FBI's ability to legally access secure messaging app content and metadata [pdf]

https://propertyofthepeople.org/document-detail/?doc-id=21114562

by sega_sai • 5 years ago

562 450 5 years ago

propertyofthepeople.org

yownie8• 5 years ago

link seems to be broken

https://propertyofthepeople.org/document-detail/?doc-id=2111...

mmh0000• 5 years ago

Not only is there main link broken, but their silly PDF reader is broken for me.

Here's a direct link to the PDF: https://assets.documentcloud.org/documents/21114562/jan-2021...

t0mas88• 5 years ago

So if you have something to hide, don't use iCloud backup.

And Whatsapp will give them the target's full contactbook (was to be expected), but also everyone that has the target in their contact list. That last one is quite far reaching.

sschueller• 5 years ago

Can you turn that off if you have icloud or do you need to not use icloud all together?

ceejayoz• 5 years ago

You can turn it off individually just for Messages, but you're still left not knowing the state of the setting on the other end.

KennyBlanken3• 5 years ago

Yes, and you can delete old backups on iCloud - and then switch to local, automatic, fully encrypted backups to a Mac or PC running iTunes.

HN tends to get very frothy-at-the-mouth over Apple and privacy but the reality is that iPhones can be easily set up to offer security and privacy that best in class, they play well with self-hosted sync services like Nextcloud....and unlike the Android-based "privacy" distros you're not running an OS made by a bunch of random nameless people, you can use banking apps, etc.

The only feature I miss is being able to control background data usage like Android does.

georgyo2• 5 years ago

You and the person you are communicating with must both not use iCloud backup. And since apple pushes the backup features pretty heavily, you can be reasonable sure that the person you are communicating is using backups. IE, you cannot use iMessage.

xanaxagoras4• 5 years ago

I got off all Apple products when they showed me their privacy stance is little more than marketing during the CSAM fiasco, but IIRC the trouble with iCloud backup is it stores the private key used to encrypt your iMessages backup. Not ideal to be sure, but wouldn't iMessage users be well protected against dragnet surveillance, or do we know that they're decrypting these messages en masse and sharing them with state authorities?

vmception• 5 years ago

iCloud backup can backup your whole phone, specifically the files section. iOS and OSX users can save anything to that.

fumar2• 5 years ago

Has Apple made any public statements regarding iCloud's lack of privacy features. It takes the wind out of their privacy marketing that is effectively hurting ad tech but not truly protecting consumers from state-level actors with data access.

amatecha• 5 years ago

Kind of. These details are indeed publicly written on their website[0]. Do many users ever read this page? Probably not.

[0] https://support.apple.com/en-us/HT202303

nicce4• 5 years ago

E2EE was in the iOS 15 beta for backups but it was removed? (Did not land for release) after they changed the time table of CSAM scanning feature. So we will see if we get E2EE backups once that image scanning lands.

minerva23• 5 years ago

if you have something to hide

Most people don't realize that most people have something to hide. The USA has so many laws on its books. Many of which are outright bizarre[0] and some of which normal people might normally break[1].

And that's only counting current/past laws. It wasn't that long ago a US President was suggesting all Muslims should be forced to carry special IDs[2]. If you have a documented history being a Muslim, it could be harder to fight a non-compliance charge.

[0] https://www.quora.com/Why-is-there-a-law-where-you-can-t-put...

[1] https://unusualkentucky.blogspot.com/2008/05/weird-kentucky-...

[2] https://www.snopes.com/fact-check/donald-trump-muslims-id/

president2• 5 years ago

Did you even read the snopes article you referenced before making what seems like a definitive claim about how Trump was suggesting muslims carry special IDs? Because Snope's own rating is "Mixture" of truth and false and if you read the assessment, it is grasping at straws to even make that conclusion.

hunterb1233• 5 years ago

“Certain things will be done that we never thought would happen in this country in terms of information and learning about the enemy,” he added. “We’re going to have to do things that were frankly unthinkable a year ago.”
“We’re going to have to look at a lot of things very closely,” Trump continued. “We’re going to have to look at the mosques. We’re going to have to look very, very carefully.”

That's all he said to the interviewer. The interviewer was asking the hypothetical and suggested the special identification! He wouldn't take the bait, so since he didn't answer the hypothetical they said "he wouldn't deny it" and wrote the campaign of hit piece articles anyway. Whatever response they got they would have wrote that same piece. If he would have answered one way they would have quoted out of context. Since he responded generically it's obviously drummed up. The fact check is hilarious. "Mixed", lol.

Never answer a hypothetical, it's always a trap.

kingcharles11• 5 years ago

I always liked this one I found in the Illinois statutes - it basically criminalizes every person online:

Barratry. If a person wickedly and willfully excites and stirs up actions or quarrels between the people of this State with a view to promote strife and contention, he or she is guilty of the petty offense of common barratry[.]

https://www.ilga.gov/legislation/ilcs/ilcs4.asp?DocName=0720...

georgyo2• 5 years ago

It says Telegram has no message content. Isn't telegram not E2EE by default, instead required explicit steps to make a conversation encrypted?

Either way looks like Signal wins by a lot. The size of it spot is so small, it seems almost squeezed in. But only because they have nothing to share.

to11mtm2• 5 years ago

I don't know whether Telegram is E2EE by default (probably not.) When you do a call on telegram you are given a series of emoji and they are supposed to match what the person on the other side has, and that's supposed to indicate E2EE for that call.

RL_Quine• 5 years ago

Verification in band seems pretty meaningless, approaching security theatre.

tptacek3• 5 years ago

It is not, by default, and none of the group chats are.

vadfa3• 5 years ago

That is correct. By default all messages sent over Telegram are stored permanently in their servers unencrypted.

Borgz• 5 years ago

Not exactly. Non-secret chats are stored encrypted on Telegram's servers, and separately from keys. The goal seems to be to require multiple jurisdictions to issue a court order before data can be decrypted.

https://telegram.org/privacy#3-3-1-cloud-chats https://telegram.org/faq#q-do-you-process-data-requests

skrowl2• 5 years ago

Source for Telegram storing the information unencrypted at rest?

nimbius• 5 years ago

for signal users this means the messages of course do exist on your phone, which will be the first thing these agencies seek to abscond with once youre detained as its infinitely more crackable in their hands.

as a casual reminder: The fifth amendment protects your speech, not your biometrics. do not use face or fingerprint to secure your phone. use a strong passphrase, and if in doubt, power down the phone (android) as this offers the greatest protection against offline bruteforce and sidechannel attacks used currently to exploit running processes in the phone.

timbit426• 5 years ago

Signal recently added 'disappearing messages' which lets you specify how long a chat you initiate remains before being deleted.

leokennis2• 5 years ago

My advice if you’re not on the level where three letter agencies are actively interested in your comings and goings:

