9 ms·

Playpen: The Story of the FBI’s Unprecedented and Illegal Hacking Operation

176 points by lelf 10y ago

javajosh 10y ago
Unfortunately the government was wise to expand their power in a child porn case. It's very, very difficult to motivate to do anything in defense of such people. If only they'd gone after someone at least somewhat sympathetic!
- micaksica 10y ago
  > Unfortunately the government was wise to expand their power in a child porn case. The state is following the age-old tactic for expanding their power and authority: go after people others won't speak up for in fear of being labeled one of them. It's exactly what the Martin Niemöller quote is about. While I do not condone the behavior of these people or otherwise support their crime, kudos to EFF for being willing to stand up to the state on this. As we have learned, any liberty sacrificed to "law enforcement" agencies or sociopolitical elites will almost never be reverted. You'd think we would have learned that with the Patriot Act and "terrorism".
  - x1798DE 10y ago
    > While I do not condone the behavior of these people or otherwise support their crime Probably doesn't help that you feel the need to mention this even when talking about the nature of the tactic used.
    - Hondor 10y ago
      Weak groups need to step on the heads of even weaker groups to gain influence. If anti-FBI-overreach activists appear to be aligned with pedophiles, that'll weaken the cause of the activists. Instead they should appear align themselves with some group that's more respected than themselves, like believers in the constitution. That's perhaps the reason pro-transsexual activists don't widely support Chelsea Manning or why bullied schoolkids aren't helped by the majority of the students who are all struggling to maintain their own image. Not that it's a very nice thing to do, it's just self-interest.
- cloudjacker 10y ago
  I like to have a thought exercise about the constitutional way to achieve the same result You Game?
  - deleted 10y ago
    [deleted]
  - mastazi 10y ago
    I'm not sure what you are trying to say. One of the reasons why the Constitution exists is that, thanks to its very existence, some things become unconstitutional. If we were to conclude that there isn't a constitutional way to achieve legalised mass surveillance, then we would have to conclude that that mass surveillance is unconstitutional. I would be quite happy with that conclusion, if I may add.
    - ikeboy 10y ago
      This case is about targeted, not mass, surveillance.
      - mastazi 10y ago
        What if the "target site" was Gmail? Would you still call it targeted surveillance? What's the limit under which we consider surveillance to be targeted? 100,000 users? One million? 10 millions?
        nullc 10y ago
        Well... there probably is more child porn in gmail.
        mastazi 10y ago
        Exactly. As the article explains, "the FBI received a tip from a foreign law enforcement agency that a Tor Hidden Service site called “Playpen” was hosting child pornography". What if the FBI received a tip that Gmail users are hosting child pornography? Would they be allowed to infect Gmail users' computers?
- axoltl 10y ago
  This is exactly what they were trying to do in the San Bernadino case with the iPhone. They were trying to set a precedent using an 'indefensible' case. He was a terrorist! We should stop terrorism! It was never about that specific iPhone. Same thing here. If they get to use this technology here what's to stop them doing it in other cases?
  - dmix 10y ago
    It's a shame defence attorneys get paid such low wages. They are the front line defence against this stuff and the state always has a strong advantage over them in every trial.
- pstuart 10y ago
  "think of the children!" It's like a all-access pass to unlimited trampling of privacy.
- danarmak 10y ago
  And, in fact, it's very difficult to motivate anyone to do anything in defense of anyone merely accused of viewing child porn who has not yet come to trial.
speeder 10y ago
A tv program here in Brazil showed the "cutting edge" tech in capturing "pedophiles" First, they showed that the police here, got from some US organizations, access to some kind of realtime NSA style spying tools, they showed on tv that their software show realtime torrent data transfer worldwide, with pips popping up on a map in the entire planet! Then, they decided to show one person, and showed on tv some kind of hidden teamviewer, they showed someone screen, realtime. All of this already made me cringe, what kind of mass spying is US exporting? Then the tv showed 3 people caught, showed their names, location, jobs, even filmed one guy house and his family inside... 1. One guy was an old man that wants help and avoid kids. 2. Another is a 32 year old unemployed that never his parents apartment, and never invite anyone, doesn't have friends or romantic partners. 3. Guy is 28 year old IT worker, no friends or girlfriend. used his work Internet because he couldn't afford broadband at home. None of the 3 are in jail, they were only officially charged, and they don't have a trial date yet. Then the tv points out that 70% of pedophiles in jail actually raped a child, and implied that those 3 maybe lied about never abused kids. So, illegal spying, and guilty until proven otherwise? How these 3 will walk on the street now? All of them lived in smaller towns, and the tv station was the most popular tv station of the country.
