News for hackers. Stuff that matters.
Re:California “Kill Switch” Bill Could Be Used to Disrupt Pr... by anigbrowl on Tuesday August 19, 2014 @03:15PM (#8199207)
This is a rather irresponsible article. The bill as passed by the CA legislature [1] addresses this possibility. In section 2, Section 22761(e) of the code limits the scope of law enforcement use in accordance with section 7908 of the Public Utilities Code [2], which prohibits interruption of communication by law enforcement in anything other than a hostage or barricade situation, ie an ongoing standoff between police and criminals or another situation involving immediate danger of death or great harm (but requiring court submissions within 6 hours). Any other situation, including one where public safety is concerned (such as a protest) requires a warrant to be obtained in advance, subject to quite stringent conditions designed to limit the scope of the communications interruption. You should read it in full to understand all provisions, rather than relying on this summary.

Now, this set of rules is not perfect and could conceivably be abused by police or some other entity. But the cdt.org story ignores these rules completely and leaves readers with impression that legislators wither haven't thought about it or don't care. In reality the law is designed to prevent exactly this kind of abuse.

1. http://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?...

2. http://www.leginfo.ca.gov/cgi-bin/displaycode?section=puc&gr...

Re:California “Kill Switch” Bill Could Be Used to Disrupt Pr... by lemonlyman87 on Tuesday August 19, 2014 @04:05PM (#8199480)
The blog post gives a full discussion of the extent to which the kill switch can be co-opted by law enforcement, and I think does so in a fair manner. It directly references both the bill's requirements for police use and PUC 7908.

Your comment, on the other hand, does not accurately describe the relevant law.

PUC 7908 states that "If a governmental entity reasonably determines that an extreme emergency situation exists that involves immediate danger of death or great bodily injury and there is insufficient time, with due diligence, to first obtain a court order, then the governmental entity may interrupt communications service without first obtaining a court order as required by this section."

Your statement that PUC 7908 prohibits interruption only in hostage or barricade situations is incorrect; those are referred to in PUC 7907, which discusses cutting phone lines. PUC 7908 involves cutting cell service, and is more broad - it uses the language quoted above.

I could easily see this applied to a protest; police say a protest will lead to looting (e.g. Ferguson), perhaps they even see plans for flash mob robbery on social media. On the basis of this, they brick every phone in a protest zone, undercutting protest organization and limiting demonstraters ability to film police abuse on smartphones.

I do not know what the legislators intended; maybe they don't know about the issue, maybe they don't care, maybe they think this is an adaquete solution and are wrong. I don't try to define their intent here, I'm simply trying to point out a very real problem with this law.

Re:California “Kill Switch” Bill Could Be Used to Disrupt Pr... by anigbrowl on Tuesday August 19, 2014 @06:01PM (#8200062)
7908(3)(C) incorporates s.7907 by reference.

(C) "Interrupt communications service" does not include any interruption of service pursuant to an order to cut, reroute, or divert service to a telephone line or wireless device used or available for use for communication by a person or persons in a hostage or barricade situation pursuant to Section 7907. However, "interruption of communications service" includes any interruption of service resulting from an order pursuant to Section 7907 that affects service to wireless devices other than any wireless device used by, or available for use by, the person or persons involved in a hostage or barricade situation.

Re:California “Kill Switch” Bill Could Be Used to Disrupt Pr... by lemonlyman87 on Tuesday August 19, 2014 @09:19PM (#8200694)
Yes, that provision does state that any type of wire cut conducted pursuant to 7907 that cuts cell service is also labeled as denial of cell service as discussed in 7908, but denial of cell service is not limited to such situations - there can be other means of shutting down cell service, such as police co-opting a kill switch.

More importantly, this subsection certainly doesn't change the fact that your above description of 7908 as a law that "prohibits interruption of communication by law enforcement in anything other than a hostage or barricade situation" is completely inaccurate.

It is broader, and could apply to protests if there is a claim of imminent risk of great bodily harm, as police have been claiming for the last week during mistreatment of protesters and journalists in Ferguson.

Re:California “Kill Switch” Bill Could Be Used to Disrupt Pr... by discardorama on Tuesday August 19, 2014 @04:26PM (#8199595)
You're not considering the second-order effects. Sure, the law in Cali says police must do X, Y and Z before killing the phones. But the phones already have the kill switch; and, because of convenience, all phones sold in the country will have this kill switch. Now what's to prevent the police in, say, Ferguson MO to just nuke everyone's phones in a region? California law doesn't apply in MO, and the police there will be free to do whatever they want with this switch.
Re:California “Kill Switch” Bill Could Be Used to Disrupt Pr... by DSMan195276 on Tuesday August 19, 2014 @04:56PM (#8199777)
Counter-argument: If what you're saying is really how the law works, then why is CA attempting to pass this at all? By your logic, if they don't pass it then they can use it all they want, but if they do pass it then there are restrictions.

