Slashdot Mirror
NYPD Says Talking About Its IMSI Catchers Would Make Them Vulnerable To Hacking (vice.com)
An anonymous reader quotes a report from Motherboard: Typically, cops don't like talking about IMSI catchers, the powerful surveillance technology used to monitor mobile phones en masse. In a recent case, the New York Police Department (NYPD) introduced a novel argument for keeping mum on the subject: Asked about the tools it uses, it argued that revealing the different models of IMSI catchers the force owned would make the devices more vulnerable to hacking. The New York Civil Liberties Union (NYCLU), an affiliate of the ACLU, has been trying to get access to information about the NYPD's IMSI catchers under the Freedom of Information Law. These devices are also commonly referred to as "stingrays," after a particularly popular model from Harris Corporation. Indeed, the NYCLU wants to know which models of IMSI catchers made by Harris the police department has. "Public disclosure of this information, and the amount of taxpayer funds spent to buy the devices, directly advances the Freedom of Information Law's purpose of informing a robust public debate about government actions," the NYCLU writes in a court filing. The group has requested documents that show how much money has been spent on the technology. After the NYPD withheld the records, the FOI request was escalated to a lawsuit, which is where the NYPD's strange argument comes in (among others). "Public disclosure of the specifications of the CSS [cell site simulator] technologies in NYPD's possession from the Withheld Records would make the software vulnerable to hacking and would jeopardize NYPD's ability to keep the technologies secure," an affidavit from NYPD Inspector Gregory Antonsen, dated August 17, reads. Antonsen then imagines a scenario where a "highly sophisticated hacker" could use their knowledge of the NYPD's Stingrays to lure officers into a trap and ambush them.
There's my contribution for today
of the elephant in the room if you talk about it
The manual is on the Intercept. Fascinating gadget, 4th amendment nightmare.
That was unconstitutional and illegal as well.
Admit the crime and stop covering it up.
-- Tigger warning: This post may contain tiggers! --
If your security is dependent on you not talking about the technology altogether, it is a pretty insecure and unreliable system altogether and should not be used, especially not in a situation where gathering evidence is critical. How easily could said evidence be thrown out if the tool you use to gather it is so insecure, unreliable and in a generally sorry state that you cannot even TALK about it lest it breaks?
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Hacking? Wow thats a new one. They normally find a way to justify whatever removal of freedoms they are currently inflicting with the good old standby of somehow making it about child porn or child abuse.
well when they just need you phone number to redirect voice and data so they can keep records of calls texts and also Man in the middle a data connection so they can inject exploits like say stagefright into a video your phone downloads off of a website. Then they can gain full access to the phone. So of course they don't want any information about that out there and to do this you would have to have someone that is skilled enough to preform the attack and then they would know that the stingrays are vulnerable because of how they work.
Do not talk about IMSI club. Second rule: it this is your first night you have to violate someone's rights.
Hi! I make Firefox Plug-ins. Check 'em out @ https://addons.mozilla.org/en-US/firefox/addon/youtube-mp3-podcaster/
I'm pretty sure every law enforcement agency that has ever used wiretapping or surreptitious monitoring systems of any kind has said they can't reveal information about them because it would make them more vulnerable.
"We use Stingrays, we use them without warrants, we capture far more conversations and people with Stingray use than the occasional warrant we get specifies, and we are afraid that talking about our cool toys too much will eventually result in those toys getting taken away from us."
The acknowledgement would also at a minimum be an admission of multiple violations of section 301 of the Communications Act.
https://www.law.cornell.edu/us...
09 F9 11 02 9D 74 E3 5B - D8 41 56 C5 63 56 88 C0 45 5F E1 04 22 CA 29 C4 93 3F 95 05 2B 79 2A B2
Does that mean a defendant can request that stingray evidence against them be thrown out on the grounds that the admittedly-by-police vulnerable technology used to acquire it was probably already hacked and the evidence was planted?
I mean yes, if they made the technology publicly known, more hackers would attack it too... but it's not like all hackers are waiting for people to announce the tech they use in order to attack it. Hackers just go fishing. If stingrays were really as vulnerable as they say, odds are somebody has done the legwork to figure out how to distinguish a connection to a stingray from the real cell tower it's impersonating, and probably found a way to mask or spoof signals of their own.
Police are simultaneously expecting the courts to trust the data they collect when they don't even trust the sanctity of the devices and have to keep it super secret to hold onto hope that it stays tamper-free. Which is it?
There's nothing too sophisticated about radio direction finding. Takes maybe $40 of hardware.
... where the police having this technology use it on a whim, without a warrant, and with absolutely no oversight.
Oh, wait. That's already happening and doesn't require a "sophisticated hacker".
They either are or they aren't. I'm guessing the former.
Taking a page from the State actors comprehensively exposing the defensive capabilities of the Internet core, there needs to be a distributed network setup to calculate and correlate all physical cell site information. When shared between a large number of users, it would be trivial to map all permanent physical infrastructure such that any IMSI catcher would light up like a bullseye the second it was turned on. Then that hardware could be targeted for comprehensive testing and exploitation. It wouldn't surprise me to see a future cellular botnet set up to do something just like that if it's not done for more above-board accountability reasons first.
Someone makes a talk about IMSI catchers, then all the cops have IMSI catchers. Everything you need to know has been public since before the police had them. Don't ask the cops, go to the source.
I'm very sorry you did not take security into account to the degree that you should have, and probably did no QA, but the facts are you have to in order to establish the credibility of your system and its data. Everyone else has to.
---- The above post was generated by the Turing Institute. Maybe.
Revealing which models of devices they bought doesn't reduce their security, unless they're using units with widely known security flaws that they leave open.
Either they're really, really stupid or they think we are. Perhaps both?
Enable 3D printed prosthetics!
...could also get their completely non-hacked, normal phone implicated in a crime, knowing that stingrays will be deployed to track it, and then lead them into an ambush.
@Whee
Through police security.
What could possibly go wrong?
Nice to see it's alive and well in the minds of retards everywhere.
NYPD Says Talking About Its IMSI Catchers Would Make Them Vulnerable To Hacking
Criminals Say Talking About Crimes Would Make Them Vulnerable To Arrest.
revealing the different models of IMSI catchers the force owned would make the devices more vulnerable to hacking.
In other words: There is at least one audit report giving them very bad marks on security and they don't have the time, budget or expertise to fix the problem. Basically, they should be treated as if they are already hacked by an unknown party or two.
You are not afraid of disclosing basic information unless you cover up known vulnerabilities.
Assorted stuff I do sometimes: Lemuria.org
Vintage Leather Bags Vintage Leather Bag | Vintage Leather Bags | Vintage Leather Bags for women | Vintage Leather Bags for men | Handmade Vintage Leather Messenger Bags , Vintage Leather Laptop Bags , Vintage Leather Luggage Bags , Vintage Leather Backpack Bags , Vintage Leather Travel Bags, Vintage Leather bags, Vintage leather backpack Bags, Vintage Leather satchel bags,Vintage leather duffle Bags, Vintage Leather Tote bags