16 ms·

Tor exit node operator gets raided by police

220 points by morninj 11y ago

LeoPanthera 11y ago
> Seattle police spokesman Sean Whitcomb says the department understands how Tor relays work, and they knew Robinson was a Tor host. > "Knowing that, moving in, it doesn't automatically preclude the idea that the people running Tor are not also involved in child porn," Whitcomb says. "It does offer a plausible alibi, but it's still something that we need to check out." > Whitcomb also says Seattle police were "artful" in the way they did the search. Instead of impounding all of Robinson's computers, which the warrant would have allowed, they offered to search them on the premises as long as he consented to turning over his passwords. He did, and they let him keep his machines after they scanned them. This is the important part. They didn't shut down the exit node. They didn't even take away the computer. This sounds bad, but in all honesty, it could have gone at lot worse.
- homero 11y ago
  They installed back doors, he has to trash them anyway
  - techthroway443 11y ago
    But if the traffic gets encrypted what is the use? Or do you mean they install their own "special" tor exit node on his machine?
    - homero 11y ago
      They probably used a root kit and a firmware
  - okasaki 11y ago
    Seems unlikely if he was present and had witnesses.
    - ArchReaper 11y ago
      If you read the article, you would know this is not the case.
    - mtmail 11y ago
      He wasn't present. Last paragraph reads "he may now have to get rid of his computers because he can't be sure what the police did to them while he was being questioned outside his apartment"
  - NoMoreNicksLeft 11y ago
    Them? The Seattle PD? They're not a spy agency, they're rent-a-cops.
    - arjie 11y ago
      This was the police, not a private agency.
      - NoMoreNicksLeft 11y ago
        Yeh, that's my point. They're incompetent.
    - freshhawk 11y ago
      The Seattle PD can plug a device they purchased into a USB port as well as anyone else. There have been various public and leaked catalogues of law enforcement tools put online now, these abilities are commoditized and packaged in a user friendly manner. This is pretty old news at this point.
      - NoMoreNicksLeft 11y ago
        Purchased from where? They probably couldn't find their asses with both hands, but if they could it'd cost several hundred thousand dollars, take 48 hours with the roads blocked off, and the scandal of them finding some soccer mom's ass instead wouldn't die down for 3 years. Do you think that they came up with this in their emergency war room, as they planned out the sneak attack on the Tor node, or was this a more general policy developed over the previous months and years and this was just one of the first times they got to practice it?
        freshhawk 11y ago
        > Purchased from where? Most famously, because they were recently hacked themselves, the Milan based company Hacking Team. The intercept has a good breakdown of their software manual here: https://theintercept.com/2014/10/30/hacking-team/#manuals https://theintercept.com/2014/10/30/hacking-team/#manuals There are many others out there, this cell phone related catalogue is really interesting: https://theintercept.com/2015/12/17/a-secret-catalogue-of-government-gear-for-spying-on-your-cellphone/ https://theintercept.com/2015/12/17/a-secret-catalogue-of-go... Any company considered a "defense contractor" will probably offer tools along these lines. They are in high demand. Of course the FBI, Homeland security and the NSA have their own tools as well. And they share with local law enforcement (probably not the latest and greatest ones). > Do you think that they came up with this in their emergency war room, as they planned out the sneak attack on the Tor node, I don't really have any idea what the Seattle PD methods or procedures would be, but they knew what TOR was and tracked the traffic to his exit node. I doubt it was the same cops who did that part ... so how likely was it that this briefing didn't include anything like "Just plug the CriminalBuster(tm) box into the computer until the light turns green, then coordinate with Bob to get access to the information you want later. You can get things like X, Y and Z from the CriminalBuster. To requisition a unit fill out form TPS-01 and give it to John." The entire reason to commoditize these things is to make it easy to use within an inefficient bureaucracy that doesn't have a lot of tech training or a "war room". Just like they have done with phone taps or gps car trackers for years. > this was just one of the first times they got to practice it? Why assume this was the first time? It's standard practice for all sorts of infosec workers, journalists, etc to assume this was done to their laptop if it was out of their hands. You can literally download one of these and put it on a usb stick yourself (for your own personal use of course, anything else would be very illegal).
- AnthonyMouse 11y ago
  It's still stupid though. It's like raiding the mailman's house for delivering an illegal letter with no return address. Sure, it could have been sent by the mailman, but it could have been sent by anyone. There isn't any more reason to suspect the exit node operators than anyone else in the whole world who could also have used the exit node.
  - dogma1138 11y ago
    No it sounds actually like good police work. Running a Tor exit node shouldn't give you some blanket against police investigations.
    - deleted 11y ago
      [deleted]
      - deleted 11y ago
        [deleted]
      - deleted 11y ago
        [deleted]
        deleted 11y ago
        [deleted]
    - AndrewUnmuted 11y ago
      I would have said the same, if it were not for the police's unnecessary and demeaning execution of their warrant at 6:00AM. If the police knew he was a tor exit node operator, then surely they could have executed this search at a more reasonable hour?
      - homero 11y ago
        But a no knock swat raid killing people's dog is more fun
      - 11y ago
- ghkbrew 11y ago
  While I applaud the police for being an unobtrusive as they could, this sort of discretionary enforcement is worrying in and of itself. In no small part, because it seems to set a precedent that they could have raided his house and impounded all his computer for no other reason than he was running a Tor exit node.
  - Laaw 11y ago
    But it does give a judge something to point at and be like, "Why couldn't you do it here (in a different situation) like you did over there (this situation)?" Not much, admittedly, but it's something.
  - techthroway443 11y ago
    It's not worrying at all. Running a Tor exit node in itself isn't a problem. The problem arises when the exit node operator knowingly is giving up control over the traffic going through his connection. If you run a tor exit node you need to accept the fact there is a chance something illegal is passing through and that when it happens (as it did here) you are going to get investigated. It would be irresponsible and neglectful for law enforcement not to raid this man's home.
    - EdHominem 11y ago
      They probably sent the picture in the first place.
      - peppaz 11y ago
        This probably isn't wrong, the FBI is the largest holder of CP in the world, last time it was reported on.
        Godel_unicode 11y ago
        They have copies of CP collected as evidence, therefore they are distributing it? By this logic, the DEA evidence locker might make them the biggest crack dealer in the US.
- djsumdog 11y ago
  This is why I run full disk encryption. I wouldn't have given them a damn fucking password.
  - kbenson 11y ago
    And they would have impounded all your computers. That's your choice to make, but I don't think it's obvious it's the correct choice. There's a lot of variables that go into that decision.
