Global: New research shows how a mobile phone can be turned into a passive indoor ultrasound sonar, locating people with high precision indoors using multi-target echolocation, and is even able to discern a rough selection of activities. It does this by overlaying imperceptible ultrasound sonar pings into played-back music, measuring the reflections coming back to the phone’s microphone. The privacy implications are staggering.

By emitting inaudible ultrasound pings as part of normal music playback, a phone can be turned into a passive sonar device, researchers from the University of Washington show in a new paper. It can track multiple individuals at an indoor precision of 8 centimeters (3 inches), and detect different types of activity by the people in its detection zone — even through barriers, all using a normal smartphone.

People with military technology background will recognize this as next-generation passive covert radar systems, radar systems which don’t transmit, but which detect objects in the sky from changes to reflection patterns from everpresent civilian transmitters such as radio and TV towers. The primary advantage of passive covert radars is that they can’t be detected, as they only contain very sensitive receivers, no transmitters. This phone research appear to be using the same kind of technology, except it is also used as a transmitter of ultrasound pings; however, it would be trivial to separate the transmitter of pings from the receiver of the reflected patterns.

“We achieve this by transforming a smartphone into an active sonar system that emits a combination of a sonar pulse and music and listens to the reflections off of humans in the environment. Our implementation, CovertBand, monitors minute changes to these reflections to track multiple people concurrently and to recognize different types of motion, leaking information about where people are in addition to what they may be doing.”

The researchers are straightforward about the privacy threat that this technology poses: “There are privacy leaks possible with today’s devices that go beyond the ability to simply record conversations in the home. For example, what if an attacker could remotely co-opt your television to track you as you move around, without you knowing? Further, what if that attacker could figure out what you were doing in addition to where you were? Could they even figure out if you were doing something with another person?”

The researchers have tested five different indoor environment and over thirty different moving individuals, and show that even under ideal conditions, the people typically could not detect the tracking.

“We evaluated CovertBand by running experiments in five homes in the Seattle area, showing that we can localize both single and multiple individuals through barriers. These tests show CovertBand can track walking subjects with a mean tracking error of 18 cm and subjects moving at a fixed position with an accuracy of 8 cm at up to 6 m in line-of-sight and 3 m through barriers.”

It’s conceivable that malicious apps with access to the speakers and microphone will be able to use this. It’s also conceivable that apps already are. Among many smartphone devices, the researchers also implemented their CovertBand demonstrator on a 42-inch SHARP television set.

“Even in ideal scenarios, listeners were unlikely to detect a CovertBand attack.”

Your privacy remains your own responsibility.

(This is a post from Falkvinge on Liberty, obtained via RSS at this feed.)

Privacy: Hardware maker Sonos has a new privacy policy, and is telling users that unless they agree to it, their devices may cease to function entirely. Of course, since people bought these objects, they’re those people’s property. And since Sonos is taking an action that they know will break these devices, Sonos is effectively saying they’ll willfully destroy your property unless you comply and give up your privacy. This is a new low.

Sonos is a high-end sound system maker, famous for being the first brand to have synchronized music in different rooms with an off-the-shelf device system. This week, they announced a new privacy policy, where they say they’ll be collecting a lot of data about you, including listening in to your room and (in a roundabout way) recording it. People were justifiably quite upset. It is in response to this community reaction that Sonos does the unforgivable: Sonos states that if people don’t accept “the new privacy policy” — meaning give up their privacy in their own home completely — Sonos is going to willfully destroy those people’s property.

“The customer can choose to acknowledge the policy, or can accept that over time their product may cease to function,” the Sonos spokesperson said, specifically.

Sonos is particularly sneaky about the part where they record sound. They say in their blog post that they “don’t keep the recordings” of sound recorded in your home, with the new Voice Assistant. However, they point out that they share their collected data with a large number of parties, the services of which you have “requested or authorized” — where people tend to read “requested”, but where “authorized” is the large part. Further, they point out that they share recorded sound with Amazon under all circumstances, and Amazon is already known to keep recordings for later use by authorities or others, so the point is kind of moot. “We don’t keep the recordings, we let others do it for us” would be a more straightforward wording.

As ZDNet notes, the community’s reaction has been quite hostile to the manufacturer who threatens to destroy their property, and not without justification.

For my personal purchasing choices, behaving like this is enough to get on my blacklist of manufacturers, just like when Sony willfully infected its customers with rootkit malware in 2005, and Sony made it onto my blacklist. (It’s a high bar to get there, and still, hardware makers keep inventing new audacious ways to clear that bar.)

