SHIT! FBI taps cell phone mic as eavesdropping tool (CNET)
 

FBI taps cell phone mic as eavesdropping tool

CNet | December 2, 2006
Declan McCullagh and Anne Broache

update: The FBI appears to have begun using a novel form of electronic surveillance in criminal investigations: remotely activating a mobile phone's microphone and using it to eavesdrop on nearby conversations.

The technique is called a "roving bug," and was approved by top U.S. Department of Justice officials for use against members of a New York organized crime family who were wary of conventional surveillance techniques such as tailing a suspect or wiretapping him.
Nextel cell phones owned by two alleged mobsters, John Ardito and his attorney Peter Peluso, were used by the FBI to listen in on nearby conversations. The FBI views Ardito as one of the most powerful men in the Genovese family, a major part of the national Mafia.

The surveillance technique came to light in an opinion published this week by U.S. District Judge Lewis Kaplan. He ruled that the "roving bug" was legal because federal wiretapping law is broad enough to permit eavesdropping even of conversations that take place near a suspect's cell phone.

Kaplan's opinion said that the eavesdropping technique "functioned whether the phone was powered on or off." Some handsets can't be fully powered down without removing the battery; for instance, some Nokia models will wake up when turned off if an alarm is set.

While the Genovese crime family prosecution appears to be the first time a remote-eavesdropping mechanism has been used in a criminal case, the technique has been discussed in security circles for years.

The U.S. Commerce Department's security office warns that "a cellular telephone can be turned into a microphone and transmitter for the purpose of listening to conversations in the vicinity of the phone." An article in the Financial Times last year said mobile providers can "remotely install a piece of software on to any handset, without the owner's knowledge, which will activate the microphone even when its owner is not making a call."

Nextel and Samsung handsets and the Motorola Razr are especially vulnerable to software downloads that activate their microphones, said James Atkinson, a counter-surveillance consultant who has worked closely with government agencies. "They can be remotely accessed and made to transmit room audio all the time," he said. "You can do that without having physical access to the phone."

Because modern handsets are miniature computers, downloaded software could modify the usual interface that always displays when a call is in progress. The spyware could then place a call to the FBI and activate the microphone--all without the owner knowing it happened. (The FBI declined to comment on Friday.)

"If a phone has in fact been modified to act as a bug, the only way to counteract that is to either have a bugsweeper follow you around 24-7, which is not practical, or to peel the battery off the phone," Atkinson said. Security-conscious corporate executives routinely remove the batteries from their cell phones, he added.

FBI's physical bugs discovered
The FBI's Joint Organized Crime Task Force, which includes members of the New York police department, had little luck with conventional surveillance of the Genovese family. They did have a confidential source who reported the suspects met at restaurants including Brunello Trattoria in New Rochelle, N.Y., which the FBI then bugged.

But in July 2003, Ardito and his crew discovered bugs in three restaurants, and the FBI quietly removed the rest. Conversations recounted in FBI affidavits show the men were also highly suspicious of being tailed by police and avoided conversations on cell phones whenever possible.

That led the FBI to resort to "roving bugs," first of Ardito's Nextel handset and then of Peluso's. U.S. District Judge Barbara Jones approved them in a series of orders in 2003 and 2004, and said she expected to "be advised of the locations" of the suspects when their conversations were recorded.

Details of how the Nextel bugs worked are sketchy. Court documents, including an affidavit (p1) and (p2) prepared by Assistant U.S. Attorney Jonathan Kolodner in September 2003, refer to them as a "listening device placed in the cellular telephone." That phrase could refer to software or hardware.

One private investigator interviewed by CNET News.com, Skipp Porteous of Sherlock Investigations in New York, said he believed the FBI planted a physical bug somewhere in the Nextel handset and did not remotely activate the microphone.

"They had to have physical possession of the phone to do it," Porteous said. "There are several ways that they could have gotten physical possession. Then they monitored the bug from fairly near by."

But other experts thought microphone activation is the more likely scenario, mostly because the battery in a tiny bug would not have lasted a year and because court documents say the bug works anywhere "within the United States"--in other words, outside the range of a nearby FBI agent armed with a radio receiver.

In addition, a paranoid Mafioso likely would be suspicious of any ploy to get him to hand over a cell phone so a bug could be planted. And Kolodner's affidavit seeking a court order lists Ardito's phone number, his 15-digit International Mobile Subscriber Identifier, and lists Nextel Communications as the service provider, all of which would be unnecessary if a physical bug were being planted.

A BBC article from 2004 reported that intelligence agencies routinely employ the remote-activiation method. "A mobile sitting on the desk of a politician or businessman can act as a powerful, undetectable bug," the article said, "enabling them to be activated at a later date to pick up sounds even when the receiver is down."

For its part, Nextel said through spokesman Travis Sowders: "We're not aware of this investigation, and we weren't asked to participate."

Other mobile providers were reluctant to talk about this kind of surveillance. Verizon Wireless said only that it "works closely with law enforcement and public safety officials. When presented with legally authorized orders, we assist law enforcement in every way possible."

