18 ms·

DOJ Subpoenas Twitter About Five Users Over a Smiley Emoji Tweet

260 points by keithrl 9y ago

jrjarrett 9y ago
I can't even anymore. If this story is anywhere near true -- and I have no reason to believe it is not -- then what the hell do we as citizens DO about it? How can we put an end to ridiculous infringements on rights and wasteful use of resources? It certainly starts with voting for representatives that won't allow thus, but damn. There aren't a lot of good choices out there. And even if there are, how do we fix the issues that allow the bad actors to get elected over a "good" rep?
- hood_syntax 9y ago
  > what the hell do we do More like what can we do, which is essentially nothing besides begging elected officials to do something about it (spoiler: they won't). Alternative is court cases, but those take a lot of time and money, and rulings won't necessarily have the reach you want even if they're in your favor.
  - clort 9y ago
    you are right, they won't do anything once they are elected.. Try making it clear to candidates that you would not support such behaviour in an elected official, and that if their interests are aligned with such causes you will not vote for them.
- ballenf 9y ago
  I'm as upset as you, but the abuses of federal law enforcement are nothing new. In fact they may have improved compared to the past, but it's impossible and pointless to compare too closely. The internet age changes the dynamics and visibility, so that is actually some comfort. In decades past, this exact same action to "protect their own" would have gone down without a blip on the national radar. It should be noted, however, the agency's power to use all the data they're wanting (phone IDs, in particular) to conduct ongoing intrusive surveillance at low cost is new and worrisome. It should also be noted that prosecutorial power works both ways: reading about the tactics used by Mueller against Trump, et al, is both encouraging and scary to me. It's nice when your friends are powerful, but scary when you realize their loyalty is fleeting.
- rayiner 9y ago
  The problem isn't the government, it's the "citizens." We're a society of cowards, who are afraid of everything and want the government to do something about it. E.g. crime rates are at historic lows, but more than half of Americans say that they worry a "great deal" about crime: http://news.gallup.com/poll/190475/americans-concern-crime-climbs-year-high.aspx http://news.gallup.com/poll/190475/americans-concern-crime-c.... It's not getting any better, it's probably getting worse. We're not that far away from people being arrested for the tweets they post: http://www.cnn.com/2017/03/17/us/twitter-journalist-strobe-epilepsy/index.html http://www.cnn.com/2017/03/17/us/twitter-journalist-strobe-e.... Millennials don't see anything wrong with that sort of thing: https://www.theatlantic.com/education/archive/2017/07/why-its-a-bad-idea-to-tell-students-words-are-violence/533970 https://www.theatlantic.com/education/archive/2017/07/why-it....
  - deleted 9y ago
    [deleted]
  - SilasX 9y ago
    >We're a society of cowards, who are afraid of everything and want the government to do something about it. E.g. crime rates are at historic lows, but more than half of Americans say that they worry a "great deal" about crime: That's not a contradiction. You can have a situation where people have to deploy numerous countermeasures[1] to head off crime, and where criminals pounce if any of these aren't active, but where the aggregate effect is to keep crime at bay. In that case, crime warrants being worried about, even if the rate is low. You might as well say it's irrational to "worry a great deal about crime" in Brazil "because you can just stay in your gated enclave, what's the problem?" [1] Locking your possessions, carrying little of value, traveling in groups, steering clear of strangers, living far out in suburbia where it's inconvenient for crime to reach, preventing buses (disproportionately used by the poor and criminal) from having stops near your home, etc.
    - icebraining 9y ago
      But is it true? Do people who don't deploy numerous countermeasures suffer significantly more crime?