Syndicated Article
This article was previously published at Private Internet Access.

(This is a post from Falkvinge on Liberty, obtained via RSS at this feed.)

Activism: The German newspaper Die Zeit has a long feature this week about IMSI catchers and their countermeasures, words that were long heard only in countersurveillance cultures at Black Hat and Defcon. Observing this phenomenon make the jump from the obscure to the mainstream tells us a lot about the years to come: surveillance and countersurveillance will be a cat-and-mouse game for quite some time.

Most people have heard of their IMEI, their phone’s unique identifier. It’s short for International Mobile Equipment Identity, and a lot of people learn how to read this number. Originally, it was produced by typing ×#06# on your phone, a sequence that amazingly still works, but it’s also on the phone receipt, in the menus, and in a number of friendlier places. This is the number you can insure, and this is the number you can report stolen to brick the phone.

A more secretive number is the IMSI, the Subscriber Identity, which identifies not the phone but the SIM card inside the phone. In most parts of the world, you’re expected to buy these separately from the phone, and you can replace the SIM card to change carriers but keep the same phone. In some other parts of the world, where telco carries have exercised regulatory capture and have a dysfunctional market, the SIM is typically card prebaked into the phone, and in these countries, you might never have seen it – but it’s still there, identified by the IMSI.

There are many good technical reasons to keep this number a secret. For example, any reconfiguration instructions sent to the phone from the carrier – so-called Over-the-Air provisioning — must be signed cryptographically with the IMSI of the current SIM card, in order to prevent fraudulent configuration. It’s also the number used when the phone contacts the carrier network, and therefore, anybody intercepting that handshake will see the IMSI.

This is the technology used in so-called IMSI catchers. When there is a large number of people in an area that the regime — police or other forces — want to keep tabs on, they deploy high-powered fake celltowers that the phones connect to, believing that these fake celltowers are their carrier’s. The fake towers then contact the real ones in turn, performing what we call a man-in-the-middle attack, which is just what it sounds like, sitting between the phones and the real cellphone towers.

This is a fairly sophisticated attack, one made by law enforcement in a highly dubious legal area. That’s why it’s really interesting to see mainstream media cover the topic now.

It’s particularly interesting as law enforcement won’t immediately get identities out of this attack — it will merely read which IMSI numbers were in the area at the time of the man-in-the-middle attack. Some of the time, this could conceivably be translated into people’s actual names, by means of subpoenas or similar to the carriers. A lot of the time, it won’t (think anonymous prepaid SIM cards).

While this attack can be used to track an individual’s movements once you have their IMSI — and has been used for this, notably with the American-made Stingray devices — it’s more alarming that law enforcement is increasingly using the attack to keep a catalog over which people, or at least their phones, are present at a certain type of protest.

Die Zeit’s article also covers countermeasures to the IMSI catcher attack, and mentions that while there are numerous apps that detect IMSI catchers, the better ones can only detect about 90% of those attacks.

We can expect this to escalate in the coming years.

Syndicated Article
This article was previously published at Private Internet Access.

(This is a post from Falkvinge on Liberty, obtained via RSS at this feed.)

Bitcoin: In 2011, I went all-in into bitcoin. As I described in a blog post at the time, I took all my savings and my entire credit line and put it into the fledgling currency, once I had realized its disruptiveness, and I did so at about $3 valuation (to simplify events a bit). People mocked me relentlessly.

I tend to be good at predicting events five years out that the large majority considers unforeseeable black swans. I’ve done so twice now for particular high-profile events: once when founding the Pirate Party – which was a “career ending decision” according to some colleagues, until I had succeeded wildly in what I had set out to do, sending people to the European Parliament on basically no budget using a novel set of leadership techniques. The other time was when I predicted the massive breakthrough of cryptocurrency in 2011, and said I predicted bitcoin to increase in value hundredfold-to-thousandfold over the next three to four years. (Do note that the actual breakthrough has not happened yet.)

Coindesk's price index broke $3,000 today, June 11 2017.

In both these cases, people basically said I was mad, even though I made no secret of going all-in into bitcoin — I’m not the “haha, I got rich five years ago with my secret method” type of person. Rather, I announced to the entire world that I was going all in, and being very specific about my reasons, giving anybody who wanted the ability to copy my actions. (A lot of people did; I get people coming up to me today saying I got them into bitcoin with these posts. Good for us, good for all of us.)

