I wish journalists would explore why the technical methods & information sharing that enable this surveillance are allowed to exist. Highlighting instances of abuse and the quasi-legal nature of the industry doesn’t really get at the interesting part, which is _what motivates our leaders to allow surveillance in the first place_.
I recently completed Barack Obama’s A Promised Land (a partial account of his presidency), and he mentions in his book that although he wanted to reform mass surveillance, it looked a little different once he was actually responsible for people’s safety. I often think about this when I drive past Flock cameras or walk into grocery stores; our leaders seem more enticed by the power of this technology than they are afraid of vague abuses happening in _not here_. It seems like no one sees a cost to just not addressing the issue.
By analogy, I feel that reporting on the dangers of fire isn’t really as effective as reporting on why we don’t have arson laws and fire alarms and social norms that make our society more robust to abuse of a useful capability. People who like cooked food aren’t going to engage with anti-fire positions if they just talk about people occasionally burning each other alive. We need to know more about what can be done to protect the average person from downsides of fire, as well as who is responsible for regulating fire and what their agenda for addressing it is. I’d love to see an article identifying who is responsible for installing these Flock cameras in my area, why they did so, and how we can achieve the positive outcomes desired from them (e.g. find car thieves) without the negatives (profiling, stalking, tracking non-criminals, etc).
Everyone thinks when they have power, they’ll use it correctly, because they have (from their perspective) good intentions.
An ideal government with total surveillance is the best case. You get the benefits of low crime without the drawback of corruption and ideology.
The problem is in practice:
- Large institutions aren’t good at exercising fine control: even if the leaders have truly good intentions, corrupt mid-level employees and inaccurate data lead to bad outcomes.
- Good leaders seem to often pick bad successors, and unless they frequently pick better successors, someone will eventually pick a corrupt one.
- Corrupt leaders seem to be good at ousting or sidelining good leaders, more than vice versa, perhaps because good leaders are less passionate about gaining and keeping power.
Perhaps there are other reasons. Not just ideal governments, but even self-preserving governments don’t tend to last. Hence, although decentralization and privacy are never ideal, they should exist at least for backup, “just in case” (inevitably in practice) the centralized surveillance system goes rouge.
There's a reason Plato's Republic looks authoritarian to people, because it models a city in which justice is the highest good, and justice and freedom are ultimately opposed to each other.
Since governments and laws exist to ensure justice, freedom will always be the price we pay.
Governments mostly exist to coordinate resource usage to out compete other societies.
Some amount of justice and welfare and roads, or whatever other things (varied by society and time period), are what they pay us so that our compliance is mostly voluntary and is therefore substantially more efficient.
You can bicker over exact word choice and the minute, but this general form is how it's always been from the present all the way back into the ancient world.
>There's a reason Plato's Republic looks authoritarian to people, because it models a city in which justice is the highest good, and justice and freedom are ultimately opposed to each other.
Note: An ideal government wouldn't define a bunch of victimless behaviour as a crime. Low crime would mean low murder, low car hijackings, etc - things that actually affect people.
Definitions differ person to person, but many things we consider benign today like sexual activities between consenting adults, racial integration, even free travel have at times and in places been considered crimes.
Today, homelessness is often criminalized. As is drug use even among otherwise productive law abiding citizens. Assisted suicide is often criminalized, even for terminally ill and suffering consenting adults.
Think of smoking marijuana on your balcony at home. Society does not get better if we punish that more - or at all. That just shouldn't be a crime to begin with. You also shouldn't do it, because smoking is bad for you, but that's not a reason to make it a crime.
Though it may be that a better society makes fewer people want to smoke.
Just like sex, any kind of power exchange needs consent.
This whole idea that people are led or need to be led is wrong. Perhaps some people do but that's their problem, it shouldn't be mine. What politicians are is decision makers, not leaders.
We don't have time to vote on every single law personally, so we appoint temporary assistants who do it for us, based on our preferences. That's how it should work.
These assistants should work for us, not lead us. We should always have the power to override their decisions and to remove and replace them at any time. Of course, making this work in a practical manner, while satisfying constraints such as secrecy of votes, is difficult. I don't dispute that but we should be striving to find ways to get as close to this ideal as possible, not making politics into a career or treating it as a reality show.
And most certainly, these assistants ("leaders" as you call them) should not be picking their successors without our consent.
Personally I would still call that leading/being led*, nonetheless that is a great reframe and I agree.
It also helps make the point of what it means to say “society is breaking down” or “democracy is at stake” or “faith in institutions in decline.” What it really means is that those whom were thought of as leaders no longer have the consent of the followers, who are making their own decisions now- often to ill effect of any strangers around them
*cf servant leadership as one particularly clear conceptualization
> Perhaps some people do but that's their problem, it shouldn't be mine.
In aggregate most people do need leadership. The kind of technocratic/managerial approach you suggest has led to the current societal problems we have: a vacuum of real leadership being filled by people willing to do it.
Whether it "should" or "shouldn't" be your problem is irrelevant to the reality.
Voting isn't necessarily a better system. The majority of people will very frequently give up rights in any given specific case that, in general, they hold dear. We're not rational actors.
And there are a lot of really weird discussions to be had about "consent," too. If we allow unlimited speech, that means that we're all subject to marketing and propaganda, and that's another thing that people are quite vulnerable to. Being convinced to vote via propaganda isn't really a great example of consent. But banning any speech that resembles propaganda is rife with problems.
Anyway, my point is that democracy/voting and free speech isn't necessarily the most free/consented-to form of government. I'm not sure what would take its place, though. I certainly wish I knew.
Dunno where parent said anything about democracy. Democracy and voting aren’t the same thing also they rejected the idea of voting on every law (democracy).
It seems inherent in your worldview that you lack faith in people to self govern (that is, for a person to govern themselves. Which would explain why you are at odds with the parent. I suggest you read a bit of Jefferson’s ideas of self governance, education, etc. There are tradeoffs as with everything else, I do think based solely on your short commentary here that there may be an opportunity for your perspective to be enriched however
> And most certainly, these assistants ("leaders" as you call them) should not be picking their successors without our consent.
Whether they pick them or you pick them, you still have the same problem.
Bad people often get into office. Politicians lie, major parties both run bad candidates, sometimes voters are of the inclination to just elect whoever they think will mount the strongest assault on the status quo.
Expecting that never to happen is a lot less pragmatic than setting things up ahead of time to mitigate the damage when it does.
But the people in office need some power, enough to cause problems if they're bad. Otherwise you have the failures of no government: "might makes right", no coordinated projects, no defense, etc.; or another group (e.g. corporation) becomes the de-facto government.
Hence the root problem, that we haven't discovered a way to consistently have "good" government, whether it's a dictatorship or democracy. Perhaps with technology, we can invent a better form of government, e.g. a "super-democracy" where people vote on individual decisions (though even today I can imagine issues that would cause).
Until then, the key point I make is that you can have a government where some people ("leaders") do have more power than others, but not enough power for total control. The hopefully-realistic ideal is that the government has enough power to defend itself against an external threat always, and coordinate large projects when functioning well; but not too much so that, when functioning badly, essential internal systems are preserved, and when it's replaced (because as mentioned it will eventually collapse) the transition is minimally disruptive.
> But the people in office need some power, enough to cause problems if they're bad. Otherwise you have the failures of no government: "might makes right", no coordinated projects, no defense, etc.; or another group (e.g. corporation) becomes the de-facto government.
You can prohibit the government from doing things it should never do (e.g. mass surveillance) without prohibiting it from doing things it ought to be doing (e.g. enforcing antitrust laws).
The problem is we currently do the opposite: The government is doing mass surveillance but not antitrust enforcement.
>Otherwise you have the failures of no government: "might makes right", no coordinated projects, no defense, etc.; or another group (e.g. corporation) becomes the de-facto government.
We're pretty f-ing far from even having to think about those problems.
> sometimes voters are of the inclination to just elect whoever they think will mount the strongest assault on the status quo
This is absolutely a thing and it's a thing because at some point, people notice how little power they actually have.
Every person's opinion is a point in N-dimensional space.
