[00:00.000 --> 00:02.080]  ...one can do about it.
[00:02.200 --> 00:16.860]  But what they actually do is interesting, and it creates a kind of collision between needing to understand the technology and needing to understand the law and policy issues that are really subtle and interesting here.
[00:17.440 --> 00:31.220]  So, you know, this is going to be very much focused on, in 2014, what are some of the open technological, legal, and policy questions related to tracking mobile devices?
[00:31.440 --> 00:33.840]  And how does it actually work?
[00:34.160 --> 00:37.800]  So, first of all, when we say mobile devices, what are we talking about?
[00:38.260 --> 00:58.200]  So, essentially, mobile devices, for our purposes here, are computers that have a couple of special features that make them particularly interesting from the point of view of tracking and make them particularly important from the point of view of protecting or violating your privacy.
[00:58.220 --> 01:01.900]  The first property of a mobile device is that it's mobile.
[01:02.040 --> 01:05.120]  You carry it around with you, very often everywhere.
[01:06.800 --> 01:12.220]  And, you know, the mobile phone is sort of the classic example of this thing that we're really...
[01:12.740 --> 01:19.480]  You know, people would sooner leave their house without their keys or their pants than without their phones, right?
[01:19.480 --> 01:24.240]  These devices have lots of sensors crammed into them.
[01:24.480 --> 01:28.160]  They know a lot about what their environment is.
[01:28.400 --> 01:32.600]  In particular, these devices themselves generally know where they are.
[01:32.780 --> 01:36.400]  They generally have GPS units.
[01:36.400 --> 01:40.020]  They generally have directional sensors like compasses and so on.
[01:40.640 --> 01:47.320]  And they have the capability of transmitting signals to the outside world in a number of different ways.
[01:47.460 --> 01:50.740]  They have a cellular phone transmitter.
[01:50.740 --> 01:53.760]  They often will have cellular data services.
[01:54.080 --> 01:55.360]  They often have Wi-Fi.
[01:55.540 --> 01:56.420]  They often have Bluetooth.
[01:56.800 --> 02:02.580]  And they often have other things that they may... that you may or may not even be aware are existing.
[02:02.580 --> 02:14.080]  And then finally, mobile devices have this property that they... much more than the computers that we as hackers sort of grew up learning about.
[02:14.340 --> 02:26.800]  These are much more heavily tied to network-based services of various kinds provided by various places than other kinds of computing devices that we use.
[02:26.900 --> 02:29.700]  These devices are designed to be online.
[02:29.700 --> 02:39.480]  And not only are they designed to be online, they're designed to be online in multiple ways in order to function the way we expect them to function.
[02:40.200 --> 02:50.800]  Now, you know, at one end of the spectrum, we have old-fashioned, you know, dumb mobile phones, phones that don't have touch screens that you can't run apps on and so on.
[02:51.160 --> 02:59.980]  And, you know, these have, you know, have been kind of upgraded to include more computational capability, smart phones, tablets.
[03:00.840 --> 03:03.660]  And then there's this idea of the Internet of Things.
[03:04.600 --> 03:15.580]  Your car likely contains a number of mobile devices, very often that have been subscribed to, with different services on your behalf, when the car was built.
[03:15.860 --> 03:21.180]  And you may not have any direct relationship that you know about with the service provider that's providing them.
[03:21.180 --> 03:24.540]  And it's, you know, driving around with you everywhere you go.
[03:24.760 --> 03:33.460]  Your toaster and your refrigerator and so on will soon be followed, although your refrigerator is a little less mobile than your car is.
[03:33.560 --> 03:33.860]  Unless it's running.
[03:34.220 --> 03:34.500]  Right.
[03:34.640 --> 03:35.460]  Unless it's running.
[03:35.640 --> 03:35.800]  Yes.
[03:35.920 --> 03:36.280]  Very good.
[03:36.480 --> 03:37.000]  Okay.
[03:37.160 --> 03:37.500]  Okay.
[03:37.520 --> 03:40.160]  You get the worst joke of the conference award.
[03:40.800 --> 03:41.320]  Okay.
[03:41.900 --> 03:56.220]  So let's go to kind of some very oversimplified, how phones work kind of a baseline understanding the basic cellular technology.
[03:56.500 --> 04:08.000]  So basically your phone handset, this device, is essentially a fairly low power because its battery has to last a long time.
[04:08.000 --> 04:13.840]  And there are also, you know, health, maybe health effects from zapping you with high levels of microwave radiation.
[04:13.840 --> 04:31.180]  So it's inherently a low power device that has a crappy antenna, making it effectively an even more low powered two-way radio that you expect to have universal connectivity pretty much everywhere you go.
[04:31.600 --> 04:45.280]  So to make up for the fact that the range of your mobile phone is inherently very limited, it can only reach, you know, maybe a mile or so under even the most ideal circumstances.
[04:45.280 --> 04:51.300]  And in an urban area with lots of obstructions around it, considerably less than that.
[04:51.740 --> 05:19.860]  The cellular carrier has to build out a network of towers, which are called cell sites, that have essentially a connection to the back infrastructure, to the telephone network, to their network, such that there are... there is a tower, a cell site, within range of your phone wherever you want to take it.
[05:19.860 --> 05:27.040]  And, you know, the term cellular phone, which is more commonly used in the US, in Europe, they call them mobile phones.
[05:28.080 --> 05:39.680]  But the term cellular phones comes from the idea that you think of these ranges of the towers as cells that are adjacent to each other, tiled across a map.
[05:39.940 --> 05:44.720]  And you're in one particular cell at any time that has the best coverage of your phone.
[05:44.720 --> 05:53.760]  So essentially, a mobile phone company is primarily in the real estate business, to rent these tower locations to put their cell sites in.
[05:54.420 --> 06:04.400]  And your handset is essentially looking for the cell tower that's broadcasting a signal, and you're also broadcasting a signal.
