Hacker News new | past | comments | ask | show | jobs | submit login
With a single wiretap, police collected 9.2M text messages (techcrunch.com)
150 points by OrgNet on June 30, 2019 | hide | past | favorite | 54 comments



Buried in the article is that no arrests were made and that warrants for wiretapping requests were down 25% overall in 2018.

However, warentless wiretapping was up 25%:

https://techcrunch.com/2019/04/30/nsa-surveillance-spike/


That article is confusing due to the author being confused himself. Warrantless wiretaps can only be ordered for non-US people living outside the United States believed to have national security relevant communications. These people do not have Fourth Amendment protection.

The ODI's transparency report (the article's only citation, from which I have obtained every fact in this post) says that indeed went up from 129K targets in 2017 to 165k targets in 2018, but the article never mentions that. Instead, it talks about searching the recorded communications of those targets for communications related to US people who aren't being wiretapped themselves.


>> Warrantless wiretaps can only be ordered for non-US people living outside the United States

Except in the case of voluntary handovers, situations where the communication provider hands over data without the need of a warrant. A cop can purchase the same location or other data any advertiser can.

https://www.wired.com/2017/02/police-get-location-data-witho...


That article is from before the Supreme Court’s decision in Carpenter, which was a pretty major change in the law on these issues. https://en.m.wikipedia.org/wiki/Carpenter_v._United_States


That is not a wiretap. A wiretap obtains contents of communications.

There is also no evidence that voluntary handovers are increasing.


Confused, can someone explain why this is downvoted?


Defining wiretaps as only content is splitting legal hairs. Location data alone can get people convicted. Browsing history (IP address/DNS lookups etc) and connection data (who you texted etc) is arguably also not "content". For the person facing the charges there is little practical difference between a content "wiretap" and non-content non-wiretap.


The word "wiretap" has a specific meaning, though. It does not mean location data. It means content. Nobody uses the word "wiretap" to mean location data.


The word "wiretap" has a specific obsolete meaning. The state of telephony moved on and so did the state of "wiretapping", rendering the term itself an anachronism. Incidentally "pen register", e.g. recording the metadata of a line, is also an anachronism.

Considering both of these terms are anachronisms originally created to describe distict devices which haven't been used in decades, getting bent out of shape over the difference between the two doesn't seem like a productive direction to steer the conversation.


The word wiretap has a clear meaning that is unrelated to the physical process it used to represent. Literally everyone understands this. There are many terms like this, and it's not a problem. We don't need to redefine the term "wiretap" just because you're no longer physically tapping wires. What is being revealed is the same, that is what everyone cares about, and so that is how the term is used.


The term wiretap is a term of art and as such is bound to be used imprecisely by people who aren't experts in that particular domain. Getting upset over somebody saying 'wiretap' instead of 'pen register' really exemplifies the worst aspects of socializing with engineers and lawyers.

As you allude to, seeing the forest instead of the trees reveals that people who are upset don't care how any of it works and they don't care which terms are assigned to which concepts. They care that their privacy is being violated. And no, they certainly don't care about court opinions concerning metadata not being data or call records not deserving privacy. The distinction between wiretaps, pen registers, and any other bullshit they dream up is not important to most people, so dragging the conversation into the weeds over the differences between the terms is not productive because it's a distinction without a meaningful difference (unless you're inclined to hassle privacy advocates.)


Except we are actually discussing a technical legal matter. When discussing a technical legal matter, definitions are important. You can say you're upset about metadata collection, but that is a distinct issue from wiretapping. Trying to justify imprecise terminology on the grounds that "people are upset" is simply a tactic for muddying the waters. If your point is good, you can be precise about it.


Most of us are not lawyers. If a lawyer is being imprecise with legal terminology, then they need to be called on it promptly. If however a non-lawyer is misusing terminology but their meaning is clear, correcting their terminology is just derailing the conversation.

If somebody says "That man assaulted me; he punched me right in the face" the correct response is not "Actually that's battery, not assault"

(I don't know [or care] if that 'correction' is true or not, but it's one that's been repeated online ad nauseum.)


You also don't care if the punch was warrantless or not. Here, we are discussing warrantless wiretaps, which has a specific meaning. You don't get to pick and choose which meanings you discard (wiretap) and which meanings you keep (warrantless) because goalposts can be moved forever, and communication becomes impossible.