Representative democracy is describing that point (expressing their political opinion) by picking 1 point out of a handful of pre-determined options (parties/representatives). Some countries only have 2 real choices.
That's absolutely insane, no wonder people feel like their vote doesn't matter, they often can't even find a choice remotely close to their real preferences.
Your only suggestion other than the semantic complaint seems like it would work terribly, there's a reason we elect people for fixed terms and don't yank them out randomly.
Functioning democracies do yank out their elected representatives. Not randomly or even arbitrarily of course, but when they step egregiously out of line. Votes of no confidence, recall elections, impeachment, general strikes demanding resignation, and a smattering of other measures are crucial checks on the abuse of power. Electing someone to be untouchable for a set period of time is a recipe for malfeasance with examples going back as far as the invention of the term "dictator".
Re-read the comment I replied to and check if that comment was referring to everything being great already because those systems are in place or if they were calling for some kind of ad-hoc popular vote at any point during a mandate based on not liking the policies, rather than for egregious actions as you described. Your reply is theoretically correct but not what I replied to.
> he mentions in his book that although he wanted to reform mass surveillance, it looked a little different once he was actually responsible for people’s safety.
This is a cowardly excuse. It's another way of saying that if you reform mass surveillance you'll be blamed for anything bad that subsequently happens, regardless of whether the mass surveillance would have prevented it. And bad things happen on a regular basis with or without mass surveillance, so then the politically risk-averse move is to not solve the problem you promised to solve and not expose yourself.
Which is cowardly specifically because the candidate's original position was correct. You can solve crimes without mass surveillance, or prevent them by reducing poverty etc. If you do those things then the chances of something bad happening go down instead of up.
And it will still not be zero -- it won't be zero no matter what you do -- but in that case you're only worried about adversarial pundits blaming you for things that weren't your fault, and adversarial pundits are going to do that regardless.
> _what motivates our leaders to allow surveillance in the first place_
Surveillance makes their jobs easier, so there's a kind of natural tendency towards authoritarianism. We've known about this for a long time, the 4th Amendment was created to put limits on government surveillance.
If you're wondering why the government would allow private businesses to spy on everybody when the government itself isn't allowed to, that's because this allows for the government to effectively bypass the 4th Amendment. The government spying on everybody is against the Constitution, but a private business spying on everybody and selling the data to the government is "legal".
> It seems like no one sees a cost to just not addressing the issue.
It's the same "impose a small but poorly defined cost on everybody and act as though it's worth it because it maybe saves one defined life and therefore anyone who wants to call you out has an uphill battle" model you see used by bad people and dishonest comment section types the world over.
Society has no good way to reason about these "it's not much individually but when you do it to all of society it adds the F up" type downsides.
Like if you could save one life per year at the cost of making it take everyone an extra minute per day that's obviously not worth it at the scale of the united states because you're actually losing more life than you're saving.
But replace the "one minute" with something more subjective and nobody calls it out.
You hit on it. The harms of surveillance is an externality, like air pollution. We think they are SELLING surveillance to us in the court of public opinion, but they aren’t. We aren’t the customers! They’re selling it to political donors, megaglobocorporate, a ruling class. And Joe Plumber is only consuming toxic byproducts
> he mentions in his book that although he wanted to reform mass surveillance, it looked a little different once he was actually responsible for people’s safety
Assuming that he was sincere about wanting reform in the first place (and that's a big if for any book like this! The best you can say for Obama vs. most other politicians, is that he at least likely wrote it himself), what it means was that he was persuaded that mass surveillance was useful. He doesn't say how, or by who, he just vaguely waves at the burden of command.
> he mentions in his book that although he wanted to reform mass surveillance, it looked a little different once he was actually responsible for people’s safety.
Obama didn't swear an oath to safety, but he did swear an oath to protect the constitution. He is an oath breaker and not a man of integrity, but if we choose to trust his excuse then maybe we can forgive him as an individual for being frightened by the horror stories told to him by power hungry three letter agencies, but we should never forgive him as a president for his failure to uphold his oath. Obama studied and taught constitutional law. He knew exactly how important the oath he took was and what would be at risk if the constitution was ignored.
It will always be more "safe" to take people's freedom and control them. Safety is just not an acceptable excuse to take away the freedoms of every American.
I’m not totally opposed to surveillance, I just wish it was more transparent and limited to need to know uses.
If the police need your google search history thats ok as long as they can get a warrant showing they have justification and then perhaps at a delayed time, the account owner should be notified that this happened.
If they need access to your phone, rather than hacking it they should just take it off you and get the password from you.
This limits tracking since this is a fairly disruptive and visible thing and prevents just passive tracking of everyone all the time.
Businesses who use facial recognition for loss prevention should be legally required to only use their data for this purpose and never for marketing and analytics. They must not ever sell the data and delete it within a reasonable time.
What kind of crimes does surveillance prevent or help solve?
1) It does not _prevent_ the most serious crimes. People who are going to murder or rape someone are often not mentally capable or understanding how likely they are to get caught or caring about it in the moment. It might help solve it but there's usually more than enough conventional evidence. And these crimes are typically not what people coordinate with others so surveilling communication does not help much.
2) Stealing? Maybe. I can imagine cameras dissuade some opportunists but then again, shoplifting is reportedly high with self-checkouts and those are packed with cameras. Other kinds like burglars will probably just learn to be more careful with gloves and masks. And surveilling communication does not help unless we're talking organized crime and those people should be competent enough to use encrypted comms even if the major platforms are backdoored.
3) Crimes of opportunity like vandalism. Again, cameras are enough, if they work at all. The extra fraction of idiots who would be caught because they brag only about setting a trash can on fire it negligible compared to the downsides.
---
What surveillance absolutely could deter and help catch is organized resistance like staging a protest/riot/insurrection or individuals doing research before an assassination.
And that's why politicians, who are the most likely victims of these crimes, want surveillance. And you might genuinely believe that no current politician in your country deserves to be shot or that the current government should not be overthrown.
But we have to keep in mind that the next government will inherit these systems. Nothing is permanent, no democracy will last forever.
Historically, most countries have periods of freedom and authoritarianism, separated by collapse or revolt. At some point, in your country too, people will need to rise up to reassert their rights again.
It's a matter of when, not if.
---
I see where you are coming from and there were times in my life where more surveillance would have helped my side but ultimately, it's a balancing act and surveillance tips the scale in favor of people who already have a lot of power.
Semi regularly the police do stop terrorism plots before they happen. And just solving existing crimes is valuable itself. Especially for things like car crime, unless there was a video of it happening there is very little chance you’ll find the perpetrator.
Increasing the chance of criminals getting caught does a lot more for dissuading crime than increasing the penalties. Would you litter if you knew there was a 100% chance of getting a $50 fine?
It’s probably the case that politicians also don’t want to be the ones who blocked the data which would have lead to preventing a terrorist attack. And they get more visibility behind the scenes after taking the job.
Terrorism is barely an inconvenience. Just now in another top HN post, terrorism accounts for less than 0.001% of US deaths. That's percent so less than 1 in 100k. It essentially does not matter. It could increase tenfold and I'd be fine with it.
But the point I am trying to make is that surveillance does not work to stop the crimes people actually care about. Even if your biggest fear is terrorism, surveillance is not gonna stop somebody ramming their car into a crowd. Those who want to create fear have a myriad of ways which cannot be stopped without absolute, total surveillance, which makes any kind of resistance impossible.
I don't wanna live in a society where I have a 10% chance to get caught littering. Not because I wanna litter but because at some point, I might find myself homeless and needing to steal food to not starve. Or I might find myself living in a dictatorship and needing to drone the fucker who's sending my friends/family to a gulag.
Everything has a price. If the price of reducing common crime by 10% reduces the chance of a successful revolution by 20%, then it's not worth it. Because people are only free as long as they revoke their consent. If 50% of the population agree they live in a dictatorship, they should have a way to remove the government, whether by a ballot box or an ammo box.
I know this isn't a popular stance but in the present age of surveillance, mandated 24/7 body cams on every civilian might actually not be such a bad thing so long as you aren't a bad person. [edit] ideal world, and all of that et al
You might want to read "The Circle" if you haven't already. The reader gets to see an open-minded perspective of exactly this. Given your prior, I'd be curious what you think of it after reading.
