FBI Tries To Force Google To Unlock User's Android Phone

Trailrunner7 writes "Those multi-gesture passcode locks on Android phones that give users (and their spouses) fits apparently present quite a challenge for the FBI as well. Frustrated by a swipe passcode on the seized phone of an alleged gang leader, FBI officials have requested a search warrant that would force Google to 'provide law enforcement with any and all means of gaining access, including login and password information, password reset, and/or manufacturer default code ("PUK"), in order to obtain the complete contents of the memory of cellular telephone.' The request is part of a case involving an alleged gang leader and human trafficker named Dante Dears in California. Dears served several years in prison for his role in founding a gang in California called PhD, and upon his release he went back to his activities with the gang, according to the FBI's affidavit."

Comments

Plausible deniability...

[Anonymous Coward]

is becoming ever more important. In fact, it will soon replace the constitution as the thing you can always depend upon.

H.

Re:Plausible deniability...

[black3d]

I'm not sure you're arguing against the correct aspect of his post. He's stating the facts of the statistics - he even mentions himself that those are the statistics. It *is* a fact that for a random robbery, it's 8 times more likely to have been committed by a black than a white. (And likewise, the individual mentioned is more *likely* to be black than white purely on a statistical basis). What's wrong with his post is that he doesn't take into account causation, and the causation is not that they're black, but other socio-economic factors, of which race is merely a correlation. That's not to say each individual isn't responsible for his crimes, but that race isn't the determining factor of why the crime occurrs.

For about a year at one point, I lived in a small island chain populated almost entirely by blacks - around 60,000 to 200 whites. However, the only murder in the last 20 years, had been committed by a white. Is it because he was white? No. And the statistics OP used to make his case are equally flawed simply in that respect.

Re:Plausible deniability...

[Charliemopps]

I think that one thing we can agree on is that statistics are total horseshit. Sure, if done by a totally impartial party (which doesn't exist) they might be useful. But in something as divisive as race, crime, punishment, slavery, social equality, who is really impartial? Ask yourself a few questions and you soon realize how pointless these statistics are...

1. Who is black? Most blacks have a large part of their genetics made up of Caucasian genes. Look at our president. I'm white, my son is adopted from the heart of Africa, 100% African genes. Is he black? Certainly... but how does he fall into these statistics? He's going to have the up-bringing of any white-middle class child.

2. Who's collecting these statistics? The judicial system? The judicial system has been proven prejudice by hundreds of studies over the years. They convict more minorities of crimes, they give them longer sentences, they charge them with more infractions. They pull over a white kid with a pocket knife and they call his parents, they get a black kid with the same knife and he's getting charged with a felony. Are blacks really twice as likely to commit a crime with a knife? Or are they just twice as likely to get convicted?

3. The AC poster is clearly a troll and probably doesn't even believe in what he's saying. So there's that.

Re:Plausible deniability...

[Kjella]

That's all well and nice, but people act on indicators not causation. To take an example I'm a male and most rapists are male and most rape victims are female. So if I happen to be walking in the same direction as a woman late at night she's got far more reason to fear that I'll drag her into the bushes and rape her than I got reason to fear that she'll drag me into the bushes and rape me. None of this has of course anything do to with causation, unless you're the kind who thinks women are "asking for it". Is it sexist or just good threat assessment? Now repeat the same with a potential mugger and a potential mugging victim, are you then a racist if you fear the black guy more than the white guy?

Of course we're all individuals, and I'm not guilty of anything because someone else who shares some physical or other characteristic with me commit crimes but you can't tell that from looking at me. Prejudice you can cure through knowledge, but what of statistical "truths"? Say you have two possible hires, practically identical resumes and interviews but you know one belongs to a group you know that's generally known to worker harder and complain less, which do you pick? Here in Norway we've had companies now pretty plainly state that they prefer Swedes for bars and restaurants and Poles for construction and industry and somehow that's not discrimination based on nationality - I guess it helps we're all white. But if someone were to say something of Somalis or Iraqis or Afghans, they'd be burned at the stake as racists.

