Hacker News Reader

<strike>Siri</strike> <em>iOS</em> has an "I'm being pulled over" keyphrase which begins recording.

There'be been a few "I'm being arrested" apps, which typically trigger by holding hard buttons (volume, home, and/or power), though I'm not aware of specifics. Most of these seem to date to the OWS protests of ... how did that happen ... a decade ago:

https://www.cnet.com/tech/mobile/help-im-getting-arrested/

Freedom of the Press Foundation offers this advice doc: https://freedom.press/training/mobile-security-for-activists...

(Initial misattribution corrected to iOS, not Siri.)

> Siri has an "I'm being pulled over" keyphrase which begins recording.

To clarify, it’s not a Siri feature but an iOS Shortcut (which you’ll need to download or recreate) invoked with Siri[1]. The actions and key phrase are customisable.

[1]: https://www.theverge.com/2020/6/17/21293996/siri-iphone-shor...

Thanks, corrected above.

The correct thing to do if you want your phone not to be searched is to shut it off. The tools used to search phones generally work with unpatched vulnerabilities and you don’t want to do anything that looks like tampering with evidence.

When off the encryption of the device will be most effective and resilient to attack because nothing will be unencrypted until you enter your passcode at boot.

Couldn't turning your phone off be seen as tampering with evidence?

If you haven't altered, destroyed, or concealed the physical phone in any way, then why would turning it off be considered tampering with evidence? Also, I believe there would be a burden to prove that some material stored on the phone would constitute "evidence." Pretty hard for the cops to do that if they can't get into the phone.

If the police are aware of this “feature”, that’s an easy contempt and destruction of evidence charge among others. I’d recommend just not doing it.

Plausible deniability.

Are you joking? This is the exact opposite of plausible deniability. This feature requires premeditated user action to hide evidence in an attempt to mislead law enforcement. It is illegal.

No. I meant that “plausible deniability” is a thing, that if implemented properly will protect against these charges.

What happens when it becomes popular and police departments catch on? “plausible deniability” escalation is a two way street as others in this thread attest.

Then anybody trying to stop them from continuing this will be demonized for "trying to take away law enforcements tools needed to do their job properly" and say that this person supports terrorism and all the usual tricks to manipulate public perception.

...until the cops learn about that and add a countermeasure, then send you to jail for using it.

Agreed. That's why I believe it might be super handy if every or at least many phones had this in place so that you don't really stand out. At least every phone using an alternate OS. If all the mainstream operating systems had this I would expect an arms race between the OS devs and the forensics device devs.

As a side note, this would not necessarily be only used for law enforcement authorities. It could be that an armed phone thief requires you to unlock your phone. Sending a duress message, maybe even camera footage, GPS coordinates could be quite useful in the event you vanish. Teaching your kids to use this feature on their phones could also be very beneficial.

You might not stand out but it would still be contempt of court. Not turning over evidence with a constitutional defense is easier to defend in court than malicious fake-compliance.

Possibly true in court at least, but I think the end user should have the option to make this decision. Maybe give them a disclaimer that says In bold red text .. "Depending on your jurisdiction you may have legal problems using this feature! Research this and consult an attorney before enabling. You have been warned". In the US this would only apply in courts. AFAIK this would not be the case when interacting with the executive branch such as law enforcement but I am no lawyer.

If courts want this data, they can issue a subpoena and follow due process. Law enforcement can pound sand all day long if they are trying to circumvent due process.

Using this feature with armed phone thieves would not be a legal risk unless you are filming them in their home. Even then I would be happy to accept any legal risk when interacting with outlaws.

Even if the feature warned users, Apple and Google would not be off the hook. It’s entirely possible a prosecutor will go after them for implementing a feature designed to evade police and destroy evidence.

Us programmers tend to thing the law is black and white and a legal disclaimer solves all issues, but it’s not. The law can be (and is) a gray area determined by the courts on an individual basis. Judges don’t look fondly on technicalities for skirting the law. After all, they are humans, too. Not computers.

