A few days after I gave a talk at the HOPE\/X conference titled, “Identifying Backdoors, Attack Points, and Surveillance Mechanisms in iOS Devices”, ZDNet published what their senior editor has described privately to me as an opinion piece, however passed it off as a factual article in an attempt to make headlines at my expense. Now that things have had time to settle down, I’ve taken the time to calmly write up a post-mortem describing what actually happened as well as some behind-the-scenes details that may shed some light on the drama we’ve seen from ZDNet and one of its writers over the past couple of weeks. Let me say first that this is the last time I will address this matter, and have no desire to continue to discuss it, or engage with ZDNet or their writer. In fact, I haven’t engaged with either parties since this all transpired a week or so after my talk, in spite of repeated attempts to bait me with more personal attacks and false claims of harassment.<\/p>\n
At HOPE\/X, I gave a very carefully-worded talk describing a number of “high value forensic services” that had not been disclosed by Apple to the consumer (some not even to developers),\u00a0such as the com.apple.mobile.file_relay service, which I admitted to the audience as having “no better word for” to describe than as a “backdoor” to bypass the consumer’s backup encryption on iOS devices; this doesn’t necessarily mean a nefarious backdoor, but can simply be an engineering backdoor, like how supervisor passwords or other mechanisms work – a simple bypass to make things convenient. A number of news agencies reached out to me, and I took time to explain to each journalist that this was nothing to panic about, as\u00a0the threat models were very limited (specifically geared towards law enforcement forensics and potentially foreign espionage). Also, that I did not believe there was any conspiracy here by Apple. Reporters from ARS Technica, Reuters, The Register, Tom’s Guide, InfoSec Institute, and a number of others spoke to me and got all the time they wanted.\u00a0You can see that these journalists each\u00a0published relatively balanced and non-alarmist stories; even The Register, who prides themselves on outlandish headlines, if you read their story, was actually quite level headed about the matter. A number of other news agencies, who had not<\/em> reached out to me, published sensationalist stories with crazy\u00a0claims of an NSA conspiracy, secret backdoors, and other ridiculous nonsense. I\u00a0tried very hard to throw cold water on those ideas both in my talk and in big letters on my first blog entry,\u00a0with”DON’T PANIC” and\u00a0instructions for journalists.<\/p>\n ZDNet was among the news agencies that had initially published a sensationalist story without approaching me first for questions.<\/p>\n <\/p>\n My\u00a0talk was based on research that I had recently submitted to, and had\u00a0gotten accepted and published<\/a>, in The International Journal of Digital Forensics and Incident Response<\/a>. The research paper was fully peer-reviewed by Editor-in-Chief Eoghan Casey<\/a>, now\u00a0with the Department of Defense. The editorial board for this journal consists of leading researchers from Google, Microsoft, a number of universities, and defense contractors. The journal publishes solid, academic quality research covering a wide range of disciplines within the digital forensics field. My\u00a0research paper goes into thorough detail about the threat models and risks that apply to this research, explains a number of the caveats, and outlines the technical details in a very thorough presentation. During the blind review process, I received feedback from the reviewers, and the research paper was refined and brought to consensus as worthy of publication.<\/p>\n The findings of my research were later validated by a number of researchers, the most prominent of which was a paper published by\u00a0Stroz Friedberg<\/a>.<\/p>\n A few days after their first story, ZDNet ran a second, this time by a freelance\u00a0reporter going by the name Violet Blue. As was with the first reporter, this one\u00a0also failed to contact me to ask any questions. She ran a smear story with the sole intent of\u00a0trying to\u00a0discredit my claims and fabricate a narrative\u00a0that my research had been debunked. ZDNet already had egg on their face from their first sensationalist story, so perhaps this was an attempt to save face from\u00a0that article, which was also irresponsibly written without my input. In ZDNet’s story, a number of personal attacks were made against me, and over 30 falsehoods were published in a mere 20 or so sentences. I’ll document these at the end of this blog post. I initially ignored the smear piece and moved on, however within a few hours, the reporter\u00a0(Violet Blue) resorted to demeaning taunts and baiting tactics on her Twitter account to get my attention. It was at this time I decided to contact ZDNet’s senior editor. In waiting for a reply, tension flared a bit and I made a few comments (via tweets) to Ms. Blue about the substandard quality of her journalism and lack of principles (which I do not apologize for), as well as two comments about ZDNet’s desire to publish what I deemed rubbish (again, which I do not apologize for, because it was). Additionally, a number of other well respected members of the InfoSec and iOS hacking communities made comments to Ms. Blue about inaccuracies in her story and the poor taste in which it was written. Here is one example<\/a>. Here is another<\/a>. Here is yet another<\/a>.