- Use a strong pass phrase

- Enable biometrics so you don’t need to type that pass phrase 100 times per day

- Learn the shortcut to have your phone disable biometrics and require the pass phrase so you can use it when police is coming for you, you’re entering the immigration line in the airport etc. - on iPhone this is mashing the side button 5 times

FalconSensei• 5 years ago

do not use face or fingerprint to secure your phone

but can't they force you to put your password in that case, instead of your finger?

vorpalhex2• 5 years ago

Your statement on the 5th amendment is no longer accurate broadly, but the matter still has some cross-jurisdictional disagreement: https://americanlegalnews.com/biometrics-covered-by-fifth-am...

jfrunyon4• 5 years ago

The fifth amendment doesn't protect either speech or biometrics. Nor does it protect passwords.

croutonwagon2• 5 years ago

Also IOS has a panic button. Hit the main/screen button (on the right) five times really fast and faceid/touchid is disabled and passcode is required

kingcharles11• 5 years ago

Don't have any family or friends, either. If you refuse to talk and invoke your rights the government will just threaten to hurt those you love until you break and give up your passwords. From experience.

I liked it in Wrath of Man where one guy is acting tough as fuck until they bring his girl into the room.

Also, if you can, if you are encrypting data, use a hidden volume inside the first - that way you can give the government the outer password and they'll be happy thinking they have everything.

makeworld• 5 years ago

the FBI's ability to legally access secure content

Maybe there are laws preventing legal access to message content? Maybe related to wherever Telegram is incorporated.

officeplant• 5 years ago

It helps Telegram is HQ'd in the UK and the operational center is in Dubai.

inetknght2• 5 years ago

Maybe there are laws preventing legal access to message content?

Well sure. A lot of laws require a court order. In the U.S. that's usually not too difficult.

skrowl2• 5 years ago

Telegram is encrypted OVER THE WIRE and AT REST by default with strong encryption no matter what you do. It's E2EE if you select private chat with someone.

Lots of FUD out there there about Telegram not being encrypted that's just not true. There's nothing either side can to do send a message in clear text / unencrypted.

542458• 5 years ago

For somebody who isn’t super cyprtography-savvy, what’s the difference between over the wire and e2ee? Does the former mean that telegram itself can read non-private-chat messages if it so chooses?

blueprint• 5 years ago

(how) does the telegram server prevent unencrypted content?

also curious - how does telegram support encryption for chatrooms without the parties being known in advance? or are those chats not encrypted?

Andrew_nenakhov8• 5 years ago

"Encrypted OVER THE WIRE and AT REST" means that telegram has easy and unfettered access to chat logs. So they can give it up to authorities. (I don't argue that they DO, just that they very much CAN).

This is proven by an extremely simple experiment: you log in on your new phone, enter password and instantly see all chats.

Another simple experiment points that chats are unlikely to be even encrypted at rest is that Telegram has an extremely fast server side message search. You log into a web client, half a second later you can type a search query and uncover chats from years ago.

shawnz• 5 years ago

Encryption over the wire and at rest is a basic expectancy of any web service today. They would meet that criteria just by using SSL and disk encryption on their servers. E2EE is a much stronger criteria.

octorian• 5 years ago

It's E2EE if you select private chat with someone. And its not E2EE if you fail to select private chat.

What this means is that any conversations where you do select E2EE are the ones the "authorities" will take interest in, even if only to the extent of metadata.

That's the fundamental problem with E2EE-by-exception, rather than by default. It calls attention to specific data, even if its not cleartext, rather than obscuring everything.

farzher• 5 years ago

are you trolling? telegram (are therefore the fbi) has full access to all content of every message. unless you use private chat, which nobody does, and isn't even available on desktop. i use it. but it's about as private as discord. which is to say not at all

racingmars• 5 years ago

This chart is showing what messaging providers are willing to give to law enforcement, not a reflection of the technical capabilities of the messaging provider.

I assume what they're showing for Telegram (basically no data except IP/phone data if Telegram decides it's for a legit counter-terrorism activity) is a matter of Telegram business policy.

Signal gives the limited information they do because I assume they are subject to warrants from U.S. courts. Telegram is run, to my understanding, from jurisdictions where enforcing a U.S. court order would be difficult-to-impossible, and they keep the private keys to decrypt their stored message content split between servers in relatively non-overlapping legal jurisdictions, so even a successful seizure of data in one wouldn't be enough to decrypt message content.

That's all well and good -- and I appreciate Telegram for setting things up that way -- but that means at any time Telegram could make a policy decision to cooperate with law enforcement and provide much more than what is shown on this chart. Signal, on the other hand, could choose to cooperate as much as they want but not have the technical capability to provide more information. (Barring them updating their client to intentionally build in a backdoor, etc., but I'm basing this on what the current implementation is.)

The other important thing about this chart: this is the unclassified version. Is there another classified document out there which says "we have a secret relationship with Telegram/whomever and they give us all the message content we want" but they don't advertise to the law enforcement community at large? They secretly use it to aid in parallel construction so they don't ever have to reveal that a messaging vendor is giving them message content in court? We have no idea.

tl;dr: Telegram looks great on this chart because of policy, not technology. I love Telegram, but I'm under no illusions that it's appropriate for talking about things I wouldn't want law enforcement to have access to. Luckily, I haven't found myself needing to talk to my friends about illegal activity.

godelski5• 5 years ago

TLDR: Telegram depends on trusting Telegram. Signal is trustless.

MertsA2• 5 years ago

Telegram looks great on this chart because of policy, not technology.

This is what puzzles me about Apple, they absolutely have the capability to mitm iMessage pretty discreetly. Because Apple just completely hand waves away key distribution and they can silently add and remove keys at their leisure it's largely only policy that underpins their security. They're not Telegram, they aren't structured to be in a position to be able to ignore demands from the justice system to assist with some agent's latest fishing expidition. How are they getting away with not providing stuff that they obviously have access to? The PDF lists "Pen Register: no capability"

sgjohnson2• 5 years ago

Telegram isn’t E2EE by default.

My bet is on the fact that they are based in Russia, so they don’t give a shit about a US warrant or subpoena.

keraf• 5 years ago

Telegram isn't based in Russia (anymore). The company is incorporated in Dubai since 2017 [0]. They opposed Russian warrants in the past, resulting in the blocking of the app in the territory for some time [1].

[0] https://www.bloomberg.com/news/articles/2017-12-12/cryptic-r... [1] https://en.wikipedia.org/wiki/Blocking_Telegram_in_Russia

beervirus• 5 years ago

What about regular text messages?

bonestamp2• 5 years ago

They've been inside the phone companies for a long time so I assume they have full access to SMS.

markab21• 5 years ago

Assume anything sent over a cellular network carrier via normal SMS can not only be retrieved, but intercepted.

brink• 5 years ago

Thank goodness a lot of companies regularly use it for 2FA.

stunt2• 5 years ago

Telecommunication is highly regulated. They have to keep records for a long time and make them available to law enforcement.

tag2103• 5 years ago

If I remember correctly standard SMS has no security on it at all and is in the clear during transit. I may be wrong and never scared of being corrected.

kf6nux2• 5 years ago

IIUC, they can get 7 years worth of SMS/MMS (including contents) with very little effort/cost.

no_time3• 5 years ago

LINE,telegram,threema and WeChat are not even american companies. Can't they just tell the FBI to suck a fat one when they ask for user data?

colechristensen2• 5 years ago

Not if they want to operate in the United States or have access to our banking system.