A Motorola representative said that "your best source in this case would be the FBI itself." Cingular, T-Mobile, and the CTIA trade association did not immediately respond to requests for comment.

Mobsters: The surveillance vanguard
This isn't the first time the federal government has pushed at the limits of electronic surveillance when investigating reputed mobsters.

In one case involving Nicodemo S. Scarfo, the alleged mastermind of a loan shark operation in New Jersey, the FBI found itself thwarted when Scarfo used Pretty Good Privacy software (PGP) to encode confidential business data.

So with a judge's approval, FBI agents repeatedly snuck into Scarfo's business to plant a keystroke logger and monitor its output.

Like Ardito's lawyers, Scarfo's defense attorneys argued that the then-novel technique was not legal and that the information gleaned through it could not be used. Also like Ardito, Scarfo's lawyers lost when a judge ruled in January 2002 that the evidence was admissible.

This week, Judge Kaplan in the southern district of New York concluded that the "roving bugs" were legally permitted to capture hundreds of hours of conversations because the FBI had obtained a court order and alternatives probably wouldn't work.

The FBI's "applications made a sufficient case for electronic surveillance," Kaplan wrote. "They indicated that alternative methods of investigation either had failed or were unlikely to produce results, in part because the subjects deliberately avoided government surveillance."
Bill Stollhans, president of the Private Investigators Association of Virginia, said such a technique would be legally reserved for police armed with court orders, not private investigators.

There is "no law that would allow me as a private investigator to use that type of technique," he said. "That is exclusively for law enforcement. It is not allowable or not legal in the private sector. No client of mine can ask me to overhear telephone or strictly oral conversations."

Surreptitious activation of built-in microphones by the FBI has been done before. A 2003 lawsuit revealed that the FBI was able to surreptitiously turn on the built-in microphones in automotive systems like General Motors' OnStar to snoop on passengers' conversations.

When FBI agents remotely activated the system and were listening in, passengers in the vehicle could not tell that their conversations were being monitored.

Malicious hackers have followed suit. A report last year said Spanish authorities had detained a man who write a Trojan horse that secretly activated a computer's video camera and forwarded him the recordings.

I knew they would use Onstar systems, but cellphones transmitting, thats a tad fucked.

I always said they where doing this but people think I am crazy, how about all them camera phones on peoples hips... You think they are not taking pictures when we don't know it? lol they got a birds eye view!

They are also data mining our pc's, keylogging everything and hacking our webcams :thumbsup

Um am I the only one who see's the HUGE market for this in the private sector?

Good gawd someone get me that cell phone mod. I will so need multiple banks to stay within the FDIC insurance limits for my merchant account dumps.

Your not lieing.... lol

yup, crazy potential!

A mod for it would be ultra easy to do, probably only take 5-10 minutes to install... the trouble is making it look ?pretty?. All that would really be necessary is to solder on a slide switch (or any switch for that matter). When in off position, make it so it hard ?cuts? the traces so that the mic is perm. off, no software is going to turn it back on. Then when you want to use the phone again, slide the switch into the on position.

Which brings me back to why I said the trouble is making it look ?pretty?. Most people have gotten so vain about their cell phones that you couldn?t just do a damn quick mod with a slide switch, oh no, you?d have to break out a dremel and cut a perfect little hole for some kind of fancy push button with a damn led in it. And with most phones being so tiny now even that would be hard to do? not to mention it?s not something most people could do by themselves, so they?d have to send their phone to you for you to do it? bleh.

Thats pretty interesting....

poop:1orglaugh :1orglaugh :1orglaugh

they are mixing facts and theoy together. no they cant record your convo's while your cell phone is off thats just silly.. they were saying under certain circumstances they "could" write software on certain types of phones that wouldmimic the " off' screen and dial out to another number and play the mic..

Toward the end of the article they make it seem as if an fbi agent can just call up the fbi enter a phone number and hear the convo from that phone.. that is impossible.

It is entirely possible software could be written to your phone by means of text message or phone call that would make this possible but on an individual basis phone by phone , not so broadly.

Actually, I just saw a show on TV recently showing how easy it is for corporate espionage to hack into a bluetooth enabled phone and have that phone call out to a phone number while that cell phone is in the person's pocket and you can listen to everything they are saying.

Gov is saving all emails too. ALL EMAILS!

They have been making phones with the capability of tracking you and listening to you when your phone is off and without the battery even in for 4+ years now. :2 cents:

Your phone has battery back up for this type of thing and you dont even know it :2 cents:

Well, I hope they are enjoying all of my stock quotes, penis enlargement, and hair growth e-mails as much as I do.

:1orglaugh

Yeah, all the penis emails have really hurt my sales, everyone thinks I sell pills or something thats a rip-off. :disgust

see my sig for info :2 cents:

Sounds like a secured and safe world for everyone.. :(

:1orglaugh :1orglaugh :1orglaugh

Well, if you're a terrorist/ child abuser/ murderer/ kidnapper/ bank robber who is under surveilance, then I understand your concerns.

With today's super computers, listening to everyone and flagging keywords is all too common I'm sure, just like all telephone calls have been for 20+ years.

