back
622 comments
There is so much to address in this post but I want to look at just this part: "One of the reasons we know this story is bogus is because of the New York Times story which cites anonymous officials, “speaking on the condition of anonymity to discuss an ongoing investigation”. That’s not a thing, that’s not a valid reason to grant anonymity under normal journalistic principles. It’s the “Washington Game” of “official leaks”, disseminating propaganda without being held accountable."

It is not accurate to claim "that's not a thing". Citing anonymous sources is a long established practice (in particular when it comes to law enforcement activities or potentially sensitive political reporting). The NYT has formal editorial standards around the identity of anonymous sources that require editors to assess the justification for applying it. It doesn't mean the information is reliable, that's where an editorial eye comes into play, but it does fall under the category of normal journalistic practice.

Next the "Washington Game": there’s a grain of truth here, but it is overstated. Yes, leaks can be part of a strategic move by politicians and it can be a source of exploitation by political operators but to equate all anonymous sourcing with propaganda is misleading. Plenty of such reporting has resulted in significant truths being revealed and powerful people being held accountable (Watergate, the Pentagon Papers, Abu Ghraib). Responsible reporting involves weighing a source's motivations as well as corroborating and contextualizing that information as accurately and truthfully as possible.

The author's dismissiveness oversimplifies (or mischaracterizes, if I am being less generous) the reason and function of anonymity here. They overstate the issue with propaganda and anonymous sources. Accurate in the sense that anonymity can enable propaganda (it has happened), it is inaccurate in its absolutism.

I feel like this sort of tone, with the absolutism, the attempt to reduce the complexity and nuance of reporting to the point where it can be dismissed is pretty typical of what passes for commentary in today's blog/tweet/commentary culture but it really plays more into the hands of those that would sow confusion and mistrust than it does into that of the truth and accuracy.

The "Washington Game" is described the Society of Professional Journalists. https://www.spj.org/spj-ethics-committee-position-papers-ano...

Citing anonymous sources is not established ETHICAL practice, it's corruption of the system. The roll of the journalist is to get sources on the record, not let them evade accountability by hiding behind anonymity. Anonymity is something that should be RARELY granted, not routinely granted as some sort of "long established practice".

What is the justification for anonymity here? The anonymous source is oath bound not to reveal secrets, so what is so important here that justifies them violating their oath to comment on an ongoing investigation? That's what we are talking about, if they are not allowed to comment on an ongoing investigation, then it's a gross violation of their duty to do so. The journalist needs to question their motives for doing so.

We all know the answer here, that they actually aren't violating their duty. They aren't revealing some big secret like Watergate. They are instead doing an "official leak", avoiding accountability by hiding behind anonymity. Moreover, what the anonymous source reveals isn't any real facts here, but just more spin.

We can easily identify the fact that it's propaganda here by such comments about the SIM farms being within 35 miles of the UN. It's 35 miles to all of Manhattan. It's an absurd statement on its face.

One of the more sober assessments in this entire thread, and closely aligned with how I experienced it. It's not nothing to stress the fact that it was pretty far away from the UN and that it's not obvious why a case of SIM cards would enable surveillance (seems more like it would anonymize an individual bad actor). But a large part of this is completely unsubstantiated speculation that people are nodding along with, which, in my opinion, is showing a breakdown in the ability to comprehend logical or evidence-based arguments.
Judith Miller taught me that either the NYT is totally corrupt, or easily misled. It is completely reasonable to place almost zero weight on stories they report on "national security" from nothing but anonymous sources from the intelligence community.

Real stories have real evidence.

>Plenty of such reporting has resulted in significant truths being revealed and powerful people being held accountable (Watergate, the Pentagon Papers, Abu Ghraib).

And what, pray tell, is the major scandal in this case? The source isn't alleging any impropriety or illegal activity. Anonymous sources are for stories which are being suppressed or lied about, not for investigations which have not yet publicly been announced due to pending litigation. If there's no obvious motive for why the source would want to be anonymous then all you're reporting on is rumor and gossip.

> The NYT has formal editorial standards around the identity of anonymous sources that require editors to assess the justification for applying it.

They should also have editorial standards that judge the quality of the information and then decide whether to even print it or not. In this case, without a second source, it probably should /not/ have been printed.

To me, the article is saying that an "ongoing investigation" is not a valid reason to grant anonymity, not that there are no valid reasons to grant anonymity.

Who is being protected from whom by granting this source anonymity? With your three examples it's clear, but not as much in this case.

While this comment is true, the bigger/real story is all(?) the media is lying.