Also, lawyers (ie me) are free to speak as private citizens. I could go on at length about the legal distinctiveness of content and non-content interception, but whether it does matter is different than whether it should. I don't see metadata as fundamentally different in practice than content. Scotus may say otherwise, but I am under no obligation to agree with them.


Oh I see. I'm kinda torn on this. Content vs. metadata is one thing, and I get where you're coming from, but if I understood your comment correctly, that wasn't quite the only distinction here? You were talking about cell location information, which is independent of calls/texts/other communication -- it's always there by the mere fact of you having cell service. It seems quite legitimate to point out that that's not "wiretapping"?


> it's always there by the mere fact of you having cell service.

The current location is known by necessity. There is no technical reason to keep a history of past locations.


I didn't say there is a technical reason for keeping a history. I said doing so is not "wiretapping".


> non-US people living outside the United States believed to have national security relevant communications. These people do not have Fourth Amendment protection.

How come Julian Assange has second amendment protection?


The US Second Amendment is "A well regulated Militia, being necessary to the security of a free State, the right of the people to keep and bear Arms, shall not be infringed."

Are you wondering whether this is interpreted to mean that Assange as an Australian has the right to own weapons in the US? Or did you mean to refer to some other amendment?


9.2M? 145 people over 3 months? That's 9.2M / (145*90) = 700~ texts per PERSON per DAY. That's insane. Even if each text goes to ever other person and is double counted, that is still 17+ texts per day from each person. Are these teenagers? Do drug dealers really send texts to dozens of people at once? We have to be missing something.


And Zipf distributions would suggest that the most frequent transmitters dominated the transmissions.

The numbers stated work out to suspiciously close to a transmission every 30 seconds, which may suggest this is a capture including both routine cell-tower transmissions and texts, with the former dominating the data.

I doubt the accuracy of the story as reported, though whether that's a misstatement in the report or a misunderstanding by the reporter isn't clear.

The report in question:

https://www.uscourts.gov/statistics-reports/wiretap-report-2...

It states:

The federal wiretap with the most intercepts occurred during a narcotics investigation in the Southern District of Texas and resulted in the interception of 9,208,906 messages in 120 days.

XLSX tables with underlying data are provided.

My read is that intercepts are not limited to user-initiated comms, and include automated telco service messaging


Even more the other case: 9.1mio/45 people/3 months makes 2250 messages per day per subject So kind of impossible for a mere human?

Or were they targeting 45 but actually collecting for vastly larger numbers (eg entire cell towers' throughout) ? Would make sense of the suspects had many phones or kept switching phones.


Yea I came to ask that same question. All I can assume is that’s badly reported and in fact entire cell tower’s messages were being tapped. Which has huge repercussions for privacy. Another thought could be some sort of forwarding service. Regardless these numbers are massive.


A halfway determined teenager probably sends over 700 texts an hour. I wouldn’t be surprised to see rates upwards of 1,000 per hour for some users.

Average character count per text is probably low. Median character count could be something like 3.

That’s all rank speculation on my part. Would be interesting to see actual data on this though!


11 a minute? One every 5 seconds? Sustained? For 24 hours/day, 7 days/wk, 4 weeks/mo, 3 months straight?

I somehow doubt that very much.


> For 24 hours/day, 7 days/wk, 4 weeks/mo, 3 months straight?

The comment above reached a figure of 700 per day per person. For my teen self, that's about two or three hours of conversation per day. It's certainly sustainable for months. Hell, I was known as the outlier in my teen circles because I liked to send longer messages (actually combining full sentences into one message) from time to time.


The comment I'm reading states 700/hr, up to 1000/hr. Not day.

That may not be what its author intended, but it's what they wrote. Twice.


r3bl is correct. In the context of incredulity over someone sending 700 texts per day, my point was that I’m sure there are many users who send over 700 texts in a single an hour.

Nowhere did I say that rate would be sustained for 24 consecutive hours.

It is the ultimate in moving goalposts to take my response to a claim of 700/day being insane, to recast the debate as if it were over sending 17,000 texts per day.