- retox 10y ago
  I'm interested in watching this footage, do you remember the name and air date?
  - speeder 10y ago
    http://g1.globo.com/fantastico/noticia/2016/09/exclusivo-nova-tecnologia-se-torna-arma-eficiente-na-cacada-aos-pedofilos.amp http://g1.globo.com/fantastico/noticia/2016/09/exclusivo-nov...
    - retox 10y ago
      Belated thank you.
- barkbro 10y ago
  > First, they showed that the police here, got from some US organizations, access to some kind of realtime NSA style spying tools, they showed on tv that their software show realtime torrent data transfer worldwide, with pips popping up on a map in the entire planet! Were they monitoring a single torrent file? Multiple? An entire tracker? Most BT traffic in the world? Trackers will happily disclose the list of peers who are downloading, so it's not hard to monitor a list of torrents. That's how BT works. A lot of anti-piracy companies do it. Unless they were monitoring a massive amount of torrent traffic, I don't see why an intelligence agency has to be involved.
sigmar 10y ago
This is the second post in the EFF's series on Playpen: https://www.eff.org/deeplinks/2016/09/playpen-story-some-fourth-amendment-basics-and-law-enforcement-hacking https://www.eff.org/deeplinks/2016/09/playpen-story-some-fou...
gragas 10y ago
Honestly, I'm very satisfied with the work the FBI did in this case. To those mad about the FBI overstepping privacy rights on shaky grounds: how could you possibly need more evidence than proof of visits to a website that distributes child pornography?
- akiselev 10y ago
  How could you possibly need more evidence than proof of J. Edgar Hoover's abuses of power that this is a real slippery slope to tyranny? Are you saying that "think of the children" is a valid argument in the face of an existential threat to democracy?
  - gragas 10y ago
    I'd rather say that I'm very impressed with the extent to which the FBI went to compromise these people from a technical standpoint. What they did is scary, yes. But I'm still very satisfied knowing that the FBI will put in not only so much manpower, but also technical and strategic effort to achieve its goals.
    - akiselev 10y ago
      That sounds like you're glad that the FBI is technically competent at bypassing the very constitutional protections that each of its agents is sworn to protect.
      - nl 10y ago
        Which constitutional protections did they bypass exactly? The Federal Court has found the fourth amendment does not protect a home computer[1]. One might disagree with that, but claiming the FBI is "bypassing the very constitutional protections that each of its agents is sworn to protect" seems quite emotive given that an actual court found the exact opposite. [1] https://www.eff.org/deeplinks/2016/06/federal-court-fourth-amendment-does-not-protect-your-home-computer https://www.eff.org/deeplinks/2016/06/federal-court-fourth-a...
- 10y ago
arca_vorago 10y ago
All I have to say is get a fucking warrant like the constitution you swore an oath to requires! Once they have a warrant, a specific one at that (as opposed to a general or blanket one), and then use of these tools is ok. I understand they got a warrant for the server, but theydidnt get warrants for each user like they should have, so unless I am missing something, it's blatantly unconstitutional. This is where some beltway establishment stenographers would say "but it was thousands, warrants would take too long!" Well tough fucking shit, you still have to get a warrant for each IP. Unless there is some legal precedent someone wants to cite to me, which I have yet to see. Mark my words, cp and terrorism and cyberterrorism (read: major bank hacks) are the things going to be used to increase the surveillance of the internet. If we dont stand up for the rights even of horrible people, its a slippery slope that will, not might bite us in the ass later. First they came for the people who clicked on url shortners, etc. Shit hell, I wouldnt be surprised if the FBI used this fishnet to spearphish people that had nothing to do with the site so they became targets. eg: Send that pesky dissident an email with a link to this so that they pop on the autocomprimise tool and voila, dissident surveillance engine disguised as good guy cp catching program. On a side note, I did some pretty extensive forensics training to be able to testify about stuff like this, and you would be utterly amazed at how many of the other "forensics specialists" were utterly incompetent. (for example, not knowing any other fs than ntfs...)