[06:04.540 --> 06:17.140]  And you figure out which of these cell sites is within range, and which has the best signal coverage where you are at any given moment, and registers with that.
[06:17.820 --> 06:20.180]  Now, it has to do that in order to work.
[06:20.620 --> 06:28.520]  It has to do that even when you're not making a phone call, because that's the mechanism that your phone relies on in order to be able to receive calls.
[06:28.700 --> 06:33.880]  We have to know where you are in the network in order to know where to route an incoming call to you.
[06:33.880 --> 06:49.520]  So what this essentially says is that right off the bat, this device is at least doing some sort of course tracking of your location, because it has to in order to work that way.
[06:49.640 --> 06:58.780]  We know what cell you're in, because that information has to be recorded with the cellular provider in order to route incoming calls to you.
[06:58.780 --> 07:01.860]  And as you move around, you're re-registering with different cells.
[07:01.980 --> 07:04.760]  It's generally the one that's nearest you.
[07:04.920 --> 07:13.700]  And that essentially list of registrations identifies where you are within the radio range of your phone.
[07:14.200 --> 07:17.520]  So that's the sort of oversimplified version of this.
[07:17.640 --> 07:19.020]  How many people knew that already?
[07:19.160 --> 07:22.680]  Well, if I could see anything, I'd imagine everyone's raising their hand right now, right?
[07:22.800 --> 07:24.180]  This is... but I can't see a thing.
[07:24.320 --> 07:27.340]  So I'm just going to pretend that everybody... that there are people in the room.
[07:27.340 --> 07:29.900]  I assume all of you have taken your clothes off or something.
[07:30.080 --> 07:31.700]  I just cannot see a thing up here.
[07:32.000 --> 07:32.400]  Okay.
[07:33.520 --> 07:33.920]  The...
[07:35.400 --> 07:35.800]  So...
[07:36.920 --> 07:39.040]  This is sort of the oversimplified version.
[07:39.280 --> 07:41.820]  So you might say, okay, well, I can live with that, right?
[07:41.980 --> 07:46.680]  The radio range of my phone is maybe a mile, so that means I'm within a one-mile radius of this.
[07:46.840 --> 07:49.520]  This thing can only track me within about a mile, right?
[07:49.640 --> 07:55.200]  Because that's... you know, the cell companies, of course, want to economize.
[07:55.200 --> 07:57.820]  They're primarily in the real estate business.
[07:58.020 --> 08:05.580]  They want to economize on how many of these expensive towers they have to put up and all this expensive space that they have to rent.
[08:05.840 --> 08:11.480]  And they're going to want to get away with putting as few of those up as they possibly can.
[08:11.580 --> 08:21.540]  And what you might say is, well, we should put them up so that their distance is essentially the typical radio range of one of these phones, and that's a mile or two apart from each other.
[08:21.940 --> 08:31.220]  And so that's the limit of the resolution of the tracking that these kinds of devices do as you're registering with the network.
[08:31.520 --> 08:43.460]  But it turns out that now that everyone has one of these things, the radio range is not the limiting factor of how close or how far apart you can get away with having these.
[08:44.640 --> 08:59.860]  If... because everybody wants one of these devices, and because the amount of radio spectrum allocated to cellular and mobile phone services is inherently a scarce resource.
[08:59.860 --> 09:06.100]  There's a limit to how much of it there is, and we're using more of it than there are users.
[09:07.660 --> 09:17.220]  And we're demanding more and more high bandwidth services to take up that limited amount of radio spectrum.
[09:19.160 --> 09:35.900]  The capacity of a cell tower is reached, particularly in any kind of populated area, well, well before the radio range radius would say you'd have to build another one.
[09:36.060 --> 09:44.640]  So you're going to reach all of the radio spectrum capacity for a cell tower within a much, much smaller...
[09:44.640 --> 09:51.580]  within all the users within a much, much smaller radius than you would if you were just looking at the radio range.
[09:51.680 --> 09:55.640]  And in fact, what that means is that how do you deal with this?
[09:55.640 --> 09:59.780]  Well, there's... we could get more spectrum, but we've kind of reached the limit of that.
[09:59.920 --> 10:06.140]  They keep auctioning off more by trying to steal it away from television stations and public safety users.
[10:06.320 --> 10:11.860]  But, you know, we can auctions... we can't auction off spectrum fast enough to meet the demand.
[10:12.020 --> 10:12.820]  So what do you do?
[10:13.580 --> 10:20.660]  Well, what do you have to... what you have to do is have each of these towers serve fewer users.
[10:20.660 --> 10:22.260]  But everybody wants one.
[10:22.420 --> 10:23.920]  So how do you deal with this?
[10:24.040 --> 10:25.700]  Well, you put more towers in.
[10:25.820 --> 10:33.600]  You make the density of these cell sites closer and closer spaced together.
[10:33.800 --> 10:43.220]  So that instead of a one-mile radius, it's going to have a small enough radius to be able to serve the users that are within range of this.
[10:43.220 --> 11:11.760]  So what effectively this means is that because everyone has one of these things, your location that's revealed by pairing with the nearest cell tower is going to be a much higher resolution, a much finer grained resolution than it was, you know, 20 years ago when cell phones were this sort of luxury item that rich,
[11:11.780 --> 11:13.820]  self-important people had.
[11:13.900 --> 11:16.380]  Now everyone is a rich, self-important person.
[11:16.620 --> 11:20.880]  And what that means is that we're tracked as a sort of side effect of that.
[11:21.040 --> 11:24.300]  We're tracked with much more high resolution when we do this.
[11:24.440 --> 11:29.240]  How many of you have heard of the term microcell or nanocell or picocell?
[11:29.240 --> 11:34.340]  Basically, these are cells that are getting smaller and smaller and cheaper and cheaper.
[11:35.020 --> 11:43.480]  Microcells are typically the term used for a cell site that's designed to serve a small public area.
[11:44.000 --> 11:48.360]  Like, you know, this hotel, no doubt, has several microcells in it.