    - MichaelGG 11y ago
      The only real variable should be "can you afford to get another machine right away?" I guess in truth it might be "do your backups actually work", but if that's false then you're already in trouble.
      - kbenson 11y ago
        What about: I can afford another machine right now, but will that put a monetary strain on other areas of my life that are important to me? I can afford another machine, and I have backups, but the restoration of the backups is painful enough that I would prefer to avoid it. I would prefer this episode be over with as quickly as possible as I'm not guilty, so should I comply to speed this process along? (note that I think this isn't necessarily guaranteed to be a good strategy). Depending on what the police believe about the situation may greatly affect what is the path of least resistance and problems, but you unfortunately have very little insight into exactly what that is. In some cases, talking to and cooperating with the police is the easiest way to extricate yourself from the situation, and in other cases it's the easiest way that they can twist the situation to implicate you in some way. The safest way is to always have a lawyer present and never voluntarily give up information, but not everyone is in a situation that makes the safest choice easy to take.
  - fizgig 11y ago
    And they would have likely taken all your shit as a punitive measure had you not complied. (I, too, run FDE on everything I own at home.) All things considered, this dude dodged a bullet. I don't know if he was acting under the advice of counsel, but he came out relatively unscathed. This time. This might be a shot across the bow designed to frighten those without the deep pockets of Apple. Just a reminder that The Man still has teeth when it comes to the 99%.
- FussyZeus 11y ago
  It went "ok" because he consented to giving them unfettered access to his computers without his oversight when they had no reason to be there. This is more akin to police searching you car with no evidence of drugs, not finding drugs, and then letting you keep your car. It's still a hideous violation of your privacy for no reason.
  - homero 11y ago
    But they let him keep his life
    - FussyZeus 11y ago
      We're in a weird place as a society when the police not shooting you dead is regarded as a "nice" thing for them to do.
      - maxerickson 11y ago
        Yeah, that's not the place we are in. If you take anything but a ridiculously short term view, the expectations of how police will treat people today are far higher than they have been in the history of the US. We still have to recognize and confront the remaining problems, but national media attention and prosecution of police who commit murders is a step up from police committing murders with no consequences.
      - krapp 11y ago
        Consider the bias of people making such statements. Society hasn't actually moved to that point, but many anti-police advocates want you to believe it has. In actual reality, most encounters with the police don't result in arbitrary killings.
        TeMPOraL 11y ago
        Moreover, repeating such statements only makes the situation worse - especially if its repeated on the (inter)national media scale. Most police officers are normal people (just like most people in general), but when the society in general starts treating them as enemies, it doesn't help them doing their job in peaceful and responsible manner.
- gist 11y ago
  > They didn't shut down the exit node. Although my view won't be popular, running an exit mode and having to deal with this is not a smart thing to do. What is the upside vs. having to deal with this type of raid and perhaps police who are not so accommodating at some point? Why draw attention to yourself in this way? Also assumes that some rogue cop won't plant something on your device if it does get hauled away. Seems dangerous the way I see it.
  - Spivak 11y ago
    That's what full disk encryption is for. It's not just a privacy tool but tamper protection as well. IANAL but I sincerely hope one would not be compelled to unlock their device only in the presence of a police officer and prohibited from having a camera, lawyer, witness, judge, internal affairs officer, etc. present.
- njharman 11y ago
  I'm happy with this level of response. It's a little bad in that they essentially coerced password disclosure and I'm guessing they would have acted on any other crime (say copyright violation) they happened to find during search. But, overall this is how Police should work / act. They need to investigate and they should investigate with consideration, care, moderation, and assumption of innocence until actual evidence indicates otherwise, they should ask for cooperation rather than assume hostile/adversarial stance. They don't need to have SWAT no-knock the place. They don't need to seize and confiscate everything and make it very hard to recover. They don't need to handcuff anyone. They don't need to act like smug assholes. Etc.
- tibbon 11y ago
  Anyone else suspect they didn't just scan them, but installed some back-door/fork?
  - CaptSpify 11y ago
    Personally, I'd reinstall everything after they left.
    - tibbon 11y ago
      Had it been the CIA, I wouldn't have trusted that there weren't hardware-based changes made, or things that would survive a reinstall. Replacing a USB cable with a wireless transmitter, etc.
- ultramancool 11y ago
  Except now he has to wipe everything because their "search" likely involves plugging in a USB drive and infecting his machines with a RAT at the very least. Just given how many companies are out peddling RATs to LEAs like this I think we have to consider it a likely possibility. Not exactly a best case.
  - pc2g4d 11y ago
    What's a RAT?
    - ultramancool 11y ago
      Remote Access Trojan or Remote Administration Tool, depends who you ask. Basically a small tool that runs hidden and allows remote keylogging, upload and download of files, screen capture, etc. https://en.wikipedia.org/wiki/DarkComet https://en.wikipedia.org/wiki/DarkComet is a good example of a free one.
gherkin0 11y ago
> Robinson admits it might be safer, legally, to host the Tor relay on rented space from a commercial Internet service to avoid mingling his personal traffic with Tor, but he says he shouldn't have to. It'd probably be safer still setup a nonprofit group to own and run the exit node(s).
- mtmail 11y ago
  There's http://noisetor.net/ http://noisetor.net/ in the US and https://www.torservers.net/ https://www.torservers.net/ in Germany.
- thescriptkiddie 11y ago
  The problem with running Tor nodes in a datacenter is that mingling your personal traffic with a Tor exit node provides plausible deniability for both you and the people using your node. It's impossible for an advisory to know which traffic is yours and which isn't. Dedicated Tor nodes are suspicious (and often get blacklisted) because they aren't a source of "legitimate" traffic, but Tor nodes run in people's homes don't.
  - marshray 11y ago
    > mingling your personal traffic with a Tor exit node provides plausible deniability for both you and the people using your node Wouldn't it be more effective to simply use Tor as intended with somebody else hosting the exit node?
    - thescriptkiddie 11y ago
      In this scenario you are the somebody else hosting the exit node. For the anonymous strangers using the exit node you are hosting for them, they benefit from having their traffic mingled with yours because theirs won't stand out as much. For you, you benefit from having the anonymous strangers' traffic mingled with yours because anyone spying on you will be very confused.
      - 11y ago
d33 11y ago
Thought I'd leave it here: https://blog.torproject.org/running-exit-node https://blog.torproject.org/running-exit-node Also, how risky would it be to host an exit node that is HTTPS only?