- pfg 10y ago
  The warrant in question is one that allows them to deploy the NIT in order to get the IP addresses in the first place. They wouldn't know these addresses prior to deploying the NIT, so there's no way they'd be able to get a warrant for each IP prior to that. Once they had the IPs, they subpoenaed the ISPs and got search warrants for the owners. I haven't really made up my mind about the legalities of this case, it's quite tricky. I think the FBI should definitely have to disclose the NIT (both the exploit and the payload) to the defense, but I'm not sure about the warrant (Rule 41 issues aside).
  - arca_vorago 10y ago
    I appreciate the details your have provided here, I will be reading up more on this. I just wish there was a "legalese for geeks" book.
nylsaar 10y ago
To me, the disturbing thing is the FBI took over the Tor node, moved the content to a FBI server, and ran it for two weeks. This article was posted here 17 days ago by minamisan. https://news.bitcoin.com/fbi-child-porn-role-govt/ https://news.bitcoin.com/fbi-child-porn-role-govt/
- phkahler 10y ago
  >> To me, the disturbing thing is the FBI took over the Tor node, moved the content to a FBI server, and ran it for two weeks. Yeah, why don't they just run a porn site full time? Is the limited duration an admission that they shouldn't use that method? Why not continue if it's so effective?
nxzero 10y ago
Are there any examples of the FBI creating or enabling predators so they are able to hunt them? If so, is this illegal, and if not, why?
- aboonaboo 10y ago
  It's only entrapment if they force you to do it against your will
trowaway_mcshea 10y ago
This is not going to be popular. Quite frankly, I think that any person with these compulsions should be put to death. People with these compulsions are almost never "cured" of them and they cause unimaginable harm to society. A child who has been sexually abused is pretty much ruined as a person for the rest of his or her life. The rest of that person's life is a long, drawn out torture. And this is assuming that the predator lets the child live. Often they are killed by the predator since the crime is so egregious and there is no turning back. I really, really do not care if the rights of these people were trampled on. Even if my machine was somehow collaterally infected with this malware, it would not bother me in the least if I knew for sure it was part of this investigation. These "people" are beyond help. There is no reform if you have these compulsions. That is why, even after they have did their time, they must register as a sex offender and be restricted in where they reside. They should just be destroyed.
- logfromblammo 10y ago
  Unfortunately for your opinion, creating a state apparatus to surveil, capture, diagnose, and execute such individuals is far more dangerous than allowing such people to exist. You may be expecting far too much of your government. My opinion is that if pedophilia became a mental illness treatable by execution, enemies of the powerful might discover that their hard drives had been filled with outlawed images without their knowledge, rather than just having convenient car wrecks or drug overdoses. Why just murder someone when you can simultaneously discredit and vilify them? If you truly believe that such people are too dangerous to live, the logical course of action is for you to go out and murder them yourself. Are you prepared to deal with the consequences of that? Would it be better to just hire a professional to do it on your behalf? Would that become more acceptable if the professional is a state employee?
  - trowaway_mcshea 10y ago
    When you are convicted of a serious pedophilia related crime with irrefutable evidence against you or a confession, the min. sentence should just be execution. The likelihood of re-offending is so high and they have already done monumental damage that it's much better from a Utility point of view to just put that person down. Sexuality is something you can't re-wire. You don't get to choose your sexual desires and compulsions. You can't "pray the gay away." Some people are asexual and they are attracted to nobody (or thing, if that's what you fancy. No judgements). Similarly, you can't stop a pedophile from being a pedophile. The only difference with pedophiles is that they are wired to cause serious negative Utility, so the negative Utility brought by killing the pedophile will be less than the negative Utility the pedophile brings if they are left alive to continue to commit atrocities.

