A phone the FBI sold to criminals
vice.com
vice.com
I have had a few different, sometimes anonymous, groups reach out trying to hire me based on this work or use my build system for unusual use cases. One, for instance, wanted advice for their own private fork of my project where they disabled the camera and similar things to supposedly meet requirements for a high security environment.
It is weird considering my open source project might have been used directly or as a reference by the FBI.
I'm honestly shocked at how most ultra-high risk people just use off the shelf products, sure they are addictive devices yes, but every few months there's another story of military, celebrity or political compromise because of their phones. It seems like a ripe field if you can somehow convince the end-user it's in their interest to reduce functionality.
Could be FBI, could be terrorists.
My personal mission is to help bring more privacy, security, and freedom to people so I don't really have an interest in work that does not further those goals.
I started my own security consulting firm largely so I can make a good living but also pick and choose my projects.
If I just wanted money without caring about ethics I know where to find high paying jobs at surveillance capitalism companies.
My ROM leads on that front https://divestos.org
Other ROMs that support locking are https://grapheneos.org and https://calyxos.org but have limited device compatibility in the name of security (primarily regarding firmware).
I may revisit some improvements I had in mind during one of my next blocks of time between clients.
CalyxOS is what I generally recommend for most use cases.
I will be reading about aosp-build tonight!
Hell, I'd even call it badass. The FBI created a tech startup (even with the .io domain!) and sold devices with a custom Android distribution.
It's funny because you can search for the XDA-Developers thread mentioned in the article, they were pretty shocked to find a phone with modded software and a locked bootloader.
If you use an OS built by someone else with no publicly available code then they own you. Always. That's hardly news.
GLS has scary[1] privacy implications and you cannot uninstall it. You can disable most of the scary stuff it does by not agreeing to use "high accuracy" mode for location, aka "device only". You must "consent" to this data collection because Google's lawyers believe this consent dialog meets legal requirements for this data collection. Their verbiage is horribly vague and absolutely does not communicate what data collection you are agreeing to by enabling this mode. It calls this data "anonymous" but location data, particularly traces, is anything but anonymous. At the high resolution of GPS these days, it cannot be anonymized.
[1] by "scary", I actually mean absolutely dystopian.
Unfortunately, I cannot.
> include a link?
That I can do. Here is their official policy:
https://policies.google.com/technologies/location-data?hl=en...
"On most Android devices, Google, as the network location provider, provides a location service called Google Location Services (GLS), known in Android 9 and above as Google Location Accuracy. This service aims to provide a more accurate device location and generally improve location accuracy. Most mobile phones are equipped with GPS, which uses signals from satellites to determine a device’s location – however, with Google Location Services, additional information from nearby Wi-Fi, mobile networks, and device sensors can be collected to determine your device’s location. It does this by periodically collecting location data from your device and using it in an anonymous way to improve location accuracy."
Consider the implications of Google collecting "anonymous" data from billions of Android phones. The technical details of scale, regularity, which sensors, their resolution, etc are highly germane here, but unfortunately not public. This is a very large blind spot in public scrutiny IMHO.
I have an Android without Google Location Services, the alternative location service is a Mozilla backend instead. I doubt that's much better for privacy and more likely stands out like a red flag to the Data Hoover collection agencies, but it is certainly possible to not use GLS.
I've only come across one small app that didn't play well with the Mozilla backend.
Aside from that, it sounds like a pretty decent secure phone, too.
Did they hire one of those TV show genius detectives to plan all this?
It sure seems more advanced than the usual FBI operations (or maybe we don't hear much about the good ones).
Why go through the trouble of running a VPN company yourself? That is sooooo 5-10 years ago.
Rolling your own fixes one issue and raises another.
In that way, an ambitious project that gives away certificates that were formerly worth a lot of money would be a pretty slick honeypot because now you could stow away private keys and have a copy of most of the encrypted webs certificates to decrypt in-flight communications.
https://en.m.wikipedia.org/wiki/Certificate_Transparency
The log is like a git hash-chain: you can never erase the past without affecting the whole chain after the erasure.