Anyone on TikTok has gone down the phone farm rabbit hole. Some of us stay. This is teen level tech. There's phone farm ASMR.

Better question is why this is the best take down of a 'bogus' story on Hacker News?

This comment really should not be top or what Hacker News discusses as a side comment.

So in a meta conversation about news, there was discussion yesterday about social media and speech. One of the main reoccurring threads of conversation was that news should be left to the experts and those vetted. https://news.ycombinator.com/item?id=45352213 https://news.ycombinator.com/item?id=45354893

If that was the model that society adopted, the fine article would be among the set of data being censored. Robert Graham seems to be competent in his field but he lacks the pedigree that the NYT wants to cite. Even worse, he disagrees with those who the NYT turn to as matter experts: https://substack.com/@cybersect/p-174413355

Author kind of made me trust him about as much as I trust the SS on not exaggerating when he spoke as if only he is an authority because he has declared himself a hacker. I think I might have trusted him more if he said "I used to run one of these SIM farms back in the day"
There is a lawyer (Alec Karakatsanis) who has been writing about police driven propaganda for years. His recent book "Copaganda" is fantastic. He carefully breaks down how major papers (NYT is chief among them) create stories that fit a narrative by using very one-sided sources. Like an article on crime written in bad faith where the only people quotes are police, police consultants, and ex-police.

It's a really good book, I wish more people were aware of it and read it.

I felt slightly...hm...confused when reading this. When I see something in the news, to the degree that I trust the source, I see it only as a statement of fact, and unless I trust the commentator, I ignore the comment. I only expect descriptive accuracy from the news. This sometimes requires resources that individuals don't generally have.

When I read a personal blog article articulating a personal opinion, presenting evidence and trying to make a case for their conclusion, I usually apply a different standard. From them, I expect sound reasoning, which often requires a form of independence/neutrality that news organizations don't have.

And let's just say this article is not exactly structured as a sequence of QEDs, so to speak. It doesn't seem like the conclusions follow from the premisses. That's not to say it's wrong, just that if it is right, it would be in part by accident.

This whole thing reminds me of the 90s when the government would bust some 16 year old hacker kid in his suburban bedroom who was abusing a PBX, and then parade him around like they'd arrested Lex Luthor (the cartoon villain, not the actual hacker) and prevented a global crisis.
> That’s not a thing, that’s not a valid reason to grant anonymity under normal journalistic principles. It’s the “Washington Game” of “official leaks”, disseminating propaganda without being held accountable.

Yeah makes a lot of sense when framed like this, the timing of the secret service of all people busting this 'huge' operation was far too suspicious.

If the objective is to knock out cell towers, just jam them. It's clearly a SIM farm for middle-man communications. It just happened to be close to where the UN were.
Paying for residential / mobile proxy[0] traffic for scraping is becoming more common - this is what I always imagined the other end of the mobile part looked like.

[0] https://oxylabs.io/products/mobile-proxies

Cell phone farm devices are a thing. Here's one you can buy on Alibaba.[1] This is a little more pro looking than the ones seen in New York. It's 20 phones in a 2U rackmount case. Costs $1880, including the phones. Cheap shipping, too.

Lots of variations available. Vertical stack, different brands of Android phones, rackmount, server racks for thousands of phones, software for clicking on ads, training videos. "No code".

Product info:

"only provide box for development or testing use.pls do not use it for illegal"

Description

Package

Each Box purchase includes the hardware (20 Phone motherboard ,USB cable, box power cord, phone motherboard +advanced control management software (15days free,after that $38 a year) download software from our website (in the video)

Whats is Box Phone Farm ? It is a piece of equipment that removes the phone screen/battery/camera/sim slot, integrates them into a chassis, and works with click farm software to achieve group control functions. 1 box contains 20 mobile phone motherboards. Install the click farm software on your computer and you can do batch operations.

Function:

Install the Click Farm software on your PC, and you can operate the device in batches or operate a mobile phone individually. Only one person can control 20 mobile phones at the same time, perform the same task, or perform different tasks separately, and easily build a network matrix of thousands of mobile phones. As long as it is an online project that mobile phone users participate in, they can participate in the control. The voltage support 110v- 220V, and when running the game all the time, one box only consumes about 100 watts.

Ethernet:

[OTG/LAN] can use USB mode, and can also use the network cable of the router to connect the box.Two connection modes can be switched.

[1] https://www.alibaba.com/product-detail/S22-Server-Rack-S8-Bo...

