Speaker 1: All zone media welcome to it could happen here a
Speaker 1: show about things falling apart. One such thing frequently falling
Speaker 1: apart is any notion of privacy or digital privacy. Ever,
Speaker 1: encroaching surveillance is one of the biggest global issues affecting
Speaker 1: free expression and a free press, both directly through surveillance
Speaker 1: technology but also by chilling speech. I'm Garrison Davis, and
Speaker 1: this past week, news has swept the Internet that ICE
Speaker 1: is using software from an Israeli company called Paragon, which
Speaker 1: allows ICE or DHS to secretly hack into any smartphone,
Speaker 1: break encryption, access messages, track real time location, and turn
Speaker 1: your iPhone or Android into a walking listening device, all
Speaker 1: of which sounds very scary, and some of which is true,
Speaker 1: though some of these class are exaggerated or even likely
Speaker 1: false based on what we can currently infer from published research.
Speaker 1: Due to legitimate fears, we live in a world of
Speaker 1: surveillance paranoia, which can lead to surveillance myths. This is
Speaker 1: a core function of the Panopticon. People should take ICE's
Speaker 1: new enhanced smartphone surveillance capacity seriously, but to adequately do
Speaker 1: so requires an accurate understanding of the threat model, which
Speaker 1: we will get into later this episode with some help
Speaker 1: from the Electronic Frontier Foundation. But first let's address the
Speaker 1: newsworthy aspect of this story. What has actually changed recently.
Speaker 1: DHS first contracted with the US branch of Paragon in
Speaker 1: September of twenty twenty four, or two million dollars, but
Speaker 1: later that October, the contract was put on hold thanks
Speaker 1: to a Biden executive order restricting a government use of
Speaker 1: foreign spyware, and ever since then the contract has been
Speaker 1: frozen pending a compliance review. But then on September first,
Speaker 1: twenty twenty five. Just last week, investigative journalist Jack Paulson
Speaker 1: reported that the stop work order affecting the Paragon contract
Speaker 1: had quietly been lifted, allowing Ice to follow through on
Speaker 1: the contract and start using Paragon's spyware technology, most likely
Speaker 1: including their flagship product, Graphite. What is Graphite? Great question
Speaker 1: one that I felt underqualified to fully answer myself, so
Speaker 1: I spoke with an expert, Cooper Quinton, of the Digital
Speaker 1: Rights group the Electronic Frontier Foundation. You'll hear from him
Speaker 1: throughout the episode.
Speaker 2: My name is Cooper Quinton. I am a senior staff
Speaker 2: technologist at the Electronic Frontier Foundation. There I do a
Speaker 2: lot of different things. Most specifically, for the purposes of
Speaker 2: this talk, I do malware research on malware that targets activists, journalists,
Speaker 2: and civil society. So is a type of spyware that
Speaker 2: is able to read your messages from your phone the
Speaker 2: same way that you or you know, maybe a cop
Speaker 2: could if they had physical access to your unlocked phone, right.
Speaker 2: That is the main capability that it has. According to
Speaker 2: the reporting published by Citizen Lab, its main job is
Speaker 2: to hook into WhatsApp and into other encrypted chat apps
Speaker 2: and just read the messages in those apps, like in
Speaker 2: the messages you've already sent and any future messages that
Speaker 2: you send. That's really it's the that's the meat of Graphite.
Speaker 1: Something that sets Paragon apart from their fellow Israeli competitors
Speaker 1: is that Paragon has marketed itself as the ethical choice
Speaker 1: for spyware. One of their early investors in Israeli firm
Speaker 1: called red Dot wrote, quote Paragon builds best in class
Speaker 1: cyber intelligence software to empower democratic countries, providing cutting edge
Speaker 1: capabilities that make the world safer.
Speaker 2: Quote.
Speaker 1: On their US website, Paragon says that they are quote
Speaker 1: unquote empowering ethical cyber defense and that they provide customers
Speaker 1: with quote ethically based tools, teams, and insights to disrupt
Speaker 1: intractable threats unquote. Though they use the term cyber defense
Speaker 1: on their US site, Paragon's startup page reads quote Paragon
Speaker 1: is an offense focused cyber company using digital intelligence for
Speaker 1: smartphone and internet surveillance solutions. The company applies strict moral
Speaker 1: restrictions on itself, limiting its extraction of information from targeted
Speaker 1: devices to conversations on chat apps. Paragon works solely with
Speaker 1: police forces and intelligence agencies that meet the standards of
Speaker 1: an enlightened democracy, which includes only thirty nine countries unquote.