- amdavidson 11y ago
  If the FBI was able to monitor your traffic they would still see the IP addresses to which your node was reaching out. Same goes if they are running a honeypot[0] that your IP is hitting (as could be the case in this instance[1]). That might not be much in the way of concrete evidence, but if your exit node is hitting carder forums all day long it might be enough for them to still knock on your door. 0: https://theintercept.com/2016/03/30/fbi-honeypot-ensnares-michigan-man/ https://theintercept.com/2016/03/30/fbi-honeypot-ensnares-mi... 1: http://www.techworm.net/2016/01/fbi-child-porn-sexually-explicit-users-arrests.html http://www.techworm.net/2016/01/fbi-child-porn-sexually-expl...
brbsix 11y ago
I'm blown away that someone (obviously so security savvy) would willingly hand over their passwords. There's little sense accepting their assurances at face value in potentially serious matters. LE can and will lie pursuant to their duties. I suppose I'm even more surprised they didn't end up impounding all the equipment anyways.
- _wmd 11y ago
  It seems to me the risk is almost entirely on the police in this scenario, meddling with running equipment is far from forensically sound and potentially leaves ample room for doubt in court. Volunteering to comply with the police request would also seem to exemplify the searchee's own presumption of innocence (IANAL!)
  - djsumdog 11y ago
    No no no no. You never corporate with the police. It doesn't matter if you're innocent. It doesn't matter if you're guilty. The police are not your friends. They are not there to help you. They don't give a shit about you. Never comply with police. Never consent to a search. They had a warrant in this case so it wouldn't have mattered, but he still shouldn't have consented. He should have never given them his passwords. He should have waited for a lawyer. He made so many mistakes that I'm surprised he isn't in jail for incompetence. https://www.youtube.com/watch?v=6wXkI4t7nuc https://www.youtube.com/watch?v=6wXkI4t7nuc
    - _wmd 11y ago
      I think you're misinterpreting that idea, it's about not granting the police privilege they did not already possess. In this case the police are offering to trade the privilege of airtight, forensically sound evidence collection in for the chance to grab secrets hiding in RAM. If the machine had no such secrets, there is nothing to lose and everything to gain
      - brbsix 11y ago
        I'm a little confused. So you want to potentially give the police access to additional evidence (via your passwords/decryption keys) in the hopes that they will fuck something up or make a custodial error in the process of recovering it? You have everything to lose by giving them your passwords, even if you are innocent of the charges. You're under no obligation to give them your passwords or empty the contents of your brain in their presence. Why give them the opportunity to find something else? Who knows whether the machine has something they will find interesting. You shouldn't be providing LE with anything like this absent the advice of your attorney. There's too much to lose. I really want to encourage you to read the following: https://www.eff.org/issues/know-your-rights https://www.eff.org/issues/know-your-rights
TenOhms 11y ago
Someone tell Apple that they can purchase a lot of privacy street cred if they hosted or funded a major TOR hosting initiative.
- redbeard0x0a 11y ago
  No, Apple should definitely not be in a position of running TOR nodes. All it takes is one National Security Letter and a Secret Court ruling that makes it so they have to compromise that endpoint for law enforcement / anti-terrorism organizations. They need to keep doing what they have been doing with the recent FBI case and bringing these things out into the public's view. There is far too many things happening to subvert our privacy that we know nothing about...
  - TenOhms 11y ago
    Are you suggesting that nobody (companies or individuals) in the US or five eyes countries should run TOR nodes since the government can slap them with a court order?
    - Karunamon 11y ago
      From a personal safety standpoint, that is what I would suggest at least. Running a Tor exit means that you're the one who's going to get the knock on the door when a crook uses your connection for crookery. I'd rather not deal with the police at all, in any capacity.
athenot 11y ago
I'm not familiar with how Tor works; would it be possible to run an exit node but have it behind a filter to limit the liability?
- fizgig 11y ago
  You can tell the exit node which out-bound ports you want to allow. So for example, you can deny port 25 traffic so people can't send spam (as easily) anonymously via your exit. If I ever get the balls to host an exit node myself, I'd likely only allow port 22. Even allowing 443 seems a bit risky after reading this.
  - jandrese 11y ago
    Only allowing port 22 seems pretty limiting. How many people ssh over TOR? Sure they can setup tunnels, but that can't be very common. In any case, you are always in danger of being identified by honeypot servers.
- blacksmith_tb 11y ago
  It's always an option to run a relay or bridge, with no exits at all. That's still helpful: https://www.eff.org/pages/what-tor-relay https://www.eff.org/pages/what-tor-relay
- nly 11y ago
  Technically speaking, you can do whatever you want to traffic passing in/out of your node. In practice I recall reading that there's some degree of monitoring on the network that attempts to detect and flag misbehaving exit nodes. You could certainly, for example, redirect HTTP traffic through the Internet Watch Foundations child-porn filters, if you had the connections.
  - dublinben 11y ago
    An exit node that did that (traffic filtering) would be shortly marked as bad, and dropped from the network.
ksdale 11y ago
I went to law school at the University of Washington and graduated in 2013 and I actually did a little research about Tor while I was there and we talked to some people fairly high up in Seattle area law enforcement and honestly I'm surprised at how fast they've come along. At the time, we couldn't find anyone who had even heard of Tor (not to say there weren't lots of people who were familiar, just that we didn't find any of them), let alone thought through the implications of someone running an exit node so I find it interesting that they didn't just seize all of his equipment. Based on my experience, I would not have predicted such an "artful" search, to use words from the article, even just a couple years ago.
antman 11y ago
In his position, I would immediately cease operations after that police software was used on the system. Resume operations only after restoring from a clean backup taken prior to the raid.
- ThrustVectoring 11y ago
  I'd purchase new devices and/or components, and do a full rotation of all my credentials. In fact, I should probably build a "invalidate every credential I have on all my computers and accounts" checklist. That and a tested backup strategy.
- pmocek 11y ago
  see also: - https://twitter.com/SeattlePrivacy/status/716460499106340864 https://twitter.com/SeattlePrivacy/status/716460499106340864 - https://twitter.com/jdormansteele/status/716807343988715521 https://twitter.com/jdormansteele/status/716807343988715521
swang 11y ago
> At one point, a detective offered to show him the image, but Robinson refused. I can't tell if the detective is a moron or just really hoping to induce a pedophile
l3m0ndr0p 11y ago
