Slashdot Mirror
US Judge Throws Out Cell Phone 'Stingray' Evidence For The First Time (reuters.com)
An anonymous reader quotes a report from Reuters: For the first time, a federal judge has suppressed evidence obtained without a warrant by U.S. law enforcement using a stingray, a surveillance device that can trick suspects' cell phones into revealing their locations. U.S. District Judge William Pauley in Manhattan on Tuesday ruled that defendant Raymond Lambis' rights were violated when the U.S. Drug Enforcement Administration used such a device without a warrant to find his Washington Heights apartment. Stingrays, also known as "cell site simulators," mimic cell phone towers in order to force cell phones in the area to transmit "pings" back to the devices, enabling law enforcement to track a suspect's phone and pinpoint its location. The DEA had used a stingray to identify Lambis' apartment as the most likely location of a cell phone identified during a drug-trafficking probe. Pauley said doing so constituted an unreasonable search. The ruling marked the first time a federal judge had suppressed evidence obtained using a stingray, according to the American Civil Liberties Union, which like other privacy advocacy groups has criticized law enforcement's use of such devices. "Absent a search warrant, the government may not turn a citizen's cell phone into a tracking device," Pauley wrote. FBI Special Agent Daniel Alfin suggests in a report via Motherboard that decrypting encrypted data fundamentally alters it, therefore contaminating it as forensic evidence.
Bernard Seidler, Lambis' lawyer, noted that occurred a week after his client was charged. He said it was unclear if the drug case against Lambis would now be dismissed.
This "War on Drugs" has proven to be a failure. Just regulate it like alcohol. And instead of sending these folks to jail, send them to rehab - an evidence based rehab like the Western Europeans do.
Prosecutors like to say that some addicts need that "Come to Jesus" moment of getting arrested to get clean - and they have zero evidence to back that claim up. But the truth is that rehabilitation in the USA is a joke. It's not evidence based and when it fails, the program doesn't get blamed but the addict; when the opposite should be the case. I don't have to work for an antibiotic to work. It works or it doesn't. If someone has to "want" to change then you don't have an evidence based treatment but a placebo.
Poor Lindsey Lohan has been in and out of rehab and her character is blamed when in fact the rehab places she's gone to are pretty much garbage.
So, until we as a country grow up and stop this moralizing and hypocrisy about drug use, we are going to be pissing billions of dollars a year away on things that don't work.
Well, he's right. With an arbitrary algorithm and arbitrary key, encrypted data can be decrypted to absolutely anything. In particular, data might have been arranged so that it can be decrypted in multiple intelligible ways, only one of which reflects a true plot, and the other of which are just made up shit to confuse anyone who tries to decrypt it. Hell, some encryption utilities allow people to create shadow partitions with no important data in it, so if you give the "wrong" key, it still likes you're giving up the goods - a cleverer alternative would be to have multiple shadows each of which contain bullshit, each of which can be decrypted with varying ease, where the bullshit is especially easy to decrypt. If LE finds one, declare precisely what you've done, and remark that all they've done is decrypt one of your red herrings.
Read the linked article. He is saying that if the government presents ONLY the decrypted data as evidence in court it is not forensically valid because it breaks the chain of evidence. They need to also show the originally captured encrypted data so that it can verified that the decrypted version actually correlates to what they got and was not somehow tampered with.
"decrypting encrypted data fundamentally alters it" What? If the decrypted data doesn't match the data that was encrypted, you failed to decrypt it properly. On a purely technical level I guess he's correct. Encrypted, the data is just a bunch of jazz and whirly bangs. Once decrypted it's actual data, so on a purely superficial level, with no understanding of encryption, I guess he's right. Damnit
This a typical /. summary that mistakes what was actually said to make it sound more interesting. The agent said decrypted data is different from what was taking by the warrant, and thus you are not turning using the actual information taken in the search (i.e. the encrypted data) but that it still is forensically sound; he never said that's "contaminating it as forensic evidence" just it may still be less forensically sound than the actual encrypted data. /. seems to imply somehow that makes the decrypted data not valid as evidence which clearly is BS.
I'm a consultant - I convert gibberish into cash-flow.
If you are truly a free human being - it is your right to consume any substances you like. If someone wants to be an addict and they hurt no one else in the process, what right does anyone have to force that person into rehab or treatment?
It's a slippery slope - first we force addicts to become clean - next we force fat people to go to the gym.
It is far better to leave people, who are not harming others, alone.
That is exactly what the judge ruled. The main reason this isn't happening all over the place is that people don't understand how the devices work, and the police/prosecutors are not exactly volunteering the information. There is a good article about it here. Basically, the police hide the fact that they used stingray devices to track suspects by either making up some other reason that they happened to find themselves at the suspect's location or hiding something very vague on page 200 of the report like, "used electronic surveillance," which most defense attorneys do not know to challenge. In rare situations where the evidence has been challenged, the prosecution just drops the case so that precedent isn't set.
A valid point, but not really related specifically to encryption. Once evidence of any kind is gathered, how do you know the evidence is entirely original?