You don’t get to pick your jurisdiction and then operate globally. You’re obligated to follow the laws where you want to operate.

no_time3• 5 years ago

I wonder how this affects nonprofits like Matrix/Element and Signal. What can they do with them? Gangstalk their developers? Coerce big tech to ban them from their appstores?

xxpor• 5 years ago

Fwiw if you want to do any sort of FX whatsoever or accept credit cards, you need access to the American banking system.

Decabytes• 5 years ago

Depends on whether the countries these companies exist in have agreements with the U.S for surveillance and stuff

er4hn• 5 years ago

Telegram, as I understand it, can access your messages when stored in their Cloud[1]. They just make a choice to not provide the content of those to anyone.

[1] https://telegram.org/privacy#4-1-storing-data

cunthorpe2• 5 years ago

Yes but they can still:

- block the company nationwide, see Huawei (also includes ceasing contracts with app stores, both of which are American)

- block access to your website, see TPB

- harass you when you travel, either to the US or fellow countries.

stunt2• 5 years ago

Well, who cares when all they need is to use something like Pegasus to obtain full access to your phone simply by sending you a WhatsApp message (without having you even open the message).

Knowing how well guarded IOS is against app developers, I wonder what kind of zero-day would suddenly turn a message received in WhatsApp to full system access. I think NSO found a WhatsApp backdoor, not a zero-day bug.

catlikesshrimp2• 5 years ago

Whatsapp is owned by facebook, not by apple. I don't think Apple wants to share a backdoor with facebook.

I don't know any detail of the whatsapp vulnerability that NSO exploited.

JBiserkov• 5 years ago

NSO can't send you an WhatsApp message if you don't have WhatsApp on your iPhone.

mmazing• 5 years ago

Or compromise the device in some other way.

At the risk of being cliche here's a relevant xkcd - https://xkcd.com/538/

efitz2• 5 years ago

This discussion is not very interesting from a security perspective. I tuned out at “cloud”.

If it’s not in your physical possession, it’s not your computer. If it’s not your computer, then whoever administers the computer, or whoever [points a gun at/gives enough money to] the administrator of that system can access whatever you put on that system.

If a “cloud” or “service” is involved, then you can trivially use them to move or store data that you encrypted locally on your computer with your key that was generated and stored locally and never left your system. But subject to the limits above, the administrators of the other computers will still be able to see metadata like where the data came from and is going to. And they might be able to see your data too if you ever (even once, ask Ross Ulbrecht) failed to follow the basic encryption guidelines above.

You can make metadata access harder via VPNs and Tor, but you CANNOT make it impossible- in the worst case, maybe your adversary is controlling all the Tor nodes and has compromised the software.

Which leads me to my last point, if you did not write (or at least read) the code that you’re using to do all of the above, then you’re at the mercy of whoever wrote it.

And, if you try to follow perfect operational security, you will have a stressful and unpleasant life, as it’s really really hard.

judge2020• 5 years ago

If i'm reading this page correctly, AMD is working on something that would allow you to run trusted code that not even someone with physical access to the hardware could read (without breaking this system).

https://www.amd.com/en/processors/epyc-confidential-computin...

And this tech is already implemented by GCP:

https://cloud.google.com/confidential-computing

With the confidential execution environments provided by Confidential VM and AMD SEV, Google Cloud keeps customers' sensitive code and other data encrypted in memory during processing. Google does not have access to the encryption keys. In addition, Confidential VM can help alleviate concerns about risk related to either dependency on Google infrastructure or Google insiders' access to customer data in the clear.

efitz2• 5 years ago

Then you only have to trust that AMD did not accidentally or intentionally introduce a bug in the system. Remember Spectre? Remember all the security bugs in the Intel management code?

You also have to trust that AMD generated and have always managed the encryption keys for that system properly and in accordance with their documentation.

And are you even sure that you’re actually running on an AMD system? If the system is in the cloud, then it’s hard to be sure what is executing your code.

And are you sure that your code didn’t accidentally break the security guarantees of the underlying system?

I have worked on all these problems in my day job, working on HSMs. At the end of the day there are still some leaps of faith.

michaelmior2• 5 years ago

if you did not write (or at least read) the code that you’re using to do all of the above, then you’re at the mercy of whoever wrote it.

It's worse than that. Even if you read the code, you have to trust that the code you read is the code a service is actually using. Even if you deploy the code yourself, you have to trust that the infrastructure you're running on does not have some type of backdoor. Even if you run your own infrastructure, hardware can still have backdoors. Of course, the likelihood of any of these things actually becoming a problem decreases significantly as you read through the paragraph.

inetknght2• 5 years ago

the likelihood of any of these things actually becoming a problem decreases significantly as you read through the paragraph.

And yet, "likelihood" doesn't necessarily mean "hasn't been done".

Just look at:

* [0]: Intel ME

* [1]: Solarwinds attack and CI systems

* [2]: Ubiquiti attack and complete infrastructure compromise

* [3]: And the famous Ken Thompson statement

[0a]: https://news.ycombinator.com/item?id=15298833

[0b]: https://www.blackhat.com/eu-17/briefings/schedule/#how-to-ha...

[1] https://www.cisecurity.org/solarwinds/

[2] https://krebsonsecurity.com/2021/04/ubiquiti-all-but-confirm...

[3] https://users.ece.cmu.edu/~ganger/712.fall02/papers/p761-tho...

dointheatl• 5 years ago

Even if you read the code, you have to trust that the code you read is the code a service is actually using.

Don't forget to verify the code for the compiler to ensure that hasn't been compromised in order to inject an exploit into the binary at compile time.

timbit426• 5 years ago

I'd like to see Tox and Jami.

wizzwizz46• 5 years ago

I read somewhere that Tox's security was compromised.

timbit426• 5 years ago

I'd like to see that. Was it not fixed?

fractal6182• 5 years ago

Now I just have to get my friends and family to use Signal.

catlikesshrimp2• 5 years ago

I have been trying to get people to install signal for 2 years. No one has budged.

The day facebook went down for some hours I got phone calls.

anonporridge2• 5 years ago

It's incredibly disheartening how difficult it is to get most people to care about digital privacy.

basilgohar• 5 years ago

I have had some success. It helps that many of the people I regularly contact were willing to migrate, even after some time. Most already used WhatsApp, so the friction to installing a new app was less than someone not accustomed to using a dedicated app for messaging.

