Hacker News Reader

Hacker News

Comment by xanaxagoras | Hacker News Reader

Full thread

xanaxagoras

They left off one very popular messenger, SMS:

* Message content: All

* Subpoena: can render all message content for the last 1-7 years

* 18 U.S.C 2703(d): can render all message content for the last 1-7 years

* Search warrant: can render all message content for the last 1-7 years

* Vague suspicion plus a small fee to the carrier: can render all message content for the last 1-7 years

View on HN

There's also:

* Law enforcement simply asks nicely: can render all message content for the last 1-7 years

* Law enforcement wants to stalk ex-girlfriend: can render all message content for the last 1-7 years

The Stored Communications Act makes disclosing the contents of messages without a search warrant unlawful

The people responsible for investigating and prosecuting such crimes have some not so great incentives to avoid doing so and keep the whole thing secret though, don't they?

And then when they get caught, they do this:

https://cdt.org/insights/the-truth-about-telecom-immunity/

Sounds like an easy way to have your case tossed out in court.

It's funny how much this differs from my own personal experience with law enforcement. The friends I know are timid as hell and don't do anything without a warrant just to stay on the safe side- even if they probably don't need one.

The really smart cops get the tips using “less than legal” means, then walk back and reconstruct using legal evidence.

“Parallel Construction:”

https://en.wikipedia.org/wiki/Parallel_construction

I'm just glad you're here to stick up for your friends without any corroboration or linking story. It's just a good thing to do.

Being charitable, let’s assume his friends work as homicide or theft detectives. If so, they need a high standard for admissible evidence to build their case.

If on the other hand his friends are street cops tasked with clearing a corner of drug dealers because some neighbor complained to their council person who complained to the police chief then those cops don’t necessarily care about extrajudicial activities.

Having been harassed by street cops and interacted with homicide detectives, I can tell you they vary tremendously in professionalism.

They definitely need a high standard for admissible evidence, that doesn't stop them from purchasing large amounts of data from all-too-willing communications companies and using parallel construction to build their case once they find out what happened via warantless spying.

Cybercrime. Lots of scams and child abuse.

They can also query these messages to see if there is something on the dealers they get paid from and then warn them if something comes up. It works both ways, no?

Good luck with that. In my case there was a ton of violations of the SCA. Violations of the SCA are only actionable if they are "constitutional" in nature. (That essentially means that if the government indict you based on information they illegally gathered through violating the SCA but the information did not belong to you - say it belonged your wife or business partner - then you can't get the information suppressed/excluded in court)

In my case the government did violate the SCA and my constitutional rights, but two judges have looked at it and both stated the same answer - the police must be allowed to commit crimes to gather evidence. Next stop: appeal courts.

Yep, the courts side with law enforcement. The whole 'truth comes out in a fair fight' is completely undermined by this. The system protects itself above all else.

I was involved with a case that sounds similar - the judges don't care about your rights and blatantly missapply the law. Also, magistrates are also complete BS, and don't even know basic legal stuff. I had one think I called him prejudice when requesting a case be dismissed with prejudice... Complaints do nothing. There's no real oversight, leading to a completely incompetent system.

> There's no real oversight, leading to a completely incompetent system.

It's the system working as intended. If you want something that looks like justice, you'll need substantial wealth to get it.

Imagine a world where the entire law enforcement complex followed the law. What a world.

"Sounds like an easy way to have your case tossed out in court."

This is terribly naive in my experience.

Let's be honest, how often do people share with their pals about how they commit crimes, or are less than scrupulous, at work, assuming their pals aren't criminals, as well? People tend to keep things like that a secret, even from people that are close to them.

You have to generally assume that the FBI and other government agencies are competent. My baseline, starting assumption is that if everyone in the US was too scared to use programs like PRISM, they wouldn't have been built.

So these kinds of claims just don't make any sense in a world where we know that government has conducted surveillance without a warrant, and where we know that the FBI has built entire programs designed to make it easier for them to conduct surveillance without a warrant.

