CEO who sold phone encryption to take prison time

Not a lot of information here, but saw this:

https://arstechnica.com/tech-policy/2018/10/ceo-that-sold-encrypted-blackberry-phones-to-drug-dealers-pleads-guilty/

I’m not sure how I feel about this. I’m a bit concerned what kind of precedent this may set with some of the details of this case, but it may depend on information not provided in this article.

He admitted that it was used to move a bunch of cocaine, so it sounds like he both made a very substantial mistake in opsec and also compromised zero knowledge. He knowingly facilitated illegal activity. It’s that intent, that knowledge, that makes it illegal.

1 Like

Right, but I’m less concerned about this particular case and more concerned about how some of the details of this may allow the decision to be used for hitting broader targets.

For instance, this seems to be a Canadian being charged by the U.S. government for at least some actions done in Panama and Hong Kong.

For another, this is about encryption and wiping technology, something we know the U.S. government (and others) aren’t fond of if they don’t have back doors for it.

And as far as I can tell from the article, they “facilitated illegal activities” by making a good encryption/privacy service, which could be used for any number of purposes. I don’t see how their service could actually do the drug distributions itself, it only allows for confidence in communications.

I’m not even saying these guys are squeaky clean either. But it’s not an uncommon strategy to go after certain weaker targets first to set precedent for going after other, unrelated targets. When you have a case that says, “providing encryption is an illegal assistance to other illegal activities”, it can be used in other cases to support a claim that, “providing encryption is an illegal activity” or using encryption is illegal.

Likewise, what is illegal can be a bit questionable. These guys are smuggling drugs, but what about journalists “illegally” reporting on governments nefarious activates to international communities? Or ‘illegally’ exposing a police officer’s use of excessive force?

Like I said, knowledge and intent matters. Take Backpage dot com (removed link, you don’t want to click it by accident). They were covered by zero knowledge for years, and only successfully indicted after FOSTA passed and the government could prove that they actually interfered in ads for prostitutes that appeared to be underage, telling advertisers they couldn’t say “looks like a schoolgirl” or whatever, censoring terms that indicated the hooker was underage, and then posting the censored ads. They could no longer say they were a common provider, they compromised zero knowledge.

2 Likes

and only successfully indicted after FOSTA passed

Minor clarification, they didn’t need FOSTA for their enforcement actions against Backpage. It was actually noteworthy that they didn’t use it, even though the timing and content were so similar.

I’m a bit concerned what kind of precedent this may set

None, since this was a plea deal.

For instance, this seems to be a Canadian being charged by the U.S. government for at least some actions done in Panama and Hong Kong.

According to the indictment, they were selling phones in the US. Specifically, southern California. This establishes jurisdictional standing, regardless of where the people were from. US laws were broken in the US.

For another, this is about encryption and wiping technology

making a good encryption/privacy service, which could be used for any number of purposes.

This is about selling secure devices with the explicit purpose of evading law enforcement to people known to be engaging in criminal activity. None of the charges are directly related to the technology (i.e. encryption and wiping are both legal), nor where they located their servers (offshore servers are legal, too).

I totally understand your concern about this case, but these people are pants-on-head retards.

The indictment also mentions that they did not generically distribute the devices, instead using a referral/vouch system from existing customers. This is a key part of the case. Apple and Google sell phones that could be used by drug dealers, but Apple and Google don’t market exclusively to known drug dealers. That’s the element that makes this case criminal.

Pro-Criminal Tip: Never market directly to criminals. Market pro-privacy things to everybody. Signal to noise ratio matters.

2 Likes

Blunter than I put it, but yeah. They’re dumbasses.