It might be like prison reform and prisoners' rights - Nobody gets elected on a "soft on crime" platform, and civic engagement at the state and local level is so bad that people typically put up with cameras instead of agitating to get them banned. I say agitate. Show up, keep showing up, keep talking, keep telling friends. We can fight this. Democracy will work if we get people onboard, one way or another
You are more optimistic than I am. Flock and friends seem something like ChatControl. Those in power who want it have unlimited patience. They will keep pushing for expanded capabilities for the day when public attention has failed. Once they win, near impossible to revoke.
Because when you call them leaders and when they see themselves as leaders, they see themselves as a separate class. A permanent difference from the " mere citizen" class.
"Citizens will be on their best behavior because we are constantly recording and reporting everything that’s going on." -- Larry Ellison (who should not be anthropomorphized)
And Ellison is not even a politician, he doesn't even has any kind of immunity. Meanwhile, EU politicians want to impose Chat Control on everyone except them.
The core issue is that they see themselves as different from us.
Politics should not be a career. It should be something a person does for 5, at most 10 years max and after that they are back to being like everyone else, with 0 benefits (and with potentially more surveillance, I think politicians' finances should be under extra scrutiny for the rest of their lives).
It's really strange how we disconnected ideology from politics, in people's minds ideology only exists on the fringes of the far-left and far-right which are considered identical. If you criticize a politician you should be aware of their ideology, because they certainly are very much "political", but you aren't. When "leaders" talk about activists they say things like they were "politicized" as a derogatory term, in contrast to the default which is "depoliticized". Our leaders are waaaay more politicized than we are and way more ideologically consistent in their actions than you will ever realize.
I wonder if Congress would behave differently if they were consistently called "law janitors" or "public servants" or if those terms would just acquire the same connotations as "leader" and "politician"
> it looked a little different once he was actually responsible for people’s safety.
That seems highly disingenuous or just ignorant. We publicly had this problem starting in the 1990s. The NSA used to have a program that would capture data but then encrypt it and protect it from random access. They discontinued that program and instituted a new one that had zero privacy protections in it.
This was right at the turn when the "war on terror" started. Which was the excuse then used to abandon the better program for the egregious one since it was projected to be better for this particular use case. It's debatable whether that was true or not.
> Flock cameras or walk into grocery stores
Record it if you want. Law enforcement, at any level, should require an actual warrant to access it in any form. This isn't a binary. You can enhance security and privacy at the same time.
It is about a company, First Wap, that makes it possible to track individuals. Their USP is a piece of software that operates at phone network level and uses the fact that phone companies still support an old protocol, Signalling System 7:
> Phone networks need to know where users are in order to route text messages and phone calls. Operators exchange signalling messages to request, and respond with, user location information. The existence of these signalling messages is not in itself a vulnerability. The issue is rather that networks process commands, such as location requests, from other networks, without being able to verify who is actually sending them and for what purpose.
> These signalling messages are never seen on a user’s phone. They are sent and received by “Global Titles” (GTs), phone numbers that represent nodes in a network but are not assigned to subscribers.
> The issue is rather that networks process commands, such as location requests, from other networks, without being able to verify who is actually sending them and for what purpose
'Fun' fact: "other networks" includes all foreign networks with a roaming partnership. It's possible to abuse SS7 to track people across borders, from half the world away.
> it’s more than that. it’s any device that can present itself as a possible base station.
can you elaborate on this a bit? what devices are able to to present themselves as possible base stations? do i need any form of entitlement to participate in the network or not? From past encounters with SS7 and its, uhm, capabilities, it seemed the hardest part would be getting access to the network, albeit not hard really, it sounds like you were hinting at possibly gaining access by participating in the network without any official entitlement, by posing as a base station.
the group:
- dragged its feet on resolving SS7 security vulnerabilities
- repeatedly ignored input from DHS technical experts
- [identified] best practices.. using different filtering systems
- [but] pushed.. to rely on voluntary compliance
It's fascinating how these secrets are turning up in the press now. The article is (probably intentionally) vague about it's sources: they only say "Lighthouse found a vast archive of data on the deep web". But reading between the lines - does that imply that this surveillance company kept records on thousands of targets, and then left them in an open S3 bucket? Not the first time - the TM_Signal leak of upper-echelon U.S. government communications was also facilitated by an open S3 bucket that contained the message archives of everything that, say, the Secretary of Defense was messaging to the POTUS.
But it is highly ironic that these companies specialize in surveillance, tracking, and security, and then have a tendency to leave the data that they steal from others open to the Internet in a very amateurish security lapse that in turn leads to everyone stealing from them.
If I can make a guess, I'd say that the reporters engaged with them as a potential customer and demanded a sample of the data so they can indeed verify the accuracy. That's how they obtained the sample records, not via a s3 leak.
The reporters published a YouTube video in which they went undercover to a security convention (ISS Europe), and requested information about how the product works, some usecases, etc. [1]. Although, I don't recall the presenter indicating anything about leaked sample data...
Is it possible the phreakers are so specialized they have no experience with cloud admin and just went with some copypasta from SO answers to get the boring shit done so they could get back to phreaking? Not everyone is an expert in cloud management. It is easy to bork something when you have no idea what you're doing because you don't want to be doing it. They could have also hired low level people to do something for them and just didn't spend enough to have it done correctly. There's many reasons for a very specialized group of smart people to do something utterly dumb and easy to avoid by people with other specialized skills. These people would probably look at you as silly and amateur for using SMS.
"Signalling System 7, or SS7, is a decades-old set of protocols that allows phone networks to communicate with one another, routing messages and calls across borders. It was never designed with security in mind, and while operators have moved to more secure evolutions with 4G and 5G, they still need to maintain backwards compatibility with SS7. This is likely to remain the case for years if not decades to come.
Phone networks need to know where users are in order to route text messages and phone calls. Operators exchange signalling messages to request, and respond with, user location information. The existence of these signalling messages is not in itself a vulnerability. The issue is rather that networks process commands, such as location requests, from other networks, without being able to verify who is actually sending them and for what purpose.
These signalling messages are never seen on a user’s phone. They are sent and received by “Global Titles” (GTs), phone numbers that represent nodes in a network but are not assigned to subscribers. Surveillance companies have often leased GTs from phone operators and used them to send unauthorised signalling messages into other networks, benefitting from the fact that the signalling messages appear to be coming from the legitimate operator which owns the GT.
First Wap primarily works via in-country installations of Altamides. In this setup, a government client uses Altamides via an SS7 link belonging to a local phone operator. The local phone operator provides the GTs and Altamides uses these GTs to conduct location tracking domestically and internationally."
So basically the telecoms network itself has no security. Anyone operating network equipment on the telecoms network can see where any phone is at any time.
I didn't know we lived in a world that is this stupid. Great. If you're a dissident you basically cannot have a phone or be around anyone who has a phone.
SS7 telcom vulns still seem to be prevelant in 2025:
Femtocells and Fake Base Stations
Attackers deploy femtocells — small cellular base stations — or fake base stations, commonly known as IMSI catchers, to intercept SS7 traffic. A modified femtocell can act as a man-in-the-middle, capturing signaling messages between a phone and the network.
Fake base stations mimic legitimate cell towers, tricking devices into connecting and relaying SS7 messages to the attacker’s system.
IMSI catchers exploit a known security vulnerability in the GSM specification, which requires the handset to authenticate to the network but does not require the network to authenticate to the handset. They broadcast a stronger signal than legitimate cell towers to lure mobile phones into connecting. Once connected, an IMSI catcher can force the transmission of the International Mobile Subscriber Identity (IMSI) and compel the connected mobile station to use no encryption or easily breakable encryption.
For 3G and LTE networks, sophisticated IMSI catcher attacks may involve downgrading the connection to less secure non-LTE network services to bypass enhanced security features. For example, a hacker might deploy a fake base station near a target to capture their IMSI and initiate SS7 queries.
> This investigation began with an archive of data. [...] It contains 1.5 million records, more than 14,000 unique phone numbers, and people surveilled in over 160 countries.