Why would anybody give up their password & allow the police to work on your computer? Let them take the systems and accept the risk that running a TOR node in this day and age will get you a visit from the police or similar. This guy gave up the password & now doesn't trust what they did to his systems. He has to get rid of them now? This is no different if they took his computers away without knowing his passwords. What if this guys was working with the police all along. Now some guy decides to give away his password to the police so they can check his computer? Sounds fucking suspicious to me. I guess they are testing the waters to see if other TOR node exit maintainers are going to do the same. Listen up! Never give your password out. Encrypt your systems & keep them separated if you are running a TOR node. Let them take your systems, because you will have to trash them anyway if you grant them access.
fhood 11y ago
Should the police be allowed to do this? I don't know. Obviously the line has to be drawn somewhere right? Child pornography isn't like narcotics. It isn't in any way a victimless crime and I would prefer that the police be able to inhibit its distribution. But then again if they had taken the same actions because someone was purchasing drugs I would be totally opposed. Severity of a crime is subjective, but a the law is still the law no matter how unfair it may seem. My point is that either the police should be allowed to take these actions or they shouldn't and the crime in question shouldn't really enter the picture. Actions taken based on one type of crime can be fairly easily justified for another. This is why in the US free speech is limited as little as is possible. It's a slippery slope. So I think the real question is if you operate a Tor exit node and something illegal passes through it should the police be able to compel you to release the passwords to your servers. I think they probably shouldn't. You would be hard pressed to find a Tor node that something illegal hasn't passed through. Does that give police carte blanche to access any information on any Tor node they want? Maybe.
- goldent777 11y ago
  Seattle, and most of cascadia for that sake, is a complete police state. They are far enough and fringe enough from the rest of the population to get away with whatever they would like. Tor exit nodes in the PNW are a very bad idea.
geff82 11y ago
The german criminal police (in US: FBI) once called me and insisted on a good talk because of something. They finally visited me sensibly at my workplace, dressed up as customers (promised not to tell my coworkers who they really were). Then they told me there had been terror threats for thr Ukraine coming from my TOR server (they knew about Tor...). Bad thing: the terror threat had been some weeks ago and I had reinstalled the server three days before (without Tor) and all logs/evidences had been destroyed. Luckily, they believed me and left me after I simply gave them all passwords concerning the case. I have not run a Tor server since then. I support the concept, but it can bring you real trouble.
godgod 11y ago
What's crazy is that the cops knew this was a TOR exit node and they still crashed the party. Makes you question their motives and tactics. A simple polite knock would have saved everyone the trouble but I suspect the police wanted to make a point.
wstrange 11y ago
This is an area where public libraries could take a lead role by running Tor exit nodes. Running an exit node as an individual is going to be a dicey proposition.
mattbee 11y ago
Someone I know (in the UK) was arrested and spent a day in a cell when some criminal postings to Twitter were traced to his Tor exit node. When the police interviewed him and admitted they _knew_ what a Tor exit node was, and that he was unlikely to be responsible for the traffic. But they did want him to know that running a Tor exit node makes their life harder, and would land him in this sort of trouble. (I can't remember the exact words he reported, but it was outright intimidation).
SG- 11y ago
I'm disgusted the detectives carried around child porn even tho it's evidence and not only brought it to a potential crime scene but offered to show it to him. Would they bring around cocaine or a gun from another scene? I'm assuming the police officer is exempt from distributing child porn as long as he's accusing of something before showing it.
- dmix 11y ago
  Having read various police forensic reports, I'd say this is normal. They need the hash of the image to do a forensic sweep of his computer. The search for porn would be mostly automated, especially considering they are searching for one specific image which is probably what the warrant was limited to. Then they would probably want to compare the image itself if it was detected on the harddrive, instead of relying purely on the file hash.
  - SG- 11y ago
    I agree, but this isn't something the detective would perform himself, it would be the 'tech' guys and he still shouldn't offer to show it around.
  - pmocek 11y ago
    > considering they are searching for one specific image That was not the case. They were authorized by warrant to search for the following, which I transcribed from a copy of the affidavit in support of application for warrant: A. Personal computer hardware to include, the computer system case with internal components, motherboard, CPU, memory, etc., internal and peripheral storage devices (such as fixed disks, external hard disks, floppy disk drives and diskettes, tape drives and tapes, zip drives, optical storage devices, transistor-like binary devices, video cameras, digital cameras, cell phones, and any other memory storage devices); peripheral input/output devices (such as keyboards, mouse/track ball/pad, video display monitor); and all related cables, power cords and connections, RAM or ROM units or CD ROM; as well as any devices, mechanisms, or parts that cat be used to restrict access to computer hardware (such as physical keys and locks). B. Computer software applications used by the computer system and any related components. C. Computer-related documentation that explains or illustrates how to configure or use the computer hardware, software, or other related items/devices. The documentation consists of written, recorded, printed, or electronically stored material. D. Computer-related passwords and other data security devices designed to restrict access or hide computer software, documentation, or data. E. Digital data that may be kept on any computer related storage device listed in 'A' above. The specific data will be (or will contain or incorporate) digital video and/or image files depicting minors engaged in sexually explicit conduct, any digital data related to the trading or exchange of depictions of minors engaged in sexually explicit conduct, and any digital "user attribution" evidence to include, but not limited to, registry information, configuration files, user profiles, e-mail, e-mail address books, "chat," instant messaging logs, photographs, and correspondence (and the data associated with the foregoing, such as file creation and last accessed dates) that may be evidence of who used or controlled hte computer or storage medium at a relevant time. F. Photographs of the interior and exterior of the listed residence. G. Papers showing dominion and control. H. Any other evidence of the crimes of RCW 9.68A.070, to include but not limited to videotapes, books, magazines, catalogs, photographs, film, diaries, or other documents pertaining to the possession or dealing of child pornography, to include printed material documenting any communication with other persons regarding the trading or exchange of depictions of minors engaged in sexually explicit conduct.
stegosaurus 11y ago
Illegal numbers are my favourite kind of numbers. How many bytes do I need? In the countries that have laws against cartoons, can I make an illegal favicon? Can I design a neural network which generates illegal favicons? More seriously, criminalizing data is a terrible, terrible idea, simply because it provides a backdoor into the justice system.