But most of my American friends that don't have international contacts still just use SMS because they are not really accustomed to an app such as WhatsApp and so on.

djanogo• 5 years ago

I switched to signal and got few people to switch too, then they started their shit coin(MOB). IMO Signal Messenger is just a way for that company to reach their shit coin goals. Uninstalled and never recommending that again.

MatekCopatek• 5 years ago

I remember many people being pissed off when these features were announced some months ago.

As far as I can tell, nothing really happened afterwards. I use Signal on a daily basis and haven't noticed any coin-related functionalities. Either they were canceled, haven't been released yet or they're just buried somewhere deep and not advertised.

Do you have a different experience?

arthurcolle• 5 years ago

Are you sure you're not thinking of Telegram? They had a thing called Telegram Open Platform or something (TOP rings a bell for some reason)

yabones• 5 years ago

I've had surprisingly good luck with strong-arming people into switching. The important part is having their trust, if they don't believe you they won't listen. The next part is to make simple, verifiable, and non-technical arguments for switching. Believe it or not, almost everybody is willing to take small steps if they're free.

Instead of rambling on and on about "end to end encryption" or "double-ratchet cryptographic algorithms" or other junk only nerds care about, approach it like this:

* There are no ads, and none of the messages you send can be used for advertising

* It's not owned by Facebook, Google, Microsoft, or any of the other mega-corporations, and you don't need an account on one of their sites to use it

* It will still work great if you travel, change providers, etc

* It's much safer to use on public Wi-Fi than other services or SMS

Honestly, don't even touch on law enforcement access as in the OP. That can strike a nerve for some people. The best appeals are the simple ones.

godelski5• 5 years ago

Also, a big one that works for me (especially iPhone users, which are the hardest to convert): "You can send full quality images and videos to Android users." The fact that Apple shots themselves in the foot is an advantage to Signal.

upofadown5• 5 years ago

Even if you do it is pretty much impossible to get them to check their safety numbers and keep them checked.

godelski5• 5 years ago

The best advice I have to give to get people to switch is showing that you have cross platform capabilities. Essentially everyone can have the features of iMessage/WA: full resolution images and videos, responding to messages with emojis (WA doesn't have), stickers (unfortunately you have to grab from signalstickers.com instead of in-app), voice and video calling, etc. If Apple didn't have such a closed ecosystem then I think it would be harder to get people to switch. In this respect, Signal is more feature rich than anything else (except Telegram, but Telegram doesn't have the same security and isn't trustless).

I think the common mistake is trying to convince people with the security. Use that as a bonus, not the main feature. You're talking geek to people that don't speak geek (convince geeks with these arguments, not mom and dad). I also suggest strong arming people and using momentum (if 4 people in a group of 5 have Signal, switch the group to Signal. Or respond to WA messages on Signal).

fractal6182• 5 years ago

Now I just have to get all my friends and family to use Signal.

tacLog• 5 years ago

My family has really taken to it. Granted it's mostly just message family app to them, but they are very not technically fluent but yet seemed to have picked it up just fine. I really think this is not discussed when hacker news brings up secure messaging. The user experience is so much more important than the underlying tech. My family doesn't care about end to end encryption. They care about video calling with the press of a button, and easy features that are just there and work like zoom or the many other software products that they have to use work.

Thank you Signal team for focusing so hard on the user experience.

xanaxagoras4• 5 years ago

They left off one very popular messenger, SMS:

* Message content: All

* Subpoena: can render all message content for the last 1-7 years

* 18 U.S.C 2703(d): can render all message content for the last 1-7 years

* Search warrant: can render all message content for the last 1-7 years

* Vague suspicion plus a small fee to the carrier: can render all message content for the last 1-7 years

heavyset_go5• 5 years ago

There's also:

* Law enforcement simply asks nicely: can render all message content for the last 1-7 years

Consultant32452• 5 years ago

* Law enforcement wants to stalk ex-girlfriend: can render all message content for the last 1-7 years

gnopgnip2• 5 years ago

The Stored Communications Act makes disclosing the contents of messages without a search warrant unlawful

dkdk8283• 5 years ago

Companies also sell data to law enforcement.

authed3• 5 years ago

You forgot email... and they don't need a warrant for messages older then 180 days if in the cloud (they never delete them, too): https://www.consumerreports.org/consumerist/house-passes-bil...

kingcharles11• 5 years ago

IIRC the only reason this amendment was made was because the 180 day limit was found unconstitutional anyway by an appellate court. So, technically the amendment did nothing.

It doesn't matter where your data is held, locally or cloud, (if you are an American resident and your data is in the USA) as it is _your_ data and it is unconstitutional for them to read it without a warrant. In theory.

lsiebert• 5 years ago

It's about secure messaging

grumple2• 5 years ago

Source is a few years old, but I suppose we can make another FOIA request to find out how long carriers store text messages these days - it was basically 0-5 days a decade ago:

https://www.nbcnews.com/technolog/how-long-do-wireless-carri...

FateOfNations• 5 years ago

Idk... back in the mid 2000s my parents managed to get a transcript of all of my (minor) sister's SMS messages for a few months back (as part of a billing dispute).

jc014805• 5 years ago

You’ll be lucky if it’s any longer than 24-hours now. There’s no business use case for building and maintaining the technological infrastructure to manage it for years. It’s private info and they can’t sell it to anyone without legal liability. If LE gave them the funds to build this infrastructure and use it for retention then the service provider is essentially an agent of the state at that point.

jc014805• 5 years ago

Major service providers do not maintain SMS history beyond 24 hours, let alone 1-7 years (last time I worked a case that is). They’re transparent about it as well. Look up the LE liaison contacts on their sites and they’ll clearly list what is available or not available. That’s why it’s crucial to get the actual devices themselves. Reason: the infrastructure to manage SMS content for every customer for 7 years with zero business justification/use case is phenomenal. They’d spend most of their time responding to civil and criminal subpoenas/warrants. That would be a feat the NSA would be proud of. Been there and done that a 100 times. (This also aligns with certain VPN providers refusing to keep logs. It’s a cost that provides zero returns, so they cut it as a business decision, not because they’re trying to stick it to the man.

wyldfire• 5 years ago

There's no reason for them to keep those records, other than for law enforcement's sake. No use case for calling up your operator to ask about that text message you got "from Fred at 4am one day a couple years ago."

superkuh• 5 years ago

I'm surprised to hear this has changed so significantly since the snowden leaks. Especially after the blatant attack on Qwest CEO Joseph Nacchio for refusing to spy. It was established then that the major mobile telcos in the USA were keeping and providing sms full data for 2-5 years (t-mobile, at&t, verizon, etc).

lrvick4• 5 years ago

I went to a major cell provider and asked them nicely for access to SMS for all their customers and they happily took money and gave me an API.