In short my impression is that you get plenty discrimination, but only certain groups in certain situations gets to call foul and say it's racism. We're all equals but as usual some are more equal than others, the rest of us are just supposed to take it when we're being discriminated against. Why am I supposed to take blanket statements about us when I can't make the same kind of blanket statements about others? Same with our department of equality, you'd have to search long and hard to find a case where men were discriminated rather than women, sexism is another one-way street. But if you point that out it's STFU you're a white male, you got nothing to complain about - as if that wasn't the most racist, sexist remark of them all.

Re:Plausible deniability...

[hairyfeet]

Actually, and I'm sure the left leaning on this site will scream and hit the downmod for me daring to point this out but it isn't blacks its AMERICAN blacks which have embraced a VERY destructive pattern of attacking those that try to get an education while worshiping the wasting of money and the whole "thug life!" bullshit that is the cause of the much higher crimerates among blacks, that and 50 years of white guilt that caused more damage to the black community than dropping an atomic bomb on them. Instead of hand ups all they got were hand outs that rewarded destructive behavior like having more unwed mothers with more unwanted children and the community itself not only not condemning this behavior but actually treating it as a valid "lifestyle" certainly didn't help matters any.

But if you do look at the stats you'll see a black just off the boat from Africa, despite language and culture barriers, is something like 9 times more likely to become middle class than an American black that has the advantage of being born here. I would argue this is entirely due to culture and the almost pathological hatred for anything that can be considered "white" like education. I have actually witnessed this myself, with friends that were actually trying to get ahead being openly ridiculed and attacked by others in the community and even in their own family, who have a "you think you are better than me Uncle Tom?" attitude to those trying to get ahead. i just haven't seen this kind of hatred for those trying to do better in any other race. Hell when my son was accepted into the college's premed on a full scholarship we were all happy he was gonna do better than us, but the attitude in the black community would have been to attack. To me that just doesn't compute and its no wonder there is so much crime when you have the worship of money in the form of wasted wealth like "bling" and rims and Caddys but attack the ways one can legally earn those things.

As for TFA as more and more people live off their cell i'm sure we'll see this more often, big bro don't like not being able to get into anything they want at anytime. i have to wonder if it is not sheer laziness on the part of the police, as in the old days they would actually investigate whereas now with GPS and cells and a bazillion other easy sources of information all it takes is access to the data and you can find out anything you want about an individual. Kinda sad that you don't really need big bro to plant a tracker on you as the corps have made sure you are shackled to that smartphone 24/7 that makes it easy enough to track your every move. I have to wonder if that isn't the real future of big brother, that it won't be the governments who will just become impotent stoolies but the multinational corps who end up ruling vast nation states like in the classic rollerball. As someone with whom i was discussing Brave New World VS 1984 pointed out to me we are living in BNW right now, with every pleasure on demand and endless information and he wondered if they aren't simply too sides to the same coin, you start off with BNW and then as the system breaks down as more and more simply can't afford the endless distractions and trappings of BNW it slowly morphs into 1984 as the elite build more and more safeguards into the system to protect themselves from the masses of poor who get tired of being hungry and never getting ahead.

Re:Plausible deniability...

[Bongo]

That sort of culture isn't just part of one group, though.

I recall my Scottish grandmother showing similar contempt for her children when they made moves to improve themselves. It became a life long resentment that destroyed the relationships and the hatred was never healed. Another example from a previous generation, a son and his wife who left Pakistan for the UK, to find better opportunities, was spat at by his mother and she said she hoped they all died on the voyage.

Modern life demands that individuals leave their family and community loyalty behind and go where the opportunities are.

Those who don't shift into that modern mindset will remain poor.

If that sort of attitude sounds hard to believe, you have to bear in mind at that time in Scotland, it was considered wise to have all your teeth pulled when you were a teenager so you wouldn't face medical bills later on. When people are very poor all they have is family loyalty. So what makes you strong is also what holds you back in modern life.

Ars Technica Lnk

[DarkHelmet]

http://arstechnica.com/tech-policy/news/2012/03/fbi-stumped-by-pimps-androids-pattern-lock-serves-warrant-on-google.ars

The one thing I found amusing about the whole thing is that PhD supposedly stood for "Pimpin' Hoes Daily". Then I read this:

Her $500 a night went straight to Dears, though, who "took care of her" in his own special way. As San Diego's Union Tribune reported, Dears found out the woman had spoken to a man who wanted to help her get off the streets. So Dears "beat her up in the back seat of his Cadillac and then forced her to get into the car's trunk, she testified. While in the trunk, she was driven from East Main Street in El Cajon to Hotel Circle in Mission Valley, she testified."

