A commercial product comes with a technical manual why is this even news?
Is The Intercept running out of stories that they need to turn "user guides" into news? Did anyone expected equipment and software that can cost millions of dollars not to be supported?
Heck commercial malware these days comes with online support, manuals, an SDK, and a development community w/ access to Jira.
Because it seems that it is controlled under ITAR, the manufacturer seems to be following US law.
Googling other alternatives that are not US based like Verint seems to indicate that their manuals and support material are more or less available even for cellular tracking (e.g SkyLock)
it's news because the cops and feds have fought extremely hard to prevent the public from understanding what these can do, how frequently they are used, and who has them.
they don't want this info out, therefore it's high intel value to the public and must be disseminated.
technical manuals hardware provide avenues for discovering defenses and vulnerabilities, which we're in dire need of.
We have different priorities then, I see no value in this information other than for my own personal technical interests.
I also see no correlation between the technical information and what we can all agree on that is important - how, when, and on whom are they used.
Spreading a manual which is controlled under ITAR does nothing, infact it's utterly counter productive because it gives the government more reason to bunker and deny FOIA requests.
As far as defenses go there is plenty of information about how IMSI catchers and various other interception techniques work, I had no problems getting technical datasheets for about 10 of those including from vendors like HP (well now Keysight since it' was Agilent/HP > Keysight).
You can buy those things from freaking Alibaba and there are now plenty of chinese companies that clone and develop their own interception gear and sell it online they just ask you to confirm you have the legal authority to possess the equipment.
Talks about this like the SS7 talk in CCC also didn't seem to be hindered due to lack of technical material from vendors, so yeah these manuals not to mention they story they tried to make around them aren't really news in my books, but hey different strokes.
great, now maybe we can develop countermeasures to illegal & unethical surveillance methods like these. there are a few imsi-catcher detection apps out right now, maybe we will see more.
What scares me is that we all thought we had countermeasures in HTTPS and anonymizing proxies. When using both, so long as you only did things over HTTPS you were safe. It turns out that wasn't true at all for at least iOS dating back many years:
This makes it quite clear that these devices are intended and used for the routine disruption of a licensed radio system ... which is Federal offence in the US. The interesting question here is; why? Why would someone working in law enforcement risk a year in jail just so they can do warrantless wiretapping? That suggests a certain level of desperation.
One answer is that we to a certain extent make it impossible for law enforcement to do their job any other way. We have a lot of laws on the books where none of the people violating those laws are likely to go down to a police station and file a complaint. The prohibition on illegal drugs is a good example. It's like asking a friend to help you with your diet while forbidding them from looking in your fridge. Your friend is likely to look in your fridge if they don't just refuse to help at all. We are sending mixed signals.
Another answer is purely economic. It is very expensive to have law enforcement people sitting around on stakeouts and/or following people. It saves a tremendous amount of time and effort if you can find out where people are going to be. If warrantless surveillance becomes technologically impossible, then we are going to have to pay a lot more salaries to have all our laws enforced.
>> "If warrantless surveillance becomes technologically impossible, then we are going to have to pay a lot more salaries to have all our laws enforced."
Completely agree, cost would rapidly get out of control without warrantless surveillance and criminal activities would surge. In fact, why even use tech like this when everyone by law should just wear a device to broadcast their location, all their communications, etc. All the data collected should be admissible in court too.
Particular categories of criminal activities would surge. A strong argument can be made that the associated problems shouldn't be handled with law enforcement ... but that is not something law enforcement gets to decide, we do.
In a sense we are being crummy bosses, we want our employees to do two mutually incompatible things at the same time. Our conflicted thoughts about things like recreational drugs trickle down into bad policy.
It's not really new information, as knowledge of stingrays has been around for a while, but it is still amazing that so few people know about this. Since this is essentially MitM.
I wonder how easily they could just get the data from the actual tower (without a warrant).
18 comments
[ 3.1 ms ] story [ 60.5 ms ] threadIs The Intercept running out of stories that they need to turn "user guides" into news? Did anyone expected equipment and software that can cost millions of dollars not to be supported?
Heck commercial malware these days comes with online support, manuals, an SDK, and a development community w/ access to Jira.
Googling other alternatives that are not US based like Verint seems to indicate that their manuals and support material are more or less available even for cellular tracking (e.g SkyLock)
Name one.
1. Permanently storing data on devices under surveillance.
2. Selectively degrading service for a target device.
they don't want this info out, therefore it's high intel value to the public and must be disseminated.
technical manuals hardware provide avenues for discovering defenses and vulnerabilities, which we're in dire need of.
I also see no correlation between the technical information and what we can all agree on that is important - how, when, and on whom are they used.
Spreading a manual which is controlled under ITAR does nothing, infact it's utterly counter productive because it gives the government more reason to bunker and deny FOIA requests.
As far as defenses go there is plenty of information about how IMSI catchers and various other interception techniques work, I had no problems getting technical datasheets for about 10 of those including from vendors like HP (well now Keysight since it' was Agilent/HP > Keysight). You can buy those things from freaking Alibaba and there are now plenty of chinese companies that clone and develop their own interception gear and sell it online they just ask you to confirm you have the legal authority to possess the equipment.
Talks about this like the SS7 talk in CCC also didn't seem to be hindered due to lack of technical material from vendors, so yeah these manuals not to mention they story they tried to make around them aren't really news in my books, but hey different strokes.
https://www.kb.cert.org/vuls/id/905344
One answer is that we to a certain extent make it impossible for law enforcement to do their job any other way. We have a lot of laws on the books where none of the people violating those laws are likely to go down to a police station and file a complaint. The prohibition on illegal drugs is a good example. It's like asking a friend to help you with your diet while forbidding them from looking in your fridge. Your friend is likely to look in your fridge if they don't just refuse to help at all. We are sending mixed signals.
Another answer is purely economic. It is very expensive to have law enforcement people sitting around on stakeouts and/or following people. It saves a tremendous amount of time and effort if you can find out where people are going to be. If warrantless surveillance becomes technologically impossible, then we are going to have to pay a lot more salaries to have all our laws enforced.
Completely agree, cost would rapidly get out of control without warrantless surveillance and criminal activities would surge. In fact, why even use tech like this when everyone by law should just wear a device to broadcast their location, all their communications, etc. All the data collected should be admissible in court too.
/sarcasm
In a sense we are being crummy bosses, we want our employees to do two mutually incompatible things at the same time. Our conflicted thoughts about things like recreational drugs trickle down into bad policy.
Please provide examples and the reasoning used to support these examples.
Whole legal arguments about the wireless signals is that they're "public" data.