This was for a startup.

I have no doubt they do the same for governments.

Terretta• 5 years ago

Major service providers do not maintain SMS history beyond 24 hours, let alone 1-7 years

Nobody should make decisions based on this comment.

baby• 5 years ago

I'm wondering how this was obtained, and how old this is?

For WhatsApp:

if target is using an iPhone and iCloud backups enabled, iCloud returns may contain WhatsApp data, to include message content

Probably not true since WhatsApp launched encrypted backups.

vorpalhex2• 5 years ago

Reading the document answers this for you: It is a declassified government document originally produced by the FBI and was prepared on Jan 2nd, 2021.

gnabgib• 5 years ago

I mean the document says the data is accurate "as of November/2020", and the slide was prepared 7-Jan-2021

cunthorpe2• 5 years ago

WhatsApp has its own backups in addition to regular full-phone iCloud backups.

If WhatsApp does not encrypt its content at rest locally, then “iCloud backups” still contain everything unencrypted too.

the_optimist5• 5 years ago

Isn’t this simply imaginary, where in practice all the FBI has to do to up the ante is to request military-grade interception from a willing foreign counterpart?

tata71• 5 years ago

Tier of which requires....expense.

anonporridge2• 5 years ago

The point of promoting and using privacy respecting software is not necessarily to make it impossible for law enforcement to get what they want. It's to make it somewhat expensive and require targeted probes.

You simply want it to be cost prohibitive to engage in mass surveillance on everyone, because that is an immensely powerful tool of totalitarian oppression that get really bad if we happen to elect the wrong person once.

wizzwizz46• 5 years ago

I don't care if they spy on me; they probably have a good reason to! But I do care if they spy on everyone, so I make it hard to spy on me.

the_optimist5• 5 years ago

I agree with you on the level of my person, and naturally flag that this economic argument is extremely poor policy. It’s quite unclear that the marginal cost is non-zero, or even flat by person. One might reasonably conclude we are already each inside a high-resolution springing trap, waiting for the moment we find ourselves athwart the powers that be. Imagine in physical space where the local police could simply call in foreign air strikes upon domestic citizens, with only economics to prevent otherwise. We must have transparent and firm laws, reformed at a fundamental level.

upofadown5• 5 years ago

Can't the FBI do a Pegasus style remote access thing on an appropriate warrant themselves?

the_optimist5• 5 years ago

Seems like it. And can they also do it without an appropriate warrant [by asking someone else]?

headphoneswater2• 5 years ago

If this is what it takes to keep us safe, I and most americans are ok with it. We live in dangerous times.

The US has a balanced criminal justice system -- as long as due process is preserved privacy from the state should not be a major issue

numlock862• 5 years ago

How does them reading my messages keep me safe, though?

headphoneswater2• 5 years ago

In that example it's keeping me safe from you

wizzwizz46• 5 years ago

if it's not we have bigger problems anyway

Really, we shouldn't do anything; we have the bigger problem of the eventual heat death of the universe.

Take into account not only the size of the problem, but how easy it is to do something about it.

benlivengood• 5 years ago

Current U.S. "due process" includes national security letters and other secret legal requests and secret courts to approve those requests. So there are still some checks and balances but it's less clear that they are working well enough or as intended.

Just look at the transparency reports of major Internet companies; they can report numbers of (certain types of) requests and that's about it. Mass surveillance under seal is not a great trend.

When political parties start advocating for jailing political opponents and treating the supreme court as political office for nominations, I find it harder to trust the current due process.

bredren• 5 years ago

The way these became bullet points on the slide is ~

An active investigation leads an agent to a suspect known to have used one of these applications

An administrative subpoena is issued to the company asking for what information is available

The company is then ordered by a federal judge to provide information related to a particular account or accounts

The company complies.

This is why it is important to understand how your messaging service handles data and how you can compromise your own safekeeping of all or part of that data.

skinkestek7• 5 years ago

Check the difference between Telegram and WhatsApp.

Add to this the fact that WhatsApp

- uploads messages unencrypted to Google if you or someone you chat with enable backups

- and send all your metadata to Facebook.

Then remember how many people here have tried to tell us that Telegram is unusable abd WhatsApp is the bees knees.

Then think twice before taking security advice from such people again.

PS: as usual, if your life depends on it I recommend using Signal, and also being generally careful. For post card messaging use whatever makes you happy (except WhatsApp ;-)

KennyBlanken3• 5 years ago

Telegram defaults to no encryption, does not do encrypted group chats, has a home-rolled encryption protocol which almost guarantees it's weak as nearly every home-rolled encryption system always is (if not also backdoored). Coupled with it being headquartered in Russia means it is completely untrustable.

The only reason Telegram comes out on top of Whatsapp in the document in question is because Telegram is a foreign company with little interest in cooperating with a US domestic police agency; the FBI has no leverage over Russian companies.

What that list doesn't show is what Telegram does when the FSB knocks. By all means, give your potentially embarassing message content to a hostile nation's intelligence service.

nicce4• 5 years ago

That is a lot of speculation. If you read the encryption protocol, actual methods being used for encryption are well known. Client is open source and supports reproducible builds. If there is a backdoor, it is in front of our eyes.

What that list doesn't show is what Telegram does when the FSB knocks. By all means, give your potentially embarassing message content to a hostile nation's intelligence service.

Telegram is in a lot of trouble in operating in Russia. It was blocked for two years. [1]

If they are so co-operative, why pass the opportunity to watch on their own people. Or did they become co-operative after unblock? It seems, that they help on some level [2], but does this threaten to other countries? Hard to say so.

[1] https://en.wikipedia.org/wiki/Blocking_Telegram_in_Russia

[2] https://www.independent.co.uk/news/world/europe/telegram-rus...

skinkestek7• 5 years ago

Telegram defaults to no encryption,

This is plain false as can be verified by anyone who can check Telegram GitHub repos or run the app in a debugging environment.

Telegram defaults to point-to-point encryption. Same as banks and gmail.

Fun fact: back in the days WhatsApp sent messages unencrypted (i.e. as plain text) over port 443(!).

does not do encrypted group chats,

again, point-to-point encryption

has a home-rolled encryption protocol which almost guarantees it's weak as nearly every home-rolled encryption system always is (if not also backdoored).

Earlier versions had serious problems. Newer versions are supposedly better.

Also there is a lot of difference between home-grown cryptography by a math wizard, made open source for everyone to inspect and various secret sauce variants.

HN has a long history of claiming it can be trivially broken, yet despite source code being available no one has done it? Lazyness or incompetence? Or maybe it isn't so simple?

I don't know but if you want to shut me up and make your claim to fame: do break Telegram cryptography. You'll do the world a service both by exposing it and by shutting up people like me.

Meanwhile, stop spreading lies. Telegram is not unencrypted. It is point-to-point encrypted by default.