From the article posted that you're replying to:

> What Administration officials tend to obscure is that what they seek is not immunity for future cooperation with lawful surveillance, but rather telecom immunity for assisting with unlawful surveillance conducted from October 2001 through January 17, 2007, as part of the warrantless wiretap program initiated by the White House.

I'm not sure I understand what your implication is. I don't understand how it's possible to respond to an article that is about telecoms seeking immunity for previous unlawful actions by saying, "the government/businesses would be way too scared to do anything unlawful." I mean... obviously not, they sought immunity for it. They wouldn't just randomly do that, the most likely explanation is that they made immunity a pressing issue because they thought they needed it.

It does not seem to me that the optimistic world you describe and the observable actions and lobbying efforts of companies/administrations line up with each other.

The reality is that many times the only barrier to sensitive information is a shared login which many people know and a statement that users represent that they have legal authority to access that info.

EO12333 makes it lawful without a warrant.

> EO12333

An EO making it lawful for a federal agency to collect doesn't mean it is lawful for a private company to disclose, it doesn't change when a company is permitted to disclose the content of messages under the SCA

I mean, this whole discussion is moot since nobody will enforce things like this, especially against themselves.

Just like the NSA spying on Americans is unlawful [0] the FBI terrorizing political movements is unlawful [1] or the CIA operating in the US is unlawful [2]

Yet, I'm pretty sure all these are still happening, to a certain degree, to this day.

[0] https://www.reuters.com/article/us-usa-nsa-spying-idUSKBN25T...

[1] https://en.wikipedia.org/wiki/COINTELPRO

[2] https://en.wikipedia.org/wiki/Operation_CHAOS

Larger point would be if it's obtained unlawfully it can't be used in a court of law against you.

Recent cases:

https://www.vice.com/en/article/pkppqk/court-throws-out-mess...

https://www.computerweekly.com/news/252503524/Berlin-court-f...

That is little consolation in the court of public opinion, where FBI management and the Justice Department have demonstrated willingness and capability to hold mob court and manipulate public opinion outside the formal legal system. They will SWAT you themselves if they like, on live TV.

Parallel Construction makes this a technicality/nuisance, not a show stopper.

came here to say this.

Generally only if you have the means to hire a good lawyer.

The NSA doesn't need to illegally spy on Americans when an ally can do it for them and then share the data legally.

https://www.nationalarchives.gov.uk/ukusa/

https://en.wikipedia.org/wiki/Five_Eyes

That's not really how it works. Sure, it is also a way to circumvent such local legislature, but for that to work American allies would need to run actual surveillance structures in the US mainland proper out in the open..

You know, like the US does in the countries of it's "allies" like Germany [0]

Do you really think the US would allow German intelligence agencies to build whole complexes, plugged right into the US's largest IPX?

That's why this situation is not nearly as "symbiotic" as it's often made out to be. At best that applies to Five Eyes countries, and even there only to a very limited degree as no Five Eyes member as as much foreign presence as the US.

[0] https://en.wikipedia.org/wiki/ECHELON#Examples_of_industrial...

To this rhetorical question, a resounding “yes” answer. There is credible suggestion that GCHQ has been invited to operate US facilities on US soil for this explicit purpose.

https://www.theguardian.com/uk-news/2013/aug/01/nsa-paid-gch...

You are correct. There’s also varying 2-party/1-party consent required depending on the state in the absence of a warrant. But unless you’re targeting the devices, you will not get much at all from service providers. They simply don’t keep it contrary to what I read here.

Tell that to the FAANG companies that provide white glove access to authorities any time they ask.

Companies also sell data to law enforcement.

Many tech companies even develop nice portals for law enforcement to use where they can request and view data, with or without a warrant or subpoena.