- Dirlewanger 9y ago
  We're probably indefinitely fucked. The future is an abject morass straddled between 1984 and Brave New World. A violent uprising looks to be the only way. The problem is that it's against the mightiest military humanity has ever seen. Now watch me get subpoenaed for this...
- JumpCrisscross 9y ago
  > what the hell do we as citizens DO about it? Call your Congressperson [1], U.S. Senator [2] and state representatives. Tell them why you think this is ridiculous, in a calm and collected manner. Ask them, politely, for written follow-up. I do this about issues I care about. In my urban district of three-quarters of a million people, I'm almost always the only person calling about tech-related issues. Multiple times, the LA has asked me to email them supporting materials I reference. [1] https://www.house.gov/representatives/find/ https://www.house.gov/representatives/find/ Find your Congressperson [2] https://www.senate.gov/senators/contact/senators_cfm.cfm https://www.senate.gov/senators/contact/senators_cfm.cfm Find your U.S. Senator
Spivak 9y ago
So a security researcher who was angry about getting raided and hit with a CFAA accusation after an unauthorized access of private medical data started doxxing the FBI agent responsible on Twitter. And in response the FBI is requesting information about the Twitter users that were part of the conversation. Doesn't seem quite as sensational once you know the backstory. The author is right that the charges aren't the strongest but we can't be obtuse and pretend that posting the personal information of the officer and his family couldn't meet the bar for intimidation or harassment.
- slackingoff2017 9y ago
  "unauthorized access" is bs. It was a public ftp server and he notified the owners. It's like telling your neighbor his door is open.
  - gist 9y ago
    > It's like telling your neighbor his door is open. I think it's more like your neighbors door being open and you going in side and seeing that the refrigerator is open. Therefore proving that you trespassed on private property. Not legal. Of course in most cases you wouldn't be prosecuted for that I would imagine unless you tramped around the house. Article says: "he'd come across an FTP server operated by another dental software company, Patterson Dental, which makes "Eaglesoft," a dental practice management software product. Shafer had discovered an openly available anonymous FTP server with patient data" In order to determine it had patient data he would have to see the patient data not just connect to the server at the root level and then exit. So at the very least (in theory) he would have cd'd a few directories and perhaps downloaded a few files or noted the directory structure and names. That is entering and looking around.
    - DarronWyke 9y ago
      Occam's Razor would say he logged in, saw a patient_data directory or something similar, and logged out. We don't know anything really about how his perusal or lack thereof had him come to that conclusion. If it was running batch job processing that places like Epic and others do, it could have a recognizable directory structure that would give it a clear fingerprint.
coldcode 9y ago
One of the subpoenas was about PopeHat, who of course is public, and he wrote about it on his blog. Why demand twitter unmask a public account?
- simcop2387 9y ago
  Link to said popehat blog article, https://www.popehat.com/2017/10/24/in-which-my-identity-is-sought-by-federal-grand-jury-subpoena/ https://www.popehat.com/2017/10/24/in-which-my-identity-is-s... Speculated reasoning in the comments on the article was that it then gives an admissible account of who owns the twitter name. Otherwise the assertions about who owns it are inadmissable hearsay. That said it's still really weird that the accounts were subpeonaed EDIT: fixed link. Just noticed it went to an old article. Apparently the new one is up but not listed on the homepage? (Similar topics so I didn't notice right away)
  - heartbreak 9y ago
    Link to the actual post: https://www.popehat.com/2017/10/24/in-which-my-identity-is-sought-by-federal-grand-jury-subpoena/ https://www.popehat.com/2017/10/24/in-which-my-identity-is-s...