If the encryption is weak, prove it or shut up.

zer0zzz• 5 years ago

This isn’t the case anymore with WhatsApp. Backups to iCloud and google drive are optionally fully encrypted. You have the choice of storing the decryption artifacts on facebooks servers (which are held on a Secure Enclave) or to backup the 64 character decryption code yourself.

wwww3ww2• 5 years ago

I do DIY encryption with enigma reloaded and it works

wwww3ww2• 5 years ago

i use enigma reloaded to manually encrypt my messages

xster3• 5 years ago

This seems like a good place to say that I strongly recommend Yasha Levine's Surveillance Valley book (https://www.goodreads.com/book/show/34220713-surveillance-va...) where he suggests that all of this is working as intended, going all the way back to the military counter-insurgency roots of the arpanet first in places like Vietnam, and then back home in anti-war and leftist movements. The contemporary themes that are relevant are the fact that current privacy movements like Tor, Signal, OTF, BBG are fundamentally military funded and survive on government contracts. It distracts from the needed political discourse into a technology one where "encryption is the great equalizer" and everyone can resist big brother in their own way on the platforms the government has built. Encryption does exist, but it also distracts from other vectors like vulnerabilities (that led to Ulbricht getting caught), what services you would e2e connect to, how you get the clients to connect to those services, what store can push binaries for said clients etc.

hutzlibu2• 5 years ago

"are the fact that current privacy movements like Tor, Signal, OTF, BBG are fundamentally military funded and survive on government contracts."

Are those "facts" avaiable for investigating, without having to buy the book?

(that Tor is partly US administration funded is known, but Signal? And what is OTF and BGG?)

xster3• 5 years ago

https://www.opentech.fund/results/supported-projects/open-wh...

Funded by Open Technology Fund (OTF) https://en.wikipedia.org/wiki/Open_Technology_Fund

Which is funded by Radio Free Asia (RFA) https://en.wikipedia.org/wiki/Radio_Free_Asia. It had a few reboots but was created as a CIA program in 1951 (https://en.wikipedia.org/wiki/Radio_Free_Asia_(Committee_for...) to blast shortwaves into China from Manilla to try to overthrow the Chinese government. Rebooted more recently since the advent of the great firewall of China.

adamfisk6• 5 years ago

Yasha Levine is a conspiracy theorist hack. There’s really no other way to say it. His narrative is attractive to a left leaning audience with shallow knowledge in this area, but the reality is that without publicly funded software like Tor, Signal, OTF, and my own Lantern, our world would be more fully saturated with corporate control of the internet. We need more public funding for open source software (with public security audits, mind you), not less. Without them, we’d basically be left with Wikipedia as the only popular entity on the internet outside of corporate control.

All of these projects are more properly grouped with government funding in other spheres, such as the BBC or PBS in media, than they are with the surveillance state or the NSA. Levine overlooks basic details, such as reproducible builds, that quickly collapse the house of cards that is his narrative. He tries to paint them all with the NSA brush, when, in fact, they’re simply projects that have historically received some of their funding from the government while fulfilling missions with extraordinary humanitarian benefits. Levine’s own knowledge and experience in this area is shallow. Look elsewhere.

xster3• 5 years ago

I don't disagree with what you're saying. I'm not sure your statement is in disagreement with mine either? I don't think he's saying less OSS is better or anything dogmatic? All he's saying is that using Tor/Signal shouldn't be the end all be all of your surveillance concerns.

would be more fully saturated with corporate control of the internet

You might disagree. His point was that the "corporate controllers of the internet" support projects like Tor because A) it gives a (somewhat ineffective) channel for people to focus on rather than political recourses and B) there's no real threat to the corporate model. What would you do in this e2e encrypted internet without corporate services?

such as reproducible builds

Seems like a tangential point. You can have an untampered copy of a client with a vulnerability.

funding from the government while fulfilling missions with extraordinary humanitarian benefits

I don't think this is in disagreement with anything either

pphysch4• 5 years ago

This comment is an incredibly naive attempt at a smear.

Without them, we’d basically be left with Wikipedia as the only popular entity on the internet outside of corporate control.

Wikipedia is absolutely not "outside of corporate control". It is trivially astroturfed to advance special interests.

All of these projects are more properly grouped with government funding in other spheres, such as the BBC or PBS in media

Both BBC and PBS routinely publish outright disinformation to advance the special interests of their corporate/government clients, including the intelligence community. For example, look at PBS Frontline's ridiculous puff piece for the violent extremist group HTS last year.

Levine overlooks basic details, such as reproducible builds

Reproducible builds are also easily circumvented by selectively deploying backdoors and other malware, based on IP or other fingerprints.

If there are good reasons to dispute Levine's investigative journalism, they're not here.

CyanBird4• 5 years ago

from the government while fulfilling missions with extraordinary humanitarian benefits

Ahh yes, the famed operation Condor, operation Gladio, operation iceberg and so many other famed "humanitarian" projects

At the end of the day all that you mentioned goes back to a post-facto "it is good because *we* do it", I would go to say that most people here in HN are well aware of the start of Google when it was funded by us Intel as a way to parse Vietnam era datasets, or how US Intel uses Radio Free Asia to destabilize enemy countries abroad, but again, it is only good/not bad when "*we"* do it

Apologies for a rather low quality comment, but these types of persons handwaving the actual structure behind all of this really get on my nerves, specially when I have had family members be tortured as a consequence of these US activities

yownie8• 5 years ago

my own Lantern

Brilliant reposte, but I am curious what software are you referring to here?

suetoniusp• 5 years ago

Thank you. I never knew the source of the ridiculous theory that the internet sprang from spying attempts on the Vietnamese. I am always looking for keywords to filter conspiracy weirdos. Yasha Levine added

tptacek3• 5 years ago

Signal isn't funded by the military, by OTF/BBG, or any branch of the USG government. People who claim otherwise are confused (deeply) about a program OTF ran that sponsored third-party security reviews and development projects (summer-of-code style), none of which was mediated through OTF --- it was just a bucket of money.

You should be extremely skeptical about people who bring OTF/BBG up in these discussions. I have complicated feelings about Tor stemming mostly from culture and effectiveness concerns and would push back on claims that it's co-opted by the Navy or corporate interests, but at least I can see a clear (if silly) line connecting Tor to these supposed conflicts of interest.

tialaramex• 5 years ago

As I understand it the technology behind Tor is strengthened by an arms race. You want several different well-funded entities running nodes, because that makes the service better for everybody. Even if some of those entities are hostile they still help unless one entity controls a large portion of interior nodes and even then you're only giving metadata to that single entity (whichever it is) by using Tor, not anybody else - which is better than you're going to do with alternative technologies.

