14 ms·
FBI operated 23 Tor-hidden child porn sites, deployed malware from them
- api 10y agoDoesn't this show that yes you can do police work in the post crypto age?
- pmlnr 10y agoThis is not that trivial to answer. In this case, the FBI went against the law by operating these servers - a typical case of "the ends justify the means". Should we allow police work not to play by the rules? That usually doesn't end well.
- runn1ng 10y agoI am not sure about the letter of the law, but I think the spirit is clear that the intent matters. And they didn't operate the servers because they wanted to give platform to child porn users, but because they wanted to catch the users.
- pmlnr 10y agoI understand this, but if you let them do it in this case, nothing will stop them from doing the same in other cases. The law applies to anyone: if this content is banned, you aren't allowed to use it as bait either.
- Arnt 10y agoThat's called entrapment and is generally illegal, no?
- admax88q 10y agoNo, entrapment is when law enforcement induces you to commit an offense you wouldn't otherwise do. If you use a cp site of your own free will without encouragement from law enforcement, then it's not entrapment just because the site was operated by law enforcement.
- pbhjpbhj 10y agoBut if the law enforcement weren't running it then there's at least a chance you would have been thwarted and there would be no actus rea, tempting people to commit crimes that without your positive action could have been impossible seems morally wrong to me. Like leaving open bottles of spirits in alcoholic's rooms if there were prohibition.
- bitJericho 10y agoEntrapment is when the police make you do something you wouldn't normally do. For example, if they showed you a popup you didn't want to see and then arrested you for it, that would be entrapment.
- probablybroken 10y agoI think for it to be entrapment, you would have to convince the users to use the site against their normal judgement - rather than them using it of their own free will.
- archgoon 10y agoAs others have said, most likely not, as the FBI was not inducing people to visit the website. http://lawcomic.net/guide/?p=633 http://lawcomic.net/guide/?p=633
- FullMtlAlcoholc 10y agoSure, but as we saw in the Silk Road investigation, this is something that can be co-opted by a less than scrupulous agent. When you exempt certain agencies from the law, they will inevitably abuse that power. In these conditions it was acceptable. However, setting up a CP server as a honeypot crosses the line and blurs the line between stopping and supporting it.
- Raphmedia 10y agoThey arrested the stupid users. Pedophiles are not known for being among the brightest. Those people downloaded the Tor browser and blindly started browsing on it. It wouldn't have been so easy to get information on 200 real cyber criminals.
- brianwawok 10y agoThat sounds a bit like strawman. Do you have a citation that a pedo has less IQ than the average member of society? I think by using Tor that puts them in the top 1% of internet user knowledge, which is against your statement.
- foobarbecue 10y agoAre you getting straw man and ad hominum mixed up? Not that either of those fallacies were used here...
- elliottcarlson 10y agoJust because they are using Tor (either by searching how to hide their tracks, or just because the community for this kind of content in general will gravitate to something like Tor), doesn't really mean they would be in the top 1% - they followed instructions that someone in the top 1% created. Whether that means they have a lower IQ than the average member of society though, that is a whole other thing.
- brianwawok 10y agoI do not think anyone outside the top 1% could even follow the directions to download and use tor. You are vastly overestimating the compute power of the average person.
- Raphmedia 10y agoI mean, it's a simple link to a simple installer. Click on this and you will be ready to go: https://www.torproject.org/dist/torbrowser/6.0.5/torbrowser-install-6.0.5_en-US.exe https://www.torproject.org/dist/torbrowser/6.0.5/torbrowser-...
- revelation 10y agoThe FBI used a Tor Browser Exploit instead of disclosing it responsibly. If this is police work in the post crypto are, then we are all going to be a lot less secure.
- antoineMoPa 10y agoWhen I have debates about encryption and surveillance, CP & terrorism are arguments that are difficult to address. I think this solves a part of the problem.
- draw_down 10y agoWhen you gaze long into the abyss, the abyss gazes also into you.
- forthwoart 10y ago> FBI opreated 23 Tor-hidden child porn sites Uh, what? I don't think the end justifies the means here
- foobarbecue 10y agoYou might want to read beyond the clickbait headline.