Speaker 1: One of Paragon's senior executives told Forbes in twenty twenty
Speaker 1: one that they would only sell their technology to governments
Speaker 1: that quote unquote abide by international norms and respect fundamental
Speaker 1: rights and freedoms, and that quote authoritarian or non democratic
Speaker 1: regimes would never be customers. Unfortunately, Paragon was not pressed
Speaker 1: on what their definition of authoritarian regimes includes. In recent reporting,
Speaker 1: there's been a lot of misconceptions about the capabilities of
Speaker 1: Paragon's main product, Graphite. The Guardian wrote, quote, by essentially
Speaker 1: taking control of the mobile phone ice can not only
Speaker 1: track in individuals whereabouts, read their messages, look at their photographs,
Speaker 1: but also open and read information held on encrypted applications
Speaker 1: like WhatsApp or signal. Spyware like Graphite can also be
Speaker 1: used as a listening device through manipulation of the phone's
Speaker 1: recorder unquote. But research into Graphite by the surveillance watchdog
Speaker 1: group Citizen Lab has not indicated that Graphite has all
Speaker 1: these capabilities or tries to quote unquote take control of
Speaker 1: the entire device, But other tech journalists have since parroted
Speaker 1: The Guardian's unfounded class that Graphite fully takes over a
Speaker 1: phone and can record audio through the microphone.
Speaker 2: This is actually less full featured than other spyware we've
Speaker 2: seen in the past, like NSL groups, Pegasus spywere. Other
Speaker 2: types of spyware that I've seen tend to have a
Speaker 2: lot more capabilities, right, They have the capability of like
Speaker 2: turning on GPS location tracking, the capability to turn on
Speaker 2: a hot mic, to do all these other things. And
Speaker 2: this seems as far as as far as Citizen Lab
Speaker 2: has reported to not be present within the Graphite malware,
Speaker 2: and I think this is because Paragon has presented themselves
Speaker 2: as kind of being the quote unquote responsible malware manufacturer, right,
Speaker 2: and they're like like trying to minimize the amount of
Speaker 2: data they collect. It doesn't mean they couldn't add this
Speaker 2: stuff in the future, but that's the that's the gist
Speaker 2: of it. It's actually, you know, kind of a very
Speaker 2: stripped down malware. I don't want to minimize like how
Speaker 2: impactful it would be for this mawur to get all
Speaker 2: of your messages. That could have a huge impact for people.
Speaker 2: But we don't need to make up capabilities that our
Speaker 2: adversary has, especially under fascism, right, Like we can we
Speaker 2: can just work with the capabilities that we know they have.
Speaker 1: A lot of reporting and discussion of Graphite and Paragon
Speaker 1: frame it as an equivalent to nsoss by where Pegasus,
Speaker 1: which has been banned in the United States for four years,
Speaker 1: Pegasus seeks to completely hijack the target device more broadly,
Speaker 1: similar to guardians claims about Graphite. But by forcing this comparison,
Speaker 1: people might be inadvertently boosting Paragon's brand with free marketing
Speaker 1: by making their product out to be something that I'm
Speaker 1: sure Paragon would like to have people think it is,
Speaker 1: but doesn't actually equate their realistic threat model, similar to
Speaker 1: how predictions of an evil superintelligent AI actually currently serve
Speaker 1: to boost the stock price of AI companies.
Speaker 2: I think a lot of people are doing the work
Speaker 2: for the these companies that are aligning themselves with fascism, right,
Speaker 2: And I don't think it's a great trend actually, right, like,
Speaker 2: like people are assuming that you know, Palateer is sort
Speaker 2: of watching everything, right, and it really Palanteer is just
Speaker 2: like fancy visual graphing software essentially, right, Like the danger
Speaker 2: of Palenteer is combining these two government databases, right, this
Speaker 2: mawere the GRAPHI mawere right, Like, yeah, it's it's not good,
Speaker 2: but you know it's not magical, right, it's not omniscient.
Speaker 2: It's not able to you know, I don't know, go
Speaker 2: eat the fridge out of your food and you know,
Speaker 2: beat up your dad or something like.
Speaker 1: You know, well now we're talking now, Now that's a
Speaker 1: good app.
Speaker 2: If only if only chech bros could solve such social problems.
Speaker 1: No, no, they would never.
Speaker 2: No, but yeah, you know it's not it's not imagical, right,
Speaker 2: And we don't need to do their work for them, right,
Speaker 2: We don't need to do their myth making for them. Right,
Speaker 2: A bigger threat to the majority of people in the
Speaker 2: US is getting your phone seized by the cops. Right, totally.
Speaker 2: There's nothing this maur can do, according to public reports,
Speaker 2: at least that the cops can't do if they get
Speaker 2: hold of your unlocked phone.
Speaker 1: Right. Having phased idea or fordgit pass code is much
Speaker 1: more dangerous to your digital security. Yes, as an average person,
Speaker 1: even as it like anaged person, like going to a protest.
Speaker 2: Yes, yes, absolutely absolutely. You know, Celebrate, which is the
Speaker 2: machine that police plug your phone into you to make
Speaker 2: a copy of all the data on it, is much
Speaker 2: more dangerous to the average American than the Paragon is.
