The FBI Vs. Signal | Google Geofence Ensnares George Floyd Protesters | Capitol Rioters' Mobile Locations Exposed

Plus: iOS 14.5: What You Need To Know About Apple’s Exciting New iPhone Unlock Feature

In a recurring feature in this newsletter, I'm publishing court documents that you won't have seen anywhere else, ones that paint a picture of what police surveillance looks like in the real world. I call it The Wire IRL.

This week's edition looks at what happens when police come up against encrypted communications in the world's hottest messaging app, Signal.

Last year, the FBI was investigating a gun trafficking operation in New York. As part of that, they obtained the phone of a suspect and within were Signal chats, in which they discussed not just weapons trades but attempted murder too, according to documents filed by the Justice Department. How did the cops get access to those supposedly super-secret messages?

Metadata in those screenshots indicated that not only had Signal messages been decrypted on the phone, but they had been accessed on a locked iPhone via a “partial AFU.” That latter acronym stands for “after first unlock” and describes an iPhone in a certain state: an iPhone that has been unlocked once and not turned off, but is in a locked state when the police had acquired it. An iPhone in this state is more susceptible to having data inside extracted because encryption keys are stored in memory. Any hackers or hacking devices with the right iPhone vulnerabilities could then piece together keys from that memory and start unlocking private data inside the device.

The same could go for any encrypted communcations app, like WhatsApp. So there's no need to abandon Signal. Perhaps just try to stay out of the way of the FBI.

Thanks to Seamus Hughes at the Program on Extremism at the George Washington University for the initial tip. You can read the court documents here and here, if you want to learn more about how the FBI is accessing encrypted communications.

You can also read my story on Forbes here.

And if you have any tips on government surveillance or cybercrime, drop me an email on tbrewster@forbes.com or message me on Signal at +447837496820.

The Big Story

The Stories You Have To Read Today

TechCrunch reports on a warrant for a Google geofence search in an area of Minneapolis where protesters had gathered after the death of George Floyd. Such warrants demand Google provide information on customers who were in a given area at a given time. Considering the tensions around the George Floyd protests, this particular warrant comes with some real privacy concerns.

The New York Times got its hands on a database of mobile phone locations during the Capitol Hill Riots. It shows 130 devices inside the Capitol and even though the data was supposedly anonymized, it was possible to identify some of the phones' owners.

Nicole Perlroth has just released a new book on the cyber arms trade and as part of that published the story of  David Evenden, a former National Security Agency analyst who ended up hacking for a U.A.E. contractor. When, during one espionage project, he saw the emails of Michelle Obama, he knew he was doing something wrong.

Instagram has been taking tough action on the OGUsers community, made up of hackers who use illegal means to get hold of high-value usernames across different apps. In a particularly bold move, the Facebook-owned company has identified some users and threatening to sue them, Vice reports.

An Android barcode scanning app was turned malicious to serve up some super-aggressive ads. It had more than 10 million users before being removed from Google Play, according to cybersecurity firm Malwarebytes.

Winner Of The Week

Facebook has hired Ben Nimmo, widely regarded as one of the finest bot hunters in the world. Previously employed by Graphika, Nimmo has uncovered a load of foreign disinformation campaigns, including those from Russia, which has made him a target too.

Loser Of The Week

Clearview AI, a facial recognition company that caused controversy by harvesting people's faces from the web, has been declared illegal by privacy commissioners in Canada.  The U.S. company collected photos of Canadians without their consent, according to CBC. "What Clearview does is mass surveillance and it is illegal," said federal privacy commissioner Daniel Therrien.