Why not HIBP (Have I Been Pwned) style site to check against the database if your number is in?
Reads like they’re doing one of several way to get mobile device IDs, and then x-ref those against anon’d adtech datasets that anchor on the mobile ID.
If your device privacy is a mess, mobile ID links you to all the good and bad things you do on a phone.
Had no idea this was part of the tool options, but backbone cell network makes sense.
Other TTPs I’d read about was variations on geo-fenced adserving to phish a mobile ID basically via user interaction or scroll past the ad. Small enough geofence and do it a few times, one could safely figure out the user being the ID. Googling “RTB surveillance” or “DSP surveillance” are ways into the topic.
Scary stuff! Pair that with this tech has been working for years, and is international. Frames a bit differently every action by a public figure - also at risk via the same threat model.
Also long have wondered what data analysis like this is done on technical forums… ran by a VC firm… with a lot of insider context (product market fit?) in the comments.
Stallman was a firebrand and jerk, but he was right. When it comes to devices that have the potential to invade our privacy and make us easy targets for authoritarian governments, every last line of code and every transistor should be open.
What I understand is that this SS7 is difficult to get rid of. If I understand it correctly, the purpose of the location queries is for routing calls/messages. Couldn’t (shouldn’t?) telecom providers run monitoring and alerting if location queries are fired without a subsequent call/message?
That's what they do to the people that figure things out. They discredit them so other people will not listen to them. It's the ones that go full tilt with lining the walls of their houses to be Faraday cages that make it all fringy cringy the rationally paranoid folks get lumped in with.
Well its always funny to observe politicians/other VIPs use similar technologies to the most "loopy" prepper when they need to. Like actual faraday/signal jamming tents during negotiations or similar.
tbf, when the UK introduced a text to notify people of missing children ,some people(including relatives) were complaining on facebook that it could be used by the UK government to track everyone.
As if their government couldn't just track the smartphone or them via social media already.
The cognitive dissonance of thinking that apps are needed to track someone with a phone vs just being able to track your phone directly is very telling. Even before smart phones with apps, the tracking was there as a required feature to make mobile work. Granted, the number of people that spend any cycles thinking about how mobile signals work probably rounds to 0. It takes someone really dialed in to the details to come up interesting bolt on things to an existing system like tracking people with a mobile device just by looking at the logs. Same thing with looking at "just the metadata". While it may be obvious to those dialed in, to those oblivious it sounds crazy.
> We found Netflix producer Adam Ciralsky, Blackwater founder Erik Prince, Nobel Peace Prize nominee Benny Wenda, Austropop star Wolfgang Ambros, Tel Aviv district prosecutor Liat Ben Ari and Ali Nur Yasin, a senior editor at our Indonesian partner Tempo.
Political figures being there I somewhat understand, but a Netflix producer? Why would anyone need to track a Netflix producer?
They use vulns in the outdated SS7 system to trick networks into revealing a numbers location (1), and intercept SMS including the verification codes sent by apps like WhatsApp - allowing them to hijack accounts and monitor messages and calls directly (2). This method works remotely and doesn’t require antennas
The SMS are intercepted because thru SS7 by tricking the network into thinking the target phone is roaming (3).
Not just vulns. It is possible to simply purchase access or become a provider in the SS7 system (<$20-50k USD). SMS is basically a completely open system at this point. Cybersecurity companies do it all the time for pentesting. So do "Cybersecurity companies".
Horrifying that nearly banks still require you to use sms as a 2fa and do not offer any other alternative.
Did you really think the US Gov was OK with facebook running the biggest "encrypted" SMS system on earth. LOL of course they already had access to all the messages.
Hijacking WhatsApp SMS authentication codes can be prevented by just adding a PIN to your account. Doing this attack also doesn't grant you access to someone's old WhatsApp messages, and contacts with "security notices" enabled will see that your device has changed. It's quite different than big gov just having access to all your WhatsApp messages. (But there might be other ways they can do this, but just SMS sniffing doesn't get you there)
> Horrifying that nearly banks still require you to use sms as a 2fa and do not offer any other alternative.
In my country banking applications are tied to your phone via IMEI, SIM and other hardware dependent information available.
Forget getting banking details and use another device without the user knowing, either.
If someone clones your SIM or gets a replacement in behalf of you, your all banking access is blocked until you enable them one by one with your ID card or other means.
One of the banks can use FaceID as a secondary factor, too.
So, other methods are possible. It's an "implementation detail" at this point.
Privacy isn't just about hiding, it's about having the freedom to grow and change without constant watching. We need more leaders who understand this simple truth.
I think the world is not ready for the level of surveillance that exists in the wild.
For example, this post could have been a product of just probing a particular group of people to understand if they are interested in the subject and what they have to say about it.
That can be done indirectly, by suggesting someone (offering a link or planting an idea) that is already known to be interested in surveillance and prone to share interesting discoveries (in other words, the poster might not even be aware he could be an asset).
Think about the many ways someone could know your interests and how prone you are to react to something and how that could be used. If you are in tech, think about all the silly ways that kind of information can leak publicly.
People often disregard the possibility that they could be an active part of a surveillance network (as an unkowingly asset), instead focusing on more fantastical ideas such as technological hacks or coding wizardry.
Did I miss something? This was not surprising. I figured all this would have been possible (and commonplace) decades ago. I was expecting this to be about government eyes and ears in my toilet or something.
I wish journalists would explore why the technical methods & information sharing that enable this surveillance are allowed to exist. Highlighting instances of abuse and the quasi-legal nature of the industry doesn’t really get at the interesting part, which is _what motivates our leaders to allow surveillance in the first place_.
I recently completed Barack Obama’s A Promised Land (a partial account of his presidency), and he mentions in his book that although he wanted to reform mass surveillance, it looked a little different once he was actually responsible for people’s safety. I often think about this when I drive past Flock cameras or walk into grocery stores; our leaders seem more enticed by the power of this technology than they are afraid of vague abuses happening in _not here_. It seems like no one sees a cost to just not addressing the issue.
By analogy, I feel that reporting on the dangers of fire isn’t really as effective as reporting on why we don’t have arson laws and fire alarms and social norms that make our society more robust to abuse of a useful capability. People who like cooked food aren’t going to engage with anti-fire positions if they just talk about people occasionally burning each other alive. We need to know more about what can be done to protect the average person from downsides of fire, as well as who is responsible for regulating fire and what their agenda for addressing it is. I’d love to see an article identifying who is responsible for installing these Flock cameras in my area, why they did so, and how we can achieve the positive outcomes desired from them (e.g. find car thieves) without the negatives (profiling, stalking, tracking non-criminals, etc).
Everyone thinks when they have power, they’ll use it correctly, because they have (from their perspective) good intentions.
An ideal government with total surveillance is the best case. You get the benefits of low crime without the drawback of corruption and ideology. The problem is in practice:
- Large institutions aren’t good at exercising fine control: even if the leaders have truly good intentions, corrupt mid-level employees and inaccurate data lead to bad outcomes.
- Good leaders seem to often pick bad successors, and unless they frequently pick better successors, someone will eventually pick a corrupt one.
- Corrupt leaders seem to be good at ousting or sidelining good leaders, more than vice versa, perhaps because good leaders are less passionate about gaining and keeping power.
Perhaps there are other reasons. Not just ideal governments, but even self-preserving governments don’t tend to last. Hence, although decentralization and privacy are never ideal, they should exist at least for backup, “just in case” (inevitably in practice) the centralized surveillance system goes rouge.
There's a reason Plato's Republic looks authoritarian to people, because it models a city in which justice is the highest good, and justice and freedom are ultimately opposed to each other.
Since governments and laws exist to ensure justice, freedom will always be the price we pay.
>governments and laws exist to ensure justice
Governments mostly exist to coordinate resource usage to out compete other societies.
Some amount of justice and welfare and roads, or whatever other things (varied by society and time period), are what they pay us so that our compliance is mostly voluntary and is therefore substantially more efficient.
You can bicker over exact word choice and the minute, but this general form is how it's always been from the present all the way back into the ancient world.