- GrinningFool 10y ago"“I would refer you to public documents on the Playpen investigation, in which we seized and operated a darkweb child pornography site for a period of less than two weeks,” That reads to me like yes, they were running the fully operational CP sites and allowing it to continue to serve up CP. The ends do not justify the means. ANd nobody has raised the question of how this can actually be done legally - under current law is there a way to make the serving up of CP content a sufficiently grey area that it's permissible to do with only judicial approval? If not, seems to me the individuals managing the site for the window of federal operations have the potential to be in a whole mess of trouble. If so, that seems a thing that should be fixed.
- centizen 10y agoOut of context this sounds much worse than it is - the FBI forcefully took control of a hosting network that included 23 child-porn service sites. They then used it as a platform to serve malware to the visitors of the sites. Within a month, they shut down the websites.
- ikeboy 10y agoIt seems like this was related to their seizure of Freedom Hosting, and that they only hosted them for 30 days or less, reading the linked affidavit. So they seized an onion hosting provider that had 23 cp sites, they ran those sites for a few weeks, then shut them down.
- MichaelBurge 10y agoI understand the ban on child porn is justified via the interstate commerce clause: Federal jurisdiction is implicated if the child pornography offense occurred in interstate or foreign commerce. This includes, for example, using the U.S. Mails or common carriers to transport child pornography across state or international borders. Additionally, federal jurisdiction almost always applies when the Internet is used to commit a child pornography violation. Even if the child pornography image itself did not traveled across state or international borders, federal law may be implicated if the materials, such as the computer used to download the image or the CD Rom used to store the image, originated or previously traveled in interstate or foreign commerce. https://www.justice.gov/criminal-ceos/citizens-guide-us-federal-law-child-pornography https://www.justice.gov/criminal-ceos/citizens-guide-us-fede... Theoretically, would a general citizen be exempt from the ban if he manufactured his own CD-ROMs, and his own CPUs in-state? It might be illegal for them to operate the sites for extended periods of time. It doesn't seem illegal for them to deploy malware as part of an investigation. I'm looking at (f) here: https://www.law.cornell.edu/uscode/text/18/1030 https://www.law.cornell.edu/uscode/text/18/1030 So the worst that could happen is that the evidence gets thrown out. If they weren't going to otherwise be able to nab the person, the worst that could happen is they lose the case.
- js_what_ 10y agoI would say the worst that could happen is the FBI is knowingly distributing child pornography, providing access to illegal materials and re-victimizing minors.
- deleted 10y ago[deleted]
- alexmingoia 10y agoGood idea, but that defense has already been rejected by the Supreme Court twice. Their reason? I kid you not... "the butterfly effect". The Supreme Court considers any activity that doesn't leave the state to possibly affect interstate commerce so they can regulate everything with that clause. See Wickard v. Filburn and most recently Gonzales v. Raich. Prepare to be enraged.
- aezell 10y agoThis is the same as cops offering to sell drugs or sex and then busting the buyers.
- deleted 10y ago[deleted]
- mikeash 10y agoExcept that when the cops run drug or prostitution stings, they don't actually provide drugs or sex, do they? I thought they offered without actually having the product, then nail the buyer based on their intent to buy. Actually providing the sting targets with illegal material seems a lot shadier.
- wavefunction 10y agoPandering, or "offering or promoting prostitution" is still a crime.
- Bartweiss 10y agoBut it's effectively a secondary crime, like selling drugs. If no one ever used heroin, we wouldn't criminalize it (as indeed we don't criminalize selling other random chemicals). The general pattern for drug and prostitution stings is that the police will commit those secondary crimes, but intervene before allowing the primary crime to happen. In this case, they pretty much committed the primary crime at length before acting.
- 75j 10y ago> If no one ever used heroin, we wouldn't criminalize it (as indeed we don't criminalize selling other random chemicals). In a way [0], the US does preemptively ban chemicals, regardless of whether that chemical has even been synthesized or used recreationally yet. [0] https://en.wikipedia.org/wiki/Federal_Analogue_Act https://en.wikipedia.org/wiki/Federal_Analogue_Act
- unethical_ban 10y agoMy example of an analogy would be like taking over a drug house and putting GPS in each shipment, but still allowing the drugs to get sold and consumed. I'm not sure whether this is OK or not.
- 75j 10y agoHere's mine... The FBI discovers a child prostitution ring and infiltrates it, but keeps running it and forces the children to have sex for a month to ensnare more customers. If one accepts the idea of re-victimization, then I'm not sure how what the FBI did here can be considered acceptable, or any different than the analogy above.