A key to these kinds of high-risk decisions, of course, is to trust your own intelligence and judgment when you know you’re going against the grain and against common wisdom. If you try to do something halfway, it’s the equivalent of taking the average between two sidewalks and walking in the middle of the road. I quickly lost count of how many times various well-meaning people told me to “sell and collect profits and come out ahead” – but that simply wasn’t the analysis I had made. Most people didn’t even try to be well-meaning, but instead had fun at and mocked my decision to go all-in outright.

To illustrate this, this is the highest-voted comment — not a random comment, but the highest-voted comment — from the Reddit thread six years ago when I announced I was going all in. Particularly note that this is a comment made by, and voted to the top, by bitcoin enthusiasts.

“I can’t even begin to comprehend the depths of the stupidity of that kind of reasoning”. To be fair to the commenter, it took a little over five years to get there, and not my estimated three to four years.

It’s quite funny in hindsight, actually, that even the people who were most devoted to the technology expressed themselves like this at the time.

In any case, as a followup to the original post, I just wanted to highlight that it reached the target I predicted. I was, as people say, right on the money.

Or maybe I should say that bitcoin reached the first target I predicted. Today, I refrain from making predictions for bitcoin until scaling is properly resolved with good engineering, and the obstructing company Blockstream has been kicked out of the community; the currency really has no future until this event has taken place as Blockstream has negated all the utility I originally pointed out through insanely tone-deaf non-business, but cryptocurrency as a whole remains extremely disruptive, be it the first-mover variant (bitcoin) or a second-mover variant.

If you love Blockstream and/or Bitcoin Core, but started doing so after I went all-in, I would urge you to consider the rational possibility that my analysis holds water this time too.

(Oh, and the market cap total for cryptocurrency just hit a hundred billion US dollars. And it’s still just the beginning. When cryptocurrency is ready, it won’t make sense to measure it in US Dollars any longer.)

(This is a post from Falkvinge on Liberty, obtained via RSS at this feed.)

Politicians do not understand the Internet. It is not so much that the politicians in power today in their 60s weren’t born with it, even if that’s also true. It’s more that politicians as a profession are institutionally incapable of understanding it, just because it functions without – even despite – political interference.

Businesspeople are not much better in this regard. Where politicians understand power in terms of what they can regulate, businesspeople understand power in terms of ownership. But the Internet is neither; it cannot be owned nor regulated. As pointed out succinctly by Searls and Weinberger, the Internet is an agreement. It is a technical agreement between billions of people how to get a packet of data from point A to point B, where no point is worth more than any other.

In this, the Internet is best understood like a language, shared by billions. While there are certainly those who try to describe languages with authority, and publish dictionaries that some follow to the letter, at the end of the day, users of a language speak however they want, regardless of any attempts to correct them or make them do otherwise. In this, a language is an agreement between millions or billions of people, and no regulation is going to change the agreement; no governmental threat of force against any person or group of persons is going to change the meaning of a word, and no user of a language has more power over it than any other user, except by voluntary following from other users of the language, voluntary being the key word.

To understand how this contrasts utterly and completely with the worldview of a politician, we need to look at some specific present-day cases where they have been, and are, involved. Let’s take autonomous cars, autonomous delivery drones, and Hyperloop constructions.

In each of these cases, long-term planning is required to first relax the present regulations enough to allow for trials of autonomous vehicles (on road, in air, and on new rail), land zoning may be required for air and rail, investments must happen in cooperation with banking or rich companies, after which trials can proceed, and political committees can evaluate the results against some sort of safety criteria established by experts which is added to the value systems of the politicians in charge. Once the results are evaluated, the politicians may allow – allow! – mass market adoption of the new, disruptive technology. This is the worldview of a politician, this is how everything they know has come into being.

Now, compare this with the Internet, where no politicians at all were involved in its coming into being, with the possible exception of Al Gore. Politicians who are used to cooperating with state-owned, state-controlled, or at the very least state-subsidized media are finding themselves circumvented by something they didn’t allow, something that just emerged.

This is why I’m getting questions from most politicians, when I claim fiber is a necessity, why “this download speed is not enough”. For users of a language, it’s not enough to be able to listen; you must also be able to talk. One of the fantastic things about the Internet’s good connections is that download is on equal footing with upload — nobody’s a consumer, everybody’s an equal participant. Politicians absolutely do not get this, and therefore, good connections (where upload speed is equal to download speed) are still rare, even in 2017.

