Add SORM vendors

[aagt]

Companies Added from Access report: https://s3.amazonaws.com/access.3cdn.net/279b95d57718f05046_8sm6ivg69.pdf

Oxygen Software
MFI-Soft
Protei
Analytical Business Solutions
AccessData

[botherder]

I don't think that forensics company should really classify as surveillance vendors. Thoughts anyone? @agrabeli interested in looking into them?

[agrabeli]

Yes, I'll have a look.

[agrabeli]

Just had a look at those 5 companies. I would add them all given that we haven't narrowly determined the types of vendors we're interested in and I think cell phone forensics falls under surveillance broadly. To avoid confusion, perhaps it might be useful to change the data package a bit and add additional columns with specific types of surveillance that we're interested in (RCS, DPI, etc)?

[aagt]

Noted re: types of surveillance to focus on. Are IMSI catcher/Stingray vendors of interest?

My reasoning for including mobile forensics companies as surveillance vendors:

• The devices they sell are marketed to law enforcement (https://www.privacysos.org/node/636) as tools to extract contacts, videos, SMS messages, IMSI, call logs and geotags from seized devices (https://wikileaks.org/spyfiles/files/0/110_CELLEBRITE-UFED.pdf)
• Any tool that extracts a disproportionate amount of private information from a device without user consent is plainly a surveillance device, even if the collection is not done surreptitiously
• The devices are used exactly as marketed (https://www.aclu.org/blog/new-document-sheds-light-governments-ability-search-iphones?redirect=blog/technology-and-liberty-criminal-law-reform-immigrants-rights/new-document-sheds-light; see 3-5 of FOIA request: https://www.aclu.org/sites/default/files/field_document/iphone-forensics-report_redacted.pdf)
• While recent decisions in the US may discourage their use without a warrant (http://www.supremecourt.gov/opinions/13pdf/13-132_8l9c.pdf), forensics devices are still pertinent as they are still likely used improperly elsewhere

[agrabeli]

@aagt I agree with you and would add vendors of IMSI catchers and mobile forensics.

@botherder Any thoughts?

[botherder]

I would agree with iMSI catchers, I wouldn't necessarily agree on forensics software. In my opinion, forensics and surveillance are very much separable. While surveillance is an ongoing state, forensics is post-portem and done after seizure. I don't think they can be mixed up, or we risk to become very broad and inaccurate in representing the threat that certain types of company or technology really pose in our specific context.