220 points by morninj 11y ago

> Seattle police spokesman Sean Whitcomb says the department understands how Tor relays work, and they knew Robinson was a Tor host. > "Knowing that, moving in, it doesn't automatically preclude the idea that the people running Tor are not also involved in child porn," Whitcomb says. "It does offer a plausible alibi, but it's still something that we need to check out." > Whitcomb also says Seattle police were "artful" in the way they did the search. Instead of impounding all of Robinson's computers, which the warrant would have allowed, they offered to search them on the premises as long as he consented to turning over his passwords. He did, and they let him keep his machines after they scanned them. This is the important part. They didn't shut down the exit node. They didn't even take away the computer. This sounds bad, but in all honesty, it could have gone at lot worse.

homero 11y ago
They installed back doors, he has to trash them anyway
- techthroway443 11y ago
  But if the traffic gets encrypted what is the use? Or do you mean they install their own "special" tor exit node on his machine?
  - homero 11y ago
    They probably used a root kit and a firmware
- okasaki 11y ago
  Seems unlikely if he was present and had witnesses.
  - ArchReaper 11y ago
    If you read the article, you would know this is not the case.
  - mtmail 11y ago
    He wasn't present. Last paragraph reads "he may now have to get rid of his computers because he can't be sure what the police did to them while he was being questioned outside his apartment"
- NoMoreNicksLeft 11y ago
  Them? The Seattle PD? They're not a spy agency, they're rent-a-cops.
  - arjie 11y ago
    This was the police, not a private agency.
    - NoMoreNicksLeft 11y ago
      Yeh, that's my point. They're incompetent.
  - freshhawk 11y ago
    The Seattle PD can plug a device they purchased into a USB port as well as anyone else. There have been various public and leaked catalogues of law enforcement tools put online now, these abilities are commoditized and packaged in a user friendly manner. This is pretty old news at this point.
    - NoMoreNicksLeft 11y ago
      Purchased from where? They probably couldn't find their asses with both hands, but if they could it'd cost several hundred thousand dollars, take 48 hours with the roads blocked off, and the scandal of them finding some soccer mom's ass instead wouldn't die down for 3 years. Do you think that they came up with this in their emergency war room, as they planned out the sneak attack on the Tor node, or was this a more general policy developed over the previous months and years and this was just one of the first times they got to practice it?
      - freshhawk 11y ago
        > Purchased from where? Most famously, because they were recently hacked themselves, the Milan based company Hacking Team. The intercept has a good breakdown of their software manual here: https://theintercept.com/2014/10/30/hacking-team/#manuals https://theintercept.com/2014/10/30/hacking-team/#manuals There are many others out there, this cell phone related catalogue is really interesting: https://theintercept.com/2015/12/17/a-secret-catalogue-of-government-gear-for-spying-on-your-cellphone/ https://theintercept.com/2015/12/17/a-secret-catalogue-of-go... Any company considered a "defense contractor" will probably offer tools along these lines. They are in high demand. Of course the FBI, Homeland security and the NSA have their own tools as well. And they share with local law enforcement (probably not the latest and greatest ones). > Do you think that they came up with this in their emergency war room, as they planned out the sneak attack on the Tor node, I don't really have any idea what the Seattle PD methods or procedures would be, but they knew what TOR was and tracked the traffic to his exit node. I doubt it was the same cops who did that part ... so how likely was it that this briefing didn't include anything like "Just plug the CriminalBuster(tm) box into the computer until the light turns green, then coordinate with Bob to get access to the information you want later. You can get things like X, Y and Z from the CriminalBuster. To requisition a unit fill out form TPS-01 and give it to John." The entire reason to commoditize these things is to make it easy to use within an inefficient bureaucracy that doesn't have a lot of tech training or a "war room". Just like they have done with phone taps or gps car trackers for years. > this was just one of the first times they got to practice it? Why assume this was the first time? It's standard practice for all sorts of infosec workers, journalists, etc to assume this was done to their laptop if it was out of their hands. You can literally download one of these and put it on a usb stick yourself (for your own personal use of course, anything else would be very illegal).
AnthonyMouse 11y ago
It's still stupid though. It's like raiding the mailman's house for delivering an illegal letter with no return address. Sure, it could have been sent by the mailman, but it could have been sent by anyone. There isn't any more reason to suspect the exit node operators than anyone else in the whole world who could also have used the exit node.
- dogma1138 11y ago
  No it sounds actually like good police work. Running a Tor exit node shouldn't give you some blanket against police investigations.
  - deleted 11y ago
    [deleted]
    - deleted 11y ago
      [deleted]
    - deleted 11y ago
      [deleted]
      - deleted 11y ago
        [deleted]
  - AndrewUnmuted 11y ago
    I would have said the same, if it were not for the police's unnecessary and demeaning execution of their warrant at 6:00AM. If the police knew he was a tor exit node operator, then surely they could have executed this search at a more reasonable hour?
    - homero 11y ago
      But a no knock swat raid killing people's dog is more fun
    - 11y ago
ghkbrew 11y ago
While I applaud the police for being an unobtrusive as they could, this sort of discretionary enforcement is worrying in and of itself. In no small part, because it seems to set a precedent that they could have raided his house and impounded all his computer for no other reason than he was running a Tor exit node.
- Laaw 11y ago
  But it does give a judge something to point at and be like, "Why couldn't you do it here (in a different situation) like you did over there (this situation)?" Not much, admittedly, but it's something.
- techthroway443 11y ago
  It's not worrying at all. Running a Tor exit node in itself isn't a problem. The problem arises when the exit node operator knowingly is giving up control over the traffic going through his connection. If you run a tor exit node you need to accept the fact there is a chance something illegal is passing through and that when it happens (as it did here) you are going to get investigated. It would be irresponsible and neglectful for law enforcement not to raid this man's home.
  - EdHominem 11y ago
    They probably sent the picture in the first place.
    - peppaz 11y ago
      This probably isn't wrong, the FBI is the largest holder of CP in the world, last time it was reported on.
      - Godel_unicode 11y ago
        They have copies of CP collected as evidence, therefore they are distributing it? By this logic, the DEA evidence locker might make them the biggest crack dealer in the US.
djsumdog 11y ago
This is why I run full disk encryption. I wouldn't have given them a damn fucking password.
- kbenson 11y ago
  And they would have impounded all your computers. That's your choice to make, but I don't think it's obvious it's the correct choice. There's a lot of variables that go into that decision.
  - MichaelGG 11y ago
    The only real variable should be "can you afford to get another machine right away?" I guess in truth it might be "do your backups actually work", but if that's false then you're already in trouble.
    - kbenson 11y ago
      What about: I can afford another machine right now, but will that put a monetary strain on other areas of my life that are important to me? I can afford another machine, and I have backups, but the restoration of the backups is painful enough that I would prefer to avoid it. I would prefer this episode be over with as quickly as possible as I'm not guilty, so should I comply to speed this process along? (note that I think this isn't necessarily guaranteed to be a good strategy). Depending on what the police believe about the situation may greatly affect what is the path of least resistance and problems, but you unfortunately have very little insight into exactly what that is. In some cases, talking to and cooperating with the police is the easiest way to extricate yourself from the situation, and in other cases it's the easiest way that they can twist the situation to implicate you in some way. The safest way is to always have a lawyer present and never voluntarily give up information, but not everyone is in a situation that makes the safest choice easy to take.
- fizgig 11y ago
  And they would have likely taken all your shit as a punitive measure had you not complied. (I, too, run FDE on everything I own at home.) All things considered, this dude dodged a bullet. I don't know if he was acting under the advice of counsel, but he came out relatively unscathed. This time. This might be a shot across the bow designed to frighten those without the deep pockets of Apple. Just a reminder that The Man still has teeth when it comes to the 99%.
FussyZeus 11y ago
It went "ok" because he consented to giving them unfettered access to his computers without his oversight when they had no reason to be there. This is more akin to police searching you car with no evidence of drugs, not finding drugs, and then letting you keep your car. It's still a hideous violation of your privacy for no reason.
- homero 11y ago
  But they let him keep his life
  - FussyZeus 11y ago
    We're in a weird place as a society when the police not shooting you dead is regarded as a "nice" thing for them to do.
    - maxerickson 11y ago
      Yeah, that's not the place we are in. If you take anything but a ridiculously short term view, the expectations of how police will treat people today are far higher than they have been in the history of the US. We still have to recognize and confront the remaining problems, but national media attention and prosecution of police who commit murders is a step up from police committing murders with no consequences.
    - krapp 11y ago
      Consider the bias of people making such statements. Society hasn't actually moved to that point, but many anti-police advocates want you to believe it has. In actual reality, most encounters with the police don't result in arbitrary killings.
      - TeMPOraL 11y ago
        Moreover, repeating such statements only makes the situation worse - especially if its repeated on the (inter)national media scale. Most police officers are normal people (just like most people in general), but when the society in general starts treating them as enemies, it doesn't help them doing their job in peaceful and responsible manner.
gist 11y ago
> They didn't shut down the exit node. Although my view won't be popular, running an exit mode and having to deal with this is not a smart thing to do. What is the upside vs. having to deal with this type of raid and perhaps police who are not so accommodating at some point? Why draw attention to yourself in this way? Also assumes that some rogue cop won't plant something on your device if it does get hauled away. Seems dangerous the way I see it.
- Spivak 11y ago
  That's what full disk encryption is for. It's not just a privacy tool but tamper protection as well. IANAL but I sincerely hope one would not be compelled to unlock their device only in the presence of a police officer and prohibited from having a camera, lawyer, witness, judge, internal affairs officer, etc. present.
njharman 11y ago
I'm happy with this level of response. It's a little bad in that they essentially coerced password disclosure and I'm guessing they would have acted on any other crime (say copyright violation) they happened to find during search. But, overall this is how Police should work / act. They need to investigate and they should investigate with consideration, care, moderation, and assumption of innocence until actual evidence indicates otherwise, they should ask for cooperation rather than assume hostile/adversarial stance. They don't need to have SWAT no-knock the place. They don't need to seize and confiscate everything and make it very hard to recover. They don't need to handcuff anyone. They don't need to act like smug assholes. Etc.
tibbon 11y ago
Anyone else suspect they didn't just scan them, but installed some back-door/fork?
- CaptSpify 11y ago
  Personally, I'd reinstall everything after they left.
  - tibbon 11y ago
    Had it been the CIA, I wouldn't have trusted that there weren't hardware-based changes made, or things that would survive a reinstall. Replacing a USB cable with a wireless transmitter, etc.
ultramancool 11y ago
Except now he has to wipe everything because their "search" likely involves plugging in a USB drive and infecting his machines with a RAT at the very least. Just given how many companies are out peddling RATs to LEAs like this I think we have to consider it a likely possibility. Not exactly a best case.
- pc2g4d 11y ago
  What's a RAT?
  - ultramancool 11y ago
    Remote Access Trojan or Remote Administration Tool, depends who you ask. Basically a small tool that runs hidden and allows remote keylogging, upload and download of files, screen capture, etc. https://en.wikipedia.org/wiki/DarkComet https://en.wikipedia.org/wiki/DarkComet is a good example of a free one.