Speaker 2: They're much more likely to encounter that.
Speaker 1: This is more of a niche gripe, but one that's
Speaker 1: still important. There's been claims that quote ice can now
Speaker 1: hack any phone and break encryption, but Graphite doesn't actually
Speaker 1: quote unquote break encryption. It's not going after the encryption
Speaker 1: on Signal or WhatsApp. Instead, Paragon tries to circumvent and
Speaker 1: encryption by trying to gain access to content on a
Speaker 1: targeted device once it's been unencrypted by an application like
Speaker 1: WhatsApp for the user to read similar to how if
Speaker 1: you have push notifications on for an application like Signal,
Speaker 1: if the police seize your phone and push notifications display
Speaker 1: messages from Signal, that doesn't mean the police have quote
Speaker 1: unquote broken signals encryption. Now, in order for Graphit to
Speaker 1: extract messages from your phone, it needs to get onto
Speaker 1: your phone in the first place. Graphite is just the
Speaker 1: implanted code that can read and extract your messages. First,
Speaker 1: it needs to get onto your phone via what's called
Speaker 1: an exploit, which is usually a message sent to a
Speaker 1: phone number or a WhatsApp account that attacks a vulnerability
Speaker 1: in your phone's code to gain permissions to load the
Speaker 1: Graphight onto the messaging apps. Graphight and the exploit are
Speaker 1: two separate programs that work together, but exploits need to
Speaker 1: be frequently changed to keep up with soft where security updates,
Speaker 1: and that's expensive. You need different exploits for Android and iOS.
Speaker 1: Paragon has been using zero click exploits, meaning the owner
Speaker 1: of the phone doesn't have to manually click a link
Speaker 1: or intentionally download a file for the exploit to try
Speaker 1: to gain permissions on the device. You don't have to
Speaker 1: click or do anything. You just have to receive the
Speaker 1: message and then the spyware gets to work, which is
Speaker 1: very scary. But this technology cannot be deployed en mass
Speaker 1: because of how expensive and specific it needs to be
Speaker 1: in order to work.
Speaker 2: The other thing that I think is missing a lot
Speaker 2: from the conversation about Graphite in particular, is that the
Speaker 2: malware is just the program that runs when it gets
Speaker 2: on your phone, and first, before they can install Graphite,
Speaker 2: they have to get onto your phone through some sort
Speaker 2: of exploit. If your phone is up to date and
Speaker 2: fully passed, this will have to be a zero day exploit,
Speaker 2: which means it's an exploit that has had zero days
Speaker 2: for Apple or Google or whoever to fix it because
Speaker 2: it is un known to them, and these exploits cost
Speaker 2: millions of dollars right now. Paragon is not going to
Speaker 2: pay that millions of dollars for each person they're exploiting,
Speaker 2: but there is a large per person cost to Ice
Speaker 2: for each person they're going to exploit, because Paragon doesn't
Speaker 2: want to blow their zero day, which costs them millions
Speaker 2: of dollars to either buy or develop themselves.
Speaker 1: Welcome back. I'd like to get into a little bit
Speaker 1: of Paragon's backstory and how they've grown as a company.
Speaker 1: Paragon was founded in twenty nineteen by former Israeli Prime
Speaker 1: Minister A hood Brock and A Hood Schnorsen, a former
Speaker 1: commander of the IDF's cyber Warfare Unit, basically Israel's equivalent
Speaker 1: of the NSA called Unit to eight two hundred three.
Speaker 1: Other Paragon co founders are also ex Israeli intelligence. The
Speaker 1: startup got early financing from a Televiv investment fund called
Speaker 1: Red Dot Capital, though Paragon also received backing from American
Speaker 1: venture capital. In twenty twenty one, Forbes reported that the
Speaker 1: Boston based Battery Ventures had invested between five to ten
Speaker 1: million in Paragon. Bloomberg Capital has also supported the company.
Speaker 1: In twenty twenty two, Paragon launched a U S subsidiary
Speaker 1: and started recruiting former US Feds to help break into
Speaker 1: the American market. The New York Times reported that the
Speaker 1: DEA has used graphite as far back as twenty twenty two.
Speaker 1: Former CIA assistant director John Finbar Fleming became the executive
Speaker 1: chairman of Paragon US in January of twenty twenty four,
Speaker 1: according to his LinkedIn. In December of twenty twenty four,
Speaker 1: Paragon was acquired by AE Industrial Partners for nine hundred
Speaker 1: million dollars. AE Industrial Partners is a Florida based private
Speaker 1: equity fund with a specialized security portfolio. Once they bought Paragon,
Speaker 1: emerged with another a asset, this cybersecurity company, red Lattice.
Speaker 1: Back in twenty twenty one, Paragon had about fifty employees,
Speaker 1: now it has over five hundred. In June of twenty
Speaker 1: twenty five, they were hiring one hundred and fifty more.
