
California Governor Signs Law Requiring a ‘Kill Switch’ on Smartphones - sgustard
http://bits.blogs.nytimes.com/2014/08/25/california-governor-signs-law-requiring-a-kill-switch-on-smartphones
======
lukifer
> In May, Minnesota became the first state to require a kill switch on all
> smartphones sold there. But the California bill is unusual in that it
> requires manufacturers... to ship smartphones with the anti-theft technology
> turned on by default.

I wasn't aware that an opt-in version of this was already on the books. I'm
curious to see exactly how much the user is in control of this "technology" in
practice. If the user can (a) disable the feature, and (b) is the only person
who can initiate a remote shutdown, then it's probably to the consumer's
advantage. But I suspect it's only a matter of time before the FBI/CIA/NSA (or
local PD) will be able to unilaterally decide it's in the "public interest" to
suddenly shut off every phone in a particular geofence.

Cars are also stolen every day, and society manages to get by, through
insurance and opt-in theft deterrence tools (both manufacturers and consumers
already have plenty of incentive to deter theft). I have a hard time believing
that stolen phones are a big enough social problem to warrant a mandate of
this scope. Regardless of intent, this power _will_ be abused.

~~~
tzs
> But I suspect it's only a matter of time before the FBI/CIA/NSA (or local
> PD) will be able to unilaterally decide it's in the "public interest" to
> suddenly shut off every phone in a particular geofence.

This would be an ineffective way to accomplish that. They'd first have to make
a list of all the phones in the target area, and then they'd have to send the
lock commands to them, one by one.

Furthermore, even if they went through all that trouble, it only would work on
smartphones. The bill does not apply to feature phones, other non-smartphone
phones, laptops, or tablets. The bill defines a "smartphone" as a cellular
radio telephone or other mobile voice communications handset that includes ALL
of the following features:

• Utilizes a mobile operating system.

• Possess the capability to utilize mobile software applications, access and
browse the Internet, utilize text messaging, utilize digital voice service,
and send and receive email.

• Has wireless network connectivity.

• Is capable of operating on a long-term evolution network or successor
wireless data network communications standards.

The bill explicitly says that "smartphone" does not "include a radio cellular
telephone commonly referred to as a 'feature' or 'messaging' telephone, a
laptop, a tablet device, or a device that only has electronic reading
capability".

(Added in edit) Also, while the bill requires that smartphones be equipped
with this and that it be on by default, the bill does NOT require that it stay
on. Apple's iOS 7 kill switch lets the user turn it off, and I believe that is
what Samsung plans to do. People going to protests or other events where they
think authorities may try to disrupt communications can simply turn off the
kill switch before arriving at the protest.

It would be much more effective to silence a particular area by doing
something at the cell tower layer or higher.

> I have a hard time believing that stolen phones are a big enough social
> problem to warrant a mandate of this scope

Stolen phones account for half of all robberies in San Francisco. In New York,
they are 20% and rapidly rising. It's the #1 property crime nationwide,
accounting for 1/3 of all property crime. In half of the San Francisco
incidents the victims are punched, kicked, or physically intimidated, and in a
quarter of them they are threatened with a gun or knife.

That sure seems like a big enough problem to me to try to do something about.
We also know that kill switches are effective. In the first five months after
Apple put in a kill switch, iPhone thefts dropped 38% in San Francisco, 24% in
London, and 19% in New York. We know this wasn't just due to a general lowing
of crime rates, because in the same time period overall New York theft went
down 10%, and Samsung phone theft went up 40%.

~~~
ccvannorman
>>This would be an ineffective way to accomplish that. They'd first have to
make a list of all the phones in the target area, and then they'd have to send
the lock commands to them, one by one.

Phone[] phones = GetPhonesByGeo(radius=50, lat=102.23412323,
lon=-129.4342424);

foreach(Phone p in phones) { p.sendmessage("Lock"); }

func GetPhonesByGeo(){ // your tax dollars at work }

~~~
raverbashing
Very funny

You don't know what you are talking about.

EDIT: yes, please, go ahead and explain how you're going to get phone's
location geographically. Hint: not everybody has data turned on always. Or
GPS.

This is not a Batman movie you know

~~~
hobs
What about CPS? The towers know where they are, and they know you are
communicating with them.

Its not perfect, but they can get your position by just measuring your signal
strength to the multiple towers and triangulate the rest.

