their viruses by equipping them with exploits (and are thus responsible for damage wherever the worm goes.)

if that shellcode does anything at all - deleting files, adding files, bricking the device, that falls under the CFAA's definition of "damage," since it affects the integrity of the extracted files.

you could argue that Signal doesn't knowingly intend to infect "protected computers," but unless these updates are, say, geofenced to not hit the US, it'll be obvious to the court that they could anticipate government machines getting hit.

the smartest thing would be for Signal to follow through on delivering these files, but have them be cat pictures. troll Cellebrite and muddy the waters for prosecutors. no CFAA violation, but Cellebrite can't ever be sure (and prosecutors can't ever prove.)

> if Signal downloaded Cellebrite-pwning shellcode to its app

The transmission in this legal context is the other way imo. Cellebrite's device is transmitting Signal data out, and Signal is not intentionally sending data to these devices.

So, let's say for the sake of argument that Signal does download files that are intended to exploit these Cellebrite vulns to users' phones.

The part of the statute we're talking about triggers when someone:

- knowingly causes the transmission of a program, information, code, or command

- and as a result of such conduct, intentionally causes damage without authorization to a protected computer

Notice: this didn't require someone to transmit code to the victim machine: they knowingly cause code to be transmitted somewhere, and that intentionally causes damage as a result. Isn't that what you have here? In our assumed world, Signal's devs have written the app to pull down the exploit to the users' phones, thereby knowingly causing it to be transmitted. I think it'd be hard to claim with a straight face that your Cellebrite-targeting code (that you told the world about) wasn't intentionally targeting Cellebrite.

Under your rule of "you have to intentionally send data to the victim device," what result if you write malware and post it, say, on Facebook: just as you intended, anyone who clicks is infected, but the payload is inert as to Facebook's servers. Are you in the clear because the harmed users all initiated the download themselves?

But those are two separate actions:

- Signal transmits a code (exploit) and keeps it in its cache, the code is dormant, nothing is being damaged here, it could stay like this forever, no harm.

- Cellebrite transmits Signal's files and cache, including the exploit, and gets hacked by reading it with their scanner.

The key is that the first action is harmless, and the second action is performed by Cellebrite, so can't blame Signal for it. I don't think these two actions can be consider as one.

And the main difference from the malware scenario is that this Signal code is not meant for reading, it is inaccessible and harmless for anyone except the Cellebrite hackers. The exploit is activated by unauthorized use, unlike the malware.

Are you trying to convince a jury, or just bring charges?

I'm not going to pretend it's a 100% open-and-shut case: the CFAA in its great broadness is a fairly controversial area, and this is a "weird" case. And as always, who knows what a jury will do.

On the other hand, in the hypothetical scenario where this actually happened and damaged some law-enforcement-owned machines, I don't see the average jury being too sympathetic.

It's certainly problematic enough that it's a legitimate concern, I'd say.

A "protected computer" as defined in the CFAA is, to a first approximation, any computer. Particularly if it's connected to the Internet.

What about the other countries?

Reminds me of "DOS ain't done til Lotus won't run."

This is false, there are laws about booby traps (they’re generally illegal in all jurisdictions). If you plant mines on your property and a thief walks onto your lawn and loses a leg, he can sue you and will likely win with a competent lawyer.

You don’t get to say “well you shouldn’t have been there”

Traps that harm people are illegal. Traps that harm animals are legal under some circumstances (mousetraps are legal basically everywhere afaik.) But traps that harm devices rather than people or animals? Are you sure that is generally illegal?

Laws on booby traps specify that the trap be used to cause harm to a living thing. It's not a booby trap if it wasn't meant to harm someone. So the digital booby trap isn't governed by the same laws.

I agree. But that law demonstrates the concept.

booby traps that cause harm are illegal, someone stealing my phone who cuts themselves on a broken piece of glass from the screen can't argue "it's a booby trap"

This is true. Also, if you add hidden buttons that alter the way a data port works to either disable or enable it, or fry a device attached to it, this isn't intentional harm caused to police equipment specifically. It is a deterrent-after-the-fact, a protection, and a personal choice to modify one's own device without targeting anyone in particular and not intentionally, unexpectedly causing bodily harm.

the owner of the device could be charged with tampering with evidence. Signal is, paradoxically, an uninvolved third-party imho (technically uninvolved).

If Signal put this on their home page, in a sort of "download this to fuck with da police" advertising, maybe.

Judges aren't machines, that slavishly follow any tenuous reasoning. They're judging; it's in the name. Specifically, they have to judge your intent. In many cases American criminal law requires a 'mens rea', or 'guilty mind'

https://en.m.wikipedia.org/wiki/Mens_rea

However, in many jurisdictions, a trap is only a trap if it is hidden.

For example, you can have barbed or razor-wire fences, its obviously barbed, its your fault if you climb up it and get impaled.

They advertised this, it's not hidden, so even if trap laws governed it (which they don't because its not hurting a person), it's not a trap.

Even if it were a trap, it would be a trap for a device, not a person. Like anti-drill pins in a lock, which can damage or destroy a drill bit. I think you could reasonably say anti-drill pins are traps for drill bits, and they're certainly not a violation of anti-boobytrap laws.

