Most of us have heard the stories about how someone is passing through a neighborhood where a rape or murder has occurred. The police go to Google to find out who was in the neighborhood when the crime happened. An innocent person who was not even aware that a crime was committed gets arrested and spends the next six months in jail until proven innocent and is only eventually released… all because their phone was identified as being in the area when the crime was committed.
So what happens when the police go to Purism and want information about a specific AwSIM card or modem IMEI? They want to know who owns that hardware or SIM card. Purism can’t know if their customer is guilty or not. Do they just give any government agency, any information that is requested? What if a government agency wants all information on all Purism customers that purchased an AwSIM card, along with matching the sim numbers to the individual who purchased it. Would Purism disclose their cooperation (with or without an involved subpoena) to us? Would Purism choose not to renew the Warrant Canary if necessary, to let their customers know what has happened? There are all shades of gray between non-cooperation and full cooperation. Where will Purism draw the line? In the absence of any criminal allogations, would Purism give all records to any government agency, simply because they want to catalogue it? Can Purism be pressured to capitulate to such requests? What if the government trusts Google with this information of yours, to keep it archived for them? In such a case, we’re back to square one.
The current Warrant Canaries (3) may not cover the situation. However a new canary could be created.
My expectation is that Purism would comply with any lawful directive.
If an LEA went on a fishing expedition and requested all customer info, it wouldn’t surprise me if Purism pushed back (Fourth Amendment) but that would be their decision, taking into account time, dollars, effort, …
Are they true stories or fake news though? [citation needed]?
That’s why you have a HKS for each radio. Don’t want to broadcast your location non-stop? Then use the HKS. (assuming you are using the SIM in a Librem 5, and why wouldn’t you be? )
I would expect Purism to obey the law. In the grey area where law enforcement exceeds its authority, I would expect Purism to respond in a manner that protects Purism as an organization.
There are two conflated aspects of the protection of private, personal data (privacy) that need to be distinguished: 1. the protection of private, personal data from theft and appropriation by commercial organizations without appropriate recompense; and 2. the protection of private, personal data from a constitutionally endowed governmental authority.
Private personal data is an example of private property, which, unless, one is Lockean, is never absolute and therefore the second aspect above has to be resolved by the political process. Of course even the first aspect could be solved by the political process, but, at least in this case, there are workable solutions within the existing legal establishment that provide individuals with the ability to protect their privacy from appropriation. For this practical reason, I think that Purism’s impact would be larger if they focused on providing tools for the protection of personal data from commercial appropriation.
As already mentioned for the given scenario, the hardware kill switches are key. You shouldn’t have to trust the service provider (including Purism).
The phone itself is important, not just the service. I don’t see Librem AweSim as a replacement for the HKS, just an additional layer of privacy.
And I agree, Purism needs to follow the law wherever they operate. That said, I think they should insist on a warrant, and not just give the information out.
This is correct. Law enforcement (and criminals) are not factored into our threat model for AweSIM. Our goal is to give the user privacy from the upstream cellular providers who have gone on record saying they intend to capture and sell customer data as a source of revenue.
If we get a legitimate law enforcement request to link a particular AweSIM phone number with account information we have on record, we will comply. That, however, is about all of the information we would have on a customer to turn over. We will likely create a new Warrant Canary specifically for this service, because I suspect of all of our canaries, this is the service that is most likely to receive a law enforcement request.
Forgive my ignorance on the details of warrant canaries. Is it feasible to change the wording after the first one is murdered by a law enforcement request so that we can get an idea of how frequently these requests are complied with? Is this more of a one and done thing and once the awesim canary is dead there’s no way of releasing another to find out how prevalent this is?
A lot of tech companies release transparency reports about such things, instead of having a warrant canary (since their canary would be dead on day one). There are a number of different ways we could handle it and we are still deciding upon the right approach.
Innocent until proven guilty, at least in the US. If this scenario played out, the use of location data seems trivial in comparison to that principle/law being broken.
Perhaps the AwSIM warrant Canary could be set up with specific revision controls that would work as follows. Every time the revision number increments by one integer value, it could mean that Purism has complied with one more warrant. Minor wording updates to the Canary could be smaller digit values, to the right side of the decimal place. If the Canary isn’t published on schedule, then we would know that either secrecy has been required along with at least one warrant, or that Purism is not cooperating with something (we wouldn’t know which). But as the revision values increment with each Canary renewal, we could then all see how many warrants were complied with by Purism.