If you want hidden backdoors, put them in hardware, not software. Chips are the best place.
And even if a VPN company isn't compromised, there are so many legal loopholes that would allow government to access your data. Kitten on a tree can quickly become a matter of national security.
maybe lester freamon? this is essentially a more sophisticated version of what he did in season 3 of the wire. nothing new under the sun, I guess.
>Seeing a void in the underground market, the F.B.I. recruited a former Phantom Secure distributor who had been developing a new encrypted communications system called Anom. The informant agreed to work for the F.B.I. and let the bureau control the network for the possibility of a reduced prison sentence, according to the court documents. The F.B.I. paid the informant $120,000, the documents said.
https://www.nytimes.com/2021/06/08/world/australia/operation... (from when it was first revealed to the public last month)
Edited to add: It's fairly obvious that Phantom Secure was setup specifically to cater to organised crime communications - it appears the CEO experssly admitted this. I wonder if the company would have been better off marketing to 'security and privacy' conscious individuals, rather than, specifically, drug cartels, leaving the door of plausible deniability open.
https://www.reuters.com/article/us-mexico-telecoms-cartels-s...
Truly scary and ruthless people.
It wasn't a good choice if you're privacy-conscious anyway, since there was no source code available, so you couldn't check it actually does what it claimed.
Innocent (and clueless) people seeking privacy had their privacy violated by this action.
You state this as fact without any proof. The AFP and FBI assert that 100% of the users were engaged in criminal activity. Given the distribution method, which included vetting by a known criminal organization, the requirement to have an account created by administrators that are again known to be criminal, and the ability to only contact others on the same network, I tend to believe that assertion until I see proof otherwise.
Don't take cop statements at face value unless they're proven in open court.
If you're not familiar with the US policies around such things, lying is part of the job for police there. Most cases end up in plea bargains, which allows prosecutors and cops to avoid having to actually prove anything in court to secure a guilty verdict as part of a plea agreement.
Very few police accusations actually end up being proven with evidence.
The problem is that these things go hand in hand. The criminals wont buy from the poisoned channel if they can get the security they need from the standard consumer models. If you go to T-mobile, and you get the option everyone gets and it is end-to-end encrypted properly and there aren't any remote exploits then the criminals will just use that.
> The Department of Justice has charged multiple people who allegedly worked for Anom in part for obstructing law enforcement by using this [remote] wipe feature.
I thought anom was a government company the whole time- why would they be charging themselves? Is this simply a case of the right hand not knowing what the left is doing, or did the company used to be actually a sketchy outfit and got acquired/pressured to play along with the sting operation?
https://www.google.com/search?client=firefox-b-1-d&q=phantom...
https://www.abc.net.au/news/2021-06-15/no-one-in-america-arr...
> The AFP made more than 500 arrests but US privacy laws stopped the same from happening there.
It specifically says that the natural right will not be violated, how is that a legal right?
The BoR is, by plain definition, a codification of rights. To codify means to make into law, which is what it is: a law, implementing the formal recognition rights... and it does so by making illegal specific abuses.
It's supposed to be a way of showing that the government is subservient to the citizens, as it does not have the power to grant citizens rights. I doubt it's effective though, as most people seem to think the Constitution grants rights.
Maybe that's just me, but that's way too abstract for me. Have planets and stars always had certain rights purely by existing as well?
> and society chooses which ones should be protected
Well in that case you could make the case that every single person has every single right anyone could possibly have and the society chooses a subset of these rights as actual laws. I guess this is a way to eat your cake and have it, too, since it makes the difference between my and your view unobservable.
You are right that people have rights without the constitution. Other people are right that the constitution grants rights. The confusion is that you are both talking about different types of rights.
A law that says "the government can't legally do [x] to me", by definition, creates a legal right that I have "a right not to have the government do [x] to me". They are semantically different in perspective, but causal in relationship.