- tdb7893 10y agoI think the idea in this case is that there isn't re-victimization. The point of these sting operations is to lead to less victims overall.
- 75j 10y agoSorry, I should have been clearer. If you accept the idea that a child is re-victimized by the viewing of child pornography (which, as I understand it, is one of the justifications for the criminalization of viewing child pornography), then I don't see how what the FBI did can be considered acceptable.
- Blahah 10y agoI agree with your logic except the last clause. The FBI are presumably trying to minimise the overall perceived harm caused by the viewing of child pornography, and have judged that enabling some viewing initially will help prevent a greater amount of future viewing.
- deleted 10y ago[deleted]
- sschueller 10y agoIsn't the whole issue the exploitation of children? As in the FBI should be going after the creators and distributors not become a distributor.
- stephengillie 10y agoIt's the "War On Drugs" model, where they chase the end-users and end-distributors, but don't stop the problem at the source. Occasionally, they hit a big target and make a big show of it, but most of what they do is police the populace.
- awqrre 10y agoIf they would stop the problem at the source, they might be out of work... but anyways I think that it is not a good idea to become an outlaw to catch other outlaws...
- vilhelm_s 10y agoThis is about the Freedom Hosting hack in 2013. In 2013 Wired wrote > On August 4, all the sites hosted by Freedom Hosting — some with no connection to child porn — began serving an error message with hidden code embedded in the page. Security researchers dissected the code and found it exploited a security hole in Firefox to identify users of the Tor Browser Bundle [https://www.wired.com/2013/09/freedom-hosting-fbi/ https://www.wired.com/2013/09/freedom-hosting-fbi/] However, as far as we know, unlike the more recent Playpen thing, in the Freedom hosting case the FBI did not actually serve child pornography, they just displayed an error message. I don't see anything in this article that suggests otherwise.
- cloudjacker 10y agoWhonix.
- tombrossman 10y agoThat's correct, the FBI hosted error messages and exploits after taking over, and supposedly did not distribute images of abuse. This point is conspicuously absent from the Ars story. Motherboard passed on this story but it appears it was too sensationalist for Ars to resist. See thread here for more info: https://twitter.com/josephfcox/status/797070958205038592 https://twitter.com/josephfcox/status/797070958205038592
- uniclaude 10y ago> a Tor exploit of some kind to force the browser to return the user’s actual IP address, operating system, MAC address, and other data. As part of the operation that took down Playpen, the FBI was then able to identify and arrest the nearly 200 child porn suspects. So, is getting someone arrested as easy as spoofing their network information and visiting those sites? I can already imagine trolls using this to have people swatted.
- openasocket 10y agoIt would be really difficult to spoof the IP address and create valid TCP connections. Plus, your method would only work if you knew in advance that certain sites were currently being used in a sting operation. If you could figure that out, that kind of defeats the purpose of a sting operation.
- uniclaude 10y ago> Security researcher Sarah Jamie Lewis told Ars that “it’s a pretty reasonable assumption” that at one point the FBI was running roughly half of the known child porn sites hosted on Tor-hidden servers. We're talking about a very large sting operation, just browse a few of those, I guess?
- solotronics 10y agoit would be trivial to hack their wifi or insert a rogue device into their home network
- openasocket 10y agoAt that point, you might as well hack into their laptop, put a bunch of CP on there, and then call the cops. Forensic analysis of the hard drive would exonerate you though.
- uniclaude 10y agoAt this time you'd already be under arrest tough, and probably in a tiny cell for a while. That was my point, this is what trolls look for. Then, unlike with other trolling methods, I'm pretty sure you need quite the clever lawyer to get out of this.
- eeZah7Ux 10y ago50 comments and nobody pointed out that the honeypot sites would attack visitors regardless of their citizenship. Given that 95% of people in the world are not from US, how many visitors were police officers from other countries, conducting their own investigation?
- clarry 10y agoAnd how many people were not visiting these sites to obtain child porn? Quite recently, I ended up on an image board [whose name suggested to me it's got to do with topics such as freedom of speech] I hadn't heard of before, with sections whose short names meant nothing to me. So out of curiosity, I opened the first one. Well, that board is no more.
