20 ms·

FBI's Use of Paid Best Buy Informants Goes Deeper Than We Knew

204 points by dsl 9y ago

beezle 9y ago
Only a matter of time before we read about the FBI paid tech putting files on the device in order to get his bounty.
- ShorsHammer 9y ago
  You'd hope in high profile cases (or really all cases), a hash of the entire drive could be taken upon seizure and given to a lawyer before any forensics started. Don't know much about forensics and maybe this already happens, but is surely a good way for both sides to avoid unfounded accusations.
  - psyc 9y ago
    The evidence would have been planted by the civilian tech before seizure.
  - triggercut 9y ago
    IIRC in law enforcement situations where a HDD has been obtained through slightly more conventional means, chain of custody is as important (as it is for all evidence) as ensuring the state is maintained. There are many forensic hardware providers that specifically sell 'read only' readers to ensure that whilst in possession of the drive, it's state is preserved (as much as practicably possible).
naringas 9y ago
>“discover material that may be child pornography and we have a legal and moral obligation to turn that material over to law enforcement.” is this true? is there a legal obligation?
- bunderbunder 9y ago
  In the USA, it's state-by-state. Some only require it of certain professionals (e.g., doctors), and others require it of everyone.
  - hnaccy 9y ago
    What state(s) requires it of everyone?
- deleted 9y ago
  [deleted]
- snomad 9y ago
  Shortly after it quotes him as saying >We have a moral and, in more than 20 states, a legal obligation to report these findings to law enforcement,” With that specific number, I am guessing it is indeed a requirement. I really wish we could get some clear 4th amendment boundaries for the digital age. On the surface, I am ok with this. But paying the Geek Squad techs seems to undermine the whole point of the thing. I don't particularly find a FBI-company party in 2008 relevant to this story. Just hopeful dot-connecting.
  - lowpro 9y ago
    I believe they're showing that Best Buy has intent to work with the FBI beyond what they say, and therefore can't be trusted regarding their public statement. It isn't enough to draw any conclusions, of course, but should cast doubt that they're being honest in their public statement. The average person probably already assumes they aren't being honest, but a journalist needs a reason to have such a doubt.
  - hermitdev 9y ago
    > With that specific number, I am guessing it is indeed a requirement. I'm guessing here, because the language is ambiguous and the relevant states & laws are not mentioned, that the legal obligation exists if you should find suspected child pornography you must report it to the relevant legal authority. I highly doubt the law states something along the lines of if you're a computer repair technician you are legally obligated to run these forensic tools to local clandestine or non-hidden photos that may be child pornography. The former I could see an argument being made that failing to report could make you criminally complicit or even an accessory to the crime. The latter, I see as possible 1st or 4th amendment violations to the US Constitution (1st amendment violation in that it's possibly compelling speech, and for the 4th, the DOJ compelling a warrant-less search. By virtue of offering the bounty in this manner, it could be argued Best Buy is effectively acting as a page contractor of the DOJ). Obligatory, I am not a lawyer. I'm merely speculating on possible legal arguments. Morally, I'm torn on this. On one hand, I find child pornography morally reprehensible, yet on the other hand, I want these scum bags thrown in a dark, dank prison. In the end, I think, however, that this should constitute a 4th amendment violation. If this is to stand, what's the rate to be for the government to get anything they want to know about me? $100? $.01? gratis? any IRS inquiries to disappear? I think we need to revisit the 4th amendment to give explicit protection to data held by an external party. "Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety." - Benjamin Franklin
TheSpiceIsLife 9y ago
> The image found on Rettenmaier’s hard drive was in an unallocated space, which typically requires forensic software to find So say someone, known or unknown, emails you a bunch of unlawful zeros and ones, you open it or it displays automagically. Or you accidentally type a web address wrong and go to unlawful pictures dot com. Anyway, you delete the file(s) and / or clear your browser cache. Your file system deletes the entry in the allocation table (or however it works) but the drive still has the relevant magnetic / electrical charges to recover the file using a data recovery tool. Are you still in possession of the unlawful zeros and ones if you've deleted the files in the only manner you are aware of - assuming the average person doesn't understand the underlying technology???
- meowface 9y ago
  The data merely being present on your hard drive isn't enough for law enforcement to make a strong case. They'd also need to prove how it got there, and why.
  - TheSpiceIsLife 9y ago
    That is also my understanding. So in the case where, as suggested in another comment, where a computer tech, or anyone with access to you device, plants the material in order to collect the bounty, while probably annoying and stressful, should auto-resolve during the investigation / discovery. Still a bit of a worry. Edit: fixed a thing
    - gowld 9y ago
      Yes, it will auto-resolve, after you spouse divorces you and obtains custody of your children, and your employer fires you.
  - manfredo 9y ago
    An interesting Defcon talk on the subject: https://youtu.be/NG9Cg_vBKOg https://youtu.be/NG9Cg_vBKOg The last case is most relevant to this topic. All the other ones are about people trying to steal company info.
will_brown 9y ago
From a legal perspective, this is a common game of cat and mouse law enforcement regularly uses to circumvent the 4th amendment prohibition on unreasonable search and seizures without a warrant. In other words if law enforcement illegally obtains evidence, that evidence can be suppressed and all evidence as a result (fruit of the poisonous tree doctrine). But the 4th amendment only applies to the government, so a non government actor can otherwise illegally obtain evidence (break in to your home and steal said evidence and turn it over to law enforcement) and you would not be able to suppress the evidence because the government didn’t violate your 4th amendment rights, another private citizen did. In this case you get entities arguing geek squad is the government/acting on behalf the government, presumably because they took some small payments, on the other hand you have the governments arguement that geek squad is not acting on behalf of the government and in fact the criminals signed a contract allowing geek squad to search and seize evidence of a crime from the computers. It’s a well settled area of law, but it’s controversial.
- akira2501 9y ago