If people said "the constitution grants the right for our free speech not to be infringed" I'd probably ignore it. That's not how any discussion goes though.
Here's why I think this matters in this instance. By saying the 4th is "just a legal right," you are saying that the Constitution only grants it to certain people and the government can spy on anyone else. But by saying it's only a limitation, there's no qualifier on whose rights they can infringe.
Of course, international rights also need international enforcement, since a right without enforcement is just a nice thought. Perhaps we'll also have a world order to enforce these rights.
Expressing discontent with the status quo is one prong of consensus gathering.
Universal human rights have exploded to be adopted by much of the world, without an international government.
Rights are not just nice thoughts. Even oppressive governments don't have the resources to control everything everyone does (of course). Just adopting the outlook, just believing you are free will make you free to a great extent.
It's difficult to make the case that only citizens deserve rights without sliding into questionable ideologies.
If you're the US government, and you're justifying your power by saying that you respect human rights, and then you do a bait-and-switch and provide citizen's rights but not human rights, you just lied.
That being said, strictly speaking I disagree, citizens do not have full authority on rights and neither are all rights conferred to classes of citizens.
I'm sure Australia is helping find US citizens the same way.
It's a run-around on the laws of each country.
In a way, privacy advocates could be thanking crime lords for their support in the future.
To be clear: I'm perfectly happy for them to be anonymous for any reason or no reason. I'm specifically wondering who theoretically would want to retaliate against someone purchasing said devices and why. First sale doctrine still applies even to known honeypotted devices, right?
I can see just generally wanting to stay off their radar, though. Even law-abiding folks can get arrested for being in the wrong place at the wrong time, and you don't want someone to see "passed an FBI-tapped phone to a tech media site" in your file. Or maybe their work requires a security clearance, that could hurt you there.
Seems enough reason to me to not want your name plastered all over the internet.
They are being sold by criminals trying to get rid of them, so they will probably have vague descriptions.
Will try to find it, but it was awhile back.
edit:
https://slate.com/news-and-politics/2021/06/encrypted-messag...
> The operation came into being after the FBI took down a Canadian-based encryption service called Phantom Secure. Phantom Secure was marketing its services to criminal elements, offering secure communications through the encrypted cellphones that the company provided to syndicates. When the company was dismantled in 2018, the FBI sought to fill the void in the black market for secure criminal communications. To make that happen, the agency recruited a former distributor of Phantom Secure as an informant who, in return for reduced jail time, not only helped develop an encrypted communications system called ANOM, but helped market it to insular networks of criminal buyers.
The FBI's plan was even more bold. Rather than penetrate an existing encrypted phone company used by criminals, it would secretly start and market its own encrypted phone firm. While criminals used the devices, the FBI would be able to read what they were saying.
The challenge was that running a fake encrypted phone company was not that different from running a real encrypted phone company.
"We can't just run a good investigation; we have to run a good company,"
...
It was essentially a problem of marketing, Young said. The FBI needed to imbue this fake company with credibility so that criminals would buy and use the phones.Even asking a regular customer, "Hey, what happened to Ivan? I haven't seen him around. Is he still in the area?" while they're shopping for sports equipment could be a conversation that provides valuable information about someone's whereabouts.
[0]https://www.npr.org/sections/money/2019/02/13/694549634/epis...
2) There might be more unintelligent people than people who are both intelligent and so incapable of socializing that they can't find work.
If you haven't heard of the just world fallacy, it might be worth looking into.
The FBI is after the upper echelons of organized crime, and organized crime can be terrifyingly intelligent and resourceful. As another commenter mentioned, some of the Mexican cartels have their own IT departments and private cell providers.
What is that based on? If they are so smart, why are they in a business where they're risking their lives, living under constant legal threat, and ruining the lives of millions of others? Lots of people get very wealthy without those risks, such as many in the Bay Area? Who is smarter?
Having your own IT department isn't a sign of genius.