Pew's 2012 estimate, the most recent available, is 167 mean, 60 median, texts/day for teens. Fewer than 20% send more than 200 texts/day. Again, the likelihood that "many" exceed 700/day, let alone 700/hr, absent some bulk multicasting method, is unsupported by plausibility or data.

https://www.pewinternet.org/2012/03/19/what-teens-do-with-th...


2012? Phhffaw. Dude, do you even text? </s>

But when did I ever say many?!


Rereading your initial comment, that's strongly implied.

I think this horse is now dead, and or has come to enjoy the beating.


What I take away from this is that the bar for warrants is either too low or there's something afoot in the law enforcement sector.

4 x 30 (just easy rounding) = 120 days against 149 individuals.

This is not a small-scale surveillance operation and all of that time, money, and effort amounted to zero arrests? Then what was the justification for the warrant that was used to enact the wiretap, in the first place? "We kind of think that something maybe kind of sort is happening, potentially, with this possible group of possibly known individuals..."?

This doesn't add-up.

Aren't warrants supposed to be used to investigate for evidence of crimes where other evidence is presented with the warrant application that a crime has possibly been committed and, thus, such gathering is necessary to further collect information directly pertinent to the investigation?

This just sounds like rubber-stamping surveillance to maybe catch individuals that may be involved in some possibly nefarious actions that some officers suspect is going on but don't really have anything else to go on...

Otherwise, how can you go to a court and say, "Based on 'x', we think these 149 individuals are involved in 'y' crime and we need to gather evidence in support of that...", waste so much time, resources, man-hours, etc. and still come up empty-handed; especially, when you were supposed to have sufficient enough evidence against at least one individual to have the warrant granted in the first place?

The way this unfolded, it seems like it was more of a fishing expedition than anything worth-while and that is the most disconcerting part.


Shit like this is the reason everyone needs to use E2E encrypted messaging.


Doesn't do a thing for metadata. Average Australian has 15,000 datapoints collected daily and stored for warrantless access by virtually any govt department, most of it cellphone location.


> three-month wiretap that collected 9.1 million text message from 45 individuals

~2210 messages per person per day on average? (~138/day hour) That's either really impressive, or something doesn't add up...


ya ... I got the math wrong. It is 149 people, not 45.


The article mentions 2 different wiretaps. One is 9.2M with 149 people, the other is 9.1M with 45 people.


I've already said it but once again: I can't access this website at all on mobile: I first land on an RGPD warning except that I can't refuse cookies and tracking directly from it so I need to follow a link, which doesn't have any settings either but un bunch of other links, and it continues. After the tenth link followed I just gave up. Fuck you Techcrunch, fuck you Oath, fuck you Verizon Media, fuck you Yahoo Consent.


Tracking consent needs to be built in at the browser level.


If you’re in the EU, don’t forget to complain to your relevant data protection authority, and let them investigate the legality of it (GDPR requires that it be easy to say no as it is to say, which clearly isn’t the case here).

If you’re outside the EU, you might want to consider getting involved in the political process of your country so that one day you too may have legal protections for your data.


9.1 million of them were "u up?"


So stop using Android or switch to WhatsApp. Simple.


You mean stop using SMS, switch to WhatsApp.


WhatsApp is now owned by Facebook. I still remember https://en.wikipedia.org/wiki/Facebook%E2%80%93Cambridge_Ana... and consider Whatsapp to be now compromised. And don't forget that the app was hacked last May. I'm interested in learning why this is still a recommended application for secure messaging.


What does Android have to do with wiretaps?


Android phones send SMS messages.


So does every mobile phone.


the default SMS message protocol is unencrypted


No, SMS is unencrypted on all platforms. I think you meant that iOS may sometimes send encrypted messages to other numbers.

But that's not a great solution for a common e2e.


Or iMessages. Or Signal.


iMessage has a backdoor for Apple in the keyserver that a government can compel Apple to use for a wiretap. https://www.lawfareblog.com/iphones-fbi-and-going-dark

The existence of this backdoor (in combination with the fact that iCloud and iMessage are operated by a PRC-controlled business in China) is likely the reason iMessage is not blocked in China.


It does not permit the same dragnet to occur as using bare SMS messages.


It makes possible a dragnet of iMessage communications in China. In the US, the Fourth Amendment prevents a dragnet on SMS messages (and on iMessage).




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: