8 ms·

It makes one wonder why anyone who has cyber dirt on their hands would step foot on US ground, after the Snowden/NSA revelations which made it clear to everybod

It makes one wonder why anyone who has cyber dirt on their hands would step foot on US ground, after the Snowden/NSA revelations which made it clear to everybody on this planet that the NSA is literally everywhere.

tptacek 9y ago
Because, really, who among us hasn't built and sold software used to harvest Amazon logins, bank account logins, and credit card numbers from botnets?
- jacquesm 9y ago
  Or crawled a webpage outside of the TOS, shared files through torrents, alerted some website that they had a security hole, ran a business legal abroad but illegal in the United States that had US customers, ran afoul of any one of the US laws without knowing about it and in places not normally under US jurisdiction and so on.
  - tptacek 9y ago
    That is a non-sequitur response, as this person has not been arrested for violating terms of service, sharing files through torrents, alerting people to security flaws, selling Canadian pharmaceuticals, or trafficking in undersized lobsters. They were arrested for building and selling software used to harvest Amazon logins, bank account logins, and credit card numbers from botnets. Your logic could just as easily be used to dismiss an indictment of any crime, from undersized lobsters to murdering someone with an undersized lobster.
    - ChuckMcM 9y ago
      As I read it, you Thomas were pointing out that the indictment contains a number of overt and recognizably 'bad' acts, and Jacques was pointing out that there are a number of actions that are arguably 'non bad' that could also get you in trouble. What I took away from this is that Marcus probably shouldn't have come to the US if there really were trails on a computer system tying him to malware. And that Jacques believes it will eventually be a bad idea to come to the US if you have done anything the US disapproves of, even if such things are both acceptable and legal where you did them and when. Me, I'm just trying to move my deck chair so that I can get a good look at the icebergs floating nearby away from all the screaming and panicing.
    - nowo 9y ago
      While it's a different situation, it's still not a good one. The lack of rights for foreigners, the NSAs reach, the willingness to prosecute citizens of other countries, long detentions and harsh penalties for computer crimes etc. puts people in a situation where the US government can make things very uncomfortable for them. I do think some risks with e.g. mass surveillance have been exaggerated, like being pursued on a basis of keywords. But if the US government actually has evidence against you of things they consider illegal, your legal protection against abuse will have weakened. So while it's unlikely that the FBI has a list of dissidents that they've correlated with collected evidence and are just waiting for people to cross the border, it's still not a situation people should have to, or have to, accept.
      - empath75 9y ago
        Foreigners who are legally in the us are afforded the exact same due process rights as Americans.
        DaiPlusPlus 9y ago
        This is not true at all. There is no Due Process when you're under the purview of USCIS/INS, CBP and ICE. This why visa holders in good standing can get turned-away at the border or destination airport and sent back immediately, even if they have done nothing wrong or violated the terms of their visa - just on the suspicion or hunch of the immigration officer - and they can extend their reach even after you pass through immigration. There's a reason they're called "constitution-free zones": https://www.aclu.org/know-your-rights-governments-100-mile-border-zone-map https://www.aclu.org/know-your-rights-governments-100-mile-b...
        jacquesm 9y ago
        Even Americans aren't safe: http://www.npr.org/2017/08/01/540903038/u-s-citizen-held-by-immigration-for-3-years-denied-compensation-by-appeals-court http://www.npr.org/2017/08/01/540903038/u-s-citizen-held-by-...
        19guid 9y ago
    - am1988 9y ago
      Except those things have happened to other people and thus anyone who has done those things (that aren't necessarily immoral or even illegal in other places) should avoid the US.
    - khazhoux 9y ago
      > to murdering someone with an undersized lobster Too far, man.
- deleted 9y ago
  [deleted]
- homakov 9y ago
  Exactly! Even I worked on some ZeuS scripts back when i was freelancing. Not sure if qualifies for weapon. It may kill a JS programmer if they look at it though. Upd. Oh it was sarcasm. Joking, black hats are pain to deal with on payment side before bitcoin, so I havent got anywhere with that task.
  - tptacek 9y ago
    Wait, why would you take that work?
    - homakov 9y ago
      Initially it was explained "create some inputs and ask for some numbers from the user" but later I realized what it is for: it's kind of a script that is injected in a banking page to leak credentials. Then I decided to not proceed with this shady task.
- kbart 9y ago
  "Because, really, who among us hasn't built and sold software used to harvest Amazon logins, bank account logins, and credit card numbers from botnets?" You don't need that. Adding up all the torrents I have downloaded during my life would probably amount to gazillions of dollars (according to DCMA, of course) and land me in jail for several life times. Just a hyperbole of course, but it highlights the fact that I would be scared to enter USA, because who knows, I might have offended some local laws sometime in the past I wasn't even aware of.
- lawnchair_larry 9y ago
  Didn't you guys write an OS X rootkit back in the day? Although I can see the line between that and this, I find it worringly thin. Throw in a leaked IRC log joking about using it for criminal purposes and an overzealous prosecutor, and you'd probably be done. Not to mention, it's idiotic to spend resources on prosecuting this guy. His life is effectively over, as he can now only ever use his skills for illegitimate work. Nobody will hire him. Since he was no longer an active accessory to crime and had already spent several years focused on legitimate work, society was far better off allowing him to continue on that path. He probably even more than made up for it by enabling hospitals to treat patients with the wannacry thing. Instead, we have thrown all that away so some prosecutor can put a notch on his belt and brag about taking down something insignificant because he couldn't get anybody that really mattered. Who, by the way, has a long line of other sellers and is still looting bank accounts.
  - tptacek 9y ago
    This logic makes sense if you suck the concept of "intent" out of criminal law. Otherwise, not so much. But also, please don't corner me into defending the prosecution here. I get that it's easy to do that; just make absurd statements about how law enforcement works, as other people in this thread have done, and I'll probably take the bait. But really, I have no idea who any of these people are. I don't work in the part of this field that gives a shit about "the Kronos banking malware", I didn't follow "MalwareTechBlog" on Twitter, I'm faintly allergic to the concept of any twitter account with "Malware" in the name, and more than anything else I think that anyone who would write PHP code to help plant HTML trojans across a botnet needs to set the bar a little higher for themselves. I do not have a strong opinion about whether this person should be prosecuted.
krapp 9y ago
If the NSA is literally everywhere, it shouldn't matter where you step foot, should it?
- _jal 9y ago
  If the NSA were law enforcement, that might be a reasonable conclusion. NSA shares a lot more than many people think they should[1], but it isn't like German or Australian local police, or (usually), even local US cops have access. To have reason to seriously consider them in your threat model[2], need to do something that encroaches on the interests of particular power centers. Aside from what most people think of as actual national security-type things, drugs are a good way, as is, apparently, majorly pissing off the copyright cartel. All that said, I do suspect that we will hear more about surveillance from the various spook agencies (not just the NSA) being laundered to more mundane criminal cases over time. We know this happens with the DEA and FBI; we know the DEA feeds local law enforcement carefully laundered intelligence; I'm really curious about DHS, ICE and major-metro police agencies like the NYPD's relationships, possibly through what amount to cutouts. [1] Interestingly, different people hold irreconcilable motivations for thinking that. [2] Assuming away movie-plots, etc.
  - maze-le 9y ago
    >> To have reason to seriously consider them in your threat model, need to do something that encroaches on the interests of particular power centers. Like building wind turbines? [0]: https://fas.org/irp/program/process/rapport_echelon_en.pdf https://fas.org/irp/program/process/rapport_echelon_en.pdf
- deleted 9y ago
  [deleted]