No, this is not a batman movie. For more, check out
[http://worldwide.espacenet.com/publicationDetails/biblio?CC=...](http://worldwide.espacenet.com/publicationDetails/biblio?CC=US&NR=5519760&KC=&FT=E&locale=en_EP)

------
parley
Could someone with relevant industry insight comment as to why we're not just
using IMEI blacklists?

From Wikipedia: "For example, if a mobile phone is stolen, the owner can call
his or her network provider and instruct them to "blacklist" the phone using
its IMEI number."

Is it because it's actually mutable/not properly authenticated? Or because
global blacklist synchronization isn't good enough and not all operators
respect them?

~~~
buyx
The IMEI blacklists don't work across borders. My sister in law's Blackberry
was stolen from her at a mall in South Africa. It was reported and added to
the IMEI blacklist. A few months later I accidentally added her old PIN as a
BBM contact and ended up chatting to a chap in Nigeria.

It isn't farfetched to assume that network providers don't really care about
stolen phones in the third world. Until they do, IMEI blacklists won't mean
much.

~~~
tzs
> It isn't farfetched to assume that network providers don't really care about
> stolen phones in the third world.

Network providers probably don't care about stolen phones in the first world.
If they could find a way to ignore domestic IMEI blacklists without too much
public outcry, they probably would.

In the US, the top four carriers make almost $8 billion per year selling theft
insurance to their customers [1]. I don't have a cite handy, but I recall
reading that they also make a huge amount selling replacement phones to people
whose phones were stolen.

Samsung planned to do a kill switch on its phones to fight theft a while ago,
and the carriers blocked it. Many believe they blocked it to protect those
insurance and replacement phone profits.

[1] [http://www.huffingtonpost.com/2013/11/20/iphone-kill-
switch_...](http://www.huffingtonpost.com/2013/11/20/iphone-kill-
switch_n_4308924.html)

------
Theodores
At some stage smartphones will become as cheap and ubiquitous as Nokia feature
phones were before the iphone took hold. Sure they will have some
secondhand/stolen goods value - $10 - but buyers might be hard to find as, by
then, it might cost $30 to buy a new one. When this point happens (and it
will), it will be hard to sell $$$ mega-bucks phones as new or into the second
hand/stolen market.

People used to burgle houses for VCR's once, and for DVD players. Nowadays a
DVD player is a giveaway item, nobody gets them stolen anymore.

~~~
NickNam
I think the data that is stored on phones will still make them a target. A
better reference would be stolen laptops... I wonder how much they get stolen
nowadays. (The TSA seems to have tons of them left a check points, so who
knows what that means.
[http://www.americanownews.com/story/22046003/12000-laptops-l...](http://www.americanownews.com/story/22046003/12000-laptops-
lost-in-airports-every-week))

------
anonbanker
I've adopted JWZ's mindset on cellphones [1] for more than a decade now. Once
it became impossible to not have one, I finally relented a bit and purchased a
7" chinese tablet that can do encrypted VoIP over wifi. I have no E911 GPS
override (mandatory since '97), and I won't ever have a kill switch either.

I had my tablet stolen a few weeks back, and got it back a week later by
allowing the thief access to my email and promising a reward (sent messages to
myself, so they'd pop up on the main screen). the email server logged all the
IP addresses that the thief used to reply to me, and with the help of the
local ISP here, tracked the IP to a house, knocked on the door, and asked for
my tablet back. they gave it back once caught, and I promised not to press
charges. I find this resolution superior to a mandatory kill switch that gives
a phone company (that I don't like/trust/respect) control over my property. I
seem to be in the minority, though.

1\.
[http://www.jwz.org/gruntle/cell.html](http://www.jwz.org/gruntle/cell.html)

~~~
scott_karana
Out of curiosity, why didn't you press charges?

~~~
anonbanker
because they could have made a decent case that they were merely concerned for
their own safety, which led to the subterfuge. And they might have been able
to claim that I left it on the bus (the video of the bus ride was not
conclusive). If he had not given me the tablet, I had people staked at the
location, and we would have placed him under citizen's arrest. Fearing his
freedom, he phoned his girlfriend who had the tablet, and I let them both go,
but kept the video of the conversation with him. We use it for contract class
now. :)

------
sgustard
Can someone explain how a kill switch works, and prevents a thief from
reinstalling the OS?