Major league asshole. I hope he gets the book thrown at him.

Re:Ars Technica Lnk

[yurtinus]

I wonder how much rage we'll see in the discussion on this article... Now, not that I'm a lawyer or anything, but it looks like a properly served warrant for access to a specific device. Pretty much exactly what I would expect (and want!!) law enforcement to do while investigating a crime. I suppose it remains to be seen if the information they get allows them to unlock an arbitrary Android device or just this one.

Re:Ars Technica Lnk

[oakgrove]

When you try and fail to unlock an Android device enough times and fail it just asks for your gmail password. I doubt Google will do anything more than give them that which would be pretty worthless against any other Android phone.

Re:Ars Technica Lnk

[russotto]

Now, not that I'm a lawyer or anything, but it looks like a properly served warrant for access to a specific device.

Well, first of all, it's a rubber stamped warrant. Literally.

Second, Google is unlikely to have some of the information requested; the PUK of the SIM would be known by the SIM manufacturer, not the maker of the phone's operating system. Same goes for text messaging; it goes through the carrier, not Google.

Third, the records are unlikely to be physically at Google Legal Investigations Support.

Fourth, some of the "items requested" amount to a fishing expedition -- so much for "particular" descriptions of the places to be searched or items seized.

Re:Ars Technica Lnk

[amiga3D]

Exactly! This is how law enforcement is supposed to act. They have a suspect, they provide reasons to a judge, get a warrant and Google opens the device. If you're involved in crime don't keep anything incriminating on your phone. I mean really, these are the kinds of assholes law enforcement should be locking up.

Re:Ars Technica Lnk

[Anonymous Coward]

Silly me - here I was thinking it was a failure of Mr. Dears to behave in a socially responsible adult manner, instead of engaging in petty crime and preying on the weak.

Society doesn't owe him a $500 a night job. Society doesn't owe him a cushy life free of any bad luck.

Re:Ars Technica Lnk

[EdIII]

It should not be that much of a problem for Google then.

There lawyers could just have fun with it. A nice lunch with some IT guys and a hour or so later you have a well written response with supporting documentation on why the FBI are complete technology retards.

They could have a few pages on how PUK and SIM actually work, and even being helpful, list contact information for the manufacturers.

Judge would just love reading that the FBI was wasting the courts time because they could not even figure out who to serve a warrant to. :)

Re:Ars Technica Lnk

[Anonymous Coward]

I would hope that Google doesn't know my gmail password. I hope they use some security system that is similar to a salted one way hash. For example with Windows, the password is not known by the domain controller and it cannot be retrieved (short of doing dictionary hacks against the hashing function). I'd expect Google to be even more secure there and not have access to my password. Now, they could absolutely RESET my password. That's a different ball game than being able to produce my existing password on demand. One is scary. The other is just inevitable.

Re:Ars Technica Lnk

[cpu6502]

It doesn't look like the warrant was issued yet. The judge may turn it down, or severely limit its scope (only require Google to provide the passgesture, if they have it).

Re:Ars Technica Lnk

[Anonymous Coward]

The PUK is also unnecessary since it's only used to unlock the phone's SIM card (and hence it's contacts.) If you fail too many times it self-destructs.

The Wireless provider knows the PUK as it's based on the serial number of the sim card, so Google certainly wouldn't have it.

Text messages are bit of a "maybe yes", while they are transmitted through the carrier, for billing purposes, the carrier has no way of reading them unless they've been stored. Having worked for AT&T, their customer service software, and all the support software doesn't let you read text messages, but it does let you send text messages anonymously to phones. If you're a technical staffer who can manually provision phones, you may have access to the SMS in-transit, but I don't think they're stored unless the FBI has been requiring it.

The actual storage of SMS messages are on the phone/SIM if not deleted. It largely depends on what the phone's software is setup to do. On early Motorola and Nokia phones, all the contacts were stored on the SIM card, but on later models (post 2005) they are stored in the phone memory by default.