    - simcop2387 9y ago
      Thanks just fixed mine. Didn't realize that it was the wrong one since the topics were similar and i grabbed it off the homepage. That's one thing popehat has always suffered from, weird caching/publishing their rss feed was running a few weeks out of date for a while.
  - robocat 9y ago
    Another article on Justin Shafer’s background with the FBI: https://www.databreaches.net/is-a-vendetta-by-the-fbi-keeping-an-innocent-man-in-jail-or-has-doj-just-lost-its-mind-altogether/ https://www.databreaches.net/is-a-vendetta-by-the-fbi-keepin...
- floatingatoll 9y ago
SubiculumCode 9y ago
I used to tell my son that there will always be work for computer security specialists and that he should go for that. This makes me wonder about my advice.
- TerminalJunkie 9y ago
  I assume that if you're freelance you're at more risk of finding yourself on the receiving end of a CFAA violation. What I wonder is that if security researchers who work for domestic companies face the same degree of scrutiny that these freelance researchers do. I guess that if you work for a company you're probably not looking at anyone's website that's not explicitly paying you/your company and under some contract.
  - SubiculumCode 9y ago
    True.
  - jerf 9y ago
    While what you posted makes sense with the right definitions, I think you might understand better if you're careful with your definitions of "security specialist" (what SubiculumCode said), "security researcher" (what you said), and the other classifications. Not all specialists or researchers are doing penetration testing. Of those, not all of them are penetration testing third party stuff, and of those, not all of them are doing it without permission. That's the only one that will get you into trouble. I'm not, technically, a "security specialist" of any stripe, but I take a very careful interest in the defensive side of security, and am currently in the middle of implementing a fairly security-sensitive system. I don't worry that the FBI is going to bust down my door at 2am because I've tweaked the API of my code to make it harder to write cross-site scripting attacks, or because I fixed the architecture so that authentication is done very early in the request cycle instead of ad-hoc and inconsistently very late in the request cycle in a way that requires every developer of every individual web page to have to enforce all authentication. Most security work is going to involve internal matters and the fixing thereto, and, yeah, the job isn't going anywhere any time soon. (Though it does have the eternal challenge of convincing people they need to pay for it, and the problem that even in companies where programming is the major product like Facebook and Google, you're still going to be a cost center.)
znpy 9y ago
So... Tweeting now is a form of assaulting ?
- seangrant 9y ago
  Sending a tweet with intent to physically hurt someone, yes. Shouldn't it be?
- chowells 9y ago
  Legally, the crime of "assault" is threatening to harm someone. That can be done over Twitter.
- deleted 9y ago
  [deleted]
- bitwize 9y ago
  Yes. The victim had epilepsy, and the tweet was something like "You deserve a seizure!" accompanied by a rapidly flashing animated GIF.
  - znpy 9y ago
    Oh. Didn't think of that.
PatientTrades 9y ago
And this is why you should be very careful what you tweet. Once its out there it can never be deleted. Even with a fake name and handle. Your ip address, mac address, location, etc.
- loeg 9y ago
  Mac address? What is possibly recording that?
  - MichaelGG 9y ago
    Many WiFi networks record MAC addresses to help associate devices with IP/users.
duxup 9y ago
What amazes me is somewhere along the process someone with power didn't notice and think "Hey you know this all seems like a bit much considering what we're looking at here..."
- jmcqk6 9y ago
  Never underestimate the power given when people take the attitude that something they are looking at is "not my problem".
Floegipoky 9y ago
Why is Ted Stevens a fool for saying the Internet is a series of tubes, but so many otherwise level-headed are fine pretending networks are houses?
- d0lph 9y ago
  It's a metaphor.