tptacek 9y ago

Because, really, who among us hasn't built and sold software used to harvest Amazon logins, bank account logins, and credit card numbers from botnets?

jacquesm 9y ago
Or crawled a webpage outside of the TOS, shared files through torrents, alerted some website that they had a security hole, ran a business legal abroad but illegal in the United States that had US customers, ran afoul of any one of the US laws without knowing about it and in places not normally under US jurisdiction and so on.
- tptacek 9y ago
  That is a non-sequitur response, as this person has not been arrested for violating terms of service, sharing files through torrents, alerting people to security flaws, selling Canadian pharmaceuticals, or trafficking in undersized lobsters. They were arrested for building and selling software used to harvest Amazon logins, bank account logins, and credit card numbers from botnets. Your logic could just as easily be used to dismiss an indictment of any crime, from undersized lobsters to murdering someone with an undersized lobster.
  - ChuckMcM 9y ago
    As I read it, you Thomas were pointing out that the indictment contains a number of overt and recognizably 'bad' acts, and Jacques was pointing out that there are a number of actions that are arguably 'non bad' that could also get you in trouble. What I took away from this is that Marcus probably shouldn't have come to the US if there really were trails on a computer system tying him to malware. And that Jacques believes it will eventually be a bad idea to come to the US if you have done anything the US disapproves of, even if such things are both acceptable and legal where you did them and when. Me, I'm just trying to move my deck chair so that I can get a good look at the icebergs floating nearby away from all the screaming and panicing.
  - nowo 9y ago
    While it's a different situation, it's still not a good one. The lack of rights for foreigners, the NSAs reach, the willingness to prosecute citizens of other countries, long detentions and harsh penalties for computer crimes etc. puts people in a situation where the US government can make things very uncomfortable for them. I do think some risks with e.g. mass surveillance have been exaggerated, like being pursued on a basis of keywords. But if the US government actually has evidence against you of things they consider illegal, your legal protection against abuse will have weakened. So while it's unlikely that the FBI has a list of dissidents that they've correlated with collected evidence and are just waiting for people to cross the border, it's still not a situation people should have to, or have to, accept.
    - empath75 9y ago
      Foreigners who are legally in the us are afforded the exact same due process rights as Americans.
      - DaiPlusPlus 9y ago
        This is not true at all. There is no Due Process when you're under the purview of USCIS/INS, CBP and ICE. This why visa holders in good standing can get turned-away at the border or destination airport and sent back immediately, even if they have done nothing wrong or violated the terms of their visa - just on the suspicion or hunch of the immigration officer - and they can extend their reach even after you pass through immigration. There's a reason they're called "constitution-free zones": https://www.aclu.org/know-your-rights-governments-100-mile-border-zone-map https://www.aclu.org/know-your-rights-governments-100-mile-b...
        jacquesm 9y ago
        Even Americans aren't safe: http://www.npr.org/2017/08/01/540903038/u-s-citizen-held-by-immigration-for-3-years-denied-compensation-by-appeals-court http://www.npr.org/2017/08/01/540903038/u-s-citizen-held-by-...
        19guid 9y ago
  - am1988 9y ago
    Except those things have happened to other people and thus anyone who has done those things (that aren't necessarily immoral or even illegal in other places) should avoid the US.
  - khazhoux 9y ago
    > to murdering someone with an undersized lobster Too far, man.
deleted 9y ago
[deleted]
homakov 9y ago
Exactly! Even I worked on some ZeuS scripts back when i was freelancing. Not sure if qualifies for weapon. It may kill a JS programmer if they look at it though. Upd. Oh it was sarcasm. Joking, black hats are pain to deal with on payment side before bitcoin, so I havent got anywhere with that task.
- tptacek 9y ago
  Wait, why would you take that work?
  - homakov 9y ago
    Initially it was explained "create some inputs and ask for some numbers from the user" but later I realized what it is for: it's kind of a script that is injected in a banking page to leak credentials. Then I decided to not proceed with this shady task.
kbart 9y ago
"Because, really, who among us hasn't built and sold software used to harvest Amazon logins, bank account logins, and credit card numbers from botnets?" You don't need that. Adding up all the torrents I have downloaded during my life would probably amount to gazillions of dollars (according to DCMA, of course) and land me in jail for several life times. Just a hyperbole of course, but it highlights the fact that I would be scared to enter USA, because who knows, I might have offended some local laws sometime in the past I wasn't even aware of.
lawnchair_larry 9y ago
Didn't you guys write an OS X rootkit back in the day? Although I can see the line between that and this, I find it worringly thin. Throw in a leaked IRC log joking about using it for criminal purposes and an overzealous prosecutor, and you'd probably be done. Not to mention, it's idiotic to spend resources on prosecuting this guy. His life is effectively over, as he can now only ever use his skills for illegitimate work. Nobody will hire him. Since he was no longer an active accessory to crime and had already spent several years focused on legitimate work, society was far better off allowing him to continue on that path. He probably even more than made up for it by enabling hospitals to treat patients with the wannacry thing. Instead, we have thrown all that away so some prosecutor can put a notch on his belt and brag about taking down something insignificant because he couldn't get anybody that really mattered. Who, by the way, has a long line of other sellers and is still looting bank accounts.
- tptacek 9y ago
  This logic makes sense if you suck the concept of "intent" out of criminal law. Otherwise, not so much. But also, please don't corner me into defending the prosecution here. I get that it's easy to do that; just make absurd statements about how law enforcement works, as other people in this thread have done, and I'll probably take the bait. But really, I have no idea who any of these people are. I don't work in the part of this field that gives a shit about "the Kronos banking malware", I didn't follow "MalwareTechBlog" on Twitter, I'm faintly allergic to the concept of any twitter account with "Malware" in the name, and more than anything else I think that anyone who would write PHP code to help plant HTML trojans across a botnet needs to set the bar a little higher for themselves. I do not have a strong opinion about whether this person should be prosecuted.

krapp 9y ago

If the NSA is literally everywhere, it shouldn't matter where you step foot, should it?

_jal 9y ago
If the NSA were law enforcement, that might be a reasonable conclusion. NSA shares a lot more than many people think they should[1], but it isn't like German or Australian local police, or (usually), even local US cops have access. To have reason to seriously consider them in your threat model[2], need to do something that encroaches on the interests of particular power centers. Aside from what most people think of as actual national security-type things, drugs are a good way, as is, apparently, majorly pissing off the copyright cartel. All that said, I do suspect that we will hear more about surveillance from the various spook agencies (not just the NSA) being laundered to more mundane criminal cases over time. We know this happens with the DEA and FBI; we know the DEA feeds local law enforcement carefully laundered intelligence; I'm really curious about DHS, ICE and major-metro police agencies like the NYPD's relationships, possibly through what amount to cutouts. [1] Interestingly, different people hold irreconcilable motivations for thinking that. [2] Assuming away movie-plots, etc.
- maze-le 9y ago
  >> To have reason to seriously consider them in your threat model, need to do something that encroaches on the interests of particular power centers. Like building wind turbines? [0]: https://fas.org/irp/program/process/rapport_echelon_en.pdf https://fas.org/irp/program/process/rapport_echelon_en.pdf
deleted 9y ago
[deleted]