The https://news.ycombinator.com/item?id=45345514 discussion has indeed raised all of the same points.
Reading between the lines, my guess is something like this happened:

* some of the US government officials protected by the Secret Service were the targets of swatting

* the USSS found the swatting calls were anonymized by a SIM Farm in/near NYC

* their investigation of the SIM Farm found "300 co-located SIM servers and 100,000 SIM cards across multiple sites"

* it could have hypothetically been used for swatting officials at the UN General Assembly, but that seems to be conjecture by the Secret Service, rather than anything they actually have evidence of

Does that seem consistent with what we know?

So if some rando were to just find one of these huge SIM farms, who could they call, and would anything be done?

With the number of radios seen in the photos from the original story, there must have been a great deal of SMS from that structure. That is very easy to spot with low cost equipment: a TinySA[1] and a directional antenna should be sufficient. Hams do "fox hunting" with similarly basic equipment.

Given the resources of cell operators, the most charitable explanation for how something like this can exist for more than a brief interval is total indifference.

[1] The more recent versions ($150+) are pretty powerful and can see all 4G/5G bands.

> One of the reasons we know this story is bogus is because of the New York Times story which cites anonymous officials, “speaking on the condition of anonymity to discuss an ongoing investigation”.

Yes, we should be skeptical of anything that is entirely sources from anonymous sources.. even if they align with what we want to believe.

And further, I'd love to see reporters start burning sources that lie to them. After all, the source is risking/destroying the reporter's credibility along the way. Unfortunately, we'll never see that as it's all an access game.

Does anyone know what crime is being investigated? It looks like the malicious activity was sending spam text messages and forwarding international phone calls. Is there a federal regulation against sending spam messages?

Is it somehow illegal to have many sim cards in the same place as having many radios?

The telco's are also capable of bringing down the network, and they are legally allowed to turn their services off. Its not government infrastructure, its a business. If the backbone ISP providers decided to turn off their services for an area for a time, thats fine, there are contractual provisions to deal with that. its not a crime.

There has been no mention of arrest, was this 'crime' perpetrated by the infamous hackerman in ablack hoodie?

First thing I thought when reading it. This story makes no sense. Nothing they mentioned in the article is actually illegal. Having lots of phones (even in a rack-mount form factor) isn't illegal. Even if the phone network could conceivably be DoSed with that many phones all calling at once, it's not illegal unless you actually do that or intend to do it. And their other justification was that this equipment could be used to send anonymous or encrypted communications - that's not illegal either. Even this government hasn't gotten to the point of making encryption illegal.
I knew they were overhyping the National Security/United Nations impact when they said it was 35 miles from the UN building, in the NYC area there must be hundreds if not thousands of cell sites in that 35 miles. They certainly weren't targeting the UN building.
One comment I saw elsewhere: why didn't we see an announcement of an arrest by FBI at the same time this story came out?

Now I know why.

I fully agree the narrative is nonsense, the ways, means, and timing of the story is suspect, but I don't buy the "don't trust those experts, trust me, I'm the expert" vibe of this article. Criminal enterprises and nation states aren't mutually exclusive.
I thought it looked suspicious how neat the cabling was done and cables taped down to the floor to prevent tripping hazards. This would most likely not be the case for a one-time event.
Both scenarios could be right?

It could be just a scam bot farm but a scam bot farm with the intention of targeting vulnerable UN delegates with scams not necessarily to disrupt any cell tower?

Everyone is debunking a claim that wasn't made.

> The Secret Service dismantled a network of more than 300 SIM servers and 100,000 SIM cards in the New York-area that were capable of crippling telecom systems and carrying out anonymous telephonic attacks, disrupting the threat before world leaders arrived for the UN General Assembly

> that were capable of

They didn't say this is what it was used for but that it was capable of doing so. Are we sure that's false? It sounds correct that the equipment is capable of such things.

The story isn't bogus, it's just blown out of proportion. That's unfortunately how most news articles work, especially ones related to crime. The ironic part is that this article is just as much "bogus" with the assumptions it's making.
It really seemed bogus to me, but also assumed that the Secret Service had evidence of criminal behavior that wasn’t publicized which this essentially confirms.
First thing that came to my mind was SimFarm (https://en.wikipedia.org/wiki/SimFarm). And I was really confused.
Given the reluctance of the US government to name the actors behind this apparently quite real sim farm, Israel would be the top suspect?

https://apnews.com/article/unga-sim-farm-threat-explainer-52...