Everything exists only on the edges. There is no center point. There is no bottleneck. From a regulation standpoint, there is no chokepoint which can be regulated. “The Internet interprets censorship as [technical] damage to the network and routes around it.” In this context, “censorship” is any undesired regulation.

I could think of only one Internet regulation necessary at the moment, and that’s net neutrality. Still, even that is regulation only necessary to patch up previous bad regulation – a lack of competition in the telecommunications market – and one needs to be very careful to avoid so-called regulatory capture, where telco insiders take over the agency regulating them through a selection of means. (Wouldn’t it be better if you just had a selection of two dozen service providers? Bad actors like Comcast would be dumped like a bad habit.)

It’s therefore important to realize that the need for net neutrality regulation is a consequence of the telecommunications industry having been created through the political regulatory process described above. Where there are internet service providers who are not also telecom providers, where internet entrepreneurs leapfrogged the entire telecom industry and don’t have last-century luggage, the concept of net neutrality is an absolute no-brainer. (“It’s the whole service and the entire point of the service, why would we want to sell a substandard service?”.) In contrast, the telecom industry will be utterly disintegrated by the Internet — who would want to pay by the minute for 9.6 kilobits-per-second of bandwidth that can only be used with one mediocre voice application, when you have 100 general-purpose flatrate megabits-per-second in the wall? — and so, the telecom industry has every strategic incentive to delay and prevent the utility of the Internet.

Privacy remains your own responsibility, especially in the face of clueless politicians.

Syndicated Article
This article was previously published at Private Internet Access.

(This is a post from Falkvinge on Liberty, obtained via RSS at this feed.)

Copyright Monopoly: Denmark’s ISPs are collectively putting their foot down and will no longer surrender identifying subscriber information to the copyright industry’s lawyer armies. This follows a ruling in neighboring Norway, where the Supreme Court ruled that ISP Telenor is under no obligation to surrender subscriber identities, observing that the infraction of the copyright distribution monopoly is not nearly a serious enough issue to breach telecommunications privacy. This has the potential to end a long time of copyright industry free reign in Denmark, and will likely create a long series of court cases.

Denmark has long been an ugly stepchild when it comes to civil liberties online, giving the copyright industry basically everything they want in their efforts to prop up a crumbling distribution monopoly at the expense of any and all liberties. Denmark was the first country to re-introduce governmental censorship just to censor The Pirate Bay off the net, it was where the copyright industry’s plan was devised to use horrifying child abuse imagery as a battering ram against net neutrality, with the end goal of censoring any and all sites they felt threatened their established analog-era business.

Partially as a result of this, some of the more innovative legal defenses also popped up in Denmark first, among them the open wireless defense, which states that you can’t be held liable for something that happened on your open wireless network. When the first case of this type was ruled on by a court, extortion letters in Denmark from the copyright industry and their troll lawyer armies dried up overnight.

Regardless, the extortion attempts have continued against people sharing knowledge and culture with each other — which, in the eyes of public perception, is not and should not be a crime. This is one of the areas where public perception of justice collides hardest with the old analog world which insists on maintaining its analog privileges at any cost to society and the digital generation’s liberties.

And so, in the past year alone, the demands on Denmark’s ISPs to identify subscribers have risen by 250 per cent, according to Danish ITWatch.

On April 26, the Supreme Court in neighboring Norway ruled that the telecoms provider Telenor is not under any obligation to surrender identifying information to the copyright industry, justifying its ruling that simple sharing of culture and knowledge was not nearly aggravating enough to breach the telecommunications privacy.

Last week, after this ruling in the neighboring country, the Danish Internet Service Providers are collectively putting their foot down and not giving the copyright industry’s trolls who engage in so-called “speculative invoicing” — an action that would be prison-time criminal in any other industry — any more time of day. The ISP have decided that their customers are more important to them than obeying the tantrums of an obsolete distribution industry on its last legs.

What’s really puzzling is how ISPs could even consider it any other way; at any other time or in any other place — not standing up for your customers, and taking their enemies’ side instead, is simply not very good business.

Regardless, the ISPs will still have your identity and may be compelled by a court of law to surrender it, which is why a no-log VPN (or a no-log ISP, if you can find one) remains a very good defense.

Syndicated Article
This article was previously published at Private Internet Access.

(This is a post from Falkvinge on Liberty, obtained via RSS at this feed.)