Reporters: when Apple says it hands over “metadata”, ask them what the hell that means.
Every time you start an iMessage conversation with someone, Apple logs the phone number. That’s “metadata”.

Did Apple turn that metadata over in this case?
Ok, following some research. It appears there are three orders that courts/law enforcement can use to obtain metadata. This is complex. Sheesh. 1/
A subpoena from a grand jury *when sent to a Telco* will get you subscriber information and text messaging/call metadata.

However when sent to a tech company it will not get you this info. Instead you get subscriber ID and recent IP addresses. 2/
To get text messaging or email to/from metadata *from a service like Apple* (as opposed to a Telco) you need to issue a 2703(d) order. That’s not what was issued in this case. (That we’ve seen reporting on, so far.) 3/
(This difference in standards between telcos and tech companies is an artifact of how their services evolved. It’s stupid.) 4/
None of this entitles you to actual content, which requires a warrant. We have no idea if any 2703(d) orders or warrants were issued in this case (yet). Seems reasonable that there were some. 5/
A theory of this case is that the DoJ found one person and somehow dumped their call and email metadata history. They then went to providers with a list of phone numbers and email addresses to figure out who owned them. 6/
Notice that a subpoena would be enough to obtain the call/SMS logs from that target’s telco. But the list also includes email addresses.

DoJ would need a 2703(d) order to obtain email addresses, which were also included in that list. 7/
PS If you haven’t noticed that I’m speculating wildly and don’t know anything about this legal are, please be aware of this. I expect that smarter folks will correct me. 7/
Another weird fact of the case is that so many of these numbers belonged to Congress members/staffers/family members. So it this theory is correct, the initial target was probably tightly connected to Congress. Not some random outsider. 8/
Anyway if this theory is true, then there are more orders out there which haven’t trickled out. We’ve heard from Apple and Microsoft so far. What does Google have to say?

• • •

Missing some Tweet in this thread? You can try to force a refresh
 

Keep Current with Matthew Green

Matthew Green Profile picture

Stay in touch and get notified when new unrolls are available from this author!

Read all threads

This Thread may be Removed Anytime!

PDF

Twitter may remove this content at anytime! Save it as PDF for later use!

Try unrolling a thread yourself!

how to unroll video
  1. Follow @ThreadReaderApp to mention us!

  2. From a Twitter thread mention us with a keyword "unroll"
@threadreaderapp unroll

Practice here first or read more on our help page!

More from @matthew_d_green

12 Jun
This is where we’re at. The responsibility for fighting surveillance abuse falls to tech companies, because nobody even pretends that the Federal government and courts are functional moral actors.
I have to assume that right now Apple and other tech companies are developing procedures to identify subpoenas that are aimed at Congress, on the assumption that the DoJ can’t be trusted to tell them.
“Well, we only handed over metadata, not content.”

You handed over a list that could contain every phone number House Intelligence Committee members ever spoke to or texted with, and you think that makes it ok?
Read 4 tweets
11 Jun
“But iMessage is end-to-end encrypted!”
Also I think it’s amazing that in five years we’ve gone from “if you haven’t committed a crime you don’t need encryption” to “US opposition lawmakers have their texts searched.”
Quick reminder: Apple could fix this in a heartbeat by adding an “end to end encryption for iCloud backup” setting (the tech is already in place), but they don’t. Even for those who want it.
Read 7 tweets
9 Jun
Oh wow, how did I miss this one. Tricking browsers into uploading their secret cookies to FTP sites, because the two servers share a TLS certificate.
Really in-the-weeds technical discussion of mitigations by @FiloSottile.
I’m going to forget about TLS here for a moment, and point out that the best way to mitigate a lot of these attacks is just to replace cookies entirely.
Read 4 tweets
7 Jun
Oh good the FBI recovered the Colonial Pipeline ransom by tracing the wallet. Ransomware is solved!
Narrator voice: ransomware was not solved.
Looks like ransomware operators are going to have to do more than, well, the barest minimum in order to protect the privacy of their payments.
Read 12 tweets
7 Jun
The FSB’s encryption software seems to be pretty much in character. krebsonsecurity.com/2021/06/advent…
I know this is a bit of a stereotype, but why is Russian crypto always so weird?
“We don’t use a normal random number generator, we use a gerbil connected to a hot cup of tea. Also use our ciphers where the S-Boxes are ‘random’ meaning they actually aren’t.”
Read 4 tweets
3 Jun
Dear researchers: the hard part of problems like “traceability” is not the part where you build a mass surveillance system. Building mass surveillance systems is *easy*.
The hard part is building systems that don’t utterly shatter the security guarantees that the private system offered, and don’t have caveats like “obviously this can be abused, stopping that is future work.”
When I go out to see what our research community has been doing in this area, I expect them to understand what makes this research problem hard. Not to find slides like this one.
Read 7 tweets

Did Thread Reader help you today?

Support us! We are indie developers!


This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3/month or $30/year) and get exclusive features!

Become Premium

Too expensive? Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal Become our Patreon

Thank you for your support!

Follow Us on Twitter!

:(