<\/p>\n Outside of a few comments and an email to ZDNet’s editors, I have made absolutely no attempts to engage with, contact, or address Ms. Blue.<\/p>\n Somewhere in the midst of this, I even offered Ms. Blue $100 (via Twitter) to find me one journalist who would say that I led them to panic. She never claimed this bounty.<\/p>\n During this time, a few things were made known to me privately, by many individuals who had dealt with Ms. Blue and her tactics before. It was explained to me that Blue\u00a0is a manipulator, and that this type of baiting and manipulation was commonplace. I was told\u00a0that she had subjected a number of other innocent individuals to the same harassment; baiting them, taunting them, using her position to make personal attacks… and then falsely claiming harassment when they responded. This manipulation tactic is referred to as DARVO<\/a> (Deny, Attack, Reverse Victim and Offender), and is a technique often employed by abusers. A\u00a0number of credible journalists also contacted me privately to corroborate her\u00a0tactics. I was specifically told by one journalist\u00a0that Ms. Blue “attacks people in an underhanded way and when they respond screams harassment” and that she “makes my profession harder”. A different journalist expressed frustration that Ms. Blue had also misrepresented his piece as sensationalist in her own smear piece. Yet another journalist had some very not nice things to say about her at all, which do not bear repeating.<\/p>\n Another thing that had been told to me by a few different people privately, were that they had first-hand knowledge that Ms. Blue’s piece on me had more to do with the fact that I was a Christian (alleging she is very discriminating against those with my beliefs – plausible, given: link<\/a>, link<\/a>), and because I had previously written an essay criticizing Mozilla<\/a> for ousting Brendan Eich as CEO merely due to public opinion about his personal contributions to Proposition 8. Given the reliability of the people who provided this information, it seems like a plausible\u00a0explanation. On the other hand, I haven’t ruled out misandry all together, or perhaps just sheer ignorance of\u00a0tech.<\/p>\n After learning about Ms. Blue’s tactics, and seeing her begin to already falsely claim harassment, I immediately decided to stop engaging with her altogether. While Ms. Blue had claimed publicly that she blocked my Twitter account, this was just one of many lies\u00a0she’d made up, and so even while seeing her attacks continue, I have since continued to ignore her attempts to bait me – up to and including her posting derogatory comments about me on a tumblr account in the form of an “interview” that never took place (a reporter sent me the same questions for a followup). During this period where Ms. Blue had alleged I had “harassed” her, she was making numerous personal attacks against me, accused me of attacking her using a troll\u00a0account (which I hadn’t, and never would do), hurled insults at me such as\u00a0“creepy” and suggested I had psychological issues, and continued to attempt to discredit me and my character. My only attempts to engage her, as I said, were to contact her editor and fire back with a few comments of my own about her journalism. I’ve never been one to mince words. While I admit my comments, in the heat of her slander, were mildly sarcastic, they were certainly not abusive or personal in any way – as her own comments had been toward me. Nothing I ever said or did would have ever constituted harassment. If you write a smear piece about someone, you should expect to get at least a little bit of feedback from those you harmed. Journalism comes with a degree\u00a0of accountability, which is why I had approached her editor to file a complaint.