Law enforcement agents need a search warrant before they can seize a person’s historical location data stored by his cellular service provider, the Supreme Court of the United States (SCOTUS) ruled on June 22, 2018. The ruling was hailed as “the most consequential privacy decision of the digital age” by the American Civil Liberties Union. Read on to learn why…

4th Amendment Lives, says Supreme Court

The case before the Court, Carpenter v. U.S., involved a suspected burglar who was convicted based upon months’ worth of location data obtained from his phone company without a warrant. The data gave the FBI nearly perfect knowledge of where Timothy Carpenter went, what he did, who he associated with, and more. Indeed, Chief Justice John Roberts wrote in the majority’s decision,

“(W)hen the Government tracks the location of a cell phone it achieves near perfect surveillance, as if it had attached an ankle monitor to the phone’s user.”

The Court rejected the government’s long-successful argument that when a person voluntarily lets a third party store data about him, the 4th Amendment does not protect him from the warrant less seizure of that data from the third party. This legal doctrine was established in the mid-70s. Today’s ruling, the details of which can be read at SCOTUSBlog, recognized that times and tech have changed dramatically.

“There is a world of difference between the limited types of personal information addressed” by the old dogma, “and the exhaustive chronicle of location information casually collected by wireless carriers today,” the decision reads. Forty years ago, “few could have imagined a society in which a phone goes wherever its owner goes, conveying to the wireless carrier not just dialed digits, but a detailed and comprehensive record of the person’s movements.”

The Court ruled that the vast amount of location data the FBI collected from Carpenter’s phone company – over 13,000 data points spanning several months of his activities – painted such an intimate and extensive picture of his personal life that it deserved the 4th Amendment’s protection against warrant less seizure. Therefor the location data could not be used to prosecute Carpenter.

The Carpenter ruling applies only to location data collected and stored by a cellular service provider. But the Court’s reasoning will be applied to a virtually limitless range of cases in which third parties collect and store any type of data about an individual. Armed with this decision, privacy advocates can argue that all the personal data that Facebook, Google, credit agencies, banks, et. al., collect about you is now off-limits to law enforcement unless it is obtained pursuant to a valid warrant issued by a court.

The 4th Amendment and Limiting Factors

The 4th Amendment to the U.S. Constitution states: “The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized.”

Note that the Court did not overturn the third-party doctrine outright. Instead, the Court decided that there must be a limit to the scope of personal data obtainable without a warrant, and that it was clearly exceeded in Carpenter’s case. Future rulings may decide that the government can use one data point, or a day’s worth of data points, or some other measure of data’s scope, without obtaining a warrant.

The limiting factor seems to be, “Does the scope of data collected amount to invasion of the person’s privacy?” If, for example, Carpenter’s location data revealed that he (or his phone, at least) was regularly at a particular place at the same times a drug rehabilitation group held its meetings at the same place, it would be reasonable to infer that Carpenter was a drug addict in recovery. That inference, arguably, would be a private matter deserving of the 4th Amendment’s protection, so data which supports the inference would have to be seized pursuant to a court order that complies with the 4th Amendment’s requirements.

Yes, it’s complicated, and there are many wrinkles to be ironed out case by case. But the government’s long-standing position that “all your data are belong to us” is no longer acceptable in court. This a huge victory for privacy rights in the United States!

As for Timothy Carpenter, he may be a hero to privacy advocates, but it seems he’s no angel. A description of his role as ringleader of a gang of armed robbers can be found on this page from Findlaw.com. Carpenter was convicted and sentenced in April of 2014 to 116 years in prison, and even though he won his case at the Supreme Court, he will likely remain incarcerated.

That’s because of the “Good Faith Exception to Exclusionary Rule.” According to the Legal Information Institute, The Exclusionary Rule bars the use at trial of evidence obtained pursuant to an unlawful search. If officers had reasonable, good faith belief that they were acting according to legal authority, such as by relying on a search warrant that is later found to have been legally defective, the illegally seized evidence is still admissible under this rule.

The ACLU argued Carpenter’s case before the SCOTUS, and deserves much of the credit for this victory.

We Are Not Out Of The Woods Folks.

ARE WE SAFE? NO!

Is this limited to just your cellphone? NO!

This will take time. We need to remember our computers and tablets are vulnerable and use various Hot spot Wi-Fi /cell signals and are not protected through this act, and are open for anyone to see with the right hack or so called Court Ordered Warrant! Be careful how you share your information be secure. But in the mean time, A followup story on how to make sure your privacy is secure thru your router and electronic devices coming soon.

Have a great week

Zi Staff

A deadly serious threat is on the loose: a virus called VPNFilter that infects business and consumer-grade routers to steal passwords and other sensitive data from any device on a network served by an infected router. Here’s what you need to know now…

What is VPNFilter Malware?

In addition to stealing passwords, VPNFilter also degrades (decrypts) secure HTTPS connections to steal data from them and pass along new infections to the HTTPS connections’ destinations. Part of VPNFilter can survive a router reboot and then download other malware modules. It even has a “kill switch” that can destroy the firmware of its host router.

