Smartphones don’t need a kill switch, but some bills do

If you’re one of the many lucky Americans to receive a new smartphone this holiday season, congratulations! But watch out for thieves -- and policymakers with bad ideas on how to stop them.

In particular, two elected officials in the Bay Area are proposing to make mobile devices less attractive to thieves by making them more attractive to malicious hackers.

OK, that’s not their intent (I hope). It’s just one potential result if a proposal by Sen. Mark Leno (D-San Francisco) and San Francisco Dist. Atty. George Gascon becomes law.

At issue is how to combat the surging tide of cellphone thefts. According to the law enforcement officials in the Secure Our Smartphones Coalition, two smartphones are stolen every second in the United States. That’s because it’s pretty easy to find a buyer for a stolen phone, and even when there’s no interest in a particular model, the components may have value.

The number of thefts has risen sharply in recent years, and with that the number of victims injured by the robbers who snatched their smartphones. In short, it’s a real and growing problem.

The bill, which Leno says he’ll introduce in January, would require phone manufacturers to include “kill switch” technology that would turn a stolen phone into a stylish paperweight. The bill echoes the position taken by attorneys general from 30 states (but not California’s Kamala Harris), who recently sent a letter to Google, Microsoft and Samsung urging them to do more to deter thefts of their products.

The AGs’ letter included a pitch for a particular anti-theft solution. “It is our understanding that a ‘kill switch’ that would enable stolen devices to be permanently disabled is now required by South Korea, which raises questions as to what the manufacturers are capable of doing if one country has already mandated a more robust response,” they wrote.

But here’s the thing. Consumers already have the ability to lock their phones (Apple’s iOS software makes that a default setting; Google’s Android offers it as an option), which would render them much less valuable on the market for used phones than phones with no password protection. Mobile phone companies can also deactivate a phone remotely at the owner’s request, preventing it from connecting with their voice and data networks. The carrier can reactivate the phone if the owner recovers it -- a restoration that may not be possible with kill switch technology.

Mobile network operators signed on to a federal initiative in 2012 that created a registry of phones reported stolen by their owners. As part of the initiative, the carriers agreed not to activate a phone whose unique identifying number is in the registry.

One of the main shortcomings of the registry is that it’s not global, at least not today. That means thieves can still find a receptive market for stolen phones overseas.

A kill switch built into phones and operated remotely by carriers (or phone owners) could give thieves much more pause. The technology would not just deactivate a stolen phone, it would prevent the device from being used for anything. Doing so would protect all the images, texts and other content stored on the phone. The registry of stolen phones would not; a deactivated phone can still be turned on and searched, assuming the owner didn’t lock it. In fact, a deactivated phone is still a perfectly good phone, if you have a Wi-Fi network and the Skype mobile app.

If people knew stolen phones were sure to be turned into bricks, such devices wouldn’t be worth any more than the value of their salvageable components. A phone that might otherwise fetch hundreds of dollars would, once bricked, be worth a fraction of that amount.

That’s pretty compelling if you don’t care about the potential drawbacks. But the drawbacks are kinda hard to ignore.

One truism for networked devices is that anything that can be done remotely poses the risk that hackers will find a way to do those things too, without authorization or benign intent. So think about a world in which phone companies and carriers are required to build a kill switch into all their new devices. Now think about what might happen when not-so-nice people figure out how to trigger the kill switch. Could the trigger be broadcast throughout the network? If not, would there be a database holding the various triggers for individual customers’ devices? And what would happen if that database were cracked and the records stolen?

These are ugly scenarios. And considering the sheer number of phones that could be affected, hackers would probably find the temptation to develop an exploit irresistible.

“I don’t think any consumer should be forced to buy a product with this” technology, said Derek Khanna, a former congressional aide turned technology policy analyst. Some of his acquaintances “think of this as a danger,” Khanna added. “If you want a phone that does not have a kill switch, you should have that as an option.”

That seems reasonable, right? Tech-savvy consumers who want to take responsibility for their own privacy and security risks -- the kind who use pass codes to lock their phones and who encrypt the data stored on them -- should be free to do so.

But once the kill switch becomes optional, the deterrent value vanishes. Thieves will continue to steal smartphones on the (correct) assumption that some percentage won’t be bricked or password-protected.

That’s not to suggest government shouldn’t be trying to solve the problem posed by rampant smartphone theft. It’s just to say that the kill switch isn’t the right solution.

ALSO:

The umpteenth Obamacare fix

‘Duck Dynasty’ and a free society

The night L.A. vice netted Peter O’Toole and Lenny Bruce: by Joseph Wambaugh

Follow Jon Healey on Twitter @jcahealey and Google+