gherkin0 11y ago

> Robinson admits it might be safer, legally, to host the Tor relay on rented space from a commercial Internet service to avoid mingling his personal traffic with Tor, but he says he shouldn't have to. It'd probably be safer still setup a nonprofit group to own and run the exit node(s).

mtmail 11y ago
There's http://noisetor.net/ http://noisetor.net/ in the US and https://www.torservers.net/ https://www.torservers.net/ in Germany.
thescriptkiddie 11y ago
The problem with running Tor nodes in a datacenter is that mingling your personal traffic with a Tor exit node provides plausible deniability for both you and the people using your node. It's impossible for an advisory to know which traffic is yours and which isn't. Dedicated Tor nodes are suspicious (and often get blacklisted) because they aren't a source of "legitimate" traffic, but Tor nodes run in people's homes don't.
- marshray 11y ago
  > mingling your personal traffic with a Tor exit node provides plausible deniability for both you and the people using your node Wouldn't it be more effective to simply use Tor as intended with somebody else hosting the exit node?
  - thescriptkiddie 11y ago
    In this scenario you are the somebody else hosting the exit node. For the anonymous strangers using the exit node you are hosting for them, they benefit from having their traffic mingled with yours because theirs won't stand out as much. For you, you benefit from having the anonymous strangers' traffic mingled with yours because anyone spying on you will be very confused.
    - 11y ago

d33 11y ago

Thought I'd leave it here: https://blog.torproject.org/running-exit-node https://blog.torproject.org/running-exit-node Also, how risky would it be to host an exit node that is HTTPS only?

