In late May of 2012, a
damaged package split open at a FedEx facility in Rancho Cordova,
California, spilling dozens of boxed iPhones across the shipping room
floor. A worker there contacted Apple, which, with the help of corporate
security at Verizon, confirmed what FedEx personnel already suspected:
The devices were contraband, likely bound for the black market.
Two hours later, a man named Brian Fichtner showed up at the
facility. Fichtner is thin and wiry, with the clipped demeanor of a
career cop and a passing resemblance to the actor George Clooney. He has
spent his entire professional life in law enforcement, first as a
narcotics investigator and most recently as a member of the California
Department of Justice’s elite eCrime Unit, a group tasked with
prosecuting tech-related violations—identity theft, revenge porn, the
large-scale smuggling of electronics.
Fichtner used a pocketknife to slice open the broken package. There
were 37 iPhones inside. He wrote down each of the serial numbers and
resealed the box. Then he sat back to wait. The next day, a Sacramento
resident, Wasif Shamshad, picked up the package and, with eCrime
investigators on his tail, drove west to a stucco apartment complex on
the outskirts of the city. There the package was handed off again, this
time to Shou Lin Wen, a gaunt guy in his late thirties, and his wife,
Yuting Tan.
Further gumshoe work revealed that Wen
had grown up in mainland China, immigrated stateside as an adult, become
a naturalized citizen, and opened a cell phone and electronics shop in
downtown Sacramento. His record was clean. Still, Fichtner had long ago
learned to trust his instincts, and his instincts here told him that he
was likely onto something big.
Investigators were assigned to stake out Wen and Tan’s two-story
residence in the leafy neighborhood of Rosemont and were on hand when,
on a sweltering day that August, the couple hauled four heavy parcels
into a shipping facility.
The destination of their shipment was an apartment in Hong Kong. The
eCrime investigators watched Wen and Tan pay for the delivery, and once
the couple had climbed back into their black Nissan Murano and driven
away, the lawmen, along with agents from Immigration and Customs
Enforcement, inspected the contents of the parcels: 190 brand-new
smartphones, still in their boxes—mostly iPhones, but some BlackBerry
handsets thrown in too. Many of the iPhone serial numbers matched the
ones in the package picked up by Shamshad.
Fichtner’s suspicions were confirmed. Now he just had to piece
together the particulars of the operation. Over the next few months,
members of the eCrime group visited North Carolina, where the
smartphones had been purchased, and a modest townhouse in Boston—the
residence of electronics broker Pengchong Shou. Investigators obtained
search warrants, downloaded bank records, and tossed trash cans. They
whiled away hours on the phone with reps from Sprint, AT&T, and
Verizon Wireless.
Contraband smartphones confiscated by the California Department of Justice’s eCrime Unit.
Courtesy of the California Department of Justice
A picture slowly emerged of a so-called credit-mule scheme, ingenious
in its simplicity and impressive in its reach. Middlemen such as
Shamshad were dispatched to seemingly random American cities, where they
trolled homeless shelters and halfway houses, offering $100 to anyone
who would buy, on their behalf, a few on-contract phones from a local
electronics store.
Back in California, the contraband was handed off to Wen and Tan, who
arranged to have the phones shipped to their contacts in Asia. The
profit margin was enormous: In North America, wireless carriers
typically subsidize the cost of our smartphones in order to lure us into
multiyear voice and data contracts. To obtain a phone, in other words,
we fork over a small fraction of the device’s actual market worth. Wen
and Tan took advantage of the system by obtaining iPhones—through
middlemen and mules—for $200 a pop, then selling them in China for close
to $1,000.
Records obtained by the eCrime Unit indicate that in a single year,
Wen mailed 111 parcels using his FedEx account. By the time the whole
operation was brought down in March of 2013, he and his wife had become
very wealthy, to the tune of close to $2.5 million in annual income.
Today, Wen is serving just under three years at a California state
prison for conspiracy to acquire and resell stolen property; Tan
received a lesser sentence of a year. (Shamshad, the middleman, was
charged and convicted of receiving stolen property.)
And yet Fichtner and his colleagues are under no illusions that in
apprehending Wen and Tan they have come close to eradicating the larger
problem. “As long as there are profits to be made, thieves will keep on
stealing phones,” Robert Morgester, the assistant attorney general in
charge of the eCrime Unit, told me recently. He smiled. “I mean, why did
Willie Sutton rob banks? Easy: because that’s where the money was.”
In 2009, roughly 5
percent of the global population owned a smartphone. Before 2015 is out,
that number is expected to hit 35 percent, or 2.5 billion
people—approximately the populations of China and India combined.