I would actually prefer that Apple and Google do not implement this. Even if they accept the risk, it would create an arms race between the phone developers and forensics developers assuming they don't put a back door in this feature. I would prefer this only be implemented by the alternate phone OS developers or by someone maintaining an open source add-on.

I should also add this is only a legal risk if you are using this against the courts AND select the options to wipe data. AFAIK you can disavow knowledge to cops all day long in most first world countries with little risk. Again, not a lawyer but it seems this is true based on cases I have followed. And this feature would not just be to protect from police. It could be to protect from phone thieves getting sensitive financial information which arguably should not be on the phone. It could also be used to alert people if people and/or their kids are being robbed. Actually the more I think about it, this feature could save the lives of some police officers. Some people may in poor judgement have data that could carry a longer sentence than killing a police officer. I recall a case where a professional thief killed all the guards because the punishment for the information they were stealing was more detrimental legally than homicide, but this is a bit of a rare tangent.

I also have to factor in that some locations there is a very thin gray line between law enforcement and outlaws. Maybe pushing the system to follow due process and maybe even prevent cops from planting data on the phone could be useful. That could be a logging feature of the sandbox. What data was added after duress was activated

Define "due process".

My experience is that the courts will define/apply it however they feel like, usually to your detriment.

wouldn't the judge need to have ordered the search for it to be contempt?

> It could be that an armed phone thief requires you to unlock your phone.

This exact scenario happened to me. They made me do a factory reset right in front of them, before handing the phone over. I didn't have any opportunity to do anything other than what they asked, and I probably would have been killed if I tried.

I don't see how I would have been able to make use of such a feature in that scenario or any similar scenario (e.g. getting arrested at a protest). It's a nice idea, but I think its usefulness might be limited to things like airport security lines.

Fortunately, they didn't realize that Find My iPhone persists through factory resets (nice!).

Unfortunately, I couldn't figure out how to use the web interface, and ended up accidentally wiping my phone, including the Find My iPhone tracing stuff, so I never managed to trace it anywhere.

> I probably would have been killed if I tried

Wow...are you comfortable sharing more details? Thanks.

>Fortunately, they didn't realize that Find My iPhone persists through factory resets (nice!).

Wouldn't a thief that knows enough to ask you to do a factory reset also know to ask you to disable Find My iPhone ?

I mean you're even prompted to do so during the "erase all content & settings" process, right ?

> Wouldn't a thief that knows enough to ask you to do a factory reset also know to ask you to disable Find My iPhone ?

No idea, I guess not! This was several years ago, I think Find My iPhone was relatively new.

> I mean you're even prompted to do so during the "erase all content & settings" process, right ?

I don't remember being prompted.

They might also not have been that smart. In addition to my phone and cash, they took my debit card (I was able to convince them to let me keep my various other cards like driver's license, train pass, etc.) and asked for my PIN, but I just called the company and canceled the card within the hour. They didn't take any of my credit cards, my (admittedly cheap) headphones, or (fortunately) think to check my backpack with my $1000+ work laptop in it.

I figured they were looking for a quick buck, and it was easier/faster/safer to just grab the cash and the phone than to be thorough and risk someone wandering or driving by. I am also very lucky, I know people who've been robbed in that same area and got beaten up pretty badly, even while trying to comply.

This. People on this thread seem to think you'll have time to do something clever with your phone. If someone puts a loaded gun to you, like they did to us, then you're inclined to do as they say.

Unlikely, in my courtroom experience. I would highly recommend making sure the police can't get to your data. It is unlikely you will be charged with anything. And what you get charged with if they get to your data might be 1000X worse than any minor obstruction of justice charge, depending on what sort of crime you are committing.

What crime were you charged with?

Per his other comments, he spent 8+ years in Cook County so it would almost certainly have to be first degree murder.

I can't reconcile the amount of time in jail with apparently being offered a plea deal with no custody

The criminal justice system in Chicago is a total mess. None of it makes sense on any real level.