CyanBird4• 5 years ago

Signal isn't funded by the military

Correct, it is not funded by "the military", but this is incorrect

any branch of the USG government

Because Signal/TextSecure received considerable amounts of seed capital from Radio Free Asia which is a CIA spinoff with the explicit aim to fund the development of the cryptography at grass roots level, not per se to have full control of it like NSA would have done, but because having strong cryptography on such platforms (Telegram might be other) is highly effective against perceived US enemies like well... Iran, or Syria, and to allow their assets/agents to communicate more easily while abroad without bulky extra proprietary phones or software

All of that above is mentioned at length on Surveillance Valley btw

b82• 5 years ago

Ulbricht was caught via poor OPSEC and not via a Firefox/Tor 0day afaik. Though there was/is speculation that a Firefox/Tor 0day was used to bring down some Tor markets and possibly to locate the Silk Road's server. Silk Road 2.0 was brought down in like a few months, which could indicate such a 0day existed. Or that it was ran by some former Silk Road staff members who got doxed when Silk Road 1.0 was shut down.

ichydkrsrnae7• 5 years ago

Ulbricht was caught because an FBI agent, who would read things slowly and twice, recognized these 4 letters : heyy.

That's how Ulbricht sometimes spelled hey, and the agent had seen that particular spelling before in his investigation, in an email from Ulbrict’s student email address.

Nick Bilton's book “American Kingpin: The Epic Hunt for the Criminal Mastermind Behind the Silk Road” is a great read, highly recommended.

SavantIdiot2• 5 years ago

Where is any evidence of Tor being a military surveillance project? I find it hard to believe an open source project like this has been infiltrated. Yes, there is suspicion some ECC curves are compromised, but only the ones provided by NIST. I'd really like to see evidence of Tor.

tbihl• 5 years ago

The seed for that line of thinking is the fact that a US Navy lab built it.[0] Having said that, I believe that's the only basis and is a far cry from making the theory convincing or even probable.

[0] https://en.m.wikipedia.org/wiki/Tor_(network)

yownie8• 5 years ago

There's a been a suspiciously downplayed number of ephemeral hidden services that get raided / internationally taken down on the Tor network for it to be mere circumstance.

No one tries to take notice since they're hosting the worst content on the internet regularly.

nova22033• 5 years ago

Did you even click on the link? Signal gives away NOTHING.

goatcode• 5 years ago

It's kind of funny that WeChat seems pretty locked-down to the FBI, especially for Chinese citizens. Makes sense, really, but still funny.

sgjohnson2• 5 years ago

Like Telegram, they simply don’t care about US warrants.

jareklupinski• 5 years ago

is this only page two of an alphabetical list?

or are there no messaging systems with a name before 'i'

rodmena• 5 years ago

WhatsApp. -> FBI

Telegram. -> KGB

Signal. -> The rest of us?

anderber• 5 years ago

Didn't Russia(KGB) try to block Telegram in the past and were unsuccessful? I feel like they are fairly safe and trustworthy. Of course, I like Signal best, but Telegram has so many nice features.

b82• 5 years ago

Can't the FBI get chatlogs from WeChat? https://www.youtube.com/watch?v=N5V7G9IBomQ In the short documentary that the FBI made about catching Kevin Mallory they mentioned catching him sending classified stuff via WeChat.

throw_away_dgs• 5 years ago

Some FBI agents came to my house once and told me that my home Internet had been used to visit Islamic Extremist websites. They brought a local police office with them and a 'threat assessment' coordinator from my workplace. They asked me if my family was Muslim and wanted to know if we had been radicalized.

We are not religious (at all). We do not attend church, synagogue or mosque. We are lower middle class white Americans born and raised in the USA and have never traveled outside the country.

I have no idea why they thought this about us. Maybe it was an IP mix-up, but it was very disturbing. I feared that I may lose my job. I became very afraid of the FBI that day. I think this could happen to anyone at anytime.

giantg24• 5 years ago

It absolutely can.

ClumsyPilot2• 5 years ago

"threat assessment' coordinator from my workplace" "I feared that I may lose my job."

I understand that police/FBI have to conduct investigation. What dont understand is involvement of the employer , it's extremely disturbing - you have not been convincted, you have not been charged, you are not even a suspect or accused of anything at this point - how is your private life the business of your employer?

Why is your privacy being breached and livehood being placed at risk?

Surely the FBI is not allowed to publicise random dirt they find on innocent people?

IIAOPSW• 5 years ago

The FBI still has buildings named after J Edgar Hoover. That should tell you everything you need to know about their institutional respect for justice and due process.

heavyset_go5• 5 years ago

Surely the FBI is not allowed to publicise random dirt they find on innocent people?

If they're doing an investigation, they very likely got the employer involved in order to get more information on the person they're investigating, and companies have liaisons for law enforcement, as well. If the FBI comes knocking and says, "we think you've hired a terrorist," it's going to ruffle some feathers at the company no matter how unfounded or untruthful the claim is.

It isn't just the suspicion of terrorism that might have law enforcement or the FBI knocking at an employer's door. If someone is suspected of any type of cyber crime, the FBI will be coming for all of their computers and electronic devices, including the ones they use at work.

numpad0• 5 years ago

You deserve to be always assumed innocent until proven guilty, and you will have to be proven guilty to be found guilty, and realistically speaking, those premises are extremely technical.

aj3• 5 years ago

Employer might have been defense contractor. Most jobs without clearance don't even have "threat assessment coordinaror".

yownie8• 5 years ago

This is par for the course FBI intimidation tactics, along with interviewing everyone you've regularly conversed with. Serves a double purpose of investigation while simultaneously making you radioactive to be around.

Thereby isolating the person during a period of high emotional anxiety.

neves• 5 years ago

He is already being punished.

I'm reading a book where the main character receives a subpoena to go to a interview with the Portugal dictatorship political police. Nothing happens to him (till now) but everybody in the hotel where he is hosted starts to treat him differently.

Who will be the first in the line when a firing is necessary? Probably the guy that has problems with the FBI.

sjs382• 5 years ago

and a 'threat assessment' coordinator from my workplace.

What was the reason for this? What type of workplace?

akira25012• 5 years ago

I'm assuming any workplace which requires a government security clearance to enter and work in.

BLKNSLVR4• 5 years ago

It's (scarily) interesting that they react with actual personal attendance based purely on a very limited set of electronic information.

From your further description:

We are not religious (at all). We do not attend church, synagogue or mosque. We are lower middle class white Americans born and raised in the USA and have never traveled outside the country.

Would not the FBI have been able to any amount of background searching (read: further electronic information gathering), that would be less effort-intensive than getting arranging a 'threat assessment' coordinator from throw_away_dgs' actual workplace and a local police officer for an in-person door-knock. If such background checks were performed, then they either don't have much data or their threat weightings are set to red-scare levels of paranoia. Either way, it's scary.

Unless there's more to the story.

Terry_Roll• 5 years ago

It's (scarily) interesting that they react with actual personal attendance based purely on a very limited set of electronic information.

Either their intel is better than they let on and didnt think they would be walking into an ambush or they are more stupid than we think.