According to the patriot act, any illegal activity is a terrorist act.. And eventually, who knows what laws will be passed making a lot of conversations "a terrorist act"..

Welcome to your brave new future :(

Sounds like you'll need a very thick tinfoil hat then. Better get saving up for one now for this supposedly inevitable police state you are going to get (in your dreams).

:1orglaugh :1orglaugh :1orglaugh

How do you breathe with your head in the sand?

the fbi had a warrant, they snuck into a hotel room, and PLANTED a mic INSIDE this guy's cell phone.

edit: this is a different story.. nevermind. this was on digg yesterday or so (the one i was talking about)

Well that's a non question.

Your country is not turning into a police state. The population is heavily armed. They will resist when the Democrats try to create a socialist dictatorship with zero dissention.

Well, the anti-gun shit just keeps on getting worse. If they ever successfully disarm the population, you will see tyrany like we've never dreamed of here in the states. :(

no they havent i just explained how that s impossible..

lol no it doesnt i have smashed enough cell phones to know EXACTLY whats inside and theres no spare battery..:1orglaugh

Like i said they are mixing "theory" with reality..

You cant remotely turn on a phone period unless there is something added to that particular phone..

As i explained . if you hacked the phone it is possible to install software that would make the phone "appear" to be off when its actually on.. It would still be using power thus limited in its capability. If you noticed your phone was dead everytime you went to use it you would get a new one.

My phone works for a while without the battery in , and can charge as well without the batter in :2 cents:

supposed to be for emergency backup and extra power in cold weather, which i really don't get how it helps.

I found the answer to microphone taps !
http://www.iidc.indiana.edu/cedir/kidsweb/a-z.gif

it's called sign language.. or you could always not say something you dont want anyone else to hear ;o

dasmn, my secret gay life is officially over.

well like i said there are certain phones that "could" be used like this on a phone by phone basis.. but they cant simply enter a phone number at fbi headquarters and listen to a convo , or even precisely track where you are ( unless the phone has this built in on an andividual basis )

Software is already available that you can load onto someone's phone and remotely activate the mic and stream the recordings. People use it to catch cheating husbands/wifes amongst other things.

Give them time, I'm sure new cellphone technology will fix that :winkwink:

i'm sure most of the "newer" phones already have such things in them , but until its compliant with all phones theres gonna be a loophole :)

Yeah, but most people get a new phone every 2-3 years it seems becuase not many phones even last that long these days. I have an older Nokia, but it still does what I need and I'm keeping it until it stops working :thumbsup

this technique was actually talked about on Defcon hacker convention in Las Vegas. Bluetooth hacking was used with a long range yagi antenna that some guys setup on a bridge over a freeway pass. They did secessfully listen in on conversations, 3 way, download phonebook, etc. All this with/o the cell holder finding out.

The onstar thing theirs tutorials for that too. All this is fairly public information if you search long enough and play with your software and hardware enough to get good results.

1984......

they made a movie about this sorta thing... called The Listening
http://imdb.com/title/tt0427461/

interesting article and a scary thought....just turned my cell off :)

This is US. So-called leader of human right and privacy. Extremely fucked up. Shame.

Fucking kooks.

lol.. @ all the people who think this isn't possible ... WAKE UP .. no tin foil .. to secret codes .. this is real and happening .. and for anyone to actually think it is "impossible" ...I'll say it again WAKE UP .. the newer your phone the more likely the possibility ..

My only concern i think at this point it .. uh .. am I gonna get billed for those eavesdropping minutes..???

what's wrong with the US these days. soon you are all going to be locked up.

bumping old threads is fun

Warning Long Read:

Ok this is something I know about. I worked for a top ranked cellular company as a repair/ programming tech for two years.

It is very possible to remotely activate a cell phones mic from a satellite.
Triangulation is the key word here.
Modern cell phones keep time and location by communicating with the transmission towers.

If you are traveling and try to make a call you may notice the phone saying searching for a signal.

It is sending out a signal to the closest radio tower. The tower in return sends out a signal to the phone. The phone then sends a signal back to the tower with its SPECIFIC ID SIGNATURE.

This is also how the phone keeps track of time. Cell phones automatically update time zones from a signal sent out by the towers.

Every cell phones unique ID is kept on file by the service provider.
In a PERFECT World this information should be kept private.

Technically a signal function can be sent from a satellite to the towers to activate the chip of a particular Cellular ID. Thus putting the phone in a state of an active call. (IE activating the mic).

In most cell phones there is a way to limit the ability to perform this type of tracking / eavesdropping.

In the settings look for something like Tower or TIME UPDATE function.
If this feature is turned off the phone will stop sending out the location signal to the towers.

Thus making it harder if not impossible to locate the phone.
You may have to look around a bit to find the function. Sometime it is labeled as an airplane or flight function. This is so the phone won't interfere with the in-flight communications systems.

A note: When this function is disabled you may have a temporary lose of service and more dropped calls.

Yeah, guess that is how they tracked oj was by his cell phone. The gov has been at the game for years, just getting better at it.
puff, puff