Governments exist to monopolize violence in the hands of a few so that we may have less violence and more order overall.
>There's a reason Plato's Republic looks authoritarian to people, because it models a city in which justice is the highest good, and justice and freedom are ultimately opposed to each other.
So, Singapore?
> the benefits of low crime
Note: An ideal government wouldn't define a bunch of victimless behaviour as a crime. Low crime would mean low murder, low car hijackings, etc - things that actually affect people.
Which crimes do you think are victimless exactly?
Wikipedia has some good examples: https://en.wikipedia.org/wiki/Victimless_crime
Definitions differ person to person, but many things we consider benign today like sexual activities between consenting adults, racial integration, even free travel have at times and in places been considered crimes.
Today, homelessness is often criminalized. As is drug use even among otherwise productive law abiding citizens. Assisted suicide is often criminalized, even for terminally ill and suffering consenting adults.
Think of smoking marijuana on your balcony at home. Society does not get better if we punish that more - or at all. That just shouldn't be a crime to begin with. You also shouldn't do it, because smoking is bad for you, but that's not a reason to make it a crime.
Though it may be that a better society makes fewer people want to smoke.
> Good leaders seem to often pick bad successors
This whole way of thinking makes my skin crawl.
Just like sex, any kind of power exchange needs consent.
This whole idea that people are led or need to be led is wrong. Perhaps some people do but that's their problem, it shouldn't be mine. What politicians are is decision makers, not leaders.
We don't have time to vote on every single law personally, so we appoint temporary assistants who do it for us, based on our preferences. That's how it should work.
These assistants should work for us, not lead us. We should always have the power to override their decisions and to remove and replace them at any time. Of course, making this work in a practical manner, while satisfying constraints such as secrecy of votes, is difficult. I don't dispute that but we should be striving to find ways to get as close to this ideal as possible, not making politics into a career or treating it as a reality show.
And most certainly, these assistants ("leaders" as you call them) should not be picking their successors without our consent.
Personally I would still call that leading/being led*, nonetheless that is a great reframe and I agree.
It also helps make the point of what it means to say “society is breaking down” or “democracy is at stake” or “faith in institutions in decline.” What it really means is that those whom were thought of as leaders no longer have the consent of the followers, who are making their own decisions now- often to ill effect of any strangers around them
*cf servant leadership as one particularly clear conceptualization
> Perhaps some people do but that's their problem, it shouldn't be mine.
In aggregate most people do need leadership. The kind of technocratic/managerial approach you suggest has led to the current societal problems we have: a vacuum of real leadership being filled by people willing to do it.
Whether it "should" or "shouldn't" be your problem is irrelevant to the reality.
Voting isn't necessarily a better system. The majority of people will very frequently give up rights in any given specific case that, in general, they hold dear. We're not rational actors.
And there are a lot of really weird discussions to be had about "consent," too. If we allow unlimited speech, that means that we're all subject to marketing and propaganda, and that's another thing that people are quite vulnerable to. Being convinced to vote via propaganda isn't really a great example of consent. But banning any speech that resembles propaganda is rife with problems.
Anyway, my point is that democracy/voting and free speech isn't necessarily the most free/consented-to form of government. I'm not sure what would take its place, though. I certainly wish I knew.
Dunno where parent said anything about democracy. Democracy and voting aren’t the same thing also they rejected the idea of voting on every law (democracy).
It seems inherent in your worldview that you lack faith in people to self govern (that is, for a person to govern themselves. Which would explain why you are at odds with the parent. I suggest you read a bit of Jefferson’s ideas of self governance, education, etc. There are tradeoffs as with everything else, I do think based solely on your short commentary here that there may be an opportunity for your perspective to be enriched however
> And most certainly, these assistants ("leaders" as you call them) should not be picking their successors without our consent.
Whether they pick them or you pick them, you still have the same problem.
Bad people often get into office. Politicians lie, major parties both run bad candidates, sometimes voters are of the inclination to just elect whoever they think will mount the strongest assault on the status quo.
Expecting that never to happen is a lot less pragmatic than setting things up ahead of time to mitigate the damage when it does.
>Bad people often get into office.
The constraints of the office ought to account for that.
But the people in office need some power, enough to cause problems if they're bad. Otherwise you have the failures of no government: "might makes right", no coordinated projects, no defense, etc.; or another group (e.g. corporation) becomes the de-facto government.
Hence the root problem, that we haven't discovered a way to consistently have "good" government, whether it's a dictatorship or democracy. Perhaps with technology, we can invent a better form of government, e.g. a "super-democracy" where people vote on individual decisions (though even today I can imagine issues that would cause).
Until then, the key point I make is that you can have a government where some people ("leaders") do have more power than others, but not enough power for total control. The hopefully-realistic ideal is that the government has enough power to defend itself against an external threat always, and coordinate large projects when functioning well; but not too much so that, when functioning badly, essential internal systems are preserved, and when it's replaced (because as mentioned it will eventually collapse) the transition is minimally disruptive.
> But the people in office need some power, enough to cause problems if they're bad. Otherwise you have the failures of no government: "might makes right", no coordinated projects, no defense, etc.; or another group (e.g. corporation) becomes the de-facto government.
You can prohibit the government from doing things it should never do (e.g. mass surveillance) without prohibiting it from doing things it ought to be doing (e.g. enforcing antitrust laws).
The problem is we currently do the opposite: The government is doing mass surveillance but not antitrust enforcement.
>Otherwise you have the failures of no government: "might makes right", no coordinated projects, no defense, etc.; or another group (e.g. corporation) becomes the de-facto government.
We're pretty f-ing far from even having to think about those problems.
> sometimes voters are of the inclination to just elect whoever they think will mount the strongest assault on the status quo
This is absolutely a thing and it's a thing because at some point, people notice how little power they actually have.
Every person's opinion is a point in N-dimensional space.
Representative democracy is describing that point (expressing their political opinion) by picking 1 point out of a handful of pre-determined options (parties/representatives). Some countries only have 2 real choices.
That's absolutely insane, no wonder people feel like their vote doesn't matter, they often can't even find a choice remotely close to their real preferences.
First past the post is bad. Score voting is good. Guess which one we currently use.
Ego got triggered by the thought of being led?
Your only suggestion other than the semantic complaint seems like it would work terribly, there's a reason we elect people for fixed terms and don't yank them out randomly.
Functioning democracies do yank out their elected representatives. Not randomly or even arbitrarily of course, but when they step egregiously out of line. Votes of no confidence, recall elections, impeachment, general strikes demanding resignation, and a smattering of other measures are crucial checks on the abuse of power. Electing someone to be untouchable for a set period of time is a recipe for malfeasance with examples going back as far as the invention of the term "dictator".
Re-read the comment I replied to and check if that comment was referring to everything being great already because those systems are in place or if they were calling for some kind of ad-hoc popular vote at any point during a mandate based on not liking the policies, rather than for egregious actions as you described. Your reply is theoretically correct but not what I replied to.
> he mentions in his book that although he wanted to reform mass surveillance, it looked a little different once he was actually responsible for people’s safety.
This is a cowardly excuse. It's another way of saying that if you reform mass surveillance you'll be blamed for anything bad that subsequently happens, regardless of whether the mass surveillance would have prevented it. And bad things happen on a regular basis with or without mass surveillance, so then the politically risk-averse move is to not solve the problem you promised to solve and not expose yourself.
Which is cowardly specifically because the candidate's original position was correct. You can solve crimes without mass surveillance, or prevent them by reducing poverty etc. If you do those things then the chances of something bad happening go down instead of up.
And it will still not be zero -- it won't be zero no matter what you do -- but in that case you're only worried about adversarial pundits blaming you for things that weren't your fault, and adversarial pundits are going to do that regardless.
> _what motivates our leaders to allow surveillance in the first place_
Surveillance makes their jobs easier, so there's a kind of natural tendency towards authoritarianism. We've known about this for a long time, the 4th Amendment was created to put limits on government surveillance.
If you're wondering why the government would allow private businesses to spy on everybody when the government itself isn't allowed to, that's because this allows for the government to effectively bypass the 4th Amendment. The government spying on everybody is against the Constitution, but a private business spying on everybody and selling the data to the government is "legal".