So there's no need to get the SIM card PUK, It's just the easiest way to bypass the PIN password. If you remove the sim card and replace it with another one without a PIN, it will give you access to the phone and all it's data anyway. Depending on the device, you may have better luck simply syncing the device to a computer.

As for what you can do with a stolen/lost phone, not a hell of a lot. If you're looking to wipe it so you can keep it, it's much easier to do that, than to use it for identity theft. As a golden rule, I never "save my password" on any device. I'd rather a lost device be wiped than someone using the data for nefarious purposes.

Re:Ars Technica Lnk

[Kalriath]

One question: are your private prison operators paid on a per capita basis per incarcerated person, or on a performance basis per rehabilitated person? Ours are paid per rehabilitated person. Et tu?

Re:Ars Technica Lnk

[russotto]

IMHO the case as such is sufficiently egregious so as to justify an extremely broad warrant without much consideration by a judge.

First of all, the Constitution doesn't allow warrants which don't particularly describe places to be searched and things to be seized, no matter how egregious the circumstances. The Supreme Court has ruled that the judges do have to exercise judgement when approving them (though this is honored more in the breach than the observance).

Second, law enforcement is very good at painting defendants in a bad light. Look up the Kevin Mitnick case; whatever Mitnick did, it is NOT true that he could have started a nuclear war by whistling into a pay phone. In this case, they use "human trafficking" as a scare term; it appears he's actually a run of the mill pimp.

Re:Ars Technica Lnk

[Jah-Wren Ryel]

Silly me - here I was thinking it was a failure of Mr. Dears to behave in a socially responsible adult manner, instead of engaging in petty crime and preying on the weak.

Silly you indeed. We are society so we can change it. We are not Dears so we can't change him. That you equate fixing systemic problems with giving criminals "a cushy life" indicates that you don't really give a damn about society.

Re:Ars Technica Lnk

[Ethanol-fueled]

Bullshit. The middlemen (pimps) would be taken out of the equation entirely because prostitutes would be empowered to have total control over their enterprise, as they do on craigslist and other sites.

Legalizing prostitution increases profits (not having to pay a pimp), allowing women or men to "vet" their dates in advance(the high-class prostitutes are frequently grad students who target single and successful dorks like you for $400 per session) and eliminates violence and urban blight by shifting the acts to private residences.

But like the lazy, brutish, and entirely misguided crackdowns on Marijuana; legalized prostitution ain't gonna fly in Ammurika anytime soon, especially with loonies like Santorum seriously considered candidates for president.

Re:Ars Technica Lnk

[swillden]

To use google (ldap) directory sync with google apps, you need to use unsalted SHA1, or cleartext passwords in the directory you wish to sync.

That doesn't mean Google stores unsalted hashes or cleartext, it just means that whatever Google stores is computable from those.

(Disclaimer: I work for Google, on security stuff, but I don't know anything about how user passwords are stored. I will say that storing unsalted hashes or cleartext would be very out of character for Google. Google tends towards great caution when it comes to security, and employs a lot of serious security experts and cryptographers.)

Re:Ars Technica Lnk

[plover]

So you think "run of the mill pimps" somehow deserve a pass on human trafficking? Is that because they're too numerous to arrest? They have too much evidence against cops, judges, and politicians? Or is it because they just traffic in "hoes", not "people"?

The Ars article mentions a woman who he locked in the trunk of a car to prevent her escape. In what corner of the world do you live in where would that be dismissed as "run of the mill"? What kinds of people are willing to accept that behavior? Is it because she's not your daughter or sister, so it's OK that a pimp keeps her on the streets?

I agree that law enforcement often overstates their case, and try to throw a dozen charges at someone in hopes that one might stick. But this is the signed statement of an agent who interviewed a witnesses who directly observed the convicted parolee texting women who then appeared and delivered money to him throughout the evening. That's plenty of evidence to at least ask a judge to issue a search warrant for the phone. The judge could say no, of course, but this affidavit doesn't seem out of line for such requests.

He's already violating the terms of his parole agreement by not divulging his password to the FBI. The guy could certainly rot in jail for the rest of his sentence, with no more effort on anyone's part. But if additional crimes have been committed, they should be tried as well.

Re:Ars Technica Lnk

[plover]

He's already guilty of the crimes he committed before, and he has not yet completed his sentence for those crimes. He's on parole after being released early from prison. Actually, he's on parole for a second time, after having violated the terms of his parole earlier and going back to prison for an additional year and a hafl.

