Slashdot Mirror
NYPD Says Talking About Its IMSI Catchers Would Make Them Vulnerable To Hacking (vice.com)
An anonymous reader quotes a report from Motherboard: Typically, cops don't like talking about IMSI catchers, the powerful surveillance technology used to monitor mobile phones en masse. In a recent case, the New York Police Department (NYPD) introduced a novel argument for keeping mum on the subject: Asked about the tools it uses, it argued that revealing the different models of IMSI catchers the force owned would make the devices more vulnerable to hacking. The New York Civil Liberties Union (NYCLU), an affiliate of the ACLU, has been trying to get access to information about the NYPD's IMSI catchers under the Freedom of Information Law. These devices are also commonly referred to as "stingrays," after a particularly popular model from Harris Corporation. Indeed, the NYCLU wants to know which models of IMSI catchers made by Harris the police department has. "Public disclosure of this information, and the amount of taxpayer funds spent to buy the devices, directly advances the Freedom of Information Law's purpose of informing a robust public debate about government actions," the NYCLU writes in a court filing. The group has requested documents that show how much money has been spent on the technology. After the NYPD withheld the records, the FOI request was escalated to a lawsuit, which is where the NYPD's strange argument comes in (among others). "Public disclosure of the specifications of the CSS [cell site simulator] technologies in NYPD's possession from the Withheld Records would make the software vulnerable to hacking and would jeopardize NYPD's ability to keep the technologies secure," an affidavit from NYPD Inspector Gregory Antonsen, dated August 17, reads. Antonsen then imagines a scenario where a "highly sophisticated hacker" could use their knowledge of the NYPD's Stingrays to lure officers into a trap and ambush them.
That was unconstitutional and illegal as well.
Admit the crime and stop covering it up.
-- Tigger warning: This post may contain tiggers! --
If your security is dependent on you not talking about the technology altogether, it is a pretty insecure and unreliable system altogether and should not be used, especially not in a situation where gathering evidence is critical. How easily could said evidence be thrown out if the tool you use to gather it is so insecure, unreliable and in a generally sorry state that you cannot even TALK about it lest it breaks?
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Do not talk about IMSI club. Second rule: it this is your first night you have to violate someone's rights.
Hi! I make Firefox Plug-ins. Check 'em out @ https://addons.mozilla.org/en-US/firefox/addon/youtube-mp3-podcaster/
The acknowledgement would also at a minimum be an admission of multiple violations of section 301 of the Communications Act.
https://www.law.cornell.edu/us...
09 F9 11 02 9D 74 E3 5B - D8 41 56 C5 63 56 88 C0 45 5F E1 04 22 CA 29 C4 93 3F 95 05 2B 79 2A B2
... where the police having this technology use it on a whim, without a warrant, and with absolutely no oversight.
Oh, wait. That's already happening and doesn't require a "sophisticated hacker".
Taking a page from the State actors comprehensively exposing the defensive capabilities of the Internet core, there needs to be a distributed network setup to calculate and correlate all physical cell site information. When shared between a large number of users, it would be trivial to map all permanent physical infrastructure such that any IMSI catcher would light up like a bullseye the second it was turned on. Then that hardware could be targeted for comprehensive testing and exploitation. It wouldn't surprise me to see a future cellular botnet set up to do something just like that if it's not done for more above-board accountability reasons first.
I'm very sorry you did not take security into account to the degree that you should have, and probably did no QA, but the facts are you have to in order to establish the credibility of your system and its data. Everyone else has to.
---- The above post was generated by the Turing Institute. Maybe.
Revealing which models of devices they bought doesn't reduce their security, unless they're using units with widely known security flaws that they leave open.
Either they're really, really stupid or they think we are. Perhaps both?
Enable 3D printed prosthetics!
revealing the different models of IMSI catchers the force owned would make the devices more vulnerable to hacking.
In other words: There is at least one audit report giving them very bad marks on security and they don't have the time, budget or expertise to fix the problem. Basically, they should be treated as if they are already hacked by an unknown party or two.
You are not afraid of disclosing basic information unless you cover up known vulnerabilities.
Assorted stuff I do sometimes: Lemuria.org
Or they just drop the charges entirely and walk away.
http://arstechnica.com/tech-po...
Its easier than that.
Just grab a phone out of one of those recycling bins they have at some electrics stores, and call 911 (all phones can call 911, even if not activated). You don't even have to talk, just make muffled sounds, and the police will eventually show up.
The police don't even need to have a stingray, they already know where the phone is though e-911