> It seems like no one sees a cost to just not addressing the issue.
It's the same "impose a small but poorly defined cost on everybody and act as though it's worth it because it maybe saves one defined life and therefore anyone who wants to call you out has an uphill battle" model you see used by bad people and dishonest comment section types the world over.
Society has no good way to reason about these "it's not much individually but when you do it to all of society it adds the F up" type downsides.
Like if you could save one life per year at the cost of making it take everyone an extra minute per day that's obviously not worth it at the scale of the united states because you're actually losing more life than you're saving.
But replace the "one minute" with something more subjective and nobody calls it out.
You hit on it. The harms of surveillance is an externality, like air pollution. We think they are SELLING surveillance to us in the court of public opinion, but they aren’t. We aren’t the customers! They’re selling it to political donors, megaglobocorporate, a ruling class. And Joe Plumber is only consuming toxic byproducts
> he mentions in his book that although he wanted to reform mass surveillance, it looked a little different once he was actually responsible for people’s safety
Assuming that he was sincere about wanting reform in the first place (and that's a big if for any book like this! The best you can say for Obama vs. most other politicians, is that he at least likely wrote it himself), what it means was that he was persuaded that mass surveillance was useful. He doesn't say how, or by who, he just vaguely waves at the burden of command.
> he mentions in his book that although he wanted to reform mass surveillance, it looked a little different once he was actually responsible for people’s safety.
Obama didn't swear an oath to safety, but he did swear an oath to protect the constitution. He is an oath breaker and not a man of integrity, but if we choose to trust his excuse then maybe we can forgive him as an individual for being frightened by the horror stories told to him by power hungry three letter agencies, but we should never forgive him as a president for his failure to uphold his oath. Obama studied and taught constitutional law. He knew exactly how important the oath he took was and what would be at risk if the constitution was ignored.
It will always be more "safe" to take people's freedom and control them. Safety is just not an acceptable excuse to take away the freedoms of every American.
I’m not totally opposed to surveillance, I just wish it was more transparent and limited to need to know uses.
If the police need your google search history thats ok as long as they can get a warrant showing they have justification and then perhaps at a delayed time, the account owner should be notified that this happened.
If they need access to your phone, rather than hacking it they should just take it off you and get the password from you.
This limits tracking since this is a fairly disruptive and visible thing and prevents just passive tracking of everyone all the time.
Businesses who use facial recognition for loss prevention should be legally required to only use their data for this purpose and never for marketing and analytics. They must not ever sell the data and delete it within a reasonable time.
What kind of crimes does surveillance prevent or help solve?
1) It does not _prevent_ the most serious crimes. People who are going to murder or rape someone are often not mentally capable or understanding how likely they are to get caught or caring about it in the moment. It might help solve it but there's usually more than enough conventional evidence. And these crimes are typically not what people coordinate with others so surveilling communication does not help much.
2) Stealing? Maybe. I can imagine cameras dissuade some opportunists but then again, shoplifting is reportedly high with self-checkouts and those are packed with cameras. Other kinds like burglars will probably just learn to be more careful with gloves and masks. And surveilling communication does not help unless we're talking organized crime and those people should be competent enough to use encrypted comms even if the major platforms are backdoored.
3) Crimes of opportunity like vandalism. Again, cameras are enough, if they work at all. The extra fraction of idiots who would be caught because they brag only about setting a trash can on fire it negligible compared to the downsides.
---
What surveillance absolutely could deter and help catch is organized resistance like staging a protest/riot/insurrection or individuals doing research before an assassination.
And that's why politicians, who are the most likely victims of these crimes, want surveillance. And you might genuinely believe that no current politician in your country deserves to be shot or that the current government should not be overthrown.
But we have to keep in mind that the next government will inherit these systems. Nothing is permanent, no democracy will last forever.
Historically, most countries have periods of freedom and authoritarianism, separated by collapse or revolt. At some point, in your country too, people will need to rise up to reassert their rights again.
It's a matter of when, not if.
---
I see where you are coming from and there were times in my life where more surveillance would have helped my side but ultimately, it's a balancing act and surveillance tips the scale in favor of people who already have a lot of power.
Semi regularly the police do stop terrorism plots before they happen. And just solving existing crimes is valuable itself. Especially for things like car crime, unless there was a video of it happening there is very little chance you’ll find the perpetrator.
Increasing the chance of criminals getting caught does a lot more for dissuading crime than increasing the penalties. Would you litter if you knew there was a 100% chance of getting a $50 fine?
It’s probably the case that politicians also don’t want to be the ones who blocked the data which would have lead to preventing a terrorist attack. And they get more visibility behind the scenes after taking the job.
Terrorism is barely an inconvenience. Just now in another top HN post, terrorism accounts for less than 0.001% of US deaths. That's percent so less than 1 in 100k. It essentially does not matter. It could increase tenfold and I'd be fine with it.
But the point I am trying to make is that surveillance does not work to stop the crimes people actually care about. Even if your biggest fear is terrorism, surveillance is not gonna stop somebody ramming their car into a crowd. Those who want to create fear have a myriad of ways which cannot be stopped without absolute, total surveillance, which makes any kind of resistance impossible.
I don't wanna live in a society where I have a 10% chance to get caught littering. Not because I wanna litter but because at some point, I might find myself homeless and needing to steal food to not starve. Or I might find myself living in a dictatorship and needing to drone the fucker who's sending my friends/family to a gulag.
Everything has a price. If the price of reducing common crime by 10% reduces the chance of a successful revolution by 20%, then it's not worth it. Because people are only free as long as they revoke their consent. If 50% of the population agree they live in a dictatorship, they should have a way to remove the government, whether by a ballot box or an ammo box.
Mass surveillance is an attempt to make a high trust society artificially out of a low trust one.
It somewhat kind of works, which is the problem. The real solution is deeper, and harder, and longer.
Surveillance could prevent traffic crimes. I kind of feel like diving a 3000lbs thing down the road should require you to drive responsibly with it.
I guess though this problem will get solved as most transition to self driving cars over the next 15-30 years.
Who says that the purpose of surveillance is to fight crime? Seems like you introduced a premise out of nothing.
(Downvote me for “being obtuse” but I’m pointing out unspoken assumption that’s worth considering)
I know this isn't a popular stance but in the present age of surveillance, mandated 24/7 body cams on every civilian might actually not be such a bad thing so long as you aren't a bad person. [edit] ideal world, and all of that et al
You might want to read "The Circle" if you haven't already. The reader gets to see an open-minded perspective of exactly this. Given your prior, I'd be curious what you think of it after reading.
Bathrooms? Bedrooms? Changing diapers?
This is a weird stance.
> I wish journalists would explore why the technical methods & information sharing that enable this surveillance are allowed to exist.
It boils down to one thing that allows these surveillance technologies to exist: public apathy.
That’s tautology. Why are people apathetic about it?
It might be like prison reform and prisoners' rights - Nobody gets elected on a "soft on crime" platform, and civic engagement at the state and local level is so bad that people typically put up with cameras instead of agitating to get them banned. I say agitate. Show up, keep showing up, keep talking, keep telling friends. We can fight this. Democracy will work if we get people onboard, one way or another
You are more optimistic than I am. Flock and friends seem something like ChatControl. Those in power who want it have unlimited patience. They will keep pushing for expanded capabilities for the day when public attention has failed. Once they win, near impossible to revoke.
Because when you call them leaders and when they see themselves as leaders, they see themselves as a separate class. A permanent difference from the " mere citizen" class.
"Citizens will be on their best behavior because we are constantly recording and reporting everything that’s going on." -- Larry Ellison (who should not be anthropomorphized)
And Ellison is not even a politician, he doesn't even has any kind of immunity. Meanwhile, EU politicians want to impose Chat Control on everyone except them.
The core issue is that they see themselves as different from us.
Politics should not be a career. It should be something a person does for 5, at most 10 years max and after that they are back to being like everyone else, with 0 benefits (and with potentially more surveillance, I think politicians' finances should be under extra scrutiny for the rest of their lives).