One of the terms of his parole is that he must not have a mobile phone. Another one of the terms is that any passwords, encryption, to any information whatsoever that he has, he will immediately provide the means to access that data upon demand of his parole officer. He denied to his parole officer that he had a mobile phone, but his parole officer found it and seized it. The parole officer had every right to do so under the terms of his parole. He's also refused to provide the account and password information to access it, even though he agreed to provide it as a condition of his early release. So he's already in violation of two of the terms of his parole, and for that alone he gets to go back to prison. There is no additional trial needed -- he has already been found guilty of his original crimes. The terms of parole have nothing to do with "innocent until proven guilty." That bit of justice ended with his verdict. He is guilty.

As far as these new allegations and crimes go, he needs to stand trial for them. But he's already a convicted felon who was let loose from prison too early, twice. "Wholly innocent" is not a factual statement one uses to describe this felon.

Re:Ars Technica Lnk

[Nursie]

I can't name the society you're after, but I can make a couple ofr suggestions -

Stop criminalising things that people want to pay for.

Obviously this doesn't extend as a blanket rule. I'm sure some people would like to pay for murder, and we don't want to legalise taht. But in terms of drugs and prostitution we have a situation in which large numbers of otherwise law-abiding citizens are conspiring with the criminals to get money to them for goods or services. The result is that you get a mess of violent gangs with a lot of funding, you get low-quality drugs, you get human trafficking and abused women.

Legalise and regulate both and you eliminate a lot of this crap because you take away the black market aspect that keeps the cash flowing to criminal organisations. You won't end up with a perfect utopia by any means, but you will end up with a lot less people acting as willing accomplices to criminal arseholes.

As part of a case, okay sure, why not

[sandytaru]

If they have enough probable cause to suspect there's even more evidence on the phone and are going through the proper procedures of obtaining a warrant, then I don't have a problem with this. If they were not in the middle of a trial case, however, I'd think this would fall under "unreasonable searches and seizures."

Re:As part of a case, okay sure, why not

[artfulshrapnel]

Yeah, seems reasonable to me.

Your cellphone is not some magical box of protected data. If you've been committing crimes, and you get arrested for it, everything you've ever recorded is going to get looked at during that case. That includes the contents of your cellphone, and the police have the legal right to force entry to just about anything once they have probable cause.

I mean, it's not like they randomly pulled this guy out of line at an airport and demanded he unlock his phone. They've got witness testimony, previous convictions, and I'm assuming some more concrete evidence that he is a criminal. They're just trying to figure out if he's done anything ELSE, and corroborate their evidence wherever possible.

This should be interesting

[amginenigma]

Can you say whoops.... "The FBI special agent who wrote the affidavit also requested that Dears not be told about the information request, however the search warrant and affidavit were not sealed." Pretty sure the whole planet knows now dood...

Re:Hashes

[anilg]

If this is the 9-dot pattern they are talking about, even a hash would be easy to brute force,. the worst case being 9!, but the average case being 4-6! as these are the sizes commonly chosen for phones.

However, the limitation could be the delay/lock after some unsuccessful tries. If they need to see that phone's memory, they need to maybe use a 0-day exploit that google knows of, but has not yet been fixed for that phone?

Re:Hashes

[kenshin33]

depending on phone it is easy, samsung usually have an unlocked bootloader ... you can flash whatever recovery image you want, if the phone is not encrypted ... well you get access to any data you want (using adb, CWM recovery has adb enabled with root access by default).
if it is the nexus S there's an easy way to unlock the bootloader without wiping the device (found on xda). for the see previous paragraph.

Brute force?

[subreality]

I'm surprised the FBI can't just dump the flash and brute force it. There are only about 100,000 possible patterns.

Re:Brute force?

[swillden]

Which has always been a problem, and which is why we should be getting things right with smart phones.

Google Wallet stores the credit card number and other sensitive information in the "secure element", a special-purpose high-security chip that is separate from the main system, with its own CPU, it's own OS and it's own storage. The secure element (SE) is actually a smart card chip, which has the benefit of almost 30 years of evolution, as attacks were created and countermeasures added. Nothing is 100% secure, but smart cards are pretty darned good.