amdavidson 11y ago
If the FBI was able to monitor your traffic they would still see the IP addresses to which your node was reaching out. Same goes if they are running a honeypot[0] that your IP is hitting (as could be the case in this instance[1]). That might not be much in the way of concrete evidence, but if your exit node is hitting carder forums all day long it might be enough for them to still knock on your door. 0: https://theintercept.com/2016/03/30/fbi-honeypot-ensnares-michigan-man/ https://theintercept.com/2016/03/30/fbi-honeypot-ensnares-mi... 1: http://www.techworm.net/2016/01/fbi-child-porn-sexually-explicit-users-arrests.html http://www.techworm.net/2016/01/fbi-child-porn-sexually-expl...

brbsix 11y ago

I'm blown away that someone (obviously so security savvy) would willingly hand over their passwords. There's little sense accepting their assurances at face value in potentially serious matters. LE can and will lie pursuant to their duties. I suppose I'm even more surprised they didn't end up impounding all the equipment anyways.

_wmd 11y ago
It seems to me the risk is almost entirely on the police in this scenario, meddling with running equipment is far from forensically sound and potentially leaves ample room for doubt in court. Volunteering to comply with the police request would also seem to exemplify the searchee's own presumption of innocence (IANAL!)
- djsumdog 11y ago
  No no no no. You never corporate with the police. It doesn't matter if you're innocent. It doesn't matter if you're guilty. The police are not your friends. They are not there to help you. They don't give a shit about you. Never comply with police. Never consent to a search. They had a warrant in this case so it wouldn't have mattered, but he still shouldn't have consented. He should have never given them his passwords. He should have waited for a lawyer. He made so many mistakes that I'm surprised he isn't in jail for incompetence. https://www.youtube.com/watch?v=6wXkI4t7nuc https://www.youtube.com/watch?v=6wXkI4t7nuc
  - _wmd 11y ago
    I think you're misinterpreting that idea, it's about not granting the police privilege they did not already possess. In this case the police are offering to trade the privilege of airtight, forensically sound evidence collection in for the chance to grab secrets hiding in RAM. If the machine had no such secrets, there is nothing to lose and everything to gain
    - brbsix 11y ago
      I'm a little confused. So you want to potentially give the police access to additional evidence (via your passwords/decryption keys) in the hopes that they will fuck something up or make a custodial error in the process of recovering it? You have everything to lose by giving them your passwords, even if you are innocent of the charges. You're under no obligation to give them your passwords or empty the contents of your brain in their presence. Why give them the opportunity to find something else? Who knows whether the machine has something they will find interesting. You shouldn't be providing LE with anything like this absent the advice of your attorney. There's too much to lose. I really want to encourage you to read the following: https://www.eff.org/issues/know-your-rights https://www.eff.org/issues/know-your-rights

TenOhms 11y ago

Someone tell Apple that they can purchase a lot of privacy street cred if they hosted or funded a major TOR hosting initiative.

redbeard0x0a 11y ago
No, Apple should definitely not be in a position of running TOR nodes. All it takes is one National Security Letter and a Secret Court ruling that makes it so they have to compromise that endpoint for law enforcement / anti-terrorism organizations. They need to keep doing what they have been doing with the recent FBI case and bringing these things out into the public's view. There is far too many things happening to subvert our privacy that we know nothing about...
- TenOhms 11y ago
  Are you suggesting that nobody (companies or individuals) in the US or five eyes countries should run TOR nodes since the government can slap them with a court order?
  - Karunamon 11y ago
    From a personal safety standpoint, that is what I would suggest at least. Running a Tor exit means that you're the one who's going to get the knock on the door when a crook uses your connection for crookery. I'd rather not deal with the police at all, in any capacity.

athenot 11y ago

I'm not familiar with how Tor works; would it be possible to run an exit node but have it behind a filter to limit the liability?

fizgig 11y ago
You can tell the exit node which out-bound ports you want to allow. So for example, you can deny port 25 traffic so people can't send spam (as easily) anonymously via your exit. If I ever get the balls to host an exit node myself, I'd likely only allow port 22. Even allowing 443 seems a bit risky after reading this.
- jandrese 11y ago
  Only allowing port 22 seems pretty limiting. How many people ssh over TOR? Sure they can setup tunnels, but that can't be very common. In any case, you are always in danger of being identified by honeypot servers.
blacksmith_tb 11y ago
It's always an option to run a relay or bridge, with no exits at all. That's still helpful: https://www.eff.org/pages/what-tor-relay https://www.eff.org/pages/what-tor-relay
nly 11y ago
Technically speaking, you can do whatever you want to traffic passing in/out of your node. In practice I recall reading that there's some degree of monitoring on the network that attempts to detect and flag misbehaving exit nodes. You could certainly, for example, redirect HTTP traffic through the Internet Watch Foundations child-porn filters, if you had the connections.
- dublinben 11y ago
  An exit node that did that (traffic filtering) would be shortly marked as bad, and dropped from the network.

ksdale 11y ago

I went to law school at the University of Washington and graduated in 2013 and I actually did a little research about Tor while I was there and we talked to some people fairly high up in Seattle area law enforcement and honestly I'm surprised at how fast they've come along. At the time, we couldn't find anyone who had even heard of Tor (not to say there weren't lots of people who were familiar, just that we didn't find any of them), let alone thought through the implications of someone running an exit node so I find it interesting that they didn't just seize all of his equipment. Based on my experience, I would not have predicted such an "artful" search, to use words from the article, even just a couple years ago.

antman 11y ago

In his position, I would immediately cease operations after that police software was used on the system. Resume operations only after restoring from a clean backup taken prior to the raid.