  > so a non government actor can otherwise illegally obtain evidence A critical point is the police can't directly or indirectly _solicit_ this behavior. That would be a criminal act in and of itself, but it would maintain your 4th amendment rights.
- JumpCrisscross 9y ago
  > you would not be able to suppress the evidence because the government didn’t violate your 4th amendment rights, another private citizen did Could you bring a civil suit against the informant? Has anyone?
  - gamblor956 9y ago
    Yes, you could bring an invasion of privacy suit against them. I'm not aware of anyone having done so since usually informant doesn't have the resources to justify that sort of lawsuit. And in the case of Best Buy, they're not acting illegally in the situations described in the article.
sbierwagen 9y ago
Fun fact: oil change places sell your odometer reading to your car insurer, who may increase your rates if you drove more miles than you said you would: https://splinternews.com/how-car-insurance-companies-spy-on-your-mileage-1793860442 https://splinternews.com/how-car-insurance-companies-spy-on-...
- miketery 9y ago
  How is this legal for the oil shop to do?
  - rdmsr 9y ago
    It’s probably implied by something deep in the TOS.
    - TangoTrotFox 9y ago
      It doesn't need to be in the ToS. In the US your information has no legal protection, with a handful of exceptions like medical information. You should assume any information you give to any company is being shared, sold, and utilized to the fullest extent to monetize you. Even if you believe Zuckerberg has changed, it does put a quite apropo spin on those IMs from when he first started Facebook [1]: Zuckerberg: Yeah so if you ever need info about anyone at Harvard Zuckerberg: Just ask. Zuckerberg: I have over 4,000 emails, pictures, addresses, SNS [Redacted Friend's Name]: What? How'd you manage that one? Zuckerberg: People just submitted it. Zuckerberg: I don't know why. Zuckerberg: They "trust me" Zuckerberg: Dumb fucks. And now people give away vastly more than the data he had back then. [1] - http://www.businessinsider.com/well-these-new-zuckerberg-ims-wont-help-facebooks-privacy-problems-2010-5 http://www.businessinsider.com/well-these-new-zuckerberg-ims...
    - TangoTrotFox 9y ago
      It doesn't need to be in the ToS. In the US your information has no legal protection, with a handful of exceptions like medical information. You should assume any information you give to any company is being shared, sold, and utilized to the fullest extent to monetize you. Something many do not consider especially in today's era of social media and AI capable of scraping any tidbit of information you reveal about yourself. As an example, this [1] is an extremely primitive tool that generates a profile of Reddit users based on nothing but what they've publicly submitted. The profiles the companies people 'trust' with their information today are going to be orders of magnitude more detailed, and accurate. [1] - https://snoopsnoo.com/ https://snoopsnoo.com/
arca_vorago 9y ago
Violation of the 3rd amendment if trojan/rat installed. Chilling effect potentially violation of 1st amendment due to going public. Workaround violation of 4th amendment. Get a fucking warrant. It's the law. The supreme law of the land in fact. ps. informants are the real criminals, they just want to make it seem noble when they violate the rights of people en mass because they caught a bad guy via fruit of the poison tree
kevin_thibedeau 9y ago
What legitimate purpose would a Best Buy employee have scanning unallocated storage specifically looking for images? It sounds like they were deliberately running FBI provided porn detection software. That is way beyond the scope of what Best Buy's employees should be permitted to do.
- wmf 9y ago
  Maybe the customer asked the Geek Squad to recover some deleted files.
  - kevin_thibedeau 9y ago
    They aren't stored in unallocated space. The only legit thing to look for there are virus signatures.
    - kaslai 9y ago
      Most drive filesystems essentially have two parts: A hierarchical index and a bulk storage area. The index stores a small amount of file metadata (such as the file name, child index nodes, etc) as well as references to chunks of data in the bulk storage area which actually contains the file data. Unless you go out of your way to do otherwise, when you delete a file, the data isn't actually purged from the bulk data storage area. The references to the data in the index are just deleted or marked as deleted. For all intents and purposes, the file was deleted, but the data is still on the drive, in "unallocated space." Every time data is written to the drive, there's a chance that some of the "deleted" file will get overwritten, but until it is, the file data is on the drive. If you accidentally deleted all the data off of a drive in this manner (such as with a quick format, which just wipes the index and writes a new one) you could still recover a good amount of the data. Fragmented data would be nigh impossible to automatically recover after a quick format since the data isn't contiguous and the mapping was nuked when the index was wiped, though if you had known data patterns to search for (such as a few 512 byte chunks of illicit data) then you could trivially flag a drive for deeper forensic inspection. For small or unfragmented files, you can recover them in full.
  - 9y ago
Overtonwindow 9y ago
Snitches get riches at Best Buy.
upofadown 9y ago
I guess this is another example of the sort of tension caused when we make laws intended to have law enforcement save us from ourselves. So you work for the child porn police. You sit in your office and wait for someone to call you ... but no one does. It turns out that the people who have and trade child porn are not interested in talking to you. Everyone else tends to avoid child porn. So what do you do? The very fact that you are being paid to police child porn means that the citizens must agree that you should be able to do your job. So that means that it is OK to start rooting around in the normally private places that child porn is stored. So you do that. Now the citizens are complaining that you are invading their privacy. Well OK then. Why did was this law made if it was not intended to be enforced? Oh, it was intended to be enforced? Whatever, this is stupid, so you continue doing your job, but in total secrecy, now that it is obvious that that is the only way you are going to to be able to do your job. A good employee is often willing and able to compensate for the irrationality of management. This is a common problem in all forms of human endeavour.
TACIXAT 9y ago
The original image found by Best Buy techs was in unallocated space which did not hold up in court as justification for a warrant. Unfortunately, the charges against him have been dropped. The accused had child pornography on 5 devices when the FBI searched his home.
Slansitartop 9y ago
I'm thinking it might be a good idea to run a Boot & Nuke on any used computer or used hard disk you get. Who knows what the previous owner put there?
deleted 9y ago
[deleted]
diyseguy 9y ago
I'm surprised they have to resort to this. I thought they already had backdoors into our digital private lives.