Among other things, they wrap the storage in cladding layers which are physically bonded and chemically similar, so peeling or dissolving the cladding to be able to get to the EEPROM is extremely difficult, and highly likely to destroy the EEPROM. They're also careful to expose no leads which can be used to directly manipulate the memory, etc.

There have been some minor weaknesses found in Google Wallet, which Google has fixed or is fixing, but nothing that would expose the credit card number, because it's locked securely in the SE. We are getting things right with smart phones; at least Google is. I imagine ISIS is also.

(Disclaimer: I work for Google, and have even done some work around Google Wallet, though that's not my primary job. However, everything I stated above is public knowledge, filtered through 10+ years of experience working with smart cards and SEs while at IBM.)

Re:Hashes

[Americano]

However, the limitation could be the delay/lock after some unsuccessful tries

That's exactly what happened:

Technicians apparently mis-entered the pattern enough times to lock the phone, which could only be unlocked using the phone owner's Google account credentials.

Are you telling me?

[Jeremiah Cornelius]

Are you telling me that you can't unlock one of these phones, without a PhD?

Re:Are you telling me?

[__aaltlg1547]

Well the police does hold a PhD.....

Only in a cell.

Why don't they ask Apple - they own swipe 2 unlock

[hashish]

Why don't they ask Apple - they own swipe to unlock

A warrant *is* enough, conditionally

[dacarr]

Picking through the details, it's pretty simple. The FBI served Google a warrant for a user.

What they will get out of it is any information on the perpetrator that Google has in their control - so Gmail, Picasa, anything on their servers. This is what a warrant does, and any content provider such as Google will have this in their TOS.

What they *might* get is a replacement account password to access the phone. That's unclear to me. It's in that respect that I don't know how Google will proceed.

What they will NOT get, however, are unlocks, text messages (unless he backs those up into his Gmail account), device passwords, device unlock patterns, or anything that would be used to unlock the device. That's all up to the mobile carrier or (possibly) the device manufacturer - not Google.

And for those who think Google made the device, no, they didn't. Somebody else did. May have been Motorola, LG, HTC, or Samsung, just to name the big four phone makers who put out Android off the top of my head. Google's support ends at the operating system development level, and whatever they have on their network. Demanding of Google whatever's on the mobile network or the device unto itself is like demanding an Amtrak schedule of Pepsico.

lazy law enforcement

[PopeRatzo]

The request is part of a case involving an alleged gang leader and human trafficker named Dante Dears in California.

If the only way they can bust a "human trafficker" is by getting into his cellular phone, maybe they need to do a little more police work.

The criminal justice system allows a hell of a lot of latitude to law enforcement. Legal wire taps, surveillance, search warrants. Informants, RICO, DNA evidence, even tax evasion investigations.

I've seen The Wire and The Shield, Kojak, Columbo and even Mannix. There are plenty of ways to take down a perp, and if all else fails, you put a couple in his noggin, drop a throw-down piece on him and say he drew down on you. Then you go home and sleep like a baby.

But they tell us the only way they can lock up a gang leader involved in human trafficking is by checking his Angry Birds high score.

Just sayin'...

Re:Wha???

[MimeticLie]

I assumed that too, but it doesn't seem true in this case:

Technicians apparently mis-entered the pattern enough times to lock the phone, which could only be unlocked using the phone owner's Google account credentials.

Why they were even bothering with the unlock screen rather than just slurping up all the data on the phone with a UFED is beyond me.

Hey FBI, look at this post!

[toadlife]

1) Flash a rooted kernel and CWM recovery with ODIN (all Samsung phones allow this)
2) boot into recovery
3) connect to the phone using ADB
4) Using sqlite, update the settings database and disable security

You're welcome.

Re:No, don't Google it.

[Sqr(twg)]

In the olde days, a Google search would produce the same results for the same search term. Not so anymore. If I search for "waterboarding" I get Wikipedia, NPR, and a number of human-rights activist sites. If Dick Cheney searches for the same term, he gets "Waterboarding magazine", "50 fun ways of torturing a PoW", and newamericancentury.org
So to be re-usable the URL must include lots of information about the person who did the search, like age, religion, political beliefs, sex (with whom, how often), and so on. I'm actually impressed they can fit all that in 250 characters.