- Miner49er 10y agoIn that case it would certainly be entrapment wouldn't it? How do they intend to prove whether this was entrapment or not?
- draw_down 10y agoHmm, my concern is more that the US government actively peddled CP, rather than some non-American CP users getting owned.
- revelation 10y agoNot to mention that they would attack visitors regardless of the existence of any search warrant.
- Zuider 10y agoThis is less like a drug or prostitution sting where the mark is arrested before the contraband can be consumed, and more like a hired hitman sting where the victim is actually murdered. From a moral point of view, Child pornography is de-ontologically wrong. Nothing can justify its existence. Even if such a sting managed to shut down the entire industry, it would be moot to attempt to argue for its moral goodness in consequentialist terms. The FBI could have used other means to establish criminal intent in the visitors to the websites along with the fact that they had used Tor to search out and visit those websites in the first place. They could have made prospective viewers engage in a series of incriminating acts such as requiring them follow a series of links with the promise of finding the material, or making them refresh the page. There was no need to provide the actual offensive material in order to make a solid case.
- corecoder 10y ago> They could have made prospective viewers engage in a series of incriminating acts such as requiring them follow a series of links with the promise of finding the material, or making them refresh the page. I find this part very interesting: is this well established, that is, is it clear before the law which acts are surely incriminating? Is clicking on a link enough to establish intent?
- adventured 10y ago> Is clicking on a link enough to establish intent? Legally no it's not, that's a very weak binding and they know it. That's why any type of sting - whether cp or other - will attempt to get the user to sign-up, view content, or otherwise willfully provide personal information (eg a credit card).
- clifanatic 10y agoI seem to recall that it was enough to get those "catch a predator" TV show guys: the fact that they showed up at a specific location was enough to get them successfully prosecuted.
- 10y ago
- zaroth 10y agoI think the clear differential here is that compromising the server and tracking its users while it was in operation by Freedom Hosting would perhaps be "OK" but confiscating the server, moving it to HQ, and then operating the site themselves is decidedly not. Keep in mind, you can't just pause the site and expect your targets not to notice, they had to actively maintain the site (and consider what that means) to keep their targets coming back. It's disgusting and disturbing. And if it's what we know about it, it's also just the tip of the iceberg. At least with Fast & Furious I think it was real criminals running the guns and just a failure to intervene. I think a failure to intervene here would be seen as unacceptable as well. But here we have way more than failure to intervene, they effectively provided the guns and helped run them across the border.
- smaili 10y agoThat NIT, which many security experts have dubbed as malware, used a Tor exploit of some kind to force the browser to return the user’s actual IP address, operating system, MAC address, and other data. That's quite the exploit.
- klodolph 10y agoI feel like people are getting mad at the FBI for not pulling the trolley car lever in the right way, which is a valid thing to be mad about, but I believe the FBI made the right choice. First, let's not rely too heavily the analogies with drugs or prostitution. The differences between CP and drugs / prostitution are too large to ignore anyway. CP consumers are often producers as well. That's a fact—you want CP, so you make some yourself and swap it with others to get more. This isn't universal but it's common enough that you should know about it. So the visitors to the CP web site are not all just consumers of CP but many of them are producers as well. This is relevant because you have to weigh the damage of distributing CP against the benefit of catching people who produce CP. People have stated that distribution revictimizes the children, but I would weigh that against the ability to catch people who were either producing their own or at least supporting other producers of CP. So the FBI discovers this server, operates it for less than 30 days with a Tor exploit, and catches 200 people using the site. Yes, the FBI was complicit in the distribution of CP, but rephrased as a trolley car problem, this is basically like not pulling the lever, allowing the distribution to continue for a short time, and using that to catch 200 consumers—and how many of them are producers? You can pull the lever now and stop the distribution of CP, or you can let the trolley barrel down the tracks for a short time and save all these people somewhere else. (People are saying that the exploit may have done damage to other police investigations from other countries—I don't see any evidence that the exploit damaged the computer, merely that it leaked information about the computer.)
- deleted 10y ago[deleted]
- voxic11 10y agoI think maybe your argument about consumers also being producers made more sense in the pre internet age when distribution of the content was very hard. I would be rather surprised if they was still true today. After all I presume the FBI didn't create their own content...