It's really strange how we disconnected ideology from politics, in people's minds ideology only exists on the fringes of the far-left and far-right which are considered identical. If you criticize a politician you should be aware of their ideology, because they certainly are very much "political", but you aren't. When "leaders" talk about activists they say things like they were "politicized" as a derogatory term, in contrast to the default which is "depoliticized". Our leaders are waaaay more politicized than we are and way more ideologically consistent in their actions than you will ever realize.
I wonder if Congress would behave differently if they were consistently called "law janitors" or "public servants" or if those terms would just acquire the same connotations as "leader" and "politician"
although he wanted to reform mass surveillance, it looked a little different once he was actually responsible for people’s safety
Power corrupts.
> it looked a little different once he was actually responsible for people’s safety.
That seems highly disingenuous or just ignorant. We publicly had this problem starting in the 1990s. The NSA used to have a program that would capture data but then encrypt it and protect it from random access. They discontinued that program and instituted a new one that had zero privacy protections in it.
This was right at the turn when the "war on terror" started. Which was the excuse then used to abandon the better program for the egregious one since it was projected to be better for this particular use case. It's debatable whether that was true or not.
> Flock cameras or walk into grocery stores
Record it if you want. Law enforcement, at any level, should require an actual warrant to access it in any form. This isn't a binary. You can enhance security and privacy at the same time.
> I wish journalists would explore why the technical methods & information sharing that enable this surveillance are allowed to exist
You mean to ask questions ? No way. /s
It is about a company, First Wap, that makes it possible to track individuals. Their USP is a piece of software that operates at phone network level and uses the fact that phone companies still support an old protocol, Signalling System 7:
> Phone networks need to know where users are in order to route text messages and phone calls. Operators exchange signalling messages to request, and respond with, user location information. The existence of these signalling messages is not in itself a vulnerability. The issue is rather that networks process commands, such as location requests, from other networks, without being able to verify who is actually sending them and for what purpose.
> These signalling messages are never seen on a user’s phone. They are sent and received by “Global Titles” (GTs), phone numbers that represent nodes in a network but are not assigned to subscribers.
> The issue is rather that networks process commands, such as location requests, from other networks, without being able to verify who is actually sending them and for what purpose
'Fun' fact: "other networks" includes all foreign networks with a roaming partnership. It's possible to abuse SS7 to track people across borders, from half the world away.
it’s more than that. it’s any device that can present itself as a possible base station. this is how trumps lawyer was caught in a place he claimed to not be: https://www.reuters.com/article/world/special-counsel-has-ev...
this also helped confirm the identity of the 2022 killer in idaho https://en.wikipedia.org/wiki/2022_University_of_Idaho_murde...
> it’s more than that. it’s any device that can present itself as a possible base station.
can you elaborate on this a bit? what devices are able to to present themselves as possible base stations? do i need any form of entitlement to participate in the network or not? From past encounters with SS7 and its, uhm, capabilities, it seemed the hardest part would be getting access to the network, albeit not hard really, it sounds like you were hinting at possibly gaining access by participating in the network without any official entitlement, by posing as a base station.
I assumed it was the telecoms just selling the data about their subscribers. https://www.telecomstechnews.com/news/fcc-fines-major-telcos...
Why not both?
One would hope the selling is illegal and did more than just fine the companies.
"Why the US still won’t require SS7 fixes that could secure your phone" (2019) https://arstechnica.com/features/2019/04/fully-compromised-c...
It's fascinating how these secrets are turning up in the press now. The article is (probably intentionally) vague about it's sources: they only say "Lighthouse found a vast archive of data on the deep web". But reading between the lines - does that imply that this surveillance company kept records on thousands of targets, and then left them in an open S3 bucket? Not the first time - the TM_Signal leak of upper-echelon U.S. government communications was also facilitated by an open S3 bucket that contained the message archives of everything that, say, the Secretary of Defense was messaging to the POTUS.
But it is highly ironic that these companies specialize in surveillance, tracking, and security, and then have a tendency to leave the data that they steal from others open to the Internet in a very amateurish security lapse that in turn leads to everyone stealing from them.
If I can make a guess, I'd say that the reporters engaged with them as a potential customer and demanded a sample of the data so they can indeed verify the accuracy. That's how they obtained the sample records, not via a s3 leak.
The reporters published a YouTube video in which they went undercover to a security convention (ISS Europe), and requested information about how the product works, some usecases, etc. [1]. Although, I don't recall the presenter indicating anything about leaked sample data...
[1] https://youtu.be/xfWyU5iXJ3I
Is it possible the phreakers are so specialized they have no experience with cloud admin and just went with some copypasta from SO answers to get the boring shit done so they could get back to phreaking? Not everyone is an expert in cloud management. It is easy to bork something when you have no idea what you're doing because you don't want to be doing it. They could have also hired low level people to do something for them and just didn't spend enough to have it done correctly. There's many reasons for a very specialized group of smart people to do something utterly dumb and easy to avoid by people with other specialized skills. These people would probably look at you as silly and amateur for using SMS.
For anyone interested, they also have a technical explainer that describes their methodology in detail.
https://www.lighthousereports.com/methodology/surveillance-s...
"Signalling System 7, or SS7, is a decades-old set of protocols that allows phone networks to communicate with one another, routing messages and calls across borders. It was never designed with security in mind, and while operators have moved to more secure evolutions with 4G and 5G, they still need to maintain backwards compatibility with SS7. This is likely to remain the case for years if not decades to come.
Phone networks need to know where users are in order to route text messages and phone calls. Operators exchange signalling messages to request, and respond with, user location information. The existence of these signalling messages is not in itself a vulnerability. The issue is rather that networks process commands, such as location requests, from other networks, without being able to verify who is actually sending them and for what purpose.
These signalling messages are never seen on a user’s phone. They are sent and received by “Global Titles” (GTs), phone numbers that represent nodes in a network but are not assigned to subscribers. Surveillance companies have often leased GTs from phone operators and used them to send unauthorised signalling messages into other networks, benefitting from the fact that the signalling messages appear to be coming from the legitimate operator which owns the GT.
First Wap primarily works via in-country installations of Altamides. In this setup, a government client uses Altamides via an SS7 link belonging to a local phone operator. The local phone operator provides the GTs and Altamides uses these GTs to conduct location tracking domestically and internationally."
So basically the telecoms network itself has no security. Anyone operating network equipment on the telecoms network can see where any phone is at any time.
I didn't know we lived in a world that is this stupid. Great. If you're a dissident you basically cannot have a phone or be around anyone who has a phone.
SS7 telcom vulns still seem to be prevelant in 2025:
Femtocells and Fake Base Stations Attackers deploy femtocells — small cellular base stations — or fake base stations, commonly known as IMSI catchers, to intercept SS7 traffic. A modified femtocell can act as a man-in-the-middle, capturing signaling messages between a phone and the network.
Fake base stations mimic legitimate cell towers, tricking devices into connecting and relaying SS7 messages to the attacker’s system.
IMSI catchers exploit a known security vulnerability in the GSM specification, which requires the handset to authenticate to the network but does not require the network to authenticate to the handset. They broadcast a stronger signal than legitimate cell towers to lure mobile phones into connecting. Once connected, an IMSI catcher can force the transmission of the International Mobile Subscriber Identity (IMSI) and compel the connected mobile station to use no encryption or easily breakable encryption.
For 3G and LTE networks, sophisticated IMSI catcher attacks may involve downgrading the connection to less secure non-LTE network services to bypass enhanced security features. For example, a hacker might deploy a fake base station near a target to capture their IMSI and initiate SS7 queries.
https://www.how2lab.com/tech/mobile-communication/ss7-vulner...
I could not compare it completely, but it sounds very much like this talk that I saw many years ago at the CCC.
SS7: Locate. Track. Manipulate. [2014] https://media.ccc.de/v/31c3_-_6249_-_en_-_saal_1_-_201412271...
Tobias Engel's initial video about this was "Locating Mobile Phones using SS7" given at the 25C3 in 2008:
https://media.ccc.de/v/25c3-2997-en-locating_mobile_phones_u...
In Europe:
- Almost everyone has a phone.
- Almost everyone takes their phone wherever they go.
