9 ms·

I wonder if anyone has ever sent a fake National Security Letter. The inability to speak about or verify these letters is concerning to me. Seems like you cou

by cwkoss 10y ago

I wonder if anyone has ever sent a fake National Security Letter. The inability to speak about or verify these letters is concerning to me. Seems like you could cause a lot of damage by sending a fake NSL ordering a company to send you private data. At minimum it would cost the company several thousand dollars in legal fees to determine its fake.

djrogers 10y ago
I doubt that these are simply sent through the mail - they may be called 'letters' but they're the kind of thing that would likely be delivered by Men In Suits with ID cards, or at the very least accompanied by a phone call if they're frequent enough that the parties would be familiar with the forms and process.
- SilasX 10y ago
  True, but who knows what a real MIB ID looks like? And do they have a phone line that you're allowed to call to verify these? Big companies might deal with the real guys regularly but not the smaller ones.
  - ucaetano 10y ago
    National Security Letters must be approved by the Director of the FBI, so yeah, there's probably a hotline you can call.
    - gscott 10y ago
      It could be simpler. For example Facebook has an online portal https://www.facebook.com/records/ https://www.facebook.com/records/
    - SilasX 10y ago
      But I doubt they want you calling to verify on an insecure line.
      - seanp2k2 10y ago
        Trying to set up a situation where one could gain something (even just laughs) from attempting to send a fake NSL seems like a great way to end up in prison for the rest of your life. Not sure what laws that would violate (aside from impersonating), but I'd bet they'd find them.
- Steko 10y ago
  Nicholas Merrill describes how his NSL arrived here around 1:20 in: https://www.youtube.com/watch?v=eU2wAu4qE60 https://www.youtube.com/watch?v=eU2wAu4qE60
  - kqr 10y ago
    And how was that, for us without audio capabilities?
    - Steko 10y ago
      Got a mysterious call saying an agent (presumably he knew it was an FBI agent) would be coming to deliver a letter. Agent arrived handed him the letter. He read it asked if he couldn't even talk about it with his business associates and lawyer. Agent shrugged and asked him to sign a receipt.
mrsteveman1 10y ago
I'd be shocked if you couldn't verify their legitimacy with the agency that served them if for some reason their origin was in question.
- oh_sigh 10y ago
  "hello FBI switchboard operator - please connect me with the department where I can confirm receipt of my secret subpoena"
  - deleted 10y ago
    [deleted]
  - uxp 10y ago
    NSLs aren't signed by "The FBI", but rather some Agent of the FBI, which includes their case number and contact information. Even if one had to cold call the FBI operator, they could probably ask for the investigator in charge of case "X1234" and get whomever they needed that had clearance to discuss the issue. If someone forged an NSL, it would be arguably trivial to verify it's authenticity by doing a number of things, including walking into a local FBI office and asking to speak to someone about the case number, which is public enough information within the confines of the agency to get you someone who can talk about the case without having to describe the specifics of the letter over a phone to someone who might leak that information resulting in your arrest.
    - mcherm 10y ago
      > speak to someone about the case number, which is public enough information within the confines of the agency I have absolutely NO idea how you reach that conclusion. I know that legal arguments have been made for suppressing every single word of a NSL, and that even admitting the existence of the NSL is specifically prohibited by the law. What makes you think that this query would not be a violation of the law?
      - rincebrain 10y ago
tedunangst 10y ago
Where would the fake NSL demand you send the collected info?
- deleted 10y ago
  [deleted]
- nercht12 10y ago
  An Indian call center, of course. XD
- robryk 10y ago
  "FBI office" at an address where no (real) FBI office exists (with a slightly obfuscated address that doesn't mention FBI by name, but something that sounds like a department in FBI but isn't, so that the postal service doesn't get suspicious).
digler999 10y ago
might work for a small shop, but the bigger companies have legal departments who've already been served with warrants and met with feds. And who knows, maybe NSL's start with a conventional subpoena to appear at your local court room or FBI office for a meeting you cant refuse. In fact, I'd wager that they would be served in a federal courthouse before a judge informing the recipient of their (lack of any) rights.
- matt4077 10y ago
  I wish that were true... But there are actually no judges involved in this process, and trying to get them involved may end up with you on the wrong side of the court room.
yodon 10y ago
One of John Le Carre's spy novels was build around this idea [0]. His novel happens to revolve around an anti-israeli activist tricked into spying for israeli intelligence, but at the core it's a study in the difficulties an individual faces trying to reliably validate the identity behind a well-funded "social engineering" attack. [0] https://en.wikipedia.org/wiki/The_Little_Drummer_Girl https://en.wikipedia.org/wiki/The_Little_Drummer_Girl
- tedunangst 10y ago
  Isn't that basically the premise for Alias?
- deleted 10y ago
  [deleted]
Zigurd 10y ago
Since we don't know the actual method for verification this is speculation, but people put too much faith in phone calls, and telecom CPE security is often lax. You might be able to spoof verification of an NSL by hacking the DOSA capability of the FBI's PBX and setting up an extension to forward to your phone. The recipient feels confident they called the real FBI. The attendant thinks they forwarded the call to an extension, but your phone gets the call.
- derefr 10y ago
  Much easier to put the POTS equivalent of a proxy on the person's line (e.g. an LTE picocell hidden near their home, configured in a Stingray-like mode, running its own internal call-switching logic) than to hack the FBI's PBX, I'd think.
  - Zigurd 10y ago
    That requires equipment! Seriously though, the only picocells I know of that are "open" enough to turn into a poor man's stingray are 2g-only, and that will show up in the phone's connectivity status icon, and it assumes cell phone use. How very 21st c. Now that most people have forgotten their desk phone, weak security in passwords and feature access is probably worse than it has ever been in enterprise CPE. DISA/DOSA is an end-user feature, so it's not as if you are hacking the PBX configuration. It's more like hacking an individual user's voicemail. Plus it has that retro cache of "what we were hacking before we had computers to hack." Get out your old back issues of 2600.

by cwkoss 10y ago

djrogers 10y ago

I doubt that these are simply sent through the mail - they may be called 'letters' but they're the kind of thing that would likely be delivered by Men In Suits with ID cards, or at the very least accompanied by a phone call if they're frequent enough that the parties would be familiar with the forms and process.