176 points by lelf 10y ago

Unfortunately the government was wise to expand their power in a child porn case. It's very, very difficult to motivate to do anything in defense of such people. If only they'd gone after someone at least somewhat sympathetic!

micaksica 10y ago
> Unfortunately the government was wise to expand their power in a child porn case. The state is following the age-old tactic for expanding their power and authority: go after people others won't speak up for in fear of being labeled one of them. It's exactly what the Martin Niemöller quote is about. While I do not condone the behavior of these people or otherwise support their crime, kudos to EFF for being willing to stand up to the state on this. As we have learned, any liberty sacrificed to "law enforcement" agencies or sociopolitical elites will almost never be reverted. You'd think we would have learned that with the Patriot Act and "terrorism".
- x1798DE 10y ago
  > While I do not condone the behavior of these people or otherwise support their crime Probably doesn't help that you feel the need to mention this even when talking about the nature of the tactic used.
  - Hondor 10y ago
    Weak groups need to step on the heads of even weaker groups to gain influence. If anti-FBI-overreach activists appear to be aligned with pedophiles, that'll weaken the cause of the activists. Instead they should appear align themselves with some group that's more respected than themselves, like believers in the constitution. That's perhaps the reason pro-transsexual activists don't widely support Chelsea Manning or why bullied schoolkids aren't helped by the majority of the students who are all struggling to maintain their own image. Not that it's a very nice thing to do, it's just self-interest.
cloudjacker 10y ago
I like to have a thought exercise about the constitutional way to achieve the same result You Game?
- deleted 10y ago
  [deleted]
- mastazi 10y ago
  I'm not sure what you are trying to say. One of the reasons why the Constitution exists is that, thanks to its very existence, some things become unconstitutional. If we were to conclude that there isn't a constitutional way to achieve legalised mass surveillance, then we would have to conclude that that mass surveillance is unconstitutional. I would be quite happy with that conclusion, if I may add.
  - ikeboy 10y ago
    This case is about targeted, not mass, surveillance.
    - mastazi 10y ago
      What if the "target site" was Gmail? Would you still call it targeted surveillance? What's the limit under which we consider surveillance to be targeted? 100,000 users? One million? 10 millions?
      - nullc 10y ago
        Well... there probably is more child porn in gmail.
        mastazi 10y ago
        Exactly. As the article explains, "the FBI received a tip from a foreign law enforcement agency that a Tor Hidden Service site called “Playpen” was hosting child pornography". What if the FBI received a tip that Gmail users are hosting child pornography? Would they be allowed to infect Gmail users' computers?
axoltl 10y ago
This is exactly what they were trying to do in the San Bernadino case with the iPhone. They were trying to set a precedent using an 'indefensible' case. He was a terrorist! We should stop terrorism! It was never about that specific iPhone. Same thing here. If they get to use this technology here what's to stop them doing it in other cases?
- dmix 10y ago
  It's a shame defence attorneys get paid such low wages. They are the front line defence against this stuff and the state always has a strong advantage over them in every trial.
pstuart 10y ago
"think of the children!" It's like a all-access pass to unlimited trampling of privacy.
danarmak 10y ago
And, in fact, it's very difficult to motivate anyone to do anything in defense of anyone merely accused of viewing child porn who has not yet come to trial.

speeder 10y ago

A tv program here in Brazil showed the "cutting edge" tech in capturing "pedophiles" First, they showed that the police here, got from some US organizations, access to some kind of realtime NSA style spying tools, they showed on tv that their software show realtime torrent data transfer worldwide, with pips popping up on a map in the entire planet! Then, they decided to show one person, and showed on tv some kind of hidden teamviewer, they showed someone screen, realtime. All of this already made me cringe, what kind of mass spying is US exporting? Then the tv showed 3 people caught, showed their names, location, jobs, even filmed one guy house and his family inside... 1. One guy was an old man that wants help and avoid kids. 2. Another is a 32 year old unemployed that never his parents apartment, and never invite anyone, doesn't have friends or romantic partners. 3. Guy is 28 year old IT worker, no friends or girlfriend. used his work Internet because he couldn't afford broadband at home. None of the 3 are in jail, they were only officially charged, and they don't have a trial date yet. Then the tv points out that 70% of pedophiles in jail actually raped a child, and implied that those 3 maybe lied about never abused kids. So, illegal spying, and guilty until proven otherwise? How these 3 will walk on the street now? All of them lived in smaller towns, and the tv station was the most popular tv station of the country.