[11:48.480 --> 11:51.540]  Penn Station across the street has microcells in it.
[11:51.660 --> 11:56.280]  It's sort of small areas within high-demand usage areas.
[11:56.280 --> 12:00.720]  Sometimes, you know, a floor or part of a floor of a building will be served by this.
[12:00.900 --> 12:03.740]  Then there are these nanocells and picocells.
[12:03.800 --> 12:06.280]  They're not quite precisely defined.
[12:06.560 --> 12:18.620]  But these are cells that they basically convince you will give you better cell coverage in your house in exchange for being able to use some of your upstream broadband bandwidth to serve cell calls.
[12:18.620 --> 12:22.340]  So, this is a little cheap device, and sometimes they even make you pay for it.
[12:22.860 --> 12:42.200]  A little cheap device that serves a really small area that you and possibly, depending on the policy of the service provider, will share with essentially the general public, that reveals that anybody who's paired with this particular small cell is really close to this,
[12:42.340 --> 12:46.100]  like in your house or very near your house.
[12:46.340 --> 12:46.720]  Okay.
[12:46.960 --> 12:55.420]  So, the cellular infrastructure itself is starting to identify us in closer and closer ways.
[12:55.420 --> 13:01.000]  And that trend is only going to continue more and more and more and more.
[13:01.820 --> 13:11.140]  Because the, you know, the one thing we can grow essentially by manufacturing and deploying more of these things is cell sites.
[13:11.280 --> 13:12.240]  We can't grow spectrum.
[13:12.440 --> 13:18.900]  We can't encourage people to use less bandwidth as we're building more high bandwidth services.
[13:18.900 --> 13:25.980]  Unless there's an apocalypse and people just stop using cell phones, we can kind of expect this trend to greatly accelerate.
[13:26.660 --> 13:27.240]  Okay.
[13:27.340 --> 13:29.580]  So, let's look at what's in your phone.
[13:30.080 --> 13:36.860]  So, there are a large number of radios and sensor devices in your phone.
[13:37.320 --> 13:50.100]  The most obvious is the cellular radio that communicates with the carrier that you get your service from, the AT&T or the T-Mobile or the Verizon.
[13:51.060 --> 13:56.720]  You know, usually you get a boo at this point when you mention them because nobody likes their cellular service provider.
[13:56.900 --> 13:58.140]  But they're all terrible.
[13:58.740 --> 14:17.880]  But, you know, your phone has a radio that's communicating with the nearby tower, and that's used for conventional voice telephone calls and also for whatever data service is carried over that, whether that's the old Edge network or 3G or 4G or LTE or what have you.
[14:18.060 --> 14:24.180]  So, we've already discussed how your phone is constantly announcing itself to the nearest infrastructure.
[14:24.700 --> 14:39.820]  Throughout the day, as you're using this, you're just kind of saying, hey, here I am, and they know who you are because you're sending them a check every month or they're charging your credit card every month in all likelihood, unless you've gone out of your way to act like a criminal.
[14:40.920 --> 14:45.900]  All right, then there's a Wi-Fi radio in your phone.
[14:46.460 --> 14:48.300]  And what is the Wi-Fi doing?
[14:48.440 --> 14:55.900]  Well, it's trying to connect to the nearest hotspot, which may be in your home, the one for your home wireless network, or it may be some public infrastructure.
[14:55.900 --> 15:08.320]  But anytime the Wi-Fi radio is on, you're constantly announcing yourself to all of the nearby wireless space stations, no matter who happens to be providing them.
[15:08.500 --> 15:14.960]  So, you're announcing yourself to basically anybody with a Wi-Fi router in the area.
[15:15.180 --> 15:22.360]  Now, most Wi-Fi routers are just kind of throwing this information out, but that doesn't mean you're not actually announcing it and they don't know.
[15:22.360 --> 15:33.360]  It's typically staying inside the routers that are listening to this in most places, maybe, unless somebody is trying to track who's nearby that way.
[15:34.220 --> 15:52.580]  And then there's the Bluetooth radio, which has a little bit of a smaller range than the typical Wi-Fi, but it's also announcing itself basically to every other Bluetooth device that's within range of it, as it's being used and as you're moving around.
[15:54.180 --> 16:02.740]  And then finally, virtually every cell phone, whether it's exposed or not lately, has a GPS device in it.
[16:03.180 --> 16:07.560]  GPS uses satellites to calculate its own location.
[16:07.820 --> 16:18.060]  The good news here is that this is the one radio in your phone that doesn't actually have a transmitter associated with it.
[16:18.060 --> 16:39.400]  This is essentially only calculating where your location is based on received signals from the satellite, where it does these little clever time difference of arrival calculations, so that your phone can figure out where on Earth it is, without having to actually explicitly go out and send a signal to anyone.
[16:39.580 --> 16:42.500]  This is one of the areas where the people with the tinfoil hats are wrong.
[16:42.740 --> 16:45.380]  The GPS satellites aren't the thing that's tracking you.
[16:45.380 --> 16:46.980]  There are other things that are tracking you.
[16:48.460 --> 16:49.020]  Okay.
[16:49.340 --> 16:58.740]  So let's look at now what your phone itself, what your handset, your mobile device, knows about where it is on Earth.
[16:59.960 --> 17:04.620]  Well, one thing it knows is what cell tower it's registered with.
[17:05.660 --> 17:13.800]  And, you know, as we discussed, the precision and accuracy of that depends on the density of the towers.
[17:13.800 --> 17:23.940]  You're typically registered with the nearest and how fine the resolution of that is depends on how dense the area is, but it's getting denser and denser and denser.
[17:24.020 --> 17:30.220]  And in some cases, it's better than GPS, particularly when you're indoors where GPS doesn't work.
[17:31.460 --> 17:35.140]  Then there's a GPS calculation that it can do.
[17:35.280 --> 17:40.920]  And that's three-meter accuracy with a bunch of asterisks next to it.
