Together with Prof. Luigi Mancini and dr. Agostino Panico of the Information Technology Department of the Sapienza University (Rome) I wrote the chapter titled “SOF on Trial. The Technical and Legal Value of Battlefield Digital Forensics in Court“.
Yesterday the Internet Traffic Mandatory Data Retention regulation expired without being re-enacted by the Parliament. This means that at the midnight of June, 30, all the Italian Telcos and ISPs just (or should have) deleted last year Internet usage information from their databases.
Maybe the Parliament and the Data Protection Authority just had a strike of consciousness and decided so, after having “forgotten” for years to stress test the national data retention legislation to check if it could still stands against the EU Court of justice 2014 decision that bashed the data-retention directive.
Or, maybe, the powers-that-be just forgot about the data-retention.
We’ll never know for sure, but fact is that current high profile criminal investigations are now deprived of an important information gathering tool.
Phoneys is a software that allows a user to change the content of an Iphone chat thus altering the meaning of the conversation.While this is just an entertainment software, it might have some disturbing impacts on a possible criminal investigation.
Indeed, SMS, chat transcripts and messages are routinely used as a source of evidence by lawyers and prosecutors on the basis that if something is on a phone it can be hardly be faked. Of course, this is not always true, of course evidences must be corroborated by independent checks, of course the legal community is not that dumb to give face value to a text on a phone screen. But…
Phoneys allows a malicious person to create a prima facie deceiving fact, by exploiting the fact that a message has actually been sent, thus leading the investigator into thinking that a conversation took place with the intended correspondent. In an emergency context, the necessity of taking immediate action might push him to under evaluate what has been shown as “evidence”, thus jeopardizing the final result.
Maybe this is a either a minor or non-existent issue. But judicial reality has proven to be more surprising then legal-thriller. So, next time you’re confronted with a message as an evidence, why not double check?
Just in case…
According to a statement published on the Brazilian Policia Federal’s website, a criminal court issued a “mandado de pris?o preventiva” (roughly, pre-emptive arrest order) against Facebook’s representative in Brazil, charged of not having cooperated in providing information about a Facebook page.
The Brazilian Court, unlike the San Bernardino’s one in the Apple case, chose to put its white gloves off and go straight for the jugular, leaving no doubt about the fact that cooperation with the public prosecutor is a mandatory duty for everybody, tech-companies included.
By comparing the Apple and the Facebook cases (and Google’s public position about the topic) a disturbing trend emerges: Internet companies (at least the so said “Over The Top” – OTT) “think different” about themselves. Why the OTT should be let alone, when? an ISP is burdened (often for free, BTW), to provide a public prosecutor with wiretapping, data-retention, forensic support, and data-mining services? Like it or not, corporate criminal liability and obstruction to justice regulation still work for the OTT too, and the OTT must live with it.
This Facebook case further supports the opinion I’ve expressed about the true issue at stake: by one side, the lack of confidence is our social and legal system as a whole and thus the fact that you can’t actually trust a magistrate and a law enforcement agency; by the other side the “ubermensch” syndrome that affects (not only high-tech) companies and that leads them into thinking that they have the “right” (or the power) to part the right from wrong.
The US District Court for the Eastern District of New York Order that prevented the US Drug Enforcement Agency (DEA) to force Apple to provide support in bypassing the passcode security on an Apple device is another chapter of the “Should-we-allow-State-to-mess-with-our-intellectual-property” saga, starring Apple.
Now that another Court ruled in a different way than the previous one, the score is even: 1 for the “crack-the-iphone” team, 1 for the “don’t-even-think-about-it” Cupertino’s.
To me, this legal uncertainty shows the mistake underlying the whole issue.
A public prosecutor has the power to do whatever it takes to finalize an investigation, provided that his powers are scrutinized by a judge. This is the theory, and a fair compromise under the “check-and-balance” doctrine.
So, from a strictly legal point, Apple and the NY court are wrong, since the privacy threats and the possibility of abuse were still there with the wiretapping, remote surveillance and so on. The Iphone issue is just a variation of a known “breed”. We all know that the legal system is not “foolproof”, and that sometimes somebody abuses of his prerogatives, but
this is not a reason to stop allowing a law enforcement entity to do its job by way of technical means.
Again, the actual point is whether the private interests of a company can overrule the State duty to seek for justice.
And even if Apple were right, this would make things worser, because it would means that we live in a society that we ourselves don’t trust enough. And if so it is, obviously the problem is neither Apple nor the Iphone encryption…