- openasocket 10y agoLook at the affidavit: https://www.documentcloud.org/documents/3216737-Freedom-Hosting-NIT-Affidavit.html#document/p91/a327945 https://www.documentcloud.org/documents/3216737-Freedom-Host... I only skimmed, but at least 1 of the Websites required users to upload their own CP, to be approved by the admins, before they could download any.
- cloudjacker 10y agoForget the Firefox Tor browser, use Whonix Two Virtual Machines, the one you actually use for browsing and stuff only connects through the gateway virtual machine. If an exploit breaks out the firefox skin, it is just in the host VM, if it somehow breaks out of the host VM it is in the gateway VM. We could keep going down possibilities, but we are far removed from attack vectors that actually exist.
- dsfyu404ed 10y agoShit, if they keep going at this rate pretty soon they're gonna need to start worrying about ant-trust laws.
- omribahumi 10y agoI once experimented with a Tor router on a VM that isolated another VM's internet connectivity. The idea was |Stealth VM| --> |Tor router VM| --> |Virtual Box NAT| The Tor router VM was running redsocks[0] to route all TCP traffic through tor's socks proxy interface. The stealth VM also used tor's DNS service. That way, even if the stealth VM is compromised, it can't access the internet directly. [0] http://darkk.net.ru/redsocks/ http://darkk.net.ru/redsocks/
- omribahumi 10y agoWhy is this being downvoted? The topic might as well be tor user exposure with malware. I'm not trying to encourage CP consumption.
- zizzles 10y agoHow is this different than Whonix? https://en.wikipedia.org/wiki/Whonix https://en.wikipedia.org/wiki/Whonix
- omribahumi 10y agoFrom reading it, looks like it's the same concept. Thanks. Didn't know about it.
- lightedman 10y agoIOW the FBI is directly responsible for the spread and proliferation of child pornography. They've hurt more people than they've rescued. Time to charge the FBI with aiding and abetting. Period. Equal treatment under the law. Period.
- ethanbond 10y ago> They've hurt more people than they've rescued source?
- CurtMonash 10y agoI think there's a rather extreme hierarchy of wrongs here. 1. The crime that utterly dwarfs all others is involving children in the making of child porn. 2. After that, the crimes that dwarf all the rest are those that provide financial or practical support to child porn makers. Consuming child porn is generally regarded as one of those, and I'm fine with that categorization. 3. I'm sorry, but violating a victim's theoretical privacy by distributing the images a little further doesn't seem to be nearly as big a deal as helping to prevent the next live video of child porn from being made. I'm usually regarded as being pro-privacy, but privacy is not something to be a rabid extremist about. Preventing physical sexual abuse of children, on the other hand, is a fine area for extremism.
- YPCrumble 10y agoPeople who question what the FBI is doing are not "rabid extremist". That combines an ad-hominem and a straw man fallacy in the same line. You then claim that preventing child abuse is a fine area for extremism. That's an appeal to emotion and also a fallacy. Perhaps we could debate whether extremism is justified but let's do it without all the nonsense you wrap around your argument to cloud the real question. You say that extremism is justified but all of the reasons your posit as justification are fallacies.
- Bjartr 10y agoScrew chilling effects, I'm going to ask this anyway because being afraid of having these discussions is detrimental to making real progress as a society. Making the assumption* that some decent fraction of those who consume such media would be sated if they could get it and not move on to actually hurting children. Then couldn't a preventative measure be to take all the existing child porn and make it available to them? Though I guess that risks normalizing the condition and could lead to it being more commonplace (certainly it would appear so as those who successfully suppress it would hide it less) and if it's more commonplace than the fraction that does still act harmfully upon the impulse could, in absolute numbers, exceed those that do today. Figuring out how things fall would first require a good understanding of the numbers. *I don't know if this is true or false and would be interested to know if there is existing general consensus on the evolution of seeking out fantasy fulfillment over time in general and how it's affected by free access v. restricted access to related material.
- stewartjarod 10y agoI read this title and said 'What the fuck'
- chickenbane 10y agoI have no love for those who visit child porn on Tor, but in general I am now very wary of the FBI. I can't help but feel it's a powerful organization that's slowly turning into a dark oppressive one. The power grab from the CIA for the Petraeus affair. Using the sensitive nerve of terrorism to demand Apple unlock a phone. Throwing a last-minute wrench in the Clinton campaign. This is not going to end, especially under Trump.
- nameisu 10y agoGREAT MOVE