SilasX 10y ago
True, but who knows what a real MIB ID looks like? And do they have a phone line that you're allowed to call to verify these? Big companies might deal with the real guys regularly but not the smaller ones.
- ucaetano 10y ago
  National Security Letters must be approved by the Director of the FBI, so yeah, there's probably a hotline you can call.
  - gscott 10y ago
    It could be simpler. For example Facebook has an online portal https://www.facebook.com/records/ https://www.facebook.com/records/
  - SilasX 10y ago
    But I doubt they want you calling to verify on an insecure line.
    - seanp2k2 10y ago
      Trying to set up a situation where one could gain something (even just laughs) from attempting to send a fake NSL seems like a great way to end up in prison for the rest of your life. Not sure what laws that would violate (aside from impersonating), but I'd bet they'd find them.
Steko 10y ago
Nicholas Merrill describes how his NSL arrived here around 1:20 in: https://www.youtube.com/watch?v=eU2wAu4qE60 https://www.youtube.com/watch?v=eU2wAu4qE60
- kqr 10y ago
  And how was that, for us without audio capabilities?
  - Steko 10y ago
    Got a mysterious call saying an agent (presumably he knew it was an FBI agent) would be coming to deliver a letter. Agent arrived handed him the letter. He read it asked if he couldn't even talk about it with his business associates and lawyer. Agent shrugged and asked him to sign a receipt.

mrsteveman1 10y ago

I'd be shocked if you couldn't verify their legitimacy with the agency that served them if for some reason their origin was in question.

oh_sigh 10y ago
"hello FBI switchboard operator - please connect me with the department where I can confirm receipt of my secret subpoena"
- deleted 10y ago
  [deleted]
- uxp 10y ago
  NSLs aren't signed by "The FBI", but rather some Agent of the FBI, which includes their case number and contact information. Even if one had to cold call the FBI operator, they could probably ask for the investigator in charge of case "X1234" and get whomever they needed that had clearance to discuss the issue. If someone forged an NSL, it would be arguably trivial to verify it's authenticity by doing a number of things, including walking into a local FBI office and asking to speak to someone about the case number, which is public enough information within the confines of the agency to get you someone who can talk about the case without having to describe the specifics of the letter over a phone to someone who might leak that information resulting in your arrest.
  - mcherm 10y ago
    > speak to someone about the case number, which is public enough information within the confines of the agency I have absolutely NO idea how you reach that conclusion. I know that legal arguments have been made for suppressing every single word of a NSL, and that even admitting the existence of the NSL is specifically prohibited by the law. What makes you think that this query would not be a violation of the law?
    - rincebrain 10y ago

tedunangst 10y ago

Where would the fake NSL demand you send the collected info?

deleted 10y ago
[deleted]
nercht12 10y ago
An Indian call center, of course. XD
robryk 10y ago
"FBI office" at an address where no (real) FBI office exists (with a slightly obfuscated address that doesn't mention FBI by name, but something that sounds like a department in FBI but isn't, so that the postal service doesn't get suspicious).

digler999 10y ago

might work for a small shop, but the bigger companies have legal departments who've already been served with warrants and met with feds. And who knows, maybe NSL's start with a conventional subpoena to appear at your local court room or FBI office for a meeting you cant refuse. In fact, I'd wager that they would be served in a federal courthouse before a judge informing the recipient of their (lack of any) rights.

matt4077 10y ago
I wish that were true... But there are actually no judges involved in this process, and trying to get them involved may end up with you on the wrong side of the court room.

yodon 10y ago

One of John Le Carre's spy novels was build around this idea [0]. His novel happens to revolve around an anti-israeli activist tricked into spying for israeli intelligence, but at the core it's a study in the difficulties an individual faces trying to reliably validate the identity behind a well-funded "social engineering" attack. [0] https://en.wikipedia.org/wiki/The_Little_Drummer_Girl https://en.wikipedia.org/wiki/The_Little_Drummer_Girl

tedunangst 10y ago
Isn't that basically the premise for Alias?
deleted 10y ago
[deleted]

Zigurd 10y ago

Since we don't know the actual method for verification this is speculation, but people put too much faith in phone calls, and telecom CPE security is often lax. You might be able to spoof verification of an NSL by hacking the DOSA capability of the FBI's PBX and setting up an extension to forward to your phone. The recipient feels confident they called the real FBI. The attendant thinks they forwarded the call to an extension, but your phone gets the call.

derefr 10y ago
Much easier to put the POTS equivalent of a proxy on the person's line (e.g. an LTE picocell hidden near their home, configured in a Stingray-like mode, running its own internal call-switching logic) than to hack the FBI's PBX, I'd think.
- Zigurd 10y ago
  That requires equipment! Seriously though, the only picocells I know of that are "open" enough to turn into a poor man's stingray are 2g-only, and that will show up in the phone's connectivity status icon, and it assumes cell phone use. How very 21st c. Now that most people have forgotten their desk phone, weak security in passwords and feature access is probably worse than it has ever been in enterprise CPE. DISA/DOSA is an end-user feature, so it's not as if you are hacking the PBX configuration. It's more like hacking an individual user's voicemail. Plus it has that retro cache of "what we were hacking before we had computers to hack." Get out your old back issues of 2600.