[17:41.000 --> 17:48.460]  The most important is that you have to be within view of a few satellites, typically three if you don't care about altitude.
[17:48.980 --> 17:55.700]  And that means usually you have to be outdoors or really near a window with the satellites in a good location.
[17:55.700 --> 18:05.040]  It also knows what Wi-Fi hotspots are nearby if you've got a phone with 802.11 capability in it.
[18:05.580 --> 18:26.860]  And that turns out to be a really interesting and powerful way of geolocating phones, because the hotspots, the base stations in Wi-Fi networks, the one in your house and the one in Starbucks and the one in the Hotel Pennsylvania, all are sending out unique identifying beacons of their own.
[18:27.100 --> 18:37.380]  And your phone can look at which hotspots, which routers it sees nearby and say, oh, I'm near that one, and figure out what the location of that place is.
[18:37.620 --> 18:42.860]  Typically, it will ask for some help in order to figure out how to turn that onto a map.
[18:43.400 --> 18:56.180]  And then you can take kind of all of these different location tracking techniques and get a really surprisingly high-resolution picture of where you are.
[18:56.340 --> 18:59.740]  If you... and I don't recommend you do this, because they'll know.
[19:00.060 --> 19:11.840]  But if you wanted to, you know, take your Android or iPhone or whatever and put up the Google or Apple Maps, well, Apple Maps will be inaccurate, because, you know, they think that the... think we're in Boston or something.
[19:12.320 --> 19:17.200]  But the... if you put up, like, Google Maps on your phone, you're inside a room.
[19:17.360 --> 19:30.280]  It can show you where in the building you are with a pretty high... you know, it kind of knows you're in this room because there's a unique hotspot in this room that you can identify with.
[19:30.340 --> 19:35.060]  And I actually tried this in this room the other night and kind of got a little bit freaked out about this.
[19:35.160 --> 19:39.620]  So let's look at what others can learn about where you are.
[19:39.880 --> 19:54.280]  Well, we already discussed how the cellular carrier knows which cell sites you're registered with throughout the day, even when you're not making a call, because it has to keep track of this information in order to know how to route calls for you.
[19:54.340 --> 20:02.740]  As long as your phone is on and the cellular radio is on, you're not in airplane mode, this is constantly registering with these locations.
[20:02.740 --> 20:07.480]  And so the cell phone company is in a position to track that.
[20:07.800 --> 20:16.680]  Now, your Wi-Fi and Bluetooth radios are constantly announcing their Mac address to anybody within range.
[20:16.680 --> 20:22.740]  And this address is typically not something that most users ever change.
[20:22.740 --> 20:33.300]  So it's essentially a persistent identifier for your phone, unless you've taken some steps to change it from time to time.
[20:33.940 --> 20:50.520]  Now, using Wi-Fi-based location services further reveals your location to whatever platform provider, like Google or Apple, is using that to help locate you using Wi-Fi.
[20:50.680 --> 20:57.300]  You know what the identity... you know what the Mac address of the nearest hotspots are, but what you don't know is where on earth they are.
[20:57.440 --> 21:01.700]  Well, they've driven around and mapped that out conveniently for you.
[21:01.760 --> 21:16.200]  And if you simply tell it which ones you are in range of, which the phones are essentially programmed to do periodically, they will happily tell you what your map coordinates are so that you can display your location.
[21:16.200 --> 21:23.740]  But, of course, in the process, you have told them... your phone software has told them where you're located.
[21:23.960 --> 21:31.520]  So Google and Apple and so on, when your Wi-Fi radio is on and you're using location services, know where you are.
[21:31.680 --> 21:35.980]  They're also typically combining that with information from the cell radio about what towers you're near.
[21:36.100 --> 21:42.420]  So that when you go out of range of a hotspot, you still have that as a fallback.
[21:44.200 --> 21:45.940]  So what do we have now?
[21:46.040 --> 21:51.240]  Well, now we have everybody with a Wi-Fi router, everybody with a Bluetooth device who you get near.
[21:51.800 --> 22:08.220]  Your cellular provider and, you know, Google or Apple or whoever is your platform provider of your phone is getting helpful constant updates about what your movements are just by virtue of having your phone be on with its data services on.
[22:08.880 --> 22:18.540]  Now, if you connect over the Internet, of course, you get assigned an IP address, either by the Wi-Fi hotspot or by your cellular data service.
[22:18.740 --> 22:25.040]  And that IP address can be mapped back to location information, typically by whoever you happen to connect to on the other end.
[22:25.280 --> 22:34.920]  Possibly they'll need some cooperation from a provider to get it, but that information is now, you know, is now something that exists and can be obtained.
[22:35.360 --> 22:54.840]  And then, of course, you have the application economy on mobile devices, which, as best as I can tell, is based on the whole ecosystem, is based on getting you to install apps with dancing frogs on them in exchange for trying to steal as much of your personal information as possible.
[22:54.840 --> 23:02.940]  And they're leaking information back to, you know, Angry Birds headquarters, you know, constantly throughout the day.
[23:03.140 --> 23:03.300]  Sorry?
[23:03.960 --> 23:04.360]  Not...
[23:06.700 --> 23:09.080]  There's a flashlight app that steals your location.
[23:09.080 --> 23:14.220]  And if you turn off, do you want us to steal your location, you can switch that to off, and then it turns out they were doing it anyway.
[23:16.260 --> 23:18.440]  So, you can't even trust your flashlight.
[23:19.380 --> 23:22.100]  Okay, so let's, well, let's ask, what about the government?
[23:22.100 --> 23:29.720]  So, there are a few questions to ask when we think about, well, how much government and law enforcement tracking is going on here?
[23:29.900 --> 23:37.720]  And the first thing that we have to do is distinguish between intelligence agency data collection and law enforcement data collection.
[23:38.100 --> 23:40.300]  And that's going to turn out to be an important distinction.