Speaker 1: Just a week ago, executive chairman John Finbar Fleming shared
Speaker 1: a recruitment post that red Lattice was hiring quote emerging
Speaker 1: and offensive cyber engineers unquote. Next, let's discuss the biggest
Speaker 1: case study of Graphite being deployed that we know of.
Speaker 1: On January thirty first, twenty twenty five, Meta's encrypted messaging
Speaker 1: app WhatsApp sent a notification to ninety accounts that their
Speaker 1: smartphones were suspected of being targeted by spyware, which has
Speaker 1: since been traced to the Paragon product Graphite. People targeted
Speaker 1: were journalists, human rights activists, and members of civil society
Speaker 1: across Europe and the Mediterranean, but Timer based out of Italy.
Speaker 1: This was a zero day and zero click exploit, meaning
Speaker 1: it both attacked to previously unknown vulnerability and required zero
Speaker 1: user interaction to infect the device. At first, the Italian
Speaker 1: government denied knowledge, but Paragon canceled two contracts with customers
Speaker 1: in Italy, and a parliamentary oversight committee later confirmed the
Speaker 1: Italian government was using Paragon technology for spyware attacks against
Speaker 1: c migration activists. One thing that's interesting to me is
Speaker 1: that we talk about this technology is being very expensive,
Speaker 1: very individual, they have to individually target you. But then
Speaker 1: you see, you know, ninety people on WhatsApp, and you're like,
Speaker 1: that's that's a lot of people. So you can talk
Speaker 1: about how this attack was like structured and what we've
Speaker 1: learned from it.
Speaker 2: For sure, ninety people is a lot of people for
Speaker 2: such a targeted attack, although it's you know, in terms
Speaker 2: of most malware, like most commercial mawer, ninety people would
Speaker 2: be a very very small attack, right, Like it wouldn't
Speaker 2: be worth your time, So you know, it depends on
Speaker 2: the scale of things.
Speaker 3: I don't know what the scale of Italian civil society is, right,
Speaker 3: but ninety people is likely I think a small fraction
Speaker 3: of the whole of Italian civil society, right, But yeah,
Speaker 3: those so those people.
Speaker 2: That were targeted by Paragon, the ones that we know about.
Speaker 2: You know, one was a Italian anti fascist journalist, right,
Speaker 2: I think another there were a couple of other journalists
Speaker 2: that were covering migration issues, and you know, just a
Speaker 2: sort of a large swath across Italian civil society. So
Speaker 2: the way they were targeted was on WhatsApp. They were
Speaker 2: added to a group and then they were sent a
Speaker 2: malicious PDF which they didn't even have to open, and
Speaker 2: they didn't have to approve being added to the group.
Speaker 2: But as soon as that malicious PDF was received by
Speaker 2: their WhatsApp app, but by their WhatsApp client, WhatsApp client
Speaker 2: processed the PDF and it contained code which exploited WhatsApp
Speaker 2: and allowed Graphite to start running. So Graphie doesn't actually
Speaker 2: install anything. To get a little bit technical, Graphie only
Speaker 2: runs in memory of the phone, right, It only runs
Speaker 2: in the like temporary RAM so to speak. Okay, Right,
Speaker 2: So rebooting the phone would have cleared out of the
Speaker 2: Graphite infection and they would have had to reinfect the person. Interesting,
Speaker 2: right in this case. Yeah, it's possible that in the
Speaker 2: future Paragon will find a way to make Graphite persistent.
Speaker 2: But it does make it more stealthy, It makes it
Speaker 2: harder to detect, It makes it harder to forensically analyze
Speaker 2: for people like citizen Lab and like eff if it
Speaker 2: just runs in memory, sure, right, so it kind of
Speaker 2: makes sense that they would want to keep running it
Speaker 2: in memory, even though rebooting it would clear out the
Speaker 2: infection because you can just reinfect the.
Speaker 1: Person, even like like developers like WhatsApp or like Apple
Speaker 1: might have a harder time, like yeah, realizing that they've
Speaker 1: been attacked. If it can get cleared out so quickly,
Speaker 1: I guess.
Speaker 2: Yeah, absolutely absolutely, And in this case, WhatsApp had realized
Speaker 2: they had been attacked, they quickly figured out the pattern,
Speaker 2: and you know, to their credit, warned everybody immediately. Often,
Speaker 2: the only way I think people will find out they've been,
Speaker 2: you know, infected by this spywear is if WhatsApp or
Speaker 2: you know, somebody else maybe Apple warned you. That's not great,
Speaker 2: but it is, but it is better than the alternative
Speaker 2: where they just don't warn you at all.
Speaker 1: Right, After the targets were notified of the spyware attack,
Speaker 1: some including journalists and migrant refugee activists in Italy, agreed
Speaker 1: to participate in a forensic analysis of Graphite by citizen Lab.