If it is PR then it seems a bit odd. I suspect most people would care way more about them busting an SMS spam farm than protecting the communications of people at the UN. Maybe it has a specific intended audience, but protecting a UN meeting they're hosting is kinda assumed so I'm not sure who would give them much credit here.
This is odd, considering Stingray type devices in back of rideshares targeting phones by IMEI in developed countries is definitely real. But this article doesn't sound bogus, either. One plausible theory is that it was a closest plausible scapegoat that the authority could find, which isn't confidence inspiring.
Great to see that I'm not the only one thinking that the espionage story is totally bogus.
"an actual jacket like myself"... That's _sigh_ you're doing the thing that you're ranting at the agency for doing. At best you'd be an experienced pen tester in the tech industry, which is still good. Don't try to pretend you're living in a Hollywood drama.

We get it you have some political bent and don't like those in charge, but given the professionalism of the setup you don't know how quickly it was setup. If the place was rented last month that _is_ a $1M investment all up front. If it's over time it's still a professional setup all the same by people looking to abuse the system in some way or other for profit. I.e. unknown threat actor until proved proven otherwise.

Honestly picking at a public body bigging up the work they do for the public isn't worth a rant. If this was close enough to the UN buildings and Embassy's to cause a problem then yes. That becomes an international issue. Do you honestly think if this was just a scam farm they wouldn't take money from someone else to burn the thing and turn the city into a circus?

Besides if this was an agency with tech skill but limited funding, like a certain northern province in Asia, they'd bankroll it by scamming to start anyway wouldn't they.

I'm a little vague on how this works.

So the "bad guys" have loads of SIM cards installed into machines that can make calls or send SMS text messages, right? Doesn't each SIM card require an account with a cell phone provider in order to access "the phone network"? If not then are they getting free cell service and how do I sign up with that (ahem) provider? If so then how were those sim cards paid for? Can we follow the money?

If this is not a red flag to stop reading the news I don’t know what else is. If you know a little about SIM card industry, calls, spam sms, verification farms then you can clearly tell that this is that kind of farm and seeing that news you start to question all other spoonfed news.
Maybe they were going to use them to hack Google Maps and fake traffic jams!

An Artist Used 99 Phones to Fake a Google Maps Traffic Jam:

https://www.wired.com/story/99-phones-fake-google-maps-traff...

Google Maps Hacks by Simon Weckert

https://www.youtube.com/watch?v=k5eL_al_m7Q

>99 smartphones are transported in a handcart to generate virtual traffic jam in Google Maps.Through this activity, it is possible to turn a green street red which has an impact in the physical world by navigating cars on another route to avoid being stuck in traffic. #googlemapshacks

> using radio “triangulation” (sic)

Why is triangulation an error?

Ok, that's not the Sim Farm I expected.
I mean yeah, it was kinda obvious that they busted an ad fraud sim farm but needed to pad that resume for the bosses. There's no glory in "just" fighting fraud right now.
I was kinda puzzled by the story of this setup, with all these antennas, and then "35 miles from UN". Um... those aren't those kind of antennas...
I haven't seen it suggested so I might as well say it: What if that equipment was actually being used by election campaigns to spam phones with election ads?
Well, yeah, the pictures they included with the articles is a sim farm with devices available on a TOR site the same way you lease space on a server with EC2.

So, it maybe could have been used to initiate a TDoS attack if someone rented the capacity but that's not what it was there for. They caught a subcontractor and they want us to think they caught a kingpin.

That story was overblown. But it wasn't bogus. SIM farms exist, this was one of them and it definitely wasn't put there for the general good of the population. They're common enough that the UK has specific legislation targeting acquisition and use of these devices.

Which parts of the story were embellished and who they were embellished by is an interesting question but the degree to which the original story being bogus is balanced out nicely by the degree to which this article (and the overblown title) itself is bogus.

The facts: a SIM farm was discovered. It had a very large number of active SIMS. It was found in NYC. It was active when it was found.

What is speculative/hard to verify:

It was used for specific swatting attempts. It was put there by nation state level actors rather than just ordinary criminals.

What is most likely bullshit:

That it had anything to do with the UN headquarters being close by.

But that still leaves plenty of meat on the bone.

I've spent about an hour a week on this since Jan. Traced a large % of bogus news stories this year back to Reuters (fwiw) before they are picked up by other outlets and spread.

I've found legitimate stories also sourced from Reuters, but haven't found illegitimate stories NOT sourced from Reuters (in other words, they seem to originate from the same source, not sure why)

Seems like kind of a long way to say something that everybody had already here had already figured out in the comment threads when the original story ran. I'm not sure you need all the journalism kremlinology to say "these are normal devices used by organizations that do mass phone and message operations".