[23:40.520 --> 23:45.920]  We're learning a lot about what intelligence agencies are doing, thanks to that guy who opened for me earlier.
[23:48.340 --> 23:50.600]  But that's not really our focus here.
[23:50.600 --> 23:54.740]  One question is wholesale versus targeted.
[23:54.920 --> 24:01.580]  What are they getting about everyone versus what do they have to ask specifically about a target in order to get?
[24:02.040 --> 24:19.380]  We might also distinguish between things that are real time versus things that can only be done for the target in the future, after they've been identified in the target, versus things that can be done looking back in the past about where a target has been.
[24:20.160 --> 24:32.000]  We might look at call metadata as something that might be tracked, versus location data that might be tracked, versus actual content of communication that might be tracked.
[24:32.120 --> 24:36.020]  That might be a way to divide up how intrusive different things are.
[24:36.180 --> 24:45.460]  We might look at what can be done unilaterally by a government agency, versus what requires the cooperation of a third-party, such as a cellular carrier.
[24:45.460 --> 25:10.680]  And we might look at the legal standards that govern them before they can do this, which it turns out range from someone is curious, to a subpoena is issued based on some standard, such as relevance to an investigation, versus what everyone kind of grew up thinking is the standard for getting this sort of information,
[25:10.680 --> 25:12.640]  which is a probable cause warrant.
[25:13.000 --> 25:17.040]  Okay, so let's spend a couple of minutes looking at what intelligence agencies do.
[25:17.360 --> 25:19.260]  So Snowden has told us some stuff here.
[25:20.780 --> 25:24.240]  The first was the 215 program, which was interesting.
[25:24.780 --> 25:41.300]  All call detail records in phone companies, basically the records of all phone calls made by just about all the phone companies, with a couple of little exceptions, were required to deliver daily to the U.S. government, the FBI heading on their way to the NSA, for everybody.
[25:44.220 --> 26:01.040]  So if you are a phone subscriber in the US, all of your call detail records were essentially sent to the FBI and the NSA from sometime shortly after September 11, 2001, through the present and beyond.
[26:01.700 --> 26:09.360]  And this may or may not include location information, the tower, the cell site that you're in.
[26:09.460 --> 26:15.400]  It's unclear whether these records with location information were delivered.
[26:15.400 --> 26:29.080]  It appears to be variable based on the particular phone company's interpretation of what they were supposed to send, but there really hasn't been solid information about whether it's universally supposed to be there.
[26:29.180 --> 26:38.120]  The government has explicitly denied that they get the location, but then if you look at the words, they're subject to an enormous amount of incredibly careful parsing, surprisingly.
[26:40.000 --> 26:57.160]  Then there's the cable-tapping program that we learned about actually before Snowden, when an EFF whistleblower literally walked into the EFF office and said, look, there's this secret room in the San Francisco Central Office where the NSA is tapping all the fiber optic cables.
[26:57.340 --> 27:03.380]  And when they looked to find out that no one was missing from any of the local mental institutions, it turned out he was right.
[27:04.540 --> 27:11.800]  And now, that turns out to happen at just about all of the cable landings, or near all of the cable landings.
[27:11.960 --> 27:19.940]  But it... so it's supposedly focused on international traffic, but it seems to pick up some domestic U.S. traffic.
[27:20.140 --> 27:29.660]  And that basically exposes not just call metadata, but also potentially content of anything that happens to go through those particular locations.
[27:30.200 --> 27:46.920]  We learned something about handset malware implants, which is a kind of scary-sounding term, that can load malware into your phone in order to put it under the control of a government agency.
[27:47.180 --> 27:55.840]  One particularly interesting thing that a piece of malware like this might do is affect what the off switch does if you're targeted.
[27:56.060 --> 28:00.300]  Chances are this is only being done on some kind of targeted basis.
[28:00.300 --> 28:10.380]  It doesn't appear to be done on every phone, but they certainly have very, very sophisticated capabilities along these lines.
[28:10.640 --> 28:11.760]  I've been giving this talk to you now.
[28:11.820 --> 28:12.860]  Are you now on the target list?
[28:13.640 --> 28:14.280]  Who knows?
[28:14.380 --> 28:15.200]  Anybody want a phone?
[28:16.560 --> 28:17.600]  Maybe we should trade.
[28:18.820 --> 28:27.180]  It looks like there's some leakage from what the intelligence agencies are doing into domestic law enforcement, which I'll talk about later.
[28:27.180 --> 28:37.440]  But mostly these seem to be limited to intelligence, rather than being used for traditional domestic U.S.
[28:37.600 --> 28:42.060]  law enforcement investigations, with a couple of exceptions that we'll get to later.
[28:42.600 --> 28:46.620]  Okay, so let's get to where we really want to focus on this.
[28:46.700 --> 28:48.720]  So law enforcement is a little more constrained.
[28:48.740 --> 28:55.260]  I'm calling that L-E in order to save a few syllables and also to add some unnecessary acronyms here.
[28:56.240 --> 29:00.500]  Law enforcement has limited budgets relative to the intelligence community.
[29:00.760 --> 29:05.360]  It's most overwhelmingly state and local, rather than federal.
[29:05.940 --> 29:14.920]  And they also need to collect legally admissible evidence in court, which means they may have to ask questions about how that evidence was obtained.
[29:14.920 --> 29:29.400]  And again, there's some evidence that they do get some information from the federal government, in particular the DEA's hemisphere program, but that seems to be the exception rather than the rule.
[29:29.720 --> 29:42.380]  Mostly, law enforcement is doing relatively small scale and relatively in different ways targeted technologies for tracking mobile devices.
[29:42.380 --> 30:00.800]  They have things like looking at call detail records, doing something called a pen register and trap and trace, getting content wiretaps, which is sort of what we think of when we think of wiretaps, E911 services, which I'll get to in a second, something called a tower dump,
[30:00.820 --> 30:09.420]  which sounds very unpleasant, and devices like stingrays, which are also called MSI catchers.