Considering the ever-quickening pace of technological innovation and the
shrinking cost of processors and chipsets, it does not take a
particularly fertile imagination to picture the day when, perhaps as
soon as 2017, half the world will be hooked up to the small screen of a
smartphone.
For many of us, these devices are among our most valuable
possessions. Or, at the very least, they are among the most valuable
possessions that we cart with us everywhere we go. We hold them up to
our ears on city streets, we fiddle with them on subway platforms, we
set them on restaurant tables—little handheld computers with all the
firepower of a laptop and almost none of the heft. Machines that hold
our entire lives in their RAM, from family photos to work emails to the
balances of our bank accounts. Machines that can be swiped, wiped, and
resold for hundreds of bucks in the space of an hour, often without the
help of a pawnshop or a professional fence. Machines that are worth 13
times more, per ounce,
than a block of silver.
That’s why street theft of mobile devices—or “Apple picking,” as it’s
known—has been such a widespread crime in recent years. According to
Consumer Reports,
3.1 million Americans were the victims of smartphone theft in 2013, up
from 1.6 million in 2012. The mobile security firm Lookout believes that
one in 10 smartphone users in the US have had their phones stolen; 68
percent of those victims never saw their device again. Nationally, about
one-third of robberies now involve a smartphone.
For years, the mobile industry resisted
making even the most minimal efforts to prevent street theft. It had
little impetus to do so: The carriers make a lot of money selling
expensive theft insurance to consumers, and if security software did
successfully deter theft on a large scale, those same carriers might be
out a lot of cash. (William Duckworth, a professor at Creighton
University’s business school, has estimated Americans spend $4.8 billion
annually on premium phone insurance and $580 million a year on
replacement devices.) But the problem has grown so undeniable that even
the carriers are powerless to resist reforms. Last August, after an
intense lobbying campaign led by San Francisco district attorney George
Gascón and New York attorney general Eric Schneiderman, governor Jerry
Brown signed a California kill switch law mandating the inclusion of
technology that allows users to lock up a stolen handset and render it
unusable; similar legislation was signed in Minnesota.
In 2013, Apple rolled out a feature called Activation Lock, which
allows a user to password-protect a phone from being booted up again.
With iOS 7, users had to mess around with their settings to make
Activation Lock work; with iOS 8, it’s turned on by default. Google and
Microsoft have pledged to package all new phones with similar software.
Max Szabo, a spokesperson for the San Francisco district attorney’s
office, says the arrival of Apple’s Activation Lock has already had a
decisive effect. In San Francisco, iPhone robberies dropped 38 percent
in the first five months of 2014; in New York City, Apple-related
robberies were down 19 percent. “Clearly,” Szabo says, “as a deterrent,
the kill switch really works.”
To which one might add a couple of qualifiers: The kill switch really works in
certain circumstances
and as a deterrent to one common type of robbery. If you’re a
garden-variety street thief, driven by opportunism, then it’s true you
might now think twice about pulling an Activation Lock-equipped iPhone
out of a nearby purse.
But Activation Lock is only software, and as any programmer can tell
you, anything coded can eventually be breached. In late May of 2014, for
example, a pair of anonymous hackers went public with an iCloud bypass
they called doulCi, which allows you to reset a device as if it were
brand-new. Similar work-arounds remain online for anyone with the tech
savvy to implement them.
And although Apple and Gascón probably wouldn’t want me telling you
this, a locked phone doesn’t necessarily mean a worthless one. Dustin
Jones, the founder of Harvest Cellular, a telecom recycling company,
recently conducted a survey of 200 used iPhones for sale on eBay. Of
those 200 devices, 32 were explicitly labeled as being stuck on the
Activation Lock screen. Despite the best efforts of Apple, Jones
concluded in a post on the Harvest Cellular blog, “thieves still have an
easy marketplace where they can liquidate stolen devices.”
Just as worrisome is the fact that Activation Lock—and software like
it—is effective only once a device has been linked to an iOS account and
activated by a user who suspects their phone has been stolen. For that
reason, a kill switch would not have stopped the fraudsters Wen and
Tan—in that instance, there was no one to trigger the feature, and the
phones were quickly shipped overseas, where they were likely (and
promptly) fitted with new SIM cards. Nicholas Pacilio, a former
spokesperson for the California DOJ, says that the size and frequency of
credit-muling and fraud operations like the one run by Wen and Tan seem
to be increasing.
As do the number of smash-and-grabs, in which thieves break into
warehouses or electronics stores to obtain a treasure trove of
unactivated devices. In the summer of 2014, the Florida attorney general
announced the arrest of a ring of criminals who used stolen cars to
crash through the doors of Best Buy, hhgregg, and CompUSA stores across
Alabama, Florida, Georgia, and Tennessee. Before it was brought down,
the ring had allegedly obtained roughly $2 million in Apple devices.
