Eavesdropping through your cell phone

FBI taps cell phone mic as eavesdropping tool discusses a federal court case that has scary implications. In a recent court case it was disclosed the FBI has developed a new form of eavesdropping: remotely activating a mobile phone's microphone and using it to eavesdrop on nearby conversations. Further the eavesdropping works even if the phone is turned off, because some phones do not turn fully off unless you remove the battery. That's because some phones have an alarm feature that wakes the phone even if it's turned off.

This was disclosed in a court case against two alleged mobsters, John Ardito and his attorney Peter Peluso. Further details are in an opinion written by U.S. District Judge Lewis Kaplan. The judge ruled this was legal under U.S. Code TITLE 18, PART I, CHAPTER 119, section 2518. And they did get proper wiretapping approval from the judge.

The ruling doesn't state how the "roving bug" got installed, simply that it was. Hover the CNET article refers to a Financial Times article, Use of mobile helped police keep tabs on suspect and brother describes several privacy vulnerabilities which were exploited by European law enforcement in a different case.

First, cell phone operators are able to track the location of a phone to within 2-3 meters (about 5-10 feet for American readers). They do this through triangulating based on signals from three or more cell towers. Law enforcement can request tracking of a cell phone, and tracking is done in real time.

Second, cell phone operators can tap any phone call.

Third, cell phone operators can remotely install software into a handset, without the knowledge of the owner of that cell phone.

While it's nice and interesting that law enforcement can do this, this has to be a vulnerability that nefarious third parties can also exploit. This is because the mechanisms the cell phone operator uses are probably not secured well enough to prevent others from also using those mechanisms. As one of the experts quoted in the Financial Times article says:

"We have inadvertently started carrying our own trackable ID card in the form of the mobile phone," said Sandra Bell, head of the homeland security department at the Royal United Services Institute.

The CNET article gives some convincing evidence that the case they're reporting on must have relied on remotely turning on the cell phone. For example the Mafioso involved in this case were already suspicious of being tailed, so any attempt to physically borrow their cell phone to implant a physical "bug" would have been doubly suspicious.

This BBC article, 'This goes no further...', discusses routine use of remote monitoring through a cell phone. It has even been used to listen to the UN Secretary General Kofi Annan's conversations through his cell phone. There is no way anybody had an approved wiretap order to legally listen through his cell phone.

First, do no evil?

Google sure wants us to believe they are moral and upstanding. One of their first questions in any decision is supposedly an evilness rating, with their corporate mantra to "do no evil". But they're a corporation, and as a corporation they're only in it for the money. Or so it seems.

Google developing eavesdropping software: The idea is that as computers more frequently have built in microphones (and cameras) that Google can use the audio from the microphone to select context-relavent advertising based on the sounds in the background. Is the person watching television while playing on the Internet? Google can listen to the television program, and through the magic of software determine what you're watching, the relavent keywords for that show, and then pop up relavent advertising on your computer screen.

Um.. so Google is going to listen, through the microphone on your computer, to the sounds wherever you are .. and they're going to try to understand what's going on around you based on those sounds? And it's all for the purpose of showing you advertsing?

So, just how long before someone like George W. Bush gets a brilliant idea that the NSA should be wiretapping personal computers through the built-in microphone?

And, what about those video cameras that are more and more often built into computers?

Just how safe from invasions of privacy are we as the devices are more complex? How do you know whether the microphone or camera built into your computer is 'on'? Maybe the microphone is on and recording and there's no visual indication? And if it's on and recording without visual indication, then where is the recording going?

For Windows users, the rampant spyware issue ought to give pause for thought ... spyware gets surreptitiously installed on your computer, in some cases simply by having your computer on the internet. Spyware can do anything, and it seems "anything" could include activating the microphone (and/or camera) built into the computer, and sending the recordings over the Internet.

Getting back to Google ... they sure make nice about this, saying their software only digests the audio and doesn't send the actual recordings back to the mothership. Instead the mothership just receives tags giving them knowledge of the sort of content, not the actual sounds. That sure makes me feel better, right?

How can we independantly determine that's really what Google's software is doing? And, there's potentially a zillion other bits of traffic that your computer does without your knowledge.