Speaker 1: They found that Paragon spyware had spread from WhatsApp to
Speaker 1: at least two other apps on the device. In April
Speaker 1: of twenty twenty five, we got forensic confirmation of Graphite
Speaker 1: spyware on iPhone with a zero click exploit attacking I message.
Speaker 1: Citizen Lab was able to analyze the devices of a
Speaker 1: prominent European journalist who requested to remain anonymous, and an
Speaker 1: Italian journalist linked to the previous cluster of attacks in Italy.
Speaker 1: iPhone is slightly harder to target than your average Android,
Speaker 1: but certainly not impervious to this sort of attack, as
Speaker 1: we've seen from these examples in Europe. To date, citizen
Speaker 1: Lab has also identified suspected Paragon deployments in Australia, Canada, Cyprus, Denmark, Israel,
Speaker 1: and Singapore. Though the encrypted messaging app Signal is not
Speaker 1: mentioned in the citizen Lab reporting, their analysis did find
Speaker 1: that graph Fight had the capability of going after several
Speaker 1: different messaging apps, and it's probably safe to assume that
Speaker 1: Signal would be one of the apps that Paragon would
Speaker 1: want to extract messages from. We don't have much information
Speaker 1: about this spyware targeting Signal, possibly because Signal does not
Speaker 1: have as large of an international user base compared to
Speaker 1: other apps like WhatsApp, I Message or Telegram, despite Signal
Speaker 1: being much more secure. So what can you do? Though
Speaker 1: Graphite might not be the total phone hijacking super spy
Speaker 1: away that the Guardian and others claim it to be,
Speaker 1: it still poses a significant security threat. Some basic digital
Speaker 1: security precautions apply here. Get into a habit of regular
Speaker 1: digital cleaning. Remove unnecessary content from your device, save space.
Speaker 1: Old photos can be uploaded to an external encrypted hard
Speaker 1: drive in question. If you really need years of messages
Speaker 1: stored on your phone, use an encrypted chat app like Signal,
Speaker 1: which has disappearing messages so that there isn't a large
Speaker 1: backlog of communications that could be suddenly accessed by a
Speaker 1: hostile actor. Be very wary of cloud backups. They are
Speaker 1: often one of the least secure aspects of your digital life,
Speaker 1: especially if they are unencrypted, and though it won't deter
Speaker 1: zero click exploits, it's still best practice to avoid clicking
Speaker 1: mysterious links or downloading files and photos is sent to
Speaker 1: your phone. Another tip is to regularly reboot your phone.
Speaker 1: Contrary to claims that once your phone been targeted by graphites,
Speaker 1: now compromised forever something called malware persistence. To our current knowledge,
Speaker 1: rebooting can wipe Paragon's exploits. It does not appear that
Speaker 1: Paragon spyware is at the moment reboot persistent, and it
Speaker 1: seems that rebooting would actually remove it from the phone.
Speaker 2: My reading is that rebooting it would remove the malware
Speaker 2: from your phone until you were re exploit. Which so
Speaker 2: you know, if you just reboot and you don't update,
Speaker 2: or you know, the zero day isn't out yet, right,
Speaker 2: they're just going to run the exploit again.
Speaker 1: Right.
Speaker 2: I think it's a fair bet that they're just going
Speaker 2: to run the exploit again. But it would be.
Speaker 4: Enough to get it off for that time, right, And
Speaker 4: I mean, I think as far as in mitigation, my
Speaker 4: friend recommends that people like reboot their phone every morning
Speaker 4: when they're brushing their teeth, right, And I don't think
Speaker 4: it's a bad bit of security hygiene.
Speaker 2: If these guys are going due, in fact, you might
Speaker 2: as well make it, you know, more of a headache
Speaker 2: for them, right, You might as well make it more
Speaker 2: costly to them, because there is going to be a
Speaker 2: charge to them for each time they have to reinfect you.
Speaker 2: But yeah, it's certainly I think overblown to say that.
Speaker 2: You know, once it's on your phone, it's on your
Speaker 2: phone forever. There's you know, you just got to, you know,
Speaker 2: throw your one thousand dollars phone in the trash and
Speaker 2: go buy another one. Like, no, you can you know,
Speaker 2: if you don't feel safe, just rebooting it, right, like
Speaker 2: a factory reset, that would be the next step, right,
Speaker 2: I think that would that would most likely get rid
Speaker 2: of any persistence mechanisms that were installed. I'm not familiar
Speaker 2: with any iOS mower certainly that would survive a factory reset.
Speaker 1: But probably the most important thing besides using signal is
Speaker 1: to keep your phone software updated. That's the simplest and
Speaker 1: best way to make it harder for spyware like graphites
Speaker 1: to make it onto your phone in the first place.
Speaker 1: Out of date software has many more known vulnerabilities to attack.