- All SIM-cards have been forcefully (by law) linked to people's identities.
- Almost all people are therefore being tracked.
> This investigation began with an archive of data. [...] It contains 1.5 million records, more than 14,000 unique phone numbers, and people surveilled in over 160 countries.
Why not HIBP (Have I Been Pwned) style site to check against the database if your number is in?
Right! I expected one.
Visiting the site is a one of a kind "back in time" experience: it was probably developed in 2000[1].
Even the WAP part of the name makes me wonder[2].
I know I have some futile questions, but why does seem France so untouched? [3]
[1] <https://www.1rstwap.com>
[2] <https://en.wikipedia.org/wiki/Wireless_Application_Protocol>
[3] <https://i0.wp.com/www.lighthousereports.com/wp-content/uploa...>
Reads like they’re doing one of several way to get mobile device IDs, and then x-ref those against anon’d adtech datasets that anchor on the mobile ID.
If your device privacy is a mess, mobile ID links you to all the good and bad things you do on a phone.
Had no idea this was part of the tool options, but backbone cell network makes sense.
Other TTPs I’d read about was variations on geo-fenced adserving to phish a mobile ID basically via user interaction or scroll past the ad. Small enough geofence and do it a few times, one could safely figure out the user being the ID. Googling “RTB surveillance” or “DSP surveillance” are ways into the topic.
Scary stuff! Pair that with this tech has been working for years, and is international. Frames a bit differently every action by a public figure - also at risk via the same threat model.
Also long have wondered what data analysis like this is done on technical forums… ran by a VC firm… with a lot of insider context (product market fit?) in the comments.
Stallman was a firebrand and jerk, but he was right. When it comes to devices that have the potential to invade our privacy and make us easy targets for authoritarian governments, every last line of code and every transistor should be open.
What I understand is that this SS7 is difficult to get rid of. If I understand it correctly, the purpose of the location queries is for routing calls/messages. Couldn’t (shouldn’t?) telecom providers run monitoring and alerting if location queries are fired without a subsequent call/message?
And then they call people paranoid to go off the grid.
That's what they do to the people that figure things out. They discredit them so other people will not listen to them. It's the ones that go full tilt with lining the walls of their houses to be Faraday cages that make it all fringy cringy the rationally paranoid folks get lumped in with.
Well its always funny to observe politicians/other VIPs use similar technologies to the most "loopy" prepper when they need to. Like actual faraday/signal jamming tents during negotiations or similar.
tbf, when the UK introduced a text to notify people of missing children ,some people(including relatives) were complaining on facebook that it could be used by the UK government to track everyone.
As if their government couldn't just track the smartphone or them via social media already.
The cognitive dissonance of thinking that apps are needed to track someone with a phone vs just being able to track your phone directly is very telling. Even before smart phones with apps, the tracking was there as a required feature to make mobile work. Granted, the number of people that spend any cycles thinking about how mobile signals work probably rounds to 0. It takes someone really dialed in to the details to come up interesting bolt on things to an existing system like tracking people with a mobile device just by looking at the logs. Same thing with looking at "just the metadata". While it may be obvious to those dialed in, to those oblivious it sounds crazy.
> We found Netflix producer Adam Ciralsky, Blackwater founder Erik Prince, Nobel Peace Prize nominee Benny Wenda, Austropop star Wolfgang Ambros, Tel Aviv district prosecutor Liat Ben Ari and Ali Nur Yasin, a senior editor at our Indonesian partner Tempo.
Political figures being there I somewhat understand, but a Netflix producer? Why would anyone need to track a Netflix producer?
He’s also a journalist and had a carrier at the CIA. Why don’t you look him up if you’re curious about that?
look up Operation Mockingbird. half of the media is government operatives...
netflix is a crucial tool of narrative control...
they are nowhere near "just producers"...
This is why I think Microsoft, Apple and Google are owned as well. And answers a lot of questions about gatekeeping and vendor lock-in
There're also apparently random every-day civilians in the dataset. TFA mentions one person targeted by a stalker.
Looking at his career and production credits, it’s probably more accurate to describe him as a journalist who’s covered some sensitive subjects.
Maybe hoping to bump into them for a impromptu elevator pitch for a show?
They're a critic?
More on ALTAMIDES and system modules:
https://www.giosec.uk/specialist-services---geo-location.htm...
I didn't quite understand how they are capable of tracking people and breaking WhatsApp encryption.
There is mention of fake antenna but I don't think they cover entire country with that, how do they do?
They use vulns in the outdated SS7 system to trick networks into revealing a numbers location (1), and intercept SMS including the verification codes sent by apps like WhatsApp - allowing them to hijack accounts and monitor messages and calls directly (2). This method works remotely and doesn’t require antennas
The SMS are intercepted because thru SS7 by tricking the network into thinking the target phone is roaming (3).
(1)https://www.lighthousereports.com/methodology/surveillance-s...
(2)https://www.motherjones.com/politics/2025/10/firstwap-altami...
(3)https://www.fyno.io/blog/is-it-easy-to-intercept-sms-a-compl...
> intercept SMS including the verification codes sent by apps like WhatsApp
For anyone worried, this approach:
1) Breaks the existing phone from receiving WhatsApp messages, so you can notice that behavior
2) Can be prevented by setting up a WhatsApp pin in your settings
Probably these were addressed way too late. Developers are the last to know their backdoors surprisingly.
Not just vulns. It is possible to simply purchase access or become a provider in the SS7 system (<$20-50k USD). SMS is basically a completely open system at this point. Cybersecurity companies do it all the time for pentesting. So do "Cybersecurity companies".
Horrifying that nearly banks still require you to use sms as a 2fa and do not offer any other alternative.
Did you really think the US Gov was OK with facebook running the biggest "encrypted" SMS system on earth. LOL of course they already had access to all the messages.
Hijacking WhatsApp SMS authentication codes can be prevented by just adding a PIN to your account. Doing this attack also doesn't grant you access to someone's old WhatsApp messages, and contacts with "security notices" enabled will see that your device has changed. It's quite different than big gov just having access to all your WhatsApp messages. (But there might be other ways they can do this, but just SMS sniffing doesn't get you there)
> Horrifying that nearly banks still require you to use sms as a 2fa and do not offer any other alternative.
In my country banking applications are tied to your phone via IMEI, SIM and other hardware dependent information available.
Forget getting banking details and use another device without the user knowing, either.
If someone clones your SIM or gets a replacement in behalf of you, your all banking access is blocked until you enable them one by one with your ID card or other means.
One of the banks can use FaceID as a secondary factor, too.
So, other methods are possible. It's an "implementation detail" at this point.
Yes - and they also claim not to track users themselves. Is that just a lie or is there someone else doing the tracking?
This article answers none of my questions!
There's more details in the technical explainer linked in the article.
https://www.lighthousereports.com/methodology/surveillance-s...
Privacy isn't just about hiding, it's about having the freedom to grow and change without constant watching. We need more leaders who understand this simple truth.
When even Obama couldn't resist the power of surveillance, maybe it's not the tech we should fear, it's how easily power changes good intentions.
I think the world is not ready for the level of surveillance that exists in the wild.
For example, this post could have been a product of just probing a particular group of people to understand if they are interested in the subject and what they have to say about it.
That can be done indirectly, by suggesting someone (offering a link or planting an idea) that is already known to be interested in surveillance and prone to share interesting discoveries (in other words, the poster might not even be aware he could be an asset).
Think about the many ways someone could know your interests and how prone you are to react to something and how that could be used. If you are in tech, think about all the silly ways that kind of information can leak publicly.
People often disregard the possibility that they could be an active part of a surveillance network (as an unkowingly asset), instead focusing on more fantastical ideas such as technological hacks or coding wizardry.
Another brilliant example, why we need good (cooperating, international) journalism
I must say translation in Firefox is great. Now I don't have to learn Turkish...
As for article, imagine, at those times and for thousands years after in most places humans were still hunting-gathering..
mind reading technology is here, an actual reality
Did I miss something? This was not surprising. I figured all this would have been possible (and commonplace) decades ago. I was expecting this to be about government eyes and ears in my toilet or something.