I expect you meant "how do we know the evidence is unaltered." Typically a hash of the data is collected at the point of collection and stored along with other details (filename, length, date/time stamp, collector information) with the collected forensics data. So the hash value can be recomputed and verify that whatever file you're looking at is the same as at the point of collection. Additionally, the standard 'chain of custody' checks can be done to verify that that hash never changed at any point in the history of custody after it was collected. If a key is available, the defense could do their own decryption to confirm that the plaintext presented is the same as the plaintext they produce from a file with the correct hash. Min
On the whole, I find that I prefer Slashdot posts to twitter ones because I don't get limited to 140 chars before
Oh these things are useful and the evidence they generate is valid for criminal prosecution, Just get a warrant before you use it... Case closed..
"File to fit, pound to insert, paint to match" - Aircraft Maintenance 101
In a way, I'm not sure this is really an issue. Apparently the device will now require that a search warrant be granted before it is used to collect evidence, at least in that jurisdiction.
However, I wonder if this will be overturned on appeal (not that it matters to the perp as the evidence collected has now been tossed) because the police are free to lie to you when questioning you. How's that different from a device claiming to be a valid cell tower? Or, how's that different than using a directional antenna to find a specific RF transmitter device which happens to be carried by a suspect? Where I understand the stinger works a bit differently, but in principle it's not that much different from totally acceptable surveillance methods we've used for centuries that don't require warrants. As a investigator, I can follow you around in your public travels, observe what I can from public spaces at any time without a warrant. How can the RF emitted by your cell phone, observed from a public space not be legally obtained evidence? Because it's encrypted? How's that relevant?
"File to fit, pound to insert, paint to match" - Aircraft Maintenance 101
... How can the RF emitted by your cell phone, observed from a public space not be legally obtained evidence? ...
it is a little different with a general radio-frequency emission. in the case where you are emitting RF voluntarily, locating and tracking that emission requires no special permissions. you are effectively yelling in a place, and they are following the sound.
in the case of the stingray, it is giving false information to your phone, and your phone is identifying itself to a 'stranger'. in this case you are still emitting RF, and they could still locate and track that emission, but without the stingray, they would not be able to identify the owner of the RF emission until they located and identified they source..
, just the meta-data and signaling information between the tower and the phone.
That is actually not true. Stingray devices are capable of "active" attacks where they act as a man-in-the-middle between cell phones and legitimate towers, thereby decrypting and recording calls. As far as the metadata is concerned, there is a legal history of requiring warrants to get that information from phone companies. The fact that technologically it is possible to directly get it by snooping with a stingray doesn't make it clear cut that it is actually legal for the police to do so, as was demonstrated here. As an analogy, if the FBI developed a technology that allowed them to read minute EM leakage off phone wires from 100ft away, it wouldn't suddenly become legal for them to tap your land line with that.
The Stingray becomes a man in the middle. There's nothing passive about it. Imagine the real case of a plugging in a twisted pair tap on a phone line and you'll have a relatively accurate analogy.
Why the heck aren't there apps that warn you when a new cell tower pops up in an area? It seams like a relatively simple system to beat, or does it act entirely like an existing tower ID's and all?
Bye!
Your base assumption is false, the police do not have blanket powers to lie to you. There are very specific rules about how and when police can lie. They can not for example lie and tell you that they are your lawyer. Nor can they, If your lawyer is present and they make an offer, claim "we were lying when we offered you immunity in exchange for testimony".
They are also not allowed to disable your internet, knock on your door and say "I am from your ISP, here to fix your internet" unless they have a warrant.
That situation seems to me to be the most direct comparison of a sting ray. They are preventing your phone from interacting with the network and instead pretending to be that network.
That is radically different from passively listening.
excitingthingstodo.blogspot.com
Here is an arstechnica article reporting on a judge ruling that the "cut the internet, then claim to fix it" lie is illegal:
Arstechnica story
and here is a link to the official ruling:
arstechnica hosted court ruling.
excitingthingstodo.blogspot.com
Why the heck aren't there apps that warn you when a new cell tower pops up in an area?
There's AIMSICD, although I'm not sure how accurate it is. I played with it a bit last year and got a few yellow warnings, so the app detects something, but it's possible those were due to legitimate roaming or tower-sharing mechanisms. When protests were ongoing in Baltimore last year, multiple people with the app reported seeing orange warnings, which mean there's definitely some fuckery going on nearby, and red warnings, which mean the user's specific phone is being targeted.
My big problems with AIMSICD last year were that it chewed through battery, the cell tower map never worked right, the upload function for OpenCellID.org was hit or miss, and there was little or no proper documentation about what the app actually does or what its different indicators mean. I think English was a second language for (most of) the developers as well as many of the users; this made the wiki and issue tracker difficult to parse. As neither an Android developer nor a subject matter expert, there wasn't much I could do to understand what was happening under the hood.
That aside, the trouble with any stingray detector app is that it runs at the consumer OS level and can only know the "facts" that OS chooses to expose. It seems likely to me that most of the unconstitutional warrantless wiretapping functionality would operate at the baseband level, below and perhaps invisible to Android/iOS/etc and any apps running there.
Thanks to the War on Drugs, it's easier to buy meth than it is to buy cold medicine!
The Stingray becomes a man in the middle. There's nothing passive about it. Imagine the real case of a plugging in a twisted pair tap on a phone line and you'll have a relatively accurate analogy.
Why the heck aren't there apps that warn you when a new cell tower pops up in an area? It seams like a relatively simple system to beat, or does it act entirely like an existing tower ID's and all?
For that matter, arent tower locations known? If a new one appears across the street, or is driving down the street, something is up.
(-1: Post disagrees with my already-settled worldview) is not a valid mod option.