Speaker 1: For extra protection, enable lockdown mode on iPhone or advanced
Speaker 1: Protection on Android.
Speaker 2: So the reason it's important to keep your phone up
Speaker 2: to date and always install the latest security updates, even
Speaker 2: if it's a pain in the ass, and I know
Speaker 2: it's a pain in the app is because this makes
Speaker 2: an attacker have to use zero day exploits. So, if
Speaker 2: you have an old version of the software on your phone,
Speaker 2: there are known exploits. Known exploits are you know, more
Speaker 2: or less free, right, They are already out there, They
Speaker 2: are already burned. They do not matter, right like the
Speaker 2: company already knows about them. An exploit loses basically all
Speaker 2: of its value as soon as you know the company
Speaker 2: knows about it, and it's patched. Right, So, if you
Speaker 2: have out of date software on your phone, if you
Speaker 2: have out of data software in a computer, it changes
Speaker 2: the entire economics of attacking. Right, It's basically free for
Speaker 2: me to exploit your phone at this point, and I
Speaker 2: you know, I will exploit it as many times as
Speaker 2: I want. And I don't care if that exploit is burned.
Speaker 2: I don't care if you find it, because again it's free, right.
Speaker 2: Zero A exploits for especially for Apple, for like you know,
Speaker 2: Android pixel phones, for graphene, the alternative Android OS not
Speaker 2: graphite is giving me real problems lately. Zero D explots
Speaker 2: meaning explicit that the manufacturer does not know about and
Speaker 2: has not had a chance to patch, cost millions of
Speaker 2: dollars for these platforms and a zero click exploit where
Speaker 2: where the victim doesn't have to interact with it at all. Right,
Speaker 2: I don't have to click a link, I don't have
Speaker 2: to do something. You just send me, you know, a PDF,
Speaker 2: an infected PDF or a magic file, right or something,
Speaker 2: and my phone is infected. Those are the most expensive
Speaker 2: above all, Right, those those are sort of the those
Speaker 2: are the golden ticket for malwaur companies, right a million.
Speaker 2: These cost millions of dollars and if you burn it, right,
Speaker 2: if it gets caught, like like you know what happened
Speaker 2: with WhatsApp and citizen lab in Italy, Right, that's millions
Speaker 2: of dollars down the drain for para con. You know
Speaker 2: they're going to pass that on to the Italian government
Speaker 2: to ice to whoever their contractors are. Right, So keeping
Speaker 2: your phone up to date really changes the economics of
Speaker 2: running a malware attack against you, right, Like anybody can
Speaker 2: run you know out of their office old you know
Speaker 2: end day, right, more than zero day malware attacks against
Speaker 2: any me, right Like, those are cheap. But if your
Speaker 2: stuff is patched now, it's good, it's it's it totally
Speaker 2: changes the entire game. And you've got to be doing
Speaker 2: really good work for ICE to want to burn that
Speaker 2: much money on you.
Speaker 1: All these tips can make it considerably harder and more importantly,
Speaker 1: extremely expensive for this spyware to get onto your device.
Speaker 1: These exploits could only be deployed against individual targets, and
Speaker 1: that gets quite expensive. Just because ICE could theoretically hack
Speaker 1: your phone, that doesn't mean that your phone is necessarily
Speaker 1: at a high risk of being hacked by ICE. Who
Speaker 1: are the possible targets for graphite spyware? Who is at
Speaker 1: higher risk? Journalists who report on ICE and immigration, people
Speaker 1: who work for immigration advocacy organizations, immigration lawyers, as well
Speaker 1: as high profile activists. It goes without saying that anything
Speaker 1: you do on your phone or on the Internet carries
Speaker 1: a level of inherent risk. We'll close this episode with
Speaker 1: a longer segment from my interview with Cooper discussing who's
Speaker 1: at the most risk of ICE using Paragon software and
Speaker 1: more of Cooper's recommended surveillance mitigation practices. This is not
Speaker 1: something that can be deployed at a protest and sweep
Speaker 1: up you know, thousands of people. This this does go
Speaker 1: after like individuals because of its cost and the way
Speaker 1: that it needs to be deployed. Who are the people
Speaker 1: that you would say are most at risk of this?
Speaker 1: Like is this here like your local like you know,
Speaker 1: food not Bombs organizer, or like an immigration lawyer?
Speaker 2: Like?
Speaker 1: Right, who should be concerned? I guess and and take
Speaker 1: take this threat like more seriously?
