Slashdot Mirror
How The FBI Easily Retrieved Michael Cohen's Data From Both Apple and Google (cnn.com)
Court documents unsealed Tuesday showed just how much information America's FBI was able to gather on Donald Trump's lawyer Michael Cohen -- from both Google and Apple products. An anonymous reader quotes CNN:
Notably, the FBI made use of Cohen's use of Touch ID and Face ID on his Apple devices, which allow users to quickly log into iPhones and computers by scanning their face or fingerprint rather than typing in a password... But that gives law enforcement an additional means to access those devices. In one warrant application for Cohen, an FBI agent requested authorization "to press the fingers (including thumbs) of Cohen to the Touch ID sensors of the Subject Devices, or hold the Subject Devices in front of Cohen's face, for the purpose of attempting to unlock the Subject Devices via Touch ID or Face ID...."
One warrant requested not simply access to three of Cohen's Gmail accounts, as well as other email accounts, but also some of the wide array of information Google keeps for its users by default, including search history, web cookies associated with an account, device information, and a host of other metadata categories. One affidavit describes how the FBI narrowed down Cohen's temporary location at the Loews Regency Hotel in New York through his cell phone location data. Agents then used a "triggerfish" -- a reference to a stingray, or IMSI catcher, a suitcase-sized device that mimics a cell tower to convince a cell phone to connect and reveal its location...
Prosecutors also made use of a new law that Trump recently signed. Investigators in the Southern District of New York compelled Google to turn over some documents on Cohen, but the tech giant initially "declined to produce data that it stored on computer servers located outside of the United States," according to an affidavit submitted to the court by an FBI agent working on Cohen's case. Weeks later, Trump signed the CLOUD Act into law, which gave US law enforcement more legal pathways to pursue data stories overseas.... In an April 2018 affidavit, the FBI agent argued that "providers are required to disclose data even if it is stored abroad" under the new law. The judge approved the new search warrant later that day, giving investigators access to additional information from Google, including Cohen's emails, attachments, address book and files stored on Google Drive.
One technology law expert told CNN that police now seek access to more and more information.
"I think any of the electronic debris that people leave online on these services is all potentially subject to being used against you."
One warrant requested not simply access to three of Cohen's Gmail accounts, as well as other email accounts, but also some of the wide array of information Google keeps for its users by default, including search history, web cookies associated with an account, device information, and a host of other metadata categories. One affidavit describes how the FBI narrowed down Cohen's temporary location at the Loews Regency Hotel in New York through his cell phone location data. Agents then used a "triggerfish" -- a reference to a stingray, or IMSI catcher, a suitcase-sized device that mimics a cell tower to convince a cell phone to connect and reveal its location...
Prosecutors also made use of a new law that Trump recently signed. Investigators in the Southern District of New York compelled Google to turn over some documents on Cohen, but the tech giant initially "declined to produce data that it stored on computer servers located outside of the United States," according to an affidavit submitted to the court by an FBI agent working on Cohen's case. Weeks later, Trump signed the CLOUD Act into law, which gave US law enforcement more legal pathways to pursue data stories overseas.... In an April 2018 affidavit, the FBI agent argued that "providers are required to disclose data even if it is stored abroad" under the new law. The judge approved the new search warrant later that day, giving investigators access to additional information from Google, including Cohen's emails, attachments, address book and files stored on Google Drive.
One technology law expert told CNN that police now seek access to more and more information.
"I think any of the electronic debris that people leave online on these services is all potentially subject to being used against you."
Understand what is now a legal search and seizures.
How to use your OS to ensure your digital "papers" stay secure from unreasonable search attempts.
When and how your rights stay protected.
Domestic spying is now "Benign Information Gathering"
Just put up a Miranda Warning. Makes more sense
“He’s not deformed, he’s just drunk!”
With biometric authentication, you are only protected by the 4th amendment. Your finger/face/etc. are akin to a key, and a warrant can compel you to unlock the device with it.
With a password, it can be argued that divulging it would constitute self-incrimination, which keeps you protected by the 5th amendment as well, even if they get a warrant. Case law is unclear on the matter, at least, with contradictory rulings.
This is true in the USA at least. UK has a law that mandates divulging passwords, although I don't recall hearing about it being used much.
Corruption is convincing someone that the selfless ideal is the same as their selfish ideal.
We already knew that, in the US, a person can be compelled to unlock his/her phone if it can be done with a fingerprint or by showing their face.
If you're really paranoid you need to turn all that off, require a complex passcode to be entered on any of your electronic devices, and be willing to put up with a little inconvenience on a regular basis.
Personally, I'm not that paranoid - I'm aware that I'm simply not that important of a person.
#DeleteChrome
Seriously, people, your phones have back-doors, front-doors, compromised apps, malware, etc. on them and send data into insecure clouds. Do not trust your phones. The only way you could ever trust your phones was is there was strong legal protection for your data. There is not. Thanks to the raising authoritarians and proto-fascists in the West, there is the opposite.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
You are cheering for the downfall of your own country? Fascinating.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Probably Ireland, they have a European HQ located there, but not sure if they have a server farm there too.
Also, it's probably not very relevant where the data is actually stored these days, it's most likely replicated and backed up in several countries. Most global companies now use off-site backups and replicate their data in geographically separate locations, with data centers in many countries spread throughout the world. This gives them more redundancy and a better shot at handling an international disaster; a given country would likely be unaffected while another is having a disaster like a tidal wave or whatever.
The whole point of the new law was to deal with exactly this sort of situation, where the local laws or agencies of other countries are either not enforceable or somehow otherwise are an impediment to them getting legal access to the data. The other country really doesn't have any chance to say anything in the matter, if they're even aware of it. If Google or whoever refuses the request, they would no doubt prosecute them as though they had denied law enforcement's access to the data just the same as if it was located in the U.S.
Not saying it's right or wrong. Personally, I'm not a fan of laws that give Government expanded powers to nose into people's lives, either real or online, but I'm not a fan of crime, obviously. If nothing else, this was expected. Many of our laws need to be updated to be meaningful and reflect the new digital reality we live in - the legal system is lagging behind reality in many ways by anywhere from 5-10 years to about 50.
-- You are in a maze of little, twisty passages, all different... --
Biometrics are notorious for being easy to fool, even the emerging 3D-face-scanning stuff coming out is going to be as bad, because the sensors can't be integrated into the chips themselves, in turn you could always just remove the sensor, replace it with a serial line, and spoof whatever signal it expected to see from a "3D" scan using an image.
Two-factor authentication is a joke when biometrics are involved, because the biometric component negates any other component. Security can't be about something someone has (e.g. CAC cards) and is (e.g. biometrics) alone - the something someone knows (e.g. password) is the most critical factor because it can't be stolen, it can't be spoofed, and in extreme cases it can't even be cut off with a saw or scooped out of an eyesocket with a spoon (at least, not directly.)
Making biometrics a part (yes, even a part) of a security deployment of any kind is akin to making everyone set up their full name as a username with their social security number as their password - it's fucking dumb to use public information (no matter how convoluted to spoof, because if it can be done it will be done) for security.
I never said to get rid of it. Whatever gave you that idea? Just do not put stuff on it you want to keep secret.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
That's a red herring. The phone isn't so much a storage device itself, as it is conduit to all of your online data.
Learning HOW to think is more important than learning WHAT to think.