[30:09.780 --> 30:15.560]  And then finally, they occasionally seem to have the increasing capability to target handsets with malware.
[30:15.800 --> 30:19.020]  So let's look at some of these more targeted techniques.
[30:20.340 --> 30:32.040]  Every time you make or receive a phone call, the carrier creates a billing record associated with that call called a call detail record.
[30:32.480 --> 30:49.580]  And essentially a call detail record is a record associated with your phone account that gives the number you called or that called you, the duration of the call, the time that the call happened, and which cell site you were registered with.
[30:49.580 --> 30:54.260]  So essentially this is a record of your location when you placed the call.
[30:54.380 --> 31:03.400]  And depending on the carrier, maybe when the call ended and maybe throughout the call as you roam, but certainly when the call is initiated.
[31:03.860 --> 31:11.380]  And these records are a subset of the records of the information that the phone company has.
[31:11.560 --> 31:21.080]  They know where you are even when you're not making or receiving a call, but they create this special kind of record called a call detail record any time your phone gets used.
[31:21.500 --> 31:23.260]  And these are maintained for a while.
[31:23.460 --> 31:27.860]  18 months is the legal minimum that they have to maintain this for.
[31:28.360 --> 31:32.240]  And, you know, really what that means is, you know, this is data.
[31:32.440 --> 31:33.600]  Data is free to save.
[31:33.760 --> 31:35.720]  It's more expensive to throw out than to save.
[31:35.900 --> 31:39.160]  And I think it's safe to say that, you know, everybody keeps them forever.
[31:39.420 --> 31:43.480]  These are useful for business reasons for the phone companies.
[31:43.480 --> 31:52.500]  But because it's an official record, it's straightforward legally for law enforcement to make use of call detail records for targets.
[31:52.760 --> 32:04.220]  So a law enforcement agency can request of a carrier the call detail records for some period of time for some user who is of interest to an investigation.
[32:04.220 --> 32:11.100]  And the standard for obtaining this, and I'm not a lawyer, but I'm not going to let that stop me from making stuff up about the law.
[32:11.360 --> 32:15.320]  The standard for this is relevance to an investigation.
[32:15.320 --> 32:25.420]  And that's a very low standard, but it requires that you as a target be specifically identified as being relevant to an investigation.
[32:25.420 --> 32:33.760]  And essentially, they take the agents and the agency's word for whether you are, but they have to basically declare this.
[32:34.520 --> 32:45.440]  Now, it's unclear whether the call detail records given in response to this kind of request will include location information.
[32:46.780 --> 32:49.300]  This appears to be unsettled law.
[32:50.320 --> 32:56.340]  Different courts have different practices, different law enforcement agencies interpret this differently.
[32:56.580 --> 33:02.700]  In some cases they do, and in some cases they don't, based on this sort of relevance to an investigation standard.
[33:02.920 --> 33:09.420]  They may only get the calling numbers and the times, or they may get the location information.
[33:09.420 --> 33:17.680]  And, you know, this is an opportunity for Congress or the courts to give us some clarity on this that does not yet exist.
[33:18.100 --> 33:23.760]  Okay, now, generally, the records are specifically the official call detail records.
[33:24.380 --> 33:34.900]  When a law enforcement agency asks for call detail records, they don't get the list of the cell sites you were at when you weren't making or receiving a call, even though the phone companies have that information.
[33:34.900 --> 33:41.700]  And it may be that the reason that they don't get those records is they haven't figured out how to properly ask for them yet.
[33:42.100 --> 33:46.480]  But the typical practice is to get the call detail records.
[33:46.620 --> 33:47.540]  Now, let's look at what this is.
[33:47.680 --> 33:59.960]  This is a record that they have that retrospectively can be obtained by anyone for their calls in the past, whether you were a target... whether they knew you were a target at the time you made those calls or not.
[34:00.680 --> 34:10.280]  Everybody has call detail records on them, and these can be requested within, you know, 18 months or possibly more for anyone who becomes relevant to an investigation.
[34:10.280 --> 34:14.220]  So this can look back in the past at what your previous activity was.
[34:14.420 --> 34:20.360]  If we want to go into the future, there's something called a pen register or trap and trace.
[34:20.520 --> 34:24.980]  These terms are based on old-timey telephony technology.
[34:26.760 --> 34:33.940]  Essentially, this is like a call detail record, but real-time and perspective going forward.
[34:34.380 --> 34:50.320]  They get real-time... the law enforcement agency gets real-time delivery of all of the calls you make or receive, possibly again with your location, but this is unsettled law, with each call that you make.
[34:50.320 --> 35:02.200]  And there's a standard interface that the phone companies have called the CALEA interfaces, for delivering this to law enforcement agencies in real-time once it's set up and provisioned.
[35:02.340 --> 35:10.920]  Now, this is more expensive than a records... called detail records request, because it involves this real-time delivery, so they're used a little bit less.
[35:11.080 --> 35:14.660]  But the legal standard is very similar to getting past records.
[35:16.160 --> 35:18.220]  This is a wiretap box.
[35:18.340 --> 35:23.440]  This is a single-line wiretap box, just to kind of give you what it looks like.
[35:23.440 --> 35:32.700]  And this can be used for collecting call detail records or doing what we call a full-blown Title III wiretap, where they're also getting the call content.
[35:33.760 --> 35:44.080]  And again, the same interface is used as for trap and trace, but it's provisioned differently to include call content audio when you do this.
[35:45.040 --> 35:53.420]  And when they get one of those, they're also definitely getting cellular location when you're using a cell phone delivered along with this.
[35:53.540 --> 35:56.180]  This has a high legal standard to get.
[35:57.440 --> 36:04.120]  It essentially requires a probable cause warrant, plus a couple of additional hurdles.
[36:04.120 --> 36:13.160]  They have to demonstrate or at least assert that other investigative techniques would not get the evidence that they're seeking in order to do this.