Security analysts have started to see street gangs in Oakland,
California, turn away from drugs and toward iPhones.
Indeed, Ben Levitan, a telecommunications veteran who has worked for
Verizon and Sprint, among other major industry players, has argued that a
kill switch, far from fully alleviating the problem, has the potential
to send it corkscrewing in new and unpredictable directions.
A KILL SWITCH WON’T DETER THIEVES WHO QUICKLY SHIP PHONES OVERSEAS, WHERE THEY’RE FITTED WITH NEW SIM CARDS.
“So you roll out the kill switch,” Levitan says. “Great. Street theft
might shrink a little. Maybe a lot. But the guts of the phone are still
valuable, right? People are just going to be trashing their phones and
selling them for parts.” He predicted the creation of a “whole new black
market.”
There is evidence that market already exists. In Alameda County, the
eCrime Unit recently busted an illicit smartphone-parts operation run
out of a store called AppleNBerry. (The owners of AppleNBerry, Sammy and
Steven Chan, have since pleaded guilty to receiving stolen property and
selling counterfeit goods.) And in August the FBI announced the arrest
of 20 individuals associated with the so-called Mustafa Family, a
Minnesota-based group that was involved in shipping stolen phones and
parts to black marketers in the Middle East and Asia.
“Even with the Activation Lock, you still have the issue of credit
muling, you still have smash-and-grabs,” says Samir Gupte, a product
manager at Lookout. He says that eventually, manufacturers could start
to tag devices with a unique product key as they are being built; users
could be required to have that product key on hand to activate the
phone. But manufacturers are unlikely to undertake all the extra work
unless compelled to do so, and moreover, as Gupte acknowledges, “thieves
often find a way of catching up with any new technology.”
Criminals are ingenious, adaptable. In September, for example,
Pennsylvania law enforcement arrested two smartphone thieves for
allegedly breaking into several electronics stores. According to police,
the men were using a camera-equipped drone to recon their targets.
“There’s no bulletproof solution to smartphone theft and there never
will be,” wireless industry analyst Jeff Kagan says. “It’s like the long
war between the people who create computer viruses and the people who
write security software. Or the people who make radar guns and the
people who make radar detectors. It’s just continually escalating.”
In the meantime, there is concern among some
activists that kill switch technology will infringe upon the rights of
smartphone users. Last year, before the California kill switch bill
became law, the Electronic Frontier Foundation penned an open letter
criticizing the legislation and highlighting what it called the
“potential for abuse.” The government would theoretically have the
ability to force carriers to shut down certain phones, the EFF pointed
out—a frightening thought to civil libertarians.
Equally frightening is that activating a kill switch does not mean
that your privacy won’t be compromised, as was shown a couple of years
ago during an attack against the Sony PlayStation Network, in which
hackers exposed personal information from 77 million user accounts
despite Sony’s ability to shut down its system.
Examining smartphone theft statistics from this angle, along with the
proposed fixes and their various drawbacks, one can start to feel a
profound despair. Perhaps losing our phones to quick-fingered thieves is
just something we’ll have to learn to live with for months and years
and decades to come.
When I raise this possibility with security analyst Marc Rogers,
formerly of Lookout and now serving the same role with a company called
CloudFlare, he demurs. Smartphone theft only looks insoluble, he says,
because we’ve come to believe, erroneously, that it’s a monolithic
problem that can be solved by a single killer app. In fact, it’s a
dense, complicated, multilayered dilemma that requires a multilayered
solution.
Ben Wiseman
Rogers argues that the best way to reduce theft is to embrace an
array of complementary techniques. Call it the holistic approach: more
kill switches, even if they can be bypassed; more aggressive law
enforcement, even if a few thieves manage to slip through the dragnet;
and more third-party applications that help shore up defenses.
Lookout makes an app that can track your stolen device, take a
snapshot with the front-facing camera and note the location whenever an
unauthorized user attempts to access it. And Polo Chau, an assistant
professor of computing at Georgia Tech, is researching an authentication
protocol that would memorize the highly individualistic ways in which a
user swipes and types on a touchscreen. Mated to a security system,
such software could power down a phone it concluded was being accessed
by an unauthorized user.
“You want to put up obstacles for the criminals at every turn,”
Rogers says. “You’ve got to think of the theft of smart devices as an
economy, and you’ve got to destabilize that economy. You’ve got to
disrupt the supply chains. You won’t get everyone, but in some places
you’ll beat them back.”
http://www.wired.com/2014/12/where-stolen-smart-phones-go/?mbid=social_fb
MATTHEW SHAER (
@matthewshaer) is the author of
The Sinking of the Bounty: The True Story of a Tragic Shipwreck and Its Aftermath.