> If I put a fake USB port on my phone that was a USB zapper to kill the device it's connected to, it would not be illegal and it would be on the people seizing my phone to take responsibility for it.

‘If I put a bunch of laxatives on my sandwich to give the office sandwich thief violent diarrhea, it would not be illegal and it would be on the people stealing my food to take responsibility for it.’

This is the analogy that comes to mind which I’ve always heard to be illegal.

The analogy breaks down because the USB zapper isn't intended to cause bodily harm, unlike a laxative.

That's true, but I didn't put the USB zapper to harm anyone. I use it for testing USB grounding and some officer stole my phone.

Blatantly lyng about your intent doesn't make you more innocent in court.

I feel confident that if you left a conspicuous note on the sandwich that said "Warning! This sandwich may contain laxatives! Do not eat!" and the thief disregarded it and ate the sandwich anyway, then it would be entirely legal.

I am not a lawyer or even particularly well-read on this specific scenario, but my read of the spirit of the law is that (if it indeed contains laxatives) it might still be illegal. What matters is not whether you sprang a surprise to one-up someone who was violating your rights or they had a fair chance to know what exactly the consequences would be, but that you deployed the laxative with the intent of harming the thief, and most modern legal systems do not like vigilante violence (even if it's "cute" vigilante violence like giving someone diarrhea). For an intuition pump, I'm not sure there is a significant difference between the note in question and "Warning! If you take this sandwich, and I know who you are, I will personally hunt you down, wrestle you to the ground and force-feed you laxatives!" as far as the law is concerned, but would you expect to get away with this act just because the target previously stole your sandwich and you warned them?

(On the other hand, I feel like the zappy USB port may actually be easier to get away with, especially if you say your threat model was corporate spies or criminals trying to steal your password, because "violence against tools" does not seem to be put in the vigilante violence box. Those special materials they have for safe doors that are designed to damage angle grinders (https://www.newscientist.com/article/2249275-material-that-c...) are not illegal.)

Yes. I expect that if I made myself a Miralax sandwich and labeled it with a huge caution label that I would be fine if someone decided to eat it anyway. It would be trivial to show that I had no intention of harming someone.

You would probably still be sued anyway, because why would a reasonable person make a laxative sandwich? The note is obviously a joke.

I know the old laxative in the fridge item has been a stand by in office etiquette enforcement for longer than I've been alive.

The court follows the principle of clean hands. A thief is not going to have a compelling case against someone when they are throwing the first stone by stealing someone's sandwich. It's an interesting take, and I'd have to dive into actual case law to even determine if the test scenario is apocrypha or not. However, I doubt the laxative in sandwich argument would be compelling to a judge when there are much more relevant and easy to reach challenges to overcome.

-I.e. State mandated weakness to exploitation by Law Enforcement (You can't defend yourself from exploits used by Law Enforcement, which you are also not allowed to know about under Executive Privilege) -The ability of the Government to ensure their tooling meets chain of custody preserving standards Etc...

As usual, not a lawyer, just read a book on legal research and reasoning once.

You are discriminating against the illiterate and those who do not read English, or have vision issues.

There's a distinction between setting booby traps that fire shotgun shells and modifying one's device to make it trickier to access. In one case, it maybe necessary to take shelter in a random person's house (cabin in the woods during a blizzard), while in the other the point isn't necessarily to destroy police equipment but to prevent personally-unauthorized extraction by anyone.

If I put laxatives in my drink because I am having digestive issues, and someone steals my drink I don't think that's illegal. If I choose to store exploits on my own device and someone steals it from me and runs it through a forensic tool that can't handle the files, that's not on me either. At a minimum, the vulnerabilities should introduce doubt as to whether or not the capture is a forensically sound copy. There are too many variables otherwise. For instance, who is to say that some previous device didn't exploit the vulnerabilities?

are you arguing about what the law should be or what the law actually is?

I have not seen anyone state what the law actually is. Just a lot of FUD about what I am not allowed to do with my device. If you are a lawyer and can break down what I got wrong and why, I am happy to listen.

What the law is can't be realistically argued. What the law is is a function of what a prosecutor, jury, and judge collectively are willing to let a conviction go forward on.

This is what bugs me about common law. You can't take a statute at face value anymore once a sufficient amount of case law comes into the picture, and there is no active effort to reconcile the original statute with the reality of the case law it spawns.

Intent matters.

If the court (it's not that a laxative issue is likely to come to a full court, but still) believes that you did actually put laxatives in your drink because of your digestive issues, then that's legal, but if they get convinced that you did it with the intent to mess with your coworker, then the exact same action is illegal. In a smilar manner, if the court considers it plausible that you did just happen to have that file among various exploits that you store there for a specific reasonable purpose, then that would be legal, but it is illegal if the court considers it likely that you placed the exact same file there with the intent that it will destroy evidence - perhaps based on some other evidence, such as your online discussions on this topic and the timestamps of downloading and placing that file in relation to whatever other crime they are investigating.

Yes, there are many variables in play, but it doesn't make the problem undecidable, if it comes to court, your lawyer and the prosecution will point to them and the jury will decide.

Reply on news.ycombinator.com