retox 10y ago
I'm interested in watching this footage, do you remember the name and air date?
- speeder 10y ago
  http://g1.globo.com/fantastico/noticia/2016/09/exclusivo-nova-tecnologia-se-torna-arma-eficiente-na-cacada-aos-pedofilos.amp http://g1.globo.com/fantastico/noticia/2016/09/exclusivo-nov...
  - retox 10y ago
    Belated thank you.
barkbro 10y ago
> First, they showed that the police here, got from some US organizations, access to some kind of realtime NSA style spying tools, they showed on tv that their software show realtime torrent data transfer worldwide, with pips popping up on a map in the entire planet! Were they monitoring a single torrent file? Multiple? An entire tracker? Most BT traffic in the world? Trackers will happily disclose the list of peers who are downloading, so it's not hard to monitor a list of torrents. That's how BT works. A lot of anti-piracy companies do it. Unless they were monitoring a massive amount of torrent traffic, I don't see why an intelligence agency has to be involved.

sigmar 10y ago

This is the second post in the EFF's series on Playpen: https://www.eff.org/deeplinks/2016/09/playpen-story-some-fourth-amendment-basics-and-law-enforcement-hacking https://www.eff.org/deeplinks/2016/09/playpen-story-some-fou...

gragas 10y ago

Honestly, I'm very satisfied with the work the FBI did in this case. To those mad about the FBI overstepping privacy rights on shaky grounds: how could you possibly need more evidence than proof of visits to a website that distributes child pornography?

akiselev 10y ago
How could you possibly need more evidence than proof of J. Edgar Hoover's abuses of power that this is a real slippery slope to tyranny? Are you saying that "think of the children" is a valid argument in the face of an existential threat to democracy?
- gragas 10y ago
  I'd rather say that I'm very impressed with the extent to which the FBI went to compromise these people from a technical standpoint. What they did is scary, yes. But I'm still very satisfied knowing that the FBI will put in not only so much manpower, but also technical and strategic effort to achieve its goals.
  - akiselev 10y ago
    That sounds like you're glad that the FBI is technically competent at bypassing the very constitutional protections that each of its agents is sworn to protect.
    - nl 10y ago
      Which constitutional protections did they bypass exactly? The Federal Court has found the fourth amendment does not protect a home computer[1]. One might disagree with that, but claiming the FBI is "bypassing the very constitutional protections that each of its agents is sworn to protect" seems quite emotive given that an actual court found the exact opposite. [1] https://www.eff.org/deeplinks/2016/06/federal-court-fourth-amendment-does-not-protect-your-home-computer https://www.eff.org/deeplinks/2016/06/federal-court-fourth-a...
10y ago

arca_vorago 10y ago

All I have to say is get a fucking warrant like the constitution you swore an oath to requires! Once they have a warrant, a specific one at that (as opposed to a general or blanket one), and then use of these tools is ok. I understand they got a warrant for the server, but theydidnt get warrants for each user like they should have, so unless I am missing something, it's blatantly unconstitutional. This is where some beltway establishment stenographers would say "but it was thousands, warrants would take too long!" Well tough fucking shit, you still have to get a warrant for each IP. Unless there is some legal precedent someone wants to cite to me, which I have yet to see. Mark my words, cp and terrorism and cyberterrorism (read: major bank hacks) are the things going to be used to increase the surveillance of the internet. If we dont stand up for the rights even of horrible people, its a slippery slope that will, not might bite us in the ass later. First they came for the people who clicked on url shortners, etc. Shit hell, I wouldnt be surprised if the FBI used this fishnet to spearphish people that had nothing to do with the site so they became targets. eg: Send that pesky dissident an email with a link to this so that they pop on the autocomprimise tool and voila, dissident surveillance engine disguised as good guy cp catching program. On a side note, I did some pretty extensive forensics training to be able to testify about stuff like this, and you would be utterly amazed at how many of the other "forensics specialists" were utterly incompetent. (for example, not knowing any other fs than ntfs...)