Major service providers do not maintain SMS history beyond 24 hours, let alone 1-7 years (last time I worked a case that is). They’re transparent about it as well. Look up the LE liaison contacts on their sites and they’ll clearly list what is available or not available. That’s why it’s crucial to get the actual devices themselves. Reason: the infrastructure to manage SMS content for every customer for 7 years with zero business justification/use case is phenomenal. They’d spend most of their time responding to civil and criminal subpoenas/warrants. That would be a feat the NSA would be proud of. Been there and done that a 100 times. (This also aligns with certain VPN providers refusing to keep logs. It’s a cost that provides zero returns, so they cut it as a business decision, not because they’re trying to stick it to the man.

There's no reason for them to keep those records, other than for law enforcement's sake. No use case for calling up your operator to ask about that text message you got "from Fred at 4am one day a couple years ago."

I'm surprised to hear this has changed so significantly since the snowden leaks. Especially after the blatant attack on Qwest CEO Joseph Nacchio for refusing to spy. It was established then that the major mobile telcos in the USA were keeping and providing sms full data for 2-5 years (t-mobile, at&t, verizon, etc).

and also that the government was subsidizing the programs when the companies complained about the added costs.

I went to a major cell provider and asked them nicely for access to SMS for all their customers and they happily took money and gave me an API.

This was for a startup.

I have no doubt they do the same for governments.

If I understand this correctly you’re saying a major cell provider is selling you access to subscriber SMS message content?

They sold access to send or send/receive messages for use cases where customers would legitimately consent. E.G. a wireless Bluetooth accessory that wants to access and reply to SMS message content on Apple devices that Apple won't grant access to.

Still. It meant a very powerful API key had to be protected and never abused.

I can only imagine others obtain God SMS access like this with less than ethical intentions.

> Major service providers do not maintain SMS history beyond 24 hours, let alone 1-7 years

Nobody should make decisions based on this comment.

Agreed. Do your own due diligence.

You forgot email... and they don't need a warrant for messages older then 180 days if in the cloud (they never delete them, too): https://www.consumerreports.org/consumerist/house-passes-bil...

IIRC the only reason this amendment was made was because the 180 day limit was found unconstitutional anyway by an appellate court. So, technically the amendment did nothing.

It doesn't matter where your data is held, locally or cloud, (if you are an American resident and your data is in the USA) as it is _your_ data and it is unconstitutional for them to read it without a warrant. In theory.

> It doesn't matter where your data is held, locally or cloud

In the US it does

Citation?

This ruling has been adopted by the US Supreme Court: https://privacylaw.proskauer.com/2007/06/articles/electronic...

Look at the link I posted up there? it is 10 years newer then yours

If they are local and encrypted... oops, forgot the encryption key.

Source is a few years old, but I suppose we can make another FOIA request to find out how long carriers store text messages these days - it was basically 0-5 days a decade ago:

https://www.nbcnews.com/technolog/how-long-do-wireless-carri...

Idk... back in the mid 2000s my parents managed to get a transcript of all of my (minor) sister's SMS messages for a few months back (as part of a billing dispute).

You’ll be lucky if it’s any longer than 24-hours now. There’s no business use case for building and maintaining the technological infrastructure to manage it for years. It’s private info and they can’t sell it to anyone without legal liability. If LE gave them the funds to build this infrastructure and use it for retention then the service provider is essentially an agent of the state at that point.

You're overstating the technical difficulty of archiving and retrieving text.

I can only imagine that the scale of all US SMS messages is absolutely staggering. It probably eclipses all other text formats combined in terms of daily production. Here's a blog post from a few years ago estimating it at 26 billion text messages per day and rising: https://www.textrequest.com/blog/how-many-texts-people-send-...

Not counting media and assuming they are all 160 byte messages, that's 4 terabytes per day, or about 200 wikipedia's per day. I guess that's not too bad in terms of storage requirements, certainly a management amount of data for a telecom to store. But assuming that you want those indexed and easily retrievable somehow, it could get very burdensome to manage and interact with, and that tends to balloon the size at least a little bit as well.

The liability and legal issues around it (both externally and internally - don't want employees spying on their exes, leaking data from celebs, in addition to the policing issues, etc) makes it pretty undesirable to store though.

It's about secure messaging

Reply on news.ycombinator.com