204 points by dsl 9y ago

beezle 9y ago

Only a matter of time before we read about the FBI paid tech putting files on the device in order to get his bounty.

ShorsHammer 9y ago
You'd hope in high profile cases (or really all cases), a hash of the entire drive could be taken upon seizure and given to a lawyer before any forensics started. Don't know much about forensics and maybe this already happens, but is surely a good way for both sides to avoid unfounded accusations.
- psyc 9y ago
  The evidence would have been planted by the civilian tech before seizure.
- triggercut 9y ago
  IIRC in law enforcement situations where a HDD has been obtained through slightly more conventional means, chain of custody is as important (as it is for all evidence) as ensuring the state is maintained. There are many forensic hardware providers that specifically sell 'read only' readers to ensure that whilst in possession of the drive, it's state is preserved (as much as practicably possible).

naringas 9y ago

>“discover material that may be child pornography and we have a legal and moral obligation to turn that material over to law enforcement.” is this true? is there a legal obligation?

bunderbunder 9y ago
In the USA, it's state-by-state. Some only require it of certain professionals (e.g., doctors), and others require it of everyone.
- hnaccy 9y ago
  What state(s) requires it of everyone?
deleted 9y ago
[deleted]
snomad 9y ago
Shortly after it quotes him as saying >We have a moral and, in more than 20 states, a legal obligation to report these findings to law enforcement,” With that specific number, I am guessing it is indeed a requirement. I really wish we could get some clear 4th amendment boundaries for the digital age. On the surface, I am ok with this. But paying the Geek Squad techs seems to undermine the whole point of the thing. I don't particularly find a FBI-company party in 2008 relevant to this story. Just hopeful dot-connecting.
- lowpro 9y ago
  I believe they're showing that Best Buy has intent to work with the FBI beyond what they say, and therefore can't be trusted regarding their public statement. It isn't enough to draw any conclusions, of course, but should cast doubt that they're being honest in their public statement. The average person probably already assumes they aren't being honest, but a journalist needs a reason to have such a doubt.
- hermitdev 9y ago
  > With that specific number, I am guessing it is indeed a requirement. I'm guessing here, because the language is ambiguous and the relevant states & laws are not mentioned, that the legal obligation exists if you should find suspected child pornography you must report it to the relevant legal authority. I highly doubt the law states something along the lines of if you're a computer repair technician you are legally obligated to run these forensic tools to local clandestine or non-hidden photos that may be child pornography. The former I could see an argument being made that failing to report could make you criminally complicit or even an accessory to the crime. The latter, I see as possible 1st or 4th amendment violations to the US Constitution (1st amendment violation in that it's possibly compelling speech, and for the 4th, the DOJ compelling a warrant-less search. By virtue of offering the bounty in this manner, it could be argued Best Buy is effectively acting as a page contractor of the DOJ). Obligatory, I am not a lawyer. I'm merely speculating on possible legal arguments. Morally, I'm torn on this. On one hand, I find child pornography morally reprehensible, yet on the other hand, I want these scum bags thrown in a dark, dank prison. In the end, I think, however, that this should constitute a 4th amendment violation. If this is to stand, what's the rate to be for the government to get anything they want to know about me? $100? $.01? gratis? any IRS inquiries to disappear? I think we need to revisit the 4th amendment to give explicit protection to data held by an external party. "Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety." - Benjamin Franklin