Total speculation, since obviously I don't know the details of this specific case, but I would guess pled down to 2nd degree murder and received a sentence of time served.

It seems like it's this guy[0][1]. He was caught in a To Catch A Predator style sting and then they also found CP on his devices. Having read this article I'm interested in his claims of innocence, I'm not seeing a defence here.

[0] edit: decided this was doxing

[1] edit: decided this was doxing

No. Nonviolet, victimless felony. The maximum sentence was actually 3 years in prison. So I've done almost three times the maximum sentence because I refused to plead out.

I'm British and a felony conviction would impact my immigration status and also I'm innocent. So I refused. I actually thought I'd be in jail for a few weeks. Then 8 years later.

I feel bad for you. The justice system in the US sucks. How did you get out ? Were you declared innocent or what ?

Paid $15,000. I have a huge ankle monitor like 4000 others in the city. I'm technically confined to my bedroom at all times now instead of a jail cell, thus I can hang out on HN.

The idea about planting data is important. The police did all sorts of weird shit to my digital devices. Would not have known about it except that a forensic guy was taking photos in the room and accidentally caught the police in the background making changes.

Try getting your own forensic guy to see what changes were made. You need money for this. The court is supposed to supply you one, but often they do not, so you cannot show that the data was planted.

I don't know - but 1password absolutely does have this! Useful if you're in a scenario where you don't have the American version of human rights. You can hide stuff for a period of time

They call it "Travel Mode" (https://support.1password.com/travel-mode/).

It's good to know it exists.

The sad thing is, however, that even just knowing a name/identity is enough for motivated entities to "pull the thread" and go fishing on the internet for whatever they want.

IMO, just reset the phone to factory before you head to the airport, and leave it that way as long as you are in a jurisdiction that makes you think your phone is in danger of being searched. Restore from a backup when you get home.

If you do get searched, give them the phone and let them search it.

check out the Guardian Project's PanicKit. I'm not sure if it's still in active development but it looks like what you just described.

I wonder if there'd then be a worse penalty if police were to discover you were doing this, were the wipe timer not to trigger, and if that'd be worth the risk. Definitely an interesting idea, though

There's a strong possibility that Signal is already breaking Cellebrite https://signal.org/blog/cellebrite-vulnerabilities/

>For example, by including a specially formatted but otherwise innocuous file in an app on a device that is then scanned by Cellebrite, it’s possible to execute code that modifies not just the Cellebrite report being created in that scan, but also all previous and future generated Cellebrite reports from all previously scanned devices and all future scanned devices in any arbitrary way (inserting or removing text, email, photos, contacts, files, or any other data), with no detectable timestamp changes or checksum failures. This could even be done at random, and would seriously call the data integrity of Cellebrite’s reports into question.

...

>In completely unrelated news, upcoming versions of Signal will be periodically fetching files to place in app storage.

I strongly advise against pissing off Signal by claiming you can hack them.

I think an easier approach is not to do anything incriminating on your phone.

I for one, think we should not normalize a gestapo state and should absolutely push back on all forms of intrusion. Police have been caught planting drugs on suspects and it's really foolish to think they cannot plant digital evidence too.

True, but I accept the possibility that what is legal today may not be legal tomorrow and ignorance of the law is no excuse as they would say. I like having options.

"If you give me six lines written by the hand of the most honest of men, I will find something in them which will hang him."

It's generally advised to not talk to the police because anything can potentially be incriminating. Given that, your advice effectively becomes "don't have/use a phone in the first place," and I don't fault someone who doesn't want to settle for that.

Or - hear me out here - we could protect our reasonable expectation of privacy and not bend over.

If no one is testing the rights we're supposed to have, then it's unclear that we actually have them. Auditing should seem eminently sensible to all the engineers here.

Look, we live in a society where drywall dust can get you jailed for 90 days because the cops think it's drugs.

https://www.wftv.com/news/local/powdered-drywall-mistaken-fo...

And powdered milk: https://www.channel3000.com/homeless-man-told-court-powdered...