Speaker 2: Definitely, I think people who should be concerned. I mean
Speaker 2: you hit the nail on the head, right that the
Speaker 2: people that should be concerned about this are people who
Speaker 2: have you know, been a special pain in the ass
Speaker 2: for ice and pisicure. Right, you know, people who might
Speaker 2: be under HSI investigation. Right, people who you know have
Speaker 2: been threatened by the president or by Pam BONDI you
Speaker 2: know specifically, right, like had their name called out specifically, right,
Speaker 2: people who are you know, very loud, very active, right,
Speaker 2: Like the sort of leaders what's the term tall poppies, Right,
Speaker 2: Like the people that are really have their head sticking
Speaker 2: out right in a way that's like very public and
Speaker 2: very well known. If you have risen to the level
Speaker 2: where like Tom Homan knows your name personally, right, that
Speaker 2: makes it a pretty good chance that you know, you
Speaker 2: might become a target of this, right, Like, that's that's
Speaker 2: who we're talking about.
Speaker 1: Well, and like as we've seen Italy, like that can
Speaker 1: that can include like like anti fascist journalists, Yeah, definitely,
Speaker 1: people who work for like migrant human rights organizations, Yes,
Speaker 1: high profile activists. And I think like there's a real
Speaker 1: concern with with you know, trying to comprise the phone
Speaker 1: of journalists because of how journalists like talk to sources.
Speaker 1: The journalists might have information about like other people besides
Speaker 1: the journalists on their phone, and they may be targeting
Speaker 1: through the journalists, but trying to get after other people
Speaker 1: who they're talking to, same thing with like immigration lawyers,
Speaker 1: and like, there is real concern about harm spreading from
Speaker 1: those factors. And I think that's why if you are
Speaker 1: in those sorts of like roles that like like a
Speaker 1: human rights organization, a journalist, or a lawyer, you need
Speaker 1: to be like extra careful about keeping your phone updated regularly,
Speaker 1: engaging in like digital hygiene, having disappearing messages, maybe putting
Speaker 1: on lockdown mode onto your iPhone, be very wary of
Speaker 1: being added to mysterious group chats. These are just general
Speaker 1: practices that are I think worthwhile to like engage in,
Speaker 1: whether or not you're actually going to get to target by.
Speaker 2: This absolutely, and I want to especially single out lockdown
Speaker 2: mode there, Like, we are not aware of any infections
Speaker 2: of any mowur right, Pegasis, Graphite right, any others that
Speaker 2: have managed to successfully infect an iPhone on lockdown mode.
Speaker 2: So if you are worried about this, lockdown mode is
Speaker 2: the single most effective thing you can do to protect
Speaker 2: yourself against this mowur right, is go turn on lockdown
Speaker 2: if you're on Android.
Speaker 5: I think Google calls its protection mode. Yeah, yeah, advanced
Speaker 5: protection mode. So advanced protection mode used to be not
Speaker 5: very comprehensive, and I think like with the new Android
Speaker 5: update with Android sixteen that came out, you know, I
Speaker 5: think like last week or something, it's.
Speaker 2: Now much more comparable to lockdown mode. So you know,
Speaker 2: I highly recommend churning that on if you're on Android.
Speaker 1: All my homies love lockdown mode.
Speaker 2: Yes, yes, that is the number one protection right. The
Speaker 2: other thing I strongly recommend always, and I be this
Speaker 2: drum like every day, is turn on disappearing messages. If
Speaker 2: you're on Signal or WhatsApp, go turn on disappearing messages, right,
Speaker 2: because this is good against you know a lot of
Speaker 2: different things, right, Like, this is good against celebrate as
Speaker 2: well as pegass as well as grab me right, Like,
Speaker 2: if the messages are gone by the time you get infected,
Speaker 2: there's no way to recover those, right, You're minimizing your footprint. Right, yep,
Speaker 2: go delete old chats right like if you if you
Speaker 2: get a second right, like we've all Google has trained
Speaker 2: us to all be digital hoarders, right and keep depending.
Speaker 2: How will you are twenty years of email, ten years
Speaker 2: or whatever?
Speaker 1: Right?
Speaker 2: Never never delete anything, right, And that's don't ignore them,
Speaker 2: ignore Google. Google doesn't want you to delete things because
Speaker 2: they want to use all that data for selling you adds. Right,
Speaker 2: delete everything.
Speaker 1: I want more underwater data than.
Speaker 2: Yes, yes, exactly, delete everything. Delete your files, you know,
Speaker 2: like get rid of those old group chats, right, get
Speaker 2: rid of those old chats that you don't need anymore.
Speaker 1: You need to be like that lawyer in death note
Speaker 1: delete yes, delete.
Speaker 2: The death notefu.
Speaker 1: Do you wanna plug citizen Labs slash eff and tell
Speaker 1: people where to find both your work and then also
Speaker 1: other people who are doing research into graphite? And like,
Speaker 1: you know, if you've been suspected of being targeted by
Speaker 1: you know, maybe a notification how you can participate in
Speaker 1: forensic analysis to help everyone be more secure against this
Speaker 1: in the future.