By using this method, law enforcement could be incentivised to not require Purism to keep the existance of any warrant a secret (except for keeping the suspects name a secret which is reasonable). But no one will be sure whether it was Purism or the law enforcement agency that is playing hardball with respect to the warrant if the Canary stops being renewed. If Purism doesn’t update the Canary on time, we can assume that the government agency is being unreasonable (like maybe wanting Purism’s whole AwSIM customer database). If all law enforcement wants are occasional identities to go with one phone number per warrant in reasonable numbers, then the Canary gets renewed with appropriate revision numbers. That way, law enforcement can still identify real suspects and keep appropriate secrecy in their investigations. As a constituency, Purism’s customers can have some limited visibility too. But if law enforcement officials abuse our privacy rights, then Purism will have some kind of a hammer to fight with. Every AwSIM customer might assume that the government is up to no good with respect to their account privacy if the Canary stops being published. Otherwise as the canary revision numbers increment over time, the AwSIM customers will know that all is well and that Purism is not receiving unreasonable requests for private information from any government agencies.
The added legal significance to this method would be that not only can Purism not be required to publish something (the core legal principal behind the canary). But also, law enforcement can not compel Purism to publish something deceptive or that goes against Purism’s revision control protocols when they do publish something. So the control of the release of information would remain with Purism, no matter what kinds of secrecy orders are issued.
Of course but you can still be held on remand / denied bail. So while you are “innocent until proven guilty” you are not “free until proven guilty”. Sometimes there are semi-legitimate reasons for denying bail. Sometimes not so much. Sometimes the original charge is 100% game playing, but legitimate, because they want to get you, or someone else, on some bigger charge but don’t have the evidence.
Bottom line though was that no citation was provided - so we can be a bit skeptical about the scenario as presented - even though the underlying question will have to be dealt with by Purism, and clearly they are on it.
Who knows? It could be an urban legend. The scenario seems believable and possible (even likely to occur eventually if not already) to me, which is why I referred to it. Every time a new technology comes along, the powers that be always abuse it until the courts stop them. If the courts don’t stop them, they keep doing it. The courts don’t typically rule until against law enforcement until after the abuses get bad enough. So we can almost (but not conclusively) say that this has already happened.
As a matter of fact it has already happened. Now, what that guy was doing on his bike probably looked a little suspicious (since location tracking doesn’t prove what exactly you’re doing). I don’t want to derail this thread into a big dumb argument about what specific drastic reforms and restructuring is needed for significant institutions of society and of course what names we need need to call people based on their dumb suggestions because that’s what’s MOST IMPORTANT IN ANY POLITICAL DISCUSSION because the important thing to realize is that anything you might do can look suspicious to anyone else.
I don’t think Purism can do much (aside from distributing software that processes location data on device). Since Purism doesn’t own the cell towers, they probably can’t stop AT&T/T-Mobile triangulating your position and logging it constantly. Which is why the Librem 5’s switches are important.
you see, to me this sort of topic seems to be SO complex and riddled with traps that i’d rather not express ANY opinion publicly since ‘everything-you-say-can-and-will-be-used-against-you’ in a court-of-law-but-not-only …
all i’ll say is that i’m glad the L5 exists but not so much about AweSIM … centralizing collection of information even IF it’s kept private is just a ticking time bomb … as long as immoral people exist there is always something waiting to happen
By law (YMMV but this is US-only anyway at this stage) this information must be collected. So it’s a question of whether your MNO/MVNO collects it and stores it centrally or whether Purism does. At least, from a privacy perspective, Purism’s honeypot is smaller, much smaller.
Discussed a fair bit in earlier topics (q.v.). At this stage: let’s get the phone out the door.
Three circles around the victim’s house. It probably looked as if he was casing the joint.
Worse still, perhaps because he was on a bike and therefore traveling more slowly than a car normally would, it looked as if he was slowly cruising past in a car in order to conduct maximum surveillance of the victim’s house.
The cyclist should most of all be angry at Google. Google collected all this information without his informed consent. If Google didn’t collect it then it wouldn’t be available for fishing expeditions by law enforcement.
That’s why we need to escape the Apple/Google duopoly …
PS If anyone is actually intending to commit burglary, leave your freaking phone at home. That way, ironically, the evidence from Google or Apple will be exculpatory.
)
