Journalist arrested after exposing Facebook security flaw

An Australian journalist was arrested and his iPad tablet seized after he reported on a security flaw on social networking site Facebook. Fairfax Media reporter Ben Grubb, 20, had reported a Facebook privacy vulnerability test last May 16, the International Federation of Journalists said. "Queensland Police received a complaint about the May 16 story and the following day moved on Grubb, who was questioned before being asked to hand over his iPad. When Grubb questioned the legislation that allowed officers to confiscate the device, he was informed he was under arrest in relation to receiving unlawfully obtained property," the IFJ said on its website. The Federation added that, while Grubb was released a short time later, police still held the iPad. Grubb had conducted a demo at an Internet security conference session in Queensland, showing that IT experts were able to access photographs protected by Facebook’s privacy settings. The IFJ quoted Grubb as saying that he was told that forensics officers were to make a complete copy of the information on his iPad, "whether it related to this matter or not." “I feel like I have been unfairly targeted. Journalists must be able to report what they observe – that's what they've been doing for ages and so to see this kind of policing occurring is very alarming," Grubb added. Chris Warren, the federal secretary of IFJ affiliate the Media, Entertainment & Arts Alliance, said the actions by Queensland Police breached the journalist’s right to report freely. Warren added that obtaining the iPad should have been authorized by a subpoena, and officers should have presented Grubb with the option of having his lawyer present before answering any questions. “This particularly draconian and unnecessary action on the part of Queensland Police shows how fragile press freedom is in Australia," Warren said. “There is a real risk that journalists – and their sources – will be wary when it comes to using new technologies to gather news, which is a major concern," he added. Warren added it was a credit to Grubb that he recorded the police interview on his iPhone. “The IFJ is surprised and concerned to see such a flagrant violation of press freedom in a country where it is often taken for granted," IFJ Asia-Pacific Director Jacqueline Park said. “Efforts by Grubb’s colleagues and supporters to keep pressure on Queensland Police following its actions reinforce how important it is that all journalists maintain vigilance for breaches of press freedom," she added. Grubb's story, which appeared in the Sydney Morning Herald, had reported on security expert Christian Heinrich using the wife of another security expert, Chris Gatford, in his demonstration. Heinrich and Gatford "do not enjoy each other's company," Grubb's report had said. The report said that the privacy vulnerability, which can affect all Facebook users if a hacker has enough time to exploit it, allows for privacy-protected photos to be accessed without being the user's "friend." At the conference, Heinrich demonstrated how he had gained access to the privacy-protected Facebook photos of the wife of Gatford. Heinrich, who works as an IT security contractor, admitted he did not like Gatford but said that, because Gatford presented himself as a security expert, he should be accountable for what is posted online. "I have no ethical qualms about publishing the photos," he said. "They are in the public domain." Gatford, who is also attending the conference, said he had "no comment" about the incident. "Don't believe that the privacy settings extend all the way through the web application," Heinrich said. He said that social networks should tell users that they should not have an expectation of privacy. In his presentation shown to audience members, Heinrich demonstrated how he had, over about seven days, extracted the privacy-protected Facebook photos of Gatford's wife via Facebook's CDN. One photo was of Gatford sitting on the floor next to one of his children. Heinrich blurred out the child's face but left Gatford's in. US security expert at HP TippingPoint, John Pirc, who once worked for the Central Intelligence Agency (CIA) in cyber security and is also attending the conference on the Gold Coast, said that what Heinrich showed was, in his opinion, "unethical." "I wouldn't have done it. I think if you're going to demonstrate something like that you should get permission from somebody that would allow you to do that," he said. Pirc said what Heinrich showed "was no surprise" to the security industry. "I give him a lot of credit for doing it in a public forum. I certainly wouldn't have done that. I just don't think people know [that their photos aren't private]. You hear about people losing jobs for what they post on Facebook," he said. Heinrich hoped that this would be a "wake-up call" for people using social networks. — TJD, GMA News