7 ms·

It might be someplace whose laws don't recognize the authority of that court---say, Beijing. And now the US FBI has put a NIT on a non-US computer. That's a pro

by brians 10y ago

It might be someplace whose laws don't recognize the authority of that court---say, Beijing. And now the US FBI has put a NIT on a non-US computer. That's a problem. It might be someplace that doesn't let governments use NITs at all. There is another way to go: warrants for the Tor exit node, then middle node, then guard. And if you can't justify those---especially hard for the middle node---that's not just a procedural issue, but a substantive problem.

tptacek 10y ago
Just so I understand you here, your position is that simply by dint of having used a Tor hidden service, you are entitled to having your information shielded from a warrant unless the court can deliver and execute warrants to the entire Tor infrastructure?
- ryanlol 10y ago
  That's how these things work in the physical world, why should the internet be treated any differently?
  - tptacek 10y ago
    What's the physical-world analog for a something that makes it trivial for a criminal to instantaneously conceal evidence across hundreds of jurisdictions? And how do the courts handle that thing?
    - ryanlol 10y ago
      Series of anonymous (anonymity can be achieved with various means, some more legal than others) shell companies used to launder money aren't exactly unheard of. There's very little courts can do, besides issuing countless of subpoenas and search warrants, which has been the standard way of handling criminal investigations for decades now. Here's a telephony related example: http://www.nytimes.com/2015/11/29/magazine/the-serial-swatter.html http://www.nytimes.com/2015/11/29/magazine/the-serial-swatte... ctrl+f subpoenas
      - tptacek 10y ago
        Those shell companies are also bad!
        ryanlol 10y ago
        Not questioning that, it just seems weird that internet specifically needs such legislation.
        tptacek 10y ago
        This isn't legislation; it's the Federal Rules of Criminal Procedure. They're the rules judges agree to follow.
- JoshTriplett 10y ago
  If, in the process of attempting to track down material covered by a warrant, law enforcement wants to obtain information from a system owned by someone not originally party to the warrant, they should be required to serve a warrant to the operator of that system, from a court with jurisdiction over the operator of that system. Doing any less would imply that the operator of that system is less entitled to due process than the alleged criminal being pursued. I don't fundamentally have a problem with the part of the ruling that allows serving a warrant to a specific party of unknown jurisdiction, based on evidence of criminal activity; however, I do think the terms of the warrant should require that as soon as an appropriate jurisdiction is determined the warrant must be re-issued from a court with that jurisdiction before any evidence can be used. (At the very least, that would result in most such warrants going to a federal court, rather than some local court. Wouldn't help much for international cases, but it's a step in the right direction.) I do have a problem with the idea that a blanket warrant could be issued to "all operators of Tor nodes", just as I have a problem with the idea that a warrant could be issued to "all operators of Internet routers". Mass surveillance isn't any more acceptable with a warrant than without one.
yaur 10y ago
It seems like if you take proactive steps to hide what jurisdiction you are in the options are that you are effectivly in everyone's jurisdiction or no one's. The public good is IMO best served by being able to catch criminals who use tor, so we have to go with the former. The downside is that Iran can legitimately hack you if you say bad things about Mohammad from behind tor, but there isn't much of an alternative.
- ryanlol 10y ago
  But that's not how it works in finance, why should it work like that for the internet? I can do the real world equivalent of using tor by setting up a secure corporate structure and then commit for example insider trading.

by brians 10y ago

tptacek 10y ago

Just so I understand you here, your position is that simply by dint of having used a Tor hidden service, you are entitled to having your information shielded from a warrant unless the court can deliver and execute warrants to the entire Tor infrastructure?

ryanlol 10y ago
That's how these things work in the physical world, why should the internet be treated any differently?
- tptacek 10y ago
  What's the physical-world analog for a something that makes it trivial for a criminal to instantaneously conceal evidence across hundreds of jurisdictions? And how do the courts handle that thing?
  - ryanlol 10y ago
    Series of anonymous (anonymity can be achieved with various means, some more legal than others) shell companies used to launder money aren't exactly unheard of. There's very little courts can do, besides issuing countless of subpoenas and search warrants, which has been the standard way of handling criminal investigations for decades now. Here's a telephony related example: http://www.nytimes.com/2015/11/29/magazine/the-serial-swatter.html http://www.nytimes.com/2015/11/29/magazine/the-serial-swatte... ctrl+f subpoenas
    - tptacek 10y ago
      Those shell companies are also bad!
      - ryanlol 10y ago
        Not questioning that, it just seems weird that internet specifically needs such legislation.
        tptacek 10y ago
        This isn't legislation; it's the Federal Rules of Criminal Procedure. They're the rules judges agree to follow.
JoshTriplett 10y ago
If, in the process of attempting to track down material covered by a warrant, law enforcement wants to obtain information from a system owned by someone not originally party to the warrant, they should be required to serve a warrant to the operator of that system, from a court with jurisdiction over the operator of that system. Doing any less would imply that the operator of that system is less entitled to due process than the alleged criminal being pursued. I don't fundamentally have a problem with the part of the ruling that allows serving a warrant to a specific party of unknown jurisdiction, based on evidence of criminal activity; however, I do think the terms of the warrant should require that as soon as an appropriate jurisdiction is determined the warrant must be re-issued from a court with that jurisdiction before any evidence can be used. (At the very least, that would result in most such warrants going to a federal court, rather than some local court. Wouldn't help much for international cases, but it's a step in the right direction.) I do have a problem with the idea that a blanket warrant could be issued to "all operators of Tor nodes", just as I have a problem with the idea that a warrant could be issued to "all operators of Internet routers". Mass surveillance isn't any more acceptable with a warrant than without one.

yaur 10y ago

It seems like if you take proactive steps to hide what jurisdiction you are in the options are that you are effectivly in everyone's jurisdiction or no one's. The public good is IMO best served by being able to catch criminals who use tor, so we have to go with the former. The downside is that Iran can legitimately hack you if you say bad things about Mohammad from behind tor, but there isn't much of an alternative.

ryanlol 10y ago
But that's not how it works in finance, why should it work like that for the internet? I can do the real world equivalent of using tor by setting up a secure corporate structure and then commit for example insider trading.