Speaker 2: Yeah, for sure. So one of the best ways to
Speaker 2: find out you've been targeted by state sponsored malware is
Speaker 2: to get a notification from Apple or Google or WhatsApp
Speaker 2: or some other large company that you have been targeted
Speaker 2: by state sponsored malware. Typically, these notifications don't contain much
Speaker 2: more information than we believe you've been targeted by a
Speaker 2: nation of state or by state sponsored maware. But if
Speaker 2: you do get one of those notifications, take it very seriously,
Speaker 2: you know, reach out to access Now or to e
Speaker 2: f F or to Citizen Lab and let us know, right,
Speaker 2: and we will help figure out what's going on, right,
Speaker 2: Like this is this is the number one indicator, right
Speaker 2: because like this mallory is usually fairly stealthy, right, Like
Speaker 2: it's not it's not actually, but you know, I don't
Speaker 2: know flashing you're infected on your screen, right. But yeah,
Speaker 2: Citizen Lab is always doing amazing work. I'm a fellow there,
Speaker 2: so I get to work with them sometimes, which is
Speaker 2: very exciting. They are based out of the Monks School
Speaker 2: of Global Affairs at the University of Toronto and their
Speaker 2: website is Citizen Lab dot org, where you can find
Speaker 2: a lot of really excellent research on the types of
Speaker 2: threats that target civil society.
Speaker 1: Er erm, I have citizen lab dot c A. Oh,
Speaker 1: but I'm Canadian.
Speaker 2: You you are probably correct. I can never remember the.
Speaker 1: Current as a Canadian. I was very I was very
Speaker 1: put off by you erasing our nation's history, of our
Speaker 1: of our coveted dot ca A. We love, we love
Speaker 1: our dots.
Speaker 2: The I'm not trying to start a war with Canada.
Speaker 1: Well, many many people are, so.
Speaker 2: Listen, I'm firmly on the side of Canada in the
Speaker 2: war against Canada. Okay, please take me in please.
Speaker 1: Yeah, your solidarity is a noted so.
Speaker 2: Citizen lab dot org actually redirection cism laud dot c.
Speaker 2: So we were both right.
Speaker 1: There you go, or you were maybe more right.
Speaker 2: So yeah, citizen law and yeah, they're they're really fantastic.
Speaker 2: A lot of really good research going on there at
Speaker 2: e f F dot org, the Electronic Frontier Foundation. We're
Speaker 2: US based nonprofit, been around for thirty five years defending
Speaker 2: civil liberties as they intersect with technology. So a lot
Speaker 2: of a lot of free speech work, a lot of
Speaker 2: you know, privacy and Fourth Amendment work, and we also
Speaker 2: have a really excellent set of guides called the Surveillance
Speaker 2: Self Defense Guides, which are at s SD dot e
Speaker 2: f F dot org, which I highly recommend people go
Speaker 2: and check out. It's the most sort of evergreen guide
Speaker 2: for finding yourself online. A lot of the problem with
Speaker 2: the online security guys that they get out of date
Speaker 2: very quickly, and we have a totally whole, full time
Speaker 2: person dedicated to making sure that our guides stay up
Speaker 2: to date.
Speaker 1: I'll put a link in the description.
Speaker 2: Yeah, and we're a nonprofit member support a non profit,
Speaker 2: so you know, if you like to work, throw us
Speaker 2: a few bucks. We work for tips. And yeah, those
Speaker 2: are the chwof places that I'm at that I want
Speaker 2: to plug. Only other thing to plug. I guess you
Speaker 2: can follow me on social media. I'm at cooperq dot
Speaker 2: com on blue Sky and Cooper q at Masto dot
Speaker 2: hackers dot town on Mastodon.
Speaker 1: Hell yeah, yeah, all right, well, thank you so much.
Speaker 1: Thank you for the work you do at EFF and
Speaker 1: Citizen Lab.
Speaker 2: Thank you. Yeah.
Speaker 1: I guess we should also throw away our phone since
Speaker 1: there's no way to use our phone safely anymore.
Speaker 2: I mean, throwing away our phones isn't a terrible idea.
Speaker 1: That's why I bat it. You know what, I could
Speaker 1: be onto something I.
Speaker 2: Think for our own sanity just in general.
Speaker 1: No, I think they're making us more connected, and I
Speaker 1: think they're making us more stable.
Speaker 2: They are making us more connected, that's for sure. In
Speaker 2: that I get five billion notifications per day. If that's
Speaker 2: what connected means.
Speaker 4: Yeah, all right, it could happen Here is a production
Speaker 4: of cool Zone Media.
Speaker 1: For more podcasts from cool Zone Media, visit our website
Speaker 1: Coolzonemedia dot com, or check us out on the iHeartRadio app,
Speaker 1: Apple Podcasts, or wherever you listen to podcasts. You can
Speaker 1: now find sources for it could Happen here, listed directly
Speaker 1: in episode descriptions.
Speaker 2: Thanks for listening.