[36:13.340 --> 36:15.340]  This is a fairly high standard.
[36:15.960 --> 36:19.160]  And, you know, it's also an expensive process.
[36:19.400 --> 36:22.100]  You'll notice there's a big red button on the front of the box.
[36:22.300 --> 36:33.280]  Someone has to actually be sitting there listening to the calls in real time and be ready to push the big red button marked minimize when something non-pertinent happens.
[36:34.260 --> 36:43.680]  And so this means that wiretaps not only have a higher legal standard when they have call content audio, they also are a little more expensive to implement.
[36:44.360 --> 36:47.440]  Then there's something called E911 pinging.
[36:47.440 --> 37:08.360]  The FCC mandated about 20 years ago, and it's been rolled out pretty completely within the last 10 years, a service called E911 that mandates that when you call 911, the 911 call center can get with very high accuracy the location of the handset.
[37:08.360 --> 37:17.060]  So that when you call and say, help, help, I'm, you know, in a room full of people and the lights are out, they will know where you're located.
[37:17.340 --> 37:32.480]  This uses a variety of technologies, including handset-based GPS, which is why just about every phone has a GPS unit in it, and also tower triangulation with multiple nearby towers and time difference of arrival.
[37:33.140 --> 37:39.420]  Essentially, there's some cooperation with the handset through a standard interface to implement this.
[37:39.840 --> 37:45.420]  But interestingly, it doesn't actually require a 911 call in order to be triggered.
[37:45.940 --> 37:54.780]  The carrier can trigger this essentially for any phone at any time, including at law enforcement requests.
[37:54.880 --> 38:04.760]  There's a service that they will provide to law enforcement where they will say, ping us, you know, Matt's phone and tell us what the E911 data is on that.
[38:04.760 --> 38:05.400]  All right.
[38:05.580 --> 38:15.380]  Now, what we've looked at so far were kind of standard wiretapping techniques, which should, you know, make you think, all right, I'm being tracked everywhere I go.
[38:16.000 --> 38:26.800]  But you might say, if I'm not actually a suspect in a crime or relevant to an investigation, as long as I stay out of trouble, I'm okay here.
[38:28.640 --> 38:30.560]  Because I have to be targeted.
[38:30.560 --> 38:33.020]  I have to be identified as a target.
[38:33.020 --> 38:37.620]  And that's an important safeguard for kind of all of the things that we've just discussed.
[38:37.800 --> 38:49.460]  But it turns out there are also techniques that don't get targeted based on the identity of the subscriber, but that are targeted based on where your phone happens to be.
[38:50.820 --> 38:57.680]  The most prominent of these that we've learned about recently is something called a tower dump.
[38:58.300 --> 39:01.700]  This is a standard service to law enforcement agencies.
[39:01.700 --> 39:06.720]  We know about it thanks to a 2011 ACLU public records request.
[39:07.340 --> 39:09.560]  It wasn't really widely known before.
[39:09.740 --> 39:14.540]  It's still not that widely known even to all law enforcement agencies that they can get this.
[39:15.300 --> 39:24.540]  Thanks particularly to Tucson, Arizona, they had really great records about, like, what the prices are from the different carriers and how cooperative the different carriers are.
[39:24.720 --> 39:28.260]  So the ACLU asked Tucson to send these records, and they did.
[39:29.760 --> 39:38.620]  Essentially, what this does is allows law enforcement to request every cell phone that registered with a particular tower during a particular time interval.
[39:38.620 --> 39:49.320]  So if they want to know what phones were near this thing that was going on at some time, to use a kind of non-controversial example, the Boston bombing, right?
[39:49.480 --> 39:55.000]  They could get a tower dump of all the cell towers nearby and identify what cell phones were in the area.
[39:55.240 --> 40:00.540]  Now, this is inherently untargeted by subscriber because it's targeted by location.
[40:00.560 --> 40:04.080]  If you happen to register with this tower, you're included in that record.
[40:04.080 --> 40:09.200]  You'll be included in a tower dump for any time period where you registered with the tower.
[40:09.480 --> 40:13.000]  What's the legal standard to get a tower dump?
[40:14.160 --> 40:14.880]  Who knows?
[40:15.940 --> 40:16.480]  Okay.
[40:16.780 --> 40:27.600]  Then there's a way for law enforcement to do this themselves using a technique usually referred to by the product name Stingray made by Harris.
[40:27.780 --> 40:29.120]  This is not a product placement.
[40:29.240 --> 40:30.420]  They didn't pay me to mention them.
[40:30.420 --> 40:33.100]  But here's what one looks like, this beautiful Stingray device.
[40:34.280 --> 40:40.040]  This is a portable device that basically pretends to be a cell site.
[40:40.180 --> 40:42.380]  And what it does is says, I'm a cell site.
[40:42.500 --> 40:43.880]  I've got a really great signal.
[40:44.040 --> 40:45.460]  Everybody register with me.
[40:45.560 --> 40:47.000]  And then everybody does.
[40:47.520 --> 40:49.360]  Your phone kind of automatically does that.
[40:49.560 --> 40:54.140]  Now, this is typically not connected to any backhaul.
[40:54.140 --> 41:00.600]  So as soon as it collects the identities of all of the handsets in the area, it says, Oh, I'm not a cell site.
[41:00.820 --> 41:04.200]  And lets you go back to using the regular cell sites.
[41:04.440 --> 41:07.240]  Because it can't actually complete calls for you typically.
[41:09.020 --> 41:17.200]  But this is usually used early in an investigation to identify what the target's phone number is.
[41:17.200 --> 41:23.760]  But anybody in the area will register with this cell site if they're within radio range in it.
[41:26.860 --> 41:29.540]  Again, unclear what the legal standard is.
[41:29.660 --> 41:31.000]  It's a kind of bulky thing.
[41:31.660 --> 41:31.780]  Okay.
[41:32.100 --> 41:36.780]  Now, there's some trickle-down effect.