ThrustVectoring 11y ago
I'd purchase new devices and/or components, and do a full rotation of all my credentials. In fact, I should probably build a "invalidate every credential I have on all my computers and accounts" checklist. That and a tested backup strategy.
pmocek 11y ago
see also: - https://twitter.com/SeattlePrivacy/status/716460499106340864 https://twitter.com/SeattlePrivacy/status/716460499106340864 - https://twitter.com/jdormansteele/status/716807343988715521 https://twitter.com/jdormansteele/status/716807343988715521

swang 11y ago

> At one point, a detective offered to show him the image, but Robinson refused. I can't tell if the detective is a moron or just really hoping to induce a pedophile

l3m0ndr0p 11y ago

Why would anybody give up their password & allow the police to work on your computer? Let them take the systems and accept the risk that running a TOR node in this day and age will get you a visit from the police or similar. This guy gave up the password & now doesn't trust what they did to his systems. He has to get rid of them now? This is no different if they took his computers away without knowing his passwords. What if this guys was working with the police all along. Now some guy decides to give away his password to the police so they can check his computer? Sounds fucking suspicious to me. I guess they are testing the waters to see if other TOR node exit maintainers are going to do the same. Listen up! Never give your password out. Encrypt your systems & keep them separated if you are running a TOR node. Let them take your systems, because you will have to trash them anyway if you grant them access.

fhood 11y ago

Should the police be allowed to do this? I don't know. Obviously the line has to be drawn somewhere right? Child pornography isn't like narcotics. It isn't in any way a victimless crime and I would prefer that the police be able to inhibit its distribution. But then again if they had taken the same actions because someone was purchasing drugs I would be totally opposed. Severity of a crime is subjective, but a the law is still the law no matter how unfair it may seem. My point is that either the police should be allowed to take these actions or they shouldn't and the crime in question shouldn't really enter the picture. Actions taken based on one type of crime can be fairly easily justified for another. This is why in the US free speech is limited as little as is possible. It's a slippery slope. So I think the real question is if you operate a Tor exit node and something illegal passes through it should the police be able to compel you to release the passwords to your servers. I think they probably shouldn't. You would be hard pressed to find a Tor node that something illegal hasn't passed through. Does that give police carte blanche to access any information on any Tor node they want? Maybe.

goldent777 11y ago
Seattle, and most of cascadia for that sake, is a complete police state. They are far enough and fringe enough from the rest of the population to get away with whatever they would like. Tor exit nodes in the PNW are a very bad idea.

geff82 11y ago

The german criminal police (in US: FBI) once called me and insisted on a good talk because of something. They finally visited me sensibly at my workplace, dressed up as customers (promised not to tell my coworkers who they really were). Then they told me there had been terror threats for thr Ukraine coming from my TOR server (they knew about Tor...). Bad thing: the terror threat had been some weeks ago and I had reinstalled the server three days before (without Tor) and all logs/evidences had been destroyed. Luckily, they believed me and left me after I simply gave them all passwords concerning the case. I have not run a Tor server since then. I support the concept, but it can bring you real trouble.

godgod 11y ago

What's crazy is that the cops knew this was a TOR exit node and they still crashed the party. Makes you question their motives and tactics. A simple polite knock would have saved everyone the trouble but I suspect the police wanted to make a point.

wstrange 11y ago

This is an area where public libraries could take a lead role by running Tor exit nodes. Running an exit node as an individual is going to be a dicey proposition.

mattbee 11y ago

Someone I know (in the UK) was arrested and spent a day in a cell when some criminal postings to Twitter were traced to his Tor exit node. When the police interviewed him and admitted they _knew_ what a Tor exit node was, and that he was unlikely to be responsible for the traffic. But they did want him to know that running a Tor exit node makes their life harder, and would land him in this sort of trouble. (I can't remember the exact words he reported, but it was outright intimidation).

SG- 11y ago

I'm disgusted the detectives carried around child porn even tho it's evidence and not only brought it to a potential crime scene but offered to show it to him. Would they bring around cocaine or a gun from another scene? I'm assuming the police officer is exempt from distributing child porn as long as he's accusing of something before showing it.

dmix 11y ago
Having read various police forensic reports, I'd say this is normal. They need the hash of the image to do a forensic sweep of his computer. The search for porn would be mostly automated, especially considering they are searching for one specific image which is probably what the warrant was limited to. Then they would probably want to compare the image itself if it was detected on the harddrive, instead of relying purely on the file hash.
- SG- 11y ago
  I agree, but this isn't something the detective would perform himself, it would be the 'tech' guys and he still shouldn't offer to show it around.
- pmocek 11y ago
  > considering they are searching for one specific image That was not the case. They were authorized by warrant to search for the following, which I transcribed from a copy of the affidavit in support of application for warrant: A. Personal computer hardware to include, the computer system case with internal components, motherboard, CPU, memory, etc., internal and peripheral storage devices (such as fixed disks, external hard disks, floppy disk drives and diskettes, tape drives and tapes, zip drives, optical storage devices, transistor-like binary devices, video cameras, digital cameras, cell phones, and any other memory storage devices); peripheral input/output devices (such as keyboards, mouse/track ball/pad, video display monitor); and all related cables, power cords and connections, RAM or ROM units or CD ROM; as well as any devices, mechanisms, or parts that cat be used to restrict access to computer hardware (such as physical keys and locks). B. Computer software applications used by the computer system and any related components. C. Computer-related documentation that explains or illustrates how to configure or use the computer hardware, software, or other related items/devices. The documentation consists of written, recorded, printed, or electronically stored material. D. Computer-related passwords and other data security devices designed to restrict access or hide computer software, documentation, or data. E. Digital data that may be kept on any computer related storage device listed in 'A' above. The specific data will be (or will contain or incorporate) digital video and/or image files depicting minors engaged in sexually explicit conduct, any digital data related to the trading or exchange of depictions of minors engaged in sexually explicit conduct, and any digital "user attribution" evidence to include, but not limited to, registry information, configuration files, user profiles, e-mail, e-mail address books, "chat," instant messaging logs, photographs, and correspondence (and the data associated with the foregoing, such as file creation and last accessed dates) that may be evidence of who used or controlled hte computer or storage medium at a relevant time. F. Photographs of the interior and exterior of the listed residence. G. Papers showing dominion and control. H. Any other evidence of the crimes of RCW 9.68A.070, to include but not limited to videotapes, books, magazines, catalogs, photographs, film, diaries, or other documents pertaining to the possession or dealing of child pornography, to include printed material documenting any communication with other persons regarding the trading or exchange of depictions of minors engaged in sexually explicit conduct.

stegosaurus 11y ago

Illegal numbers are my favourite kind of numbers. How many bytes do I need? In the countries that have laws against cartoons, can I make an illegal favicon? Can I design a neural network which generates illegal favicons? More seriously, criminalizing data is a terrible, terrible idea, simply because it provides a backdoor into the justice system.