Silk Road forums
Discussion => Security => Topic started by: dillondillon on August 14, 2012, 08:18 pm
-
6th circuit today: Gov can ping location of prepaid phones w/o warrant. 25% of Americans use prepaid phones.
------------------
Sixth Circuit Rules That Pinging a Cell Phone to Determine Its Location is Not a Fourth Amendment “Search”
The decision handed down this morning is United States v. Skinner, and it was 2-1 on the Fourth Amendment merits. The defendant used a pre-paid cell phone obtained by providing false identity information (also known as a “burner“) to communicate with co-conspirators as he brought a motor home filled with marijuana from Arizona from Tennessee. Agents learned the cell phone number that the defendant was using and obtained a court order requiring the cell phone company to disclose location information of the phone to the agents. The government used the location information to track the car for three days, eventually catching up to the car ata rest stop in Texas. Local police brought out a dog to sniff for marijuana; the dog alerted for the presence of drugs inside; and the search of the car revealed 1,100 pounds of marijuana inside.
The majority opinion by Judge Rogers concludes that the defendant did not have a reasonable expectation of privacy in the location that his cell phone was broadcasting. The court’s opinion relies on several different strands of Fourth Amendment law. Perhaps the major rationale is this: Cell phones work by broadcasting location, and an expectation of privacy based on a misunderstanding of how the technology works cannot be reasonable.
Otherwise, dogs could not be used to track a fugitive if the fugitive did not know that the dog hounds had his scent. A getaway car could not be identified and followed based on the license plate number if the driver reasonably thought he had gotten away unseen. The recent nature of cell phone location technology does not change this. If it did, then technology would help criminals but not the police. It follows that Skinner had no expectation of privacy in the context of this case, just as the driver of a getaway car has no expectation of privacy in the particular combination of colors of the car’s paint.
Justice Alito’s concurring opinion in Jones did not change this because the defendant was monitored for only three days, which was not long enough to implicate the concerns of “comprehensive” monitoring that arose with 28 days of GPS monitoring in Jones.
Judge Donald concurred. She would have found that the monitoring was a search because “”society is prepared to recognize a legitimate expectation of privacy in the GPS data emitted from any cell phone.” Se would have then expanded the scope of the good-faith exception to the exclusionary rule so that suppression was not an available remedy.
------------
External (clearnet) link - http://www.ca6.uscourts.gov/opinions.pdf/12a0262p-06.pdf
And if you do use "burners" and want to stay safe, you should be following some steps at least:
-Do not keep them turned on in your "home" or a location that can be traced to you.
-Turn them off and take out the battery when not in use.
-Rotate old phones with new clean phones on a regular basis.
-Use different phones for different threat levels.
-Remember swapping a SIM card to a new phone, does NOT make you anonymous.
-
Well that sucks balls.
For civilians that is. Quite honestly the majority of drug vendors are more than aware of the caveats that come with cellphones.
This precedent will almost certainly lead to widespread abuses, you don't even need to be fan of SR to see that.
-
New number once a month has been my rule for a while. I like the idea of different ones for different threat levels, or even numbers for different circles of associates... Hmm I'm gonna have to scheme on this tonight. :)
-
OP - good post!
I have a question though - not that I expect you to know the answer.
But if someone has a prepaid phone - the only way "they" would know to track it is if they had the number or got their hands on the phone physically. right?
If I had a brand new prepaid phone right now and start calling a mexican cartel to arrange a deal. how would they ever know that "THAT" phone is the one to track?
ya follow?
-
OP - good post!
I have a question though - not that I expect you to know the answer.
But if someone has a prepaid phone - the only way "they" would know to track it is if they had the number or got their hands on the phone physically. right?
If I had a brand new prepaid phone right now and start calling a mexican cartel to arrange a deal. how would they ever know that "THAT" phone is the one to track?
ya follow?
It's just a hypothesis, but I would suspect the telecoms company's profile cellphone usage, method of acquisition etc. Obviously there's severe limits to this, but if you were constantly buying prepaids at the same time each week, or using them in the exact same place all the time, and more especially if you're communicating to already 'spotted' suspect numbers, then yes, such traffic analysis could be a problem.
This is why it's better to get people up to speed on email, and then use PGP and anonymously communicate via the Interweb via services like Tor. There is seldom a good reason to need to be in constant contact with other members and also require mobility within an operation unless you are disorganized. Anybody who requires constant feedback as to where they ought to be and what they should be doing is a liability in any organization, let alone a black market one.
Communicating with customers is a different thing, but that can also be alleviated if you think laterally, we had a thread on the subject recently ("best phone for drug dealer" or something similar).
-
OP - good post!
I have a question though - not that I expect you to know the answer.
But if someone has a prepaid phone - the only way "they" would know to track it is if they had the number or got their hands on the phone physically. right?
If I had a brand new prepaid phone right now and start calling a mexican cartel to arrange a deal. how would they ever know that "THAT" phone is the one to track?
ya follow?
It's just a hypothesis, but I would suspect the telecoms company's profile cellphone usage, method of acquisition etc. Obviously there's severe limits to this, but if you were constantly buying prepaids at the same time each week, or using them in the exact same place all the time, and more especially if you're communicating to already 'spotted' suspect numbers, then yes, such traffic analysis could be a problem.