Eelongate2• 5 years ago

I think what he experienced is another manifestation of the same phenomena as zero-tolerance policies in schools; institutions ask their enforcers to suspend common sense and strictly enforce the letter of the law/guideline/etc, even in situations where any reasonable person would decide it made no sense. They do this because such common sense and gut feelings is how bias and prejudice might creep into their oh-so-perfect system.

It used to be that if a teacher saw a kid get bullied and then punch his bully back, the teacher was empowered to evaluate the situation using their best judgement, and punish the bully while congratulating the bullied kid who stuck up for himself. The system sees a problem with that; the teacher's perception of the incident might have bias and prejudice. The system's solution is to have zero tolerance for any violence and punish both students equally. The system's solution to the possibility of prejudice against one student is to ensure prejudice against both students.

coldtea2• 5 years ago

If such background checks were performed, then they either don't have much data or their threat weightings are set to red-scare levels of paranoia. Either way, it's scary.

They're not gonna have anything happen to them if they go tough on (and fuck over an) innocent guy.

They're gonna look bad if they miss a terrorist.

So they have no incentive to not have "red-scare levels of paranoia".

rubyist5eva• 5 years ago

Did they have a warrant? Never talk to the police without counsel, refuse all searches without warrants, "we might think you went on a website" is not probable cause, you have a right to an attorney and silence.

sandworm101• 5 years ago

Do you work for a government agency or contractor? That might explain why they contacted your employer so readily.

NmAmDa2• 5 years ago

Imagine being a muslim in such case. Trying to convince them that this can be a mix-up ( which is possible easily) won't be successful.

coldtea2• 5 years ago

Imagine being a muslim and e.g. having a kid visiting those sites.

Or just going there out of intellectual curiosity, like how a leftie might read Main Kampf to check what that shit is.

You can end up in a very bad position...

vbezhenar• 5 years ago

Is it prohibited to visit those websites? I once was interested to understand the way radicals think, to read about their arguments, so I spent some time hanging around some radical websites.

lrvick4• 5 years ago

I was visited by the FBI for doing security research that made them at least pretend to assume I was a blackhat they wanted to take down.

Use Tor browser if you are going to research anything a criminal might regardless of pure motives.

If you so much as want to research lock picking, use Tor.

ISP traffic logs can and will be twisted against you in a court of law.

throwaway0a5e• 5 years ago

To quote a Dartmouth history professor who taught a class on the subject: "if you don't get randomly selected for a search on your next flight you aren't doing your homework"

It's not prohibited but they notice and subject you to harassment by the system at every action with every part of the system that is integrated with their database.

tw042• 5 years ago

I’ll be the dissenting voice and say this reads like a “sow discord in the US 101”. Why on earth would the FBI bring both the police and a “threat assessment” coordinator from your work to interview you? Why would your workplace ever agree to it? That screams lawsuit waiting to happen.

And on that note, why didn’t you sue your workplace for harassment? Whether you’re religious or not isn’t any of their business and is a protected class.

lrvick4• 5 years ago

A decade ago the FBI harassed me at my home waking me up from sleeping twice and at a past employer before on entirely unfounded claims.

They didn't care what the consequences were for targeting someone innocent.

They also made nasty threats like "Someone has to go down for this, and if you help us collect intel on your industry peers we suspect then someone else can be that person"

I told them politely to go die in a fire because I was not about to help them harass other innocent people but it was terrifying none the less that they seemingly had the power to end my whole universe.

I became convinced through that ordeal that the FBI is a deeply corrupt organization that creates pressure to close cases by any means needed.

The OPs post seems totally believable and consistent with stories I have heard from others, particularly if they work for an organization that has the US government as a customer like a defense contractor.

_xnmw• 5 years ago

You're incredibly naive if you think this kind of stuff doesn't happen all the time since 9/11. I personally know several people with similar stories in the US.

aero-glide2• 5 years ago

I never use a VPN. That changes today.

fsflover• 5 years ago

You should use Tor instead. With VPN, you just shift your browsing history from one place to another.

unobatbayar2• 5 years ago

Or worse yet, the VPN provider can sell your data.

Build your own VPN https://github.com/hwdsl2/setup-ipsec-vpn

darkhorn2• 5 years ago

This is why you and everyone should use DNS over HTTPS (DoH).

Next day they might visit you to ask you why you are visiting an opposition party web site.

pnut• 5 years ago

Please disambiguate acronyms in the absence of context.

smolder• 5 years ago

How exactly is DoH a protection? Wouldn't they just see that as a red flag? Then, get the data from cloudflare or whomever.

matheusmoreira2• 5 years ago

That's extremely disturbing. Accessing some random website should never cause police to show up. They should never even know what you did. That's like keeping tabs on what books people read and raiding somebody's house because they looked up how bombs are made.

wbl• 5 years ago

The only words you should ever say to the FBI "on advice of counsel I am taking the fifth".

ChrisKnott2• 5 years ago

This is awful advice for this specific situation.

OP apparently managed to clear up the mistake without much bother by speaking to them (although they were understandably shaken up by the experience). This presumably wouldn't have happened if they'd done what you suggest.

austincheney• 5 years ago

We are lower middle class white Americans born and raised in the USA and have never traveled outside the country.

I am most curious why you believe that is a defense against radicalization. In the US that is perhaps the most common demographic for radicalization of any type.

selimthegrim3• 5 years ago

Radical to him only goes before Islamic terrorism apparently

hexis• 5 years ago

I wonder where Matrix/Element would fit into this chart.

derbOac• 5 years ago

Yeah I was thinking maybe some of the most secure platforms aren't on the list.

Briar was another one.

dollabills2• 5 years ago

Snapchat?

dollabills2• 5 years ago

What about Snapchat?

dotancohen• 5 years ago

Do you want this to stop? Raise awareness, add this to your mail sig:

  > This electronic communication has been processed by the United
  > States National Security Agency.

If it makes people uncomfortable, GOOD. Pretending that your mail - and their mail - is not being accessed is not the way to resolve this uncomfortable situation. Ending it is the way. And that demands awareness.

Larrikin• 5 years ago

I use LINE a fairbit, have a number of Japanese friends as well as friends that have traveled to Japan. I had no idea they had implemented much better encryption [1]. I'm convincing all my contacts to turn on the option now.

[1]https://engineering.linecorp.com/en/blog/new-generation-of-s...

timbit426• 5 years ago

It's about time they implemented 1970's encryption technology. It should be on by default.

CookieMon• 5 years ago

The list doesn't have ANØM

richij• 5 years ago

PSA: This is a year old.

NmAmDa2• 5 years ago

The funny thing is that sometimes when I search for Arabic words about Islam I get results for some old and usually the extremest books on CIA library (direct links to PDFs) which I wonder why?

FBI's ability to legally access secure messaging app content and metadata [pdf]

Related Stories