<\/p>\n ZDNet’s senior editor (David Grober) eventually responded back amidst the mess that Ms. Blue had created and insisted that her piece was a “commentary on the relationship between your presentation and media reports\/interpretations of your work”\u00a0and that her article should have been labeled as “opinion”. Mr. Grober also acknowledged that Ms. Blue should have reached out to me for comment, as a courtesy. In spite of this, Mr. Grober made no attempt to retract or correct the article, or any of the 30 falsehoods I had pointed out – in spite of my request for him to do so. I had even provided Mr. Grober my personal cellphone number in hopes that we could walk through the article. He never called, and instead decided to ignore my\u00a0ethics complaint. Mr. Grober instead asked me to provide a rebuttal, however it appeared to me that he was only interested in the headlines and website traffic it would generate. I declined, refusing to even acknowledge their article as an act of journalism. Of course, by this time the damage had already been done anyway, and in many cases, the article was written in a way to make any attempts at a rebuttal ineffective.<\/p>\n The damage Ms. Blue had attempted to cause – whatever her motivation – was in fabricating a story and the illusion that somehow my research had been debunked, or was even being questioned; she introduced doubt where there was none, and this could have put Apple’s response to correcting the issue at risk. Additionally, as someone who has testified as an expert in high profile criminal cases, and has consulted on cases for the federal government, military, and even internationally on matters as important as national security – my credibility is important. In fabricating the idea that my research had somehow been debunked (without any evidence to back up her claim), Ms. Blue had made a direct attack at my credibility, and could have recklessly put many cases at risk.\u00a0With such a strong and outrageous accusation, Ms. Blue provided absolutely no evidence from anyone in the community of anyone questioning the validity of these security issues.<\/p>\n Following Ms. Blue’s article, there had been limited debate about the semantics of the term “backdoor”, and some understandably disagree that the file_relay fits the technical definition of such… however, even among those who disagree with the wording have also publicly stated that the underlying security issues should be addressed. Some of the community’s well-respected researchers posted public summaries, such as Dino Dai Zovi’s TL;DR writeup<\/a> (which had originally even used the term “backdoor”, but then decided that using Apple’s term would be less controversial); Ms. Blue’s tweet history shows that she even attempted to attack Mr. Dai Zovi for “validating” my work (validating<\/em> was her choice of words). Among others who found value in the research were Andrew Case<\/a>, Josh Hill (p0sixninja)<\/a>, Matthew Green<\/a>, and many others. MobileIron and Good Technologies both noted my research and published articles citing ways to protect your mobile data in light of this research. Many also jumped to my defense including Anthony Vance<\/a>, Frederic Jacobs<\/a>, and more. In addition to this, Apple themselves have validated my research by already beginning to address the security issues<\/a> in their latest beta, which was released shortly after my talk had received national attention. So while there has since been a semantics debate about use of the term “backdoor” (a term the media has inaccurately attributed\u00a0to conspiracy theories), the research and the threats these vulnerabilities pose have not been undermined or discredited in any way, and quite the contrary have been deemed valid enough that Apple is addressing\u00a0them quickly and two major countries (Russia and China) are raising all of the right questions.<\/p>\n I cannot speak as to Ms. Blue’s true motivation for running such a fabricated smear piece. Perhaps it is related to my religion, or to save face at ZDNet, or perhaps it is just because those types of sensationalist headlines sell. What I do know is that her piece was entirely fabricated, written in a vacuum, and is strongly disputed by the reputable journalists who took the time to discuss the technical details with me (and read the full white paper as well). Ms. Blue’s unfounded personal attacks have caused me great personal stress and upset.<\/p>\n Ms. Blue has continued to take every opportunity to harass and abuse me without provocation. On several occasions since these events, I’ve seen my name appear cited in news articles by reputable sources\u00a0on Twitter, with tweets from Ms. Blue trailing in the replies, attempting to smear me all over again. In anything that I do, Ms. Blue continues to slander and harass\u00a0me. I have long since moved on from this awful experience, however my professional life is now subject to cyber stalking by\u00a0this individual, who takes every opportunity to cause damage to my reputation.<\/p>\n ZDNet’s management staff eventually went through a turnover, and the new staff found Ms. Blue’s article so embarrassing that they have since disavowed themselves of it entirely with a boilerplate at the top, even to the degree of citing that Violet Blue no longer writes for them.<\/p>\nAbout the Research<\/h1>\n
The Second ZDNet Story
\n<\/strong><\/h1>\nMotivations<\/h1>\n
The Editor\u00a0Responds<\/h1>\n
The Fallout<\/h1>\n
Conclusion<\/h1>\n