pfg 10y ago
The warrant in question is one that allows them to deploy the NIT in order to get the IP addresses in the first place. They wouldn't know these addresses prior to deploying the NIT, so there's no way they'd be able to get a warrant for each IP prior to that. Once they had the IPs, they subpoenaed the ISPs and got search warrants for the owners. I haven't really made up my mind about the legalities of this case, it's quite tricky. I think the FBI should definitely have to disclose the NIT (both the exploit and the payload) to the defense, but I'm not sure about the warrant (Rule 41 issues aside).
- arca_vorago 10y ago
  I appreciate the details your have provided here, I will be reading up more on this. I just wish there was a "legalese for geeks" book.

nylsaar 10y ago

To me, the disturbing thing is the FBI took over the Tor node, moved the content to a FBI server, and ran it for two weeks. This article was posted here 17 days ago by minamisan. https://news.bitcoin.com/fbi-child-porn-role-govt/ https://news.bitcoin.com/fbi-child-porn-role-govt/

phkahler 10y ago
>> To me, the disturbing thing is the FBI took over the Tor node, moved the content to a FBI server, and ran it for two weeks. Yeah, why don't they just run a porn site full time? Is the limited duration an admission that they shouldn't use that method? Why not continue if it's so effective?

nxzero 10y ago

Are there any examples of the FBI creating or enabling predators so they are able to hunt them? If so, is this illegal, and if not, why?

aboonaboo 10y ago
It's only entrapment if they force you to do it against your will

trowaway_mcshea 10y ago

This is not going to be popular. Quite frankly, I think that any person with these compulsions should be put to death. People with these compulsions are almost never "cured" of them and they cause unimaginable harm to society. A child who has been sexually abused is pretty much ruined as a person for the rest of his or her life. The rest of that person's life is a long, drawn out torture. And this is assuming that the predator lets the child live. Often they are killed by the predator since the crime is so egregious and there is no turning back. I really, really do not care if the rights of these people were trampled on. Even if my machine was somehow collaterally infected with this malware, it would not bother me in the least if I knew for sure it was part of this investigation. These "people" are beyond help. There is no reform if you have these compulsions. That is why, even after they have did their time, they must register as a sex offender and be restricted in where they reside. They should just be destroyed.

logfromblammo 10y ago
Unfortunately for your opinion, creating a state apparatus to surveil, capture, diagnose, and execute such individuals is far more dangerous than allowing such people to exist. You may be expecting far too much of your government. My opinion is that if pedophilia became a mental illness treatable by execution, enemies of the powerful might discover that their hard drives had been filled with outlawed images without their knowledge, rather than just having convenient car wrecks or drug overdoses. Why just murder someone when you can simultaneously discredit and vilify them? If you truly believe that such people are too dangerous to live, the logical course of action is for you to go out and murder them yourself. Are you prepared to deal with the consequences of that? Would it be better to just hire a professional to do it on your behalf? Would that become more acceptable if the professional is a state employee?
- trowaway_mcshea 10y ago
  When you are convicted of a serious pedophilia related crime with irrefutable evidence against you or a confession, the min. sentence should just be execution. The likelihood of re-offending is so high and they have already done monumental damage that it's much better from a Utility point of view to just put that person down. Sexuality is something you can't re-wire. You don't get to choose your sexual desires and compulsions. You can't "pray the gay away." Some people are asexual and they are attracted to nobody (or thing, if that's what you fancy. No judgements). Similarly, you can't stop a pedophile from being a pedophile. The only difference with pedophiles is that they are wired to cause serious negative Utility, so the negative Utility brought by killing the pedophile will be less than the negative Utility the pedophile brings if they are left alive to continue to commit atrocities.