260 points by keithrl 9y ago

I can't even anymore. If this story is anywhere near true -- and I have no reason to believe it is not -- then what the hell do we as citizens DO about it? How can we put an end to ridiculous infringements on rights and wasteful use of resources? It certainly starts with voting for representatives that won't allow thus, but damn. There aren't a lot of good choices out there. And even if there are, how do we fix the issues that allow the bad actors to get elected over a "good" rep?

hood_syntax 9y ago
> what the hell do we do More like what can we do, which is essentially nothing besides begging elected officials to do something about it (spoiler: they won't). Alternative is court cases, but those take a lot of time and money, and rulings won't necessarily have the reach you want even if they're in your favor.
- clort 9y ago
  you are right, they won't do anything once they are elected.. Try making it clear to candidates that you would not support such behaviour in an elected official, and that if their interests are aligned with such causes you will not vote for them.
ballenf 9y ago
I'm as upset as you, but the abuses of federal law enforcement are nothing new. In fact they may have improved compared to the past, but it's impossible and pointless to compare too closely. The internet age changes the dynamics and visibility, so that is actually some comfort. In decades past, this exact same action to "protect their own" would have gone down without a blip on the national radar. It should be noted, however, the agency's power to use all the data they're wanting (phone IDs, in particular) to conduct ongoing intrusive surveillance at low cost is new and worrisome. It should also be noted that prosecutorial power works both ways: reading about the tactics used by Mueller against Trump, et al, is both encouraging and scary to me. It's nice when your friends are powerful, but scary when you realize their loyalty is fleeting.
rayiner 9y ago
The problem isn't the government, it's the "citizens." We're a society of cowards, who are afraid of everything and want the government to do something about it. E.g. crime rates are at historic lows, but more than half of Americans say that they worry a "great deal" about crime: http://news.gallup.com/poll/190475/americans-concern-crime-climbs-year-high.aspx http://news.gallup.com/poll/190475/americans-concern-crime-c.... It's not getting any better, it's probably getting worse. We're not that far away from people being arrested for the tweets they post: http://www.cnn.com/2017/03/17/us/twitter-journalist-strobe-epilepsy/index.html http://www.cnn.com/2017/03/17/us/twitter-journalist-strobe-e.... Millennials don't see anything wrong with that sort of thing: https://www.theatlantic.com/education/archive/2017/07/why-its-a-bad-idea-to-tell-students-words-are-violence/533970 https://www.theatlantic.com/education/archive/2017/07/why-it....
- deleted 9y ago
  [deleted]
- SilasX 9y ago
  >We're a society of cowards, who are afraid of everything and want the government to do something about it. E.g. crime rates are at historic lows, but more than half of Americans say that they worry a "great deal" about crime: That's not a contradiction. You can have a situation where people have to deploy numerous countermeasures[1] to head off crime, and where criminals pounce if any of these aren't active, but where the aggregate effect is to keep crime at bay. In that case, crime warrants being worried about, even if the rate is low. You might as well say it's irrational to "worry a great deal about crime" in Brazil "because you can just stay in your gated enclave, what's the problem?" [1] Locking your possessions, carrying little of value, traveling in groups, steering clear of strangers, living far out in suburbia where it's inconvenient for crime to reach, preventing buses (disproportionately used by the poor and criminal) from having stops near your home, etc.
  - icebraining 9y ago
    But is it true? Do people who don't deploy numerous countermeasures suffer significantly more crime?
Dirlewanger 9y ago
We're probably indefinitely fucked. The future is an abject morass straddled between 1984 and Brave New World. A violent uprising looks to be the only way. The problem is that it's against the mightiest military humanity has ever seen. Now watch me get subpoenaed for this...
JumpCrisscross 9y ago
> what the hell do we as citizens DO about it? Call your Congressperson [1], U.S. Senator [2] and state representatives. Tell them why you think this is ridiculous, in a calm and collected manner. Ask them, politely, for written follow-up. I do this about issues I care about. In my urban district of three-quarters of a million people, I'm almost always the only person calling about tech-related issues. Multiple times, the LA has asked me to email them supporting materials I reference. [1] https://www.house.gov/representatives/find/ https://www.house.gov/representatives/find/ Find your Congressperson [2] https://www.senate.gov/senators/contact/senators_cfm.cfm https://www.senate.gov/senators/contact/senators_cfm.cfm Find your U.S. Senator

Spivak 9y ago

So a security researcher who was angry about getting raided and hit with a CFAA accusation after an unauthorized access of private medical data started doxxing the FBI agent responsible on Twitter. And in response the FBI is requesting information about the Twitter users that were part of the conversation. Doesn't seem quite as sensational once you know the backstory. The author is right that the charges aren't the strongest but we can't be obtuse and pretend that posting the personal information of the officer and his family couldn't meet the bar for intimidation or harassment.

slackingoff2017 9y ago
"unauthorized access" is bs. It was a public ftp server and he notified the owners. It's like telling your neighbor his door is open.
- gist 9y ago
  > It's like telling your neighbor his door is open. I think it's more like your neighbors door being open and you going in side and seeing that the refrigerator is open. Therefore proving that you trespassed on private property. Not legal. Of course in most cases you wouldn't be prosecuted for that I would imagine unless you tramped around the house. Article says: "he'd come across an FTP server operated by another dental software company, Patterson Dental, which makes "Eaglesoft," a dental practice management software product. Shafer had discovered an openly available anonymous FTP server with patient data" In order to determine it had patient data he would have to see the patient data not just connect to the server at the root level and then exit. So at the very least (in theory) he would have cd'd a few directories and perhaps downloaded a few files or noted the directory structure and names. That is entering and looking around.
  - DarronWyke 9y ago
    Occam's Razor would say he logged in, saw a patient_data directory or something similar, and logged out. We don't know anything really about how his perusal or lack thereof had him come to that conclusion. If it was running batch job processing that places like Epic and others do, it could have a recognizable directory structure that would give it a clear fingerprint.

coldcode 9y ago

One of the subpoenas was about PopeHat, who of course is public, and he wrote about it on his blog. Why demand twitter unmask a public account?