~~~
Aldo_MX
With iPhones for example, you can't activate the OS without logging-in first
with the same iTunes account that was used before reinstalling the OS.

Well... this is the intended behavior...

------
gremy
I think that at the moment the kill switch is more for protecting the data on
the phone, rather than protecting the phone from being reused. For the common
thief, this will be an inconvenience in probably reselling the phone, but
there will always be hackers out there who will be able to reinstall the OS.
Also as far as I know Carries can blacklist Phones based on IMEI. So the kill
switch could also trigger the Carrier blacklisting. I think that iPhones
already have something built in for this.

~~~
victorhooi
I believe the idea is that you _can 't_ just reinstall the OS to circumvent
it.

Apple currently does this with their activation - if the phone gets remotely
locked by the user, it can't be unlocked without knowing the password, and no
amount of reinstalling, wiping, or praying to your deity will be enough to
unlock it.

As far as I'm aware, there aren't any known vulnerabilities with Apple's
scheme - I don't know how long this will remain true.

I'm curious how this will be implemented on the Android side (also considering
that Google is headquartered in CA - but I don't know if that changes
anything). Android phones are known for their open-ness, and on many models,
unlocked boot loaders. I wonder how you'd securely lock it down so you
couldn't wipe it, like you describe.

~~~
jordanthoms
Presumably it'd act as an extension of how it works now - the phone is shipped
with a locked bootloader, and has to be unlocked by a computer which wipes the
phone in the process.

So the bootloader could require a code which is generated by Google to do that
unlock, and Google could keep a list of 'killed' phones not to generate unlock
codes for. The challenge would be to prevent that expanding into a wider
scheme to stop users having control over their devices.

------
spacefight
Remember, the revolution will not be televised. And now also not on <your
favourite app>. And not on your news channel. No smartphone, no coverage, no
action.

This feature will be abused.

------
tobico
Seems like a pretty good idea. It's kinda weird that no such technology exists
for cars actually.

~~~
Shivetya
They do, keys are chipped. See
[http://www.nytimes.com/2014/08/12/upshot/heres-why-
stealing-...](http://www.nytimes.com/2014/08/12/upshot/heres-why-stealing-
cars-went-out-of-fashion.html?abt=0002&abg=1)

------
f3llowtraveler
How about a hardware switch that physically cuts the electricity to the
microphone, the camera, the transmitter, and even the battery itself?

With my own phone, I'd love to be able to switch that off/on. Why is that
option not available to me?

~~~
RealityVoid
Short of putting a physical button for it, I don't think there are solutions
to doing that in a way that can not be bypassed by software

~~~
f3llowtraveler
A physical button is what I want.

------
unethical_ban
Cell phone theft cannot be such a large problem that this is a politically
beneficial thing to do, much less a legitimate use of power.

~~~
sbisker
You don't take public transportation in a big city, do you?

Cell phone theft is a HUGE problem. Huge.

People don't like carrying things of large, uncontrolled value on their person
when they don't have to. The status quo is the equivalent of forcing people to
carry a small brick of gold on them everywhere they go, just so they can hail
an Uber or play Candy Crush.

People will literally feel safer for this every day - I know I do already.

~~~
techsupporter
My anecdotal evidence is that neither myself nor anyone I know has had a
mobile phone stolen while on public transport or anywhere else. That said, I
still agree with you 100%. Even if the risk is small, it still can happen and
would suck if it does. The remote-wipe feature of Exchange ActiveSync is why I
set it up on my phone plus have the data partition encrypted so that even if
it is swiped, all I've lost is the data and at least it's useless to anyone
else.

------
bcheung
This seems like a great feature but doesn't California have bigger issues to
worry about? Why not let the market decide?

~~~
dougws
Investigating theft takes up police time, which expends taxpayer resources.
The market wouldn't take this into account.

Also, "doesn't California have bigger issues to worry about" is just silly, as
if the government of an enormous state can only do one thing at a time.

~~~
icameron
Police don't investigate stolen phones.

~~~
staunch
They do investigate violent crime. At least theoretically.

[http://www.crimemapping.com/map.aspx?ll=-13620775.579218755,...](http://www.crimemapping.com/map.aspx?ll=-13620775.579218755,4544801.491085874&z=13&mc=world-
street&cc=HO,RO&db=6/26/2014&de=8/25/2014)