This is why it's better to get people up to speed on email, and then use PGP and anonymously communicate via the Interweb via services like Tor. There is seldom a good reason to need to be in constant contact with other members and also require mobility within an operation unless you are disorganized. Anybody who requires constant feedback as to where they ought to be and what they should be doing is a liability in any organization, let alone a black market one.
Communicating with customers is a different thing, but that can also be alleviated if you think laterally, we had a thread on the subject recently ("best phone for drug dealer" or something similar).
Pine - I do not know what it is like where you live (UK?) But over here there are GHETTOS!!
And these "ghetto people" live gov check to gov check. 1st and the 15th.
They ALL have prepaid cell phones. They probably all pay their bill on the same days (1st + 15th). Im sure some of them use their phones for criminal acts. While I am just as sure that some are not criminals at all.
Again I would be willing to bet that both groups pay their bills on the same set of days.
That is just one very obvious (to me) example.
With this in mind any one who is not on gov welfare could just re-up minutes on the same days and blend in?
I do not believe this at all. Profiling based on your examples would be pointless. A whole lot of work for NO reward. You would have better chance of just circling the blocks around the ghetto and looking for a street deal to go down.
Your other point about a "spotted" or "suspicious" number is the only viable way I could see any of this worth LEs time.
Maybe a big king pin has a prepaid phone and some CI (Confidential Informant) gets busted and gives LE the "king pins" number. Then MAYBE they could use it for what is outlined in the OP.
I know you started the post with "just a hypothesis", but I am going to have to disagree.
I know you love harping on encryption and anonymity, but sometimes; just sometimes the best security is obscurity.
-
I know you love harping on encryption and anonymity, but sometimes; just sometimes the best security is obscurity.
One of the many reasons we like USPS, security by obscurity.
The problem I see with security by obscurity is the ever increasing processing power of machines. We all leave traces of information, be it the time we purchased a phone, ways use it, if that phone always goes "dead" (battery out) after each call, etc. I worry that at some point, and possibly that is now, there will be enough "spare" computational power for the forces that be to profile everything they legally can, and then some.
For example, voice recognition. All that would be is needed is a sound clip of your voice. That could be cross referenced (in real time) to all voice communication going over telecom services. This could easily lead to pinpointing the whereabouts of someone. I don't care how obscure you were when you bought it, if there's enough computational power to cross reference voice data in real time, life would become far more difficult.
Another example would be profiling how users on a forum post. Over time, possibly enough data on how an individual uses grammar, punctuation, sentence structure, etc to give them a solid enough profile that they could cross reference every known clearnet webpage for that same profile. If at some point that could be done on large scale, Security by obscurity doesn't work as well anymore.
Even PGP, its still got a weak link; the user on the other end. I'd be willing to say there's a measurable percentage of vendors here that, push come to shove and LE start knocking on their door -- they will either flip and give up their PGP keys or just be tricked into believing they had to. Then you're encryption is worthless, regardless of how secure it is. SR might just be one place where you're stereotypical drug dealer is replaced by a soft 18 year old college student. Just watch any of the police integration crap on TV, they'd have you're average 18 year old college student curled up into a ball crying in the corner of the room.
I think the bottom line is, 2 can keep a secret if 1 is dead. There is always a weak link, its all in how you mitigating that risk as much as possible.
-
I think the bottom line is, 2 can keep a secret if 1 is dead. There is always a weak link, its all in how you mitigating that risk as much as possible.
i meant 3, if 2 are dead but, 2 and 1 work too..
-
One of the many reasons we like USPS, security by obscurity.
Yes. The idea of having a wall safe hidden behind a picture rather then a bank vault
Another example would be profiling how users on a forum post. Over time, possibly enough data on how an individual uses grammar, punctuation, sentence structure, etc to give them a solid enough profile that they could cross reference every known clearnet webpage for that same profile. If at some point that could be done on large scale, Security by obscurity doesn't work as well anymore.
Oh yeah. This has been said before on the forums here. Totally true.
Even PGP, its still got a weak link; the user on the other end. I'd be willing to say there's a measurable percentage of vendors here that, push come to shove and LE start knocking on their door -- they will either flip and give up their PGP keys or just be tricked into believing they had to. Then you're encryption is worthless, regardless of how secure it is.
If "push came to shove" and you were suspected on "anything" NOT giving up your encryption key could easily add to your charges (obstruction of justice) For what it is worth a lawyer told that to me.
SR might just be one place where you're stereotypical drug dealer is replaced by a soft 18 year old college student. Just watch any of the police integration crap on TV, they'd have you're average 18 year old college student curled up into a ball crying in the corner of the room.
All too true! Look at that vendor "quick buds" and the thread about him throwing weed buds into a ziplock bag and not vac packing. Then as a buyer called him out on the forum - he went crazy and called the buyer a "sissy" (among other things)
http://dkn255hz262ypmii.onion/index.php?topic=33900.0;topicseen
I think the bottom line is, 2 can keep a secret if 1 is dead. There is always a weak link, its all in how you mitigating that risk as much as possible.