simcop2387 9y ago
Link to said popehat blog article, https://www.popehat.com/2017/10/24/in-which-my-identity-is-sought-by-federal-grand-jury-subpoena/ https://www.popehat.com/2017/10/24/in-which-my-identity-is-s... Speculated reasoning in the comments on the article was that it then gives an admissible account of who owns the twitter name. Otherwise the assertions about who owns it are inadmissable hearsay. That said it's still really weird that the accounts were subpeonaed EDIT: fixed link. Just noticed it went to an old article. Apparently the new one is up but not listed on the homepage? (Similar topics so I didn't notice right away)
- heartbreak 9y ago
  Link to the actual post: https://www.popehat.com/2017/10/24/in-which-my-identity-is-sought-by-federal-grand-jury-subpoena/ https://www.popehat.com/2017/10/24/in-which-my-identity-is-s...
  - simcop2387 9y ago
    Thanks just fixed mine. Didn't realize that it was the wrong one since the topics were similar and i grabbed it off the homepage. That's one thing popehat has always suffered from, weird caching/publishing their rss feed was running a few weeks out of date for a while.
- robocat 9y ago
  Another article on Justin Shafer’s background with the FBI: https://www.databreaches.net/is-a-vendetta-by-the-fbi-keeping-an-innocent-man-in-jail-or-has-doj-just-lost-its-mind-altogether/ https://www.databreaches.net/is-a-vendetta-by-the-fbi-keepin...
floatingatoll 9y ago

SubiculumCode 9y ago

I used to tell my son that there will always be work for computer security specialists and that he should go for that. This makes me wonder about my advice.

TerminalJunkie 9y ago
I assume that if you're freelance you're at more risk of finding yourself on the receiving end of a CFAA violation. What I wonder is that if security researchers who work for domestic companies face the same degree of scrutiny that these freelance researchers do. I guess that if you work for a company you're probably not looking at anyone's website that's not explicitly paying you/your company and under some contract.
- SubiculumCode 9y ago
  True.
- jerf 9y ago
  While what you posted makes sense with the right definitions, I think you might understand better if you're careful with your definitions of "security specialist" (what SubiculumCode said), "security researcher" (what you said), and the other classifications. Not all specialists or researchers are doing penetration testing. Of those, not all of them are penetration testing third party stuff, and of those, not all of them are doing it without permission. That's the only one that will get you into trouble. I'm not, technically, a "security specialist" of any stripe, but I take a very careful interest in the defensive side of security, and am currently in the middle of implementing a fairly security-sensitive system. I don't worry that the FBI is going to bust down my door at 2am because I've tweaked the API of my code to make it harder to write cross-site scripting attacks, or because I fixed the architecture so that authentication is done very early in the request cycle instead of ad-hoc and inconsistently very late in the request cycle in a way that requires every developer of every individual web page to have to enforce all authentication. Most security work is going to involve internal matters and the fixing thereto, and, yeah, the job isn't going anywhere any time soon. (Though it does have the eternal challenge of convincing people they need to pay for it, and the problem that even in companies where programming is the major product like Facebook and Google, you're still going to be a cost center.)

znpy 9y ago

So... Tweeting now is a form of assaulting ?

seangrant 9y ago
Sending a tweet with intent to physically hurt someone, yes. Shouldn't it be?
chowells 9y ago
Legally, the crime of "assault" is threatening to harm someone. That can be done over Twitter.
deleted 9y ago
[deleted]
bitwize 9y ago
Yes. The victim had epilepsy, and the tweet was something like "You deserve a seizure!" accompanied by a rapidly flashing animated GIF.
- znpy 9y ago
  Oh. Didn't think of that.

PatientTrades 9y ago

And this is why you should be very careful what you tweet. Once its out there it can never be deleted. Even with a fake name and handle. Your ip address, mac address, location, etc.

loeg 9y ago
Mac address? What is possibly recording that?
- MichaelGG 9y ago
  Many WiFi networks record MAC addresses to help associate devices with IP/users.

duxup 9y ago

What amazes me is somewhere along the process someone with power didn't notice and think "Hey you know this all seems like a bit much considering what we're looking at here..."

jmcqk6 9y ago
Never underestimate the power given when people take the attitude that something they are looking at is "not my problem".

Floegipoky 9y ago

Why is Ted Stevens a fool for saying the Internet is a series of tubes, but so many otherwise level-headed are fine pretending networks are houses?

d0lph 9y ago
It's a metaphor.