Already, VPNFilter has infected an estimated 500,000 to 1,000,000 routers worldwide, according to Cisco Systems’ Talos Intelligence threat research division.

The FBI attributes VPNFilter to the “Fancy Bear” Russian hacker group, which is implicated in the 2016 hack of the U.S. Democratic National Committee’s network and other political and industrial espionage campaigns. Political news site, The Daily Beast, reported on May 23rd that the FBI seized a key server used by the VPNFilter botnet. But that hardly slowed the havoc being wrought by VPNfilter because of the diabolically ingenious way it is designed.

VPNFilter consists of three modules or stages. The first module is a worm, a virus that rapidly slithers from one router to another, infecting each and replicating itself for further infections. Stage One also writes itself into a list of tasks that are performed by vulnerable routers each time they are rebooted, thereby ensuring that it will survive a reboot. Stage One’s next function is to facilitate other modules’ infection of the host router.

Stage Two is downloaded by Stage One if the former is not already present. Stage Two contains the “routine” spying functions that VPNFilter performs on each device connected to an infected router. It sniffs out passwords and other account credentials, contact lists, calendars with birthdays and other sensitive personal info. Stage Two can also execute any special instructions given to it by optional Stage Three modules, which may also be downloaded by Stage One.

Many Stage Three modules have been discovered since Talos Intelligence started tracking VPNFilter in 2016. For most of that time, it appeared that VPNFilter targeted relatively few but critically important industrial control systems. The infection of consumer routers was thought to be recruitment for a botnet whose primary target was the control systems.

Plenty of Fish

But recent modules show that VPNFilter’s masters are after many more and smaller prey, including your little home network.

One new module can alter incoming data before it’s displayed to users; for example, it can make your bank account balance look normal when in reality the account is being drained dry. Others can steal PGP encryption keys, SSL certificates, and other authentication credentials. Still others can inject malicious payloads into streams of outgoing data to spread VPNFilter and its custom payloads to destination devices.

Libraries of Stage Three modules are scattered all over the Internet. A clever clue to the IP addresses of such libraries was found hidden in the metadata of image files stored on Photobucket. When that resource was removed, Stage One moved on to backup sources.

If Stage One cannot find a library of Stage Three Modules it can go into “listening mode,” passively awaiting new instructions from its human masters. Those instructions may include the locations of libraries, or malicious payloads themselves, or a “kill switch” instruction that causes Stage One to erase itself and the entire file system of its host, effectively turning the router into a brick.

Who Is Vulnerable?

Only routers that run specific Linux-based firmware are vulnerable to VPNFilter. The bad news is that a lot of manufacturers use such firmware on many consumer-grade routers. Note that this vulnerability has nothing to do with the operating system on your computer. It’s the code running inside your router that’s at issue here.

I was going to include a list of vulnerable devices from vendors including Asus, D-Link, Huawei, Linksys, Mikrotik, Netgear, QNAP, TP-Link, Ubiquiti, Upvel, and ZTE, but there are over 100 known so far, and the list is growing. At this point, it seems better to assume that your router is on the list of vulnerable devices.

There’s one important caveat, though. VPNFilter is lazy, so it only tries to break into routers that have the default (factory-supplied) login credentials. If you are certain that you’ve secured your router with a password of your own choosing, then VPNFilter will move on to other targets.

I want to remind readers that your WiFi password (the one you use to connect your computer, tablet or phone to your router) is not the same as your router’s admin password. They are distinct; the router password is used to login to the router’s setup screens, where one can configure wifi passwords, and other settings.

What To Do About VPNFilter

Some security experts recommend that all router owners, not just owners of routers on this list, perform a factory reset on their routers. A reset restores a router’s firmware to the version that was shipped with it; so VPNFilter wlll be erased for certain, if it was present.

Most routers have a RESET button on the device. Depressing that button for 10 (or sometimes 30) seconds will reset the router’s login credentials, but may or may not affect the firmware. Because there are so many different router vendors and models, I recommend that you search online for instructions on how to reset your router’s firmware, if you decide to do so.

Next, change that default admin password! The Stage One worm works at lightning speed. It knocks on a router’s door just once, with the default password. If the worm gets no answer, it is vanquished. VPNFilter has gotten as far as it has by relying on the laziness of consumers and of professional IT workers who should know better. Change the router’s password, dang it! If you don’t know how to do that search online, or ask your Internet provider for help.

If your router is more than 4-5 years old, consider replacing it rather than resetting its firmware. The value of an antique router is negligible, a new one can be had for less than $50, and you will have peace of mind knowing that it’s factory-fresh. Your internet provider may even swap out your old router for a new one upon request.

Bottom line: VPNFilter is powerfully malicious; highly resilient; and spreading like wildfire. This is not a drill. Take all the precautions you can.

Have a Great Week From all of us on the ZI Staff.