The entire reason for attempting to pass a law like this is because it's assumed it would be illegal for the police to do it without a law passed specifically saying they're allowed to (Like everything else). If the police in MO did this, they'd have tons of lawsuits against them.

Re:California “Kill Switch” Bill Could Be Used to Disrupt Pr... by talmand on Tuesday August 19, 2014 @05:06PM (#8199821)
The argument is that they would have to pass the law first to compel the manufacturers to implement the switch in every phone. Then any other agency outside that law's jurisdiction can take advantage of the presence of the switch with little oversight.

It would still likely result in lawsuits anywhere it was used regardless of the law.

Re:California “Kill Switch” Bill Could Be Used to Disrupt Pr... by anigbrowl on Tuesday August 19, 2014 @09:12PM (#8200685)
That doesn't explain why the bill includes all the restrictions on government, though. If the aim was to empower government, they could simply have been omitted.
Re:California “Kill Switch” Bill Could Be Used to Disrupt Pr... by talmand on Wednesday August 20, 2014 @01:43PM (#8203427)
I haven't seen anyone claim the bill empowers the government implementing the law beyond what it states.

The bill includes restrictions on the government at the level that falls within the jurisdiction of the law. The argument is what about jurisdictions that have no such law nor restrictions and take advantage of the existing hardware feature?

If we're talking Federal law then what you say makes sense, but as far as I know this is about a state law.

Re:California “Kill Switch” Bill Could Be Used to Disrupt Pr... by lemonlyman87 on Tuesday August 19, 2014 @05:11PM (#8199850)
I think the main reason they're passing the bill in general is a genuine desire to deter smartphone theft, and the result is a very bad policy outcome.

But keep in mind absent this law there is no mandatory kill switch in phones in the first place, so the possibility of police use en masse aginst protesters - regardless of whether law permits such co-opting or is silent on the subject - becomes much lower.

Re:California “Kill Switch” Bill Could Be Used to Disrupt Pr... by DSMan195276 on Tuesday August 19, 2014 @08:07PM (#8200508)
Personally, I just read the Bill a bit closer, and this is right in section 2.b.1:

"The smartphone shall, during the initial device setup process, prompt an authorized user to enable the technological solution. The technological solution shall be reversible, so that if an authorized user obtains possession of the smartphone after the essential features of the smartphone have been rendered inoperable, the operation of those essential features can be restored by an authorized user."

And section 2.2:

"An authorized user of a smartphone may affirmatively elect to disable or opt-out of enabling the technological solution at any time. However, the physical acts necessary to disable or opt-out of enabling the technological solution may only be performed by the authorized user or a person specifically selected by the authorized user to disable or opt-out of enabling the technological solution."

And Section 1.g:

"As a result, the technological solution should be able to withstand a hard reset or operating system downgrade, come preequipped, and the default setting of the solution shall be to prompt the consumer to enable the solution during the initial device setup. Consumers should have the option to affirmatively elect to disable this protection, but it must be clear to the consumer that the function the consumer is electing to disable is intended to prevent the unauthorized use of the device."

Personally, as long as those things are both true and implemented correctly I don't see any reason to argue. If disabling it on the phone doesn't work, everybody with those phones could sue the company making them (If they live in CA...). Outside of CA, they could legally sell phones with kill-switches inside with no disable option, but that's legal to do right now anyway so this law wouldn't change that. And, seeing as in CA it'd be illegal to sell them without the disable option, I don't see why they would spend the extra money to design a version without a disable to sell outside of CA, so it probably wouldn't change things much.

Re:California “Kill Switch” Bill Could Be Used to Disrupt Pr... by anigbrowl on Tuesday August 19, 2014 @06:05PM (#8200080)
The top post is devoted to a discussion of those second-order effects. I'm pointing out that it ignores some rather significant checks upon government's use of this.

the police there will be free to do whatever they want with this switch.

Why, do they not have any law about interfering with communications in MO? If not, why hasn't cellphone service been shut down there already?

Re:California “Kill Switch” Bill Could Be Used to Disrupt Pr... by ASneakyFox on Wednesday August 20, 2014 @03:58AM (#8201455)
It doesn't have to be legal for the government to do it. Look at the nsa.. any one who wants to give the government a kill switch to your phone is very uninformed. This level of protection for a phone makes zero sense.