[41:36.780 --> 41:50.160]  We basically have looked at the technology law enforcement is using in 2014, which was no doubt similar to the technology that intelligence agencies were using in, say, 1994.
[41:50.860 --> 42:10.160]  There's a kind of trickle-down effect that the really good surveillance technology gets invented for intelligence, and then makes its way down to local state and local law enforcement as Moore's law makes it cheaper and easier to use.
[42:10.340 --> 42:20.240]  So what the NSA is doing today, what Snowden is telling us about this week, you know, tomorrow the Tucson Police Department is going to have lots of that stuff.
[42:20.760 --> 42:23.080]  Stingrays are going to get smaller and cheaper.
[42:23.580 --> 42:27.720]  Data collection is going to get more and more ubiquitous.
[42:27.720 --> 42:34.040]  This malware to install in handsets is going to get more and more commoditized for law enforcement agencies.
[42:34.220 --> 42:49.740]  And we've already seen this with the Drug Enforcement Agency, which partnered, I love that term, with AT&T, where AT&T basically said, oh, let me give you all of our call detail records with the location, because you can use that for your law enforcement mission,
[42:49.780 --> 42:53.480]  and thanks for paying us to do it for some period of time.
[42:53.480 --> 43:03.580]  So they were getting sort of bulk call detail record similar to the 215 program for a period of time over the last decade.
[43:03.760 --> 43:19.720]  And that gave rise to this frightening term called parallel construction, where they deliberately would then recreate the same evidence not using the hemispheres data when they actually brought a criminal prosecution to avoid this coming out in court.
[43:20.400 --> 43:33.460]  So, you know, we don't really know what all of the law enforcement intelligence cooperation is, because they're getting better and better at this parallel construction technique.
[43:33.740 --> 43:37.080]  Okay, so what can we do about this as, you know, we're hackers, right?
[43:37.080 --> 43:45.920]  We should be able to help ourselves, and at least if everybody else is being spied upon, we can avoid being spied upon ourselves, right?
[43:46.140 --> 43:50.680]  Well, we have great technology for protecting content.
[43:50.900 --> 43:56.900]  Crypto is a really great way to prevent eavesdroppers from understanding what your communication is.
[43:57.000 --> 44:02.540]  But we have really less great technology for protecting metadata.
[44:02.800 --> 44:08.520]  Snowden gave me a great line, which, as you said, grad students of the world, this is the problem you should be working on.
[44:08.800 --> 44:12.240]  And he stole that line from me, apparently, because I was going to say that.
[44:14.740 --> 44:20.820]  This is just a great area to be doing research in because it's a wide open field.
[44:21.000 --> 44:22.500]  Now, you might say, what about Tor?
[44:23.160 --> 44:24.580]  Well, Tor is great.
[44:24.840 --> 44:33.220]  It prevents the observer from learning who you're communicating with, whether it's your endpoint itself or somebody observing what's going on on the network.
[44:33.220 --> 44:46.260]  But what it doesn't do is prevent a carrier from learning how you, the subscriber to that carrier, accessed their network, which you might notice was how all of this mobile device tracking works.
[44:46.780 --> 44:51.400]  So Tor solves a number of very important problems, but it doesn't solve this problem.
[44:51.500 --> 44:53.760]  And in fact, we kind of don't know how to solve this.
[44:54.280 --> 44:57.960]  So what I would suggest is we learn as much as we can from the wire.
[44:58.960 --> 44:59.880]  Burner phones.
[45:00.820 --> 45:02.240]  So what's a burner phone?
[45:02.400 --> 45:10.640]  Well, it's an anonymous cell phone account, typically paid for in cash, maybe with a ski mask over your head as you're doing it.
[45:12.500 --> 45:17.080]  You change your burner phones frequently, and that's inconvenient.
[45:17.080 --> 45:30.920]  But then there's the hard part, which is that you use your burner phone only to communicate with a new network of burner phones, and never link that back to the communications network that you communicated with in the past or your own number.
[45:31.140 --> 45:35.600]  Don't take your burner phone home and immediately test it by calling your other cell phone, right?
[45:36.920 --> 45:39.080]  Which is virtually impossible to not do.
[45:39.280 --> 45:40.880]  In fact, don't ever turn it on in your home.
[45:41.160 --> 45:52.620]  So this is kind of hard to do, but it does give rise to an important technique, which is try to change your identity to the network frequently.
[45:52.620 --> 45:58.740]  You can change your Wi-Fi and sometimes Bluetooth Mac addresses frequently, and that can be a way of doing this.
[45:58.840 --> 46:00.840]  But mostly, these are baby steps.
[46:01.040 --> 46:06.280]  And we really have to look at good systematic tools for doing this that give us some sort of assurance.
[46:06.520 --> 46:09.220]  We have time for 50% of a question.
[46:13.120 --> 46:14.940]  Okay, does anybody have a question?
[46:15.120 --> 46:16.120]  And I can't see you.
[46:17.380 --> 46:17.680]  So...
[46:17.680 --> 46:20.280]  Question about CryptoPhone.
[46:20.940 --> 46:27.520]  Just this last thing you were talking about, the voice that crypto doesn't really work.
[46:27.860 --> 46:31.220]  This is going back like eight years, but they were...
[46:31.220 --> 46:38.720]  It was a company in Germany, CryptoPhone.org, or they were talking about improving the voice call over the data channel.
[46:38.940 --> 46:40.880]  How come that hasn't become worse victims?
[46:41.460 --> 46:55.340]  Well, that's... you know, finally that technology is getting to some fruition, but it still doesn't help you with the fundamental problem, which is that once your handset has been identified as the thing to track, as it moves around the network, even if it's a crypto phone,
[46:55.500 --> 46:58.200]  it can still be tracked in the same ways.
[46:58.200 --> 46:59.960]  We basically don't know how to do that.
[47:00.080 --> 47:02.540]  So thanks a lot, everyone, and I think we're done.