TheSpiceIsLife 9y ago

> The image found on Rettenmaier’s hard drive was in an unallocated space, which typically requires forensic software to find So say someone, known or unknown, emails you a bunch of unlawful zeros and ones, you open it or it displays automagically. Or you accidentally type a web address wrong and go to unlawful pictures dot com. Anyway, you delete the file(s) and / or clear your browser cache. Your file system deletes the entry in the allocation table (or however it works) but the drive still has the relevant magnetic / electrical charges to recover the file using a data recovery tool. Are you still in possession of the unlawful zeros and ones if you've deleted the files in the only manner you are aware of - assuming the average person doesn't understand the underlying technology???

meowface 9y ago
The data merely being present on your hard drive isn't enough for law enforcement to make a strong case. They'd also need to prove how it got there, and why.
- TheSpiceIsLife 9y ago
  That is also my understanding. So in the case where, as suggested in another comment, where a computer tech, or anyone with access to you device, plants the material in order to collect the bounty, while probably annoying and stressful, should auto-resolve during the investigation / discovery. Still a bit of a worry. Edit: fixed a thing
  - gowld 9y ago
    Yes, it will auto-resolve, after you spouse divorces you and obtains custody of your children, and your employer fires you.
- manfredo 9y ago
  An interesting Defcon talk on the subject: https://youtu.be/NG9Cg_vBKOg https://youtu.be/NG9Cg_vBKOg The last case is most relevant to this topic. All the other ones are about people trying to steal company info.

will_brown 9y ago

From a legal perspective, this is a common game of cat and mouse law enforcement regularly uses to circumvent the 4th amendment prohibition on unreasonable search and seizures without a warrant. In other words if law enforcement illegally obtains evidence, that evidence can be suppressed and all evidence as a result (fruit of the poisonous tree doctrine). But the 4th amendment only applies to the government, so a non government actor can otherwise illegally obtain evidence (break in to your home and steal said evidence and turn it over to law enforcement) and you would not be able to suppress the evidence because the government didn’t violate your 4th amendment rights, another private citizen did. In this case you get entities arguing geek squad is the government/acting on behalf the government, presumably because they took some small payments, on the other hand you have the governments arguement that geek squad is not acting on behalf of the government and in fact the criminals signed a contract allowing geek squad to search and seize evidence of a crime from the computers. It’s a well settled area of law, but it’s controversial.

akira2501 9y ago
> so a non government actor can otherwise illegally obtain evidence A critical point is the police can't directly or indirectly _solicit_ this behavior. That would be a criminal act in and of itself, but it would maintain your 4th amendment rights.
JumpCrisscross 9y ago
> you would not be able to suppress the evidence because the government didn’t violate your 4th amendment rights, another private citizen did Could you bring a civil suit against the informant? Has anyone?
- gamblor956 9y ago
  Yes, you could bring an invasion of privacy suit against them. I'm not aware of anyone having done so since usually informant doesn't have the resources to justify that sort of lawsuit. And in the case of Best Buy, they're not acting illegally in the situations described in the article.

sbierwagen 9y ago

Fun fact: oil change places sell your odometer reading to your car insurer, who may increase your rates if you drove more miles than you said you would: https://splinternews.com/how-car-insurance-companies-spy-on-your-mileage-1793860442 https://splinternews.com/how-car-insurance-companies-spy-on-...

miketery 9y ago
How is this legal for the oil shop to do?
- rdmsr 9y ago
  It’s probably implied by something deep in the TOS.
  - TangoTrotFox 9y ago
    It doesn't need to be in the ToS. In the US your information has no legal protection, with a handful of exceptions like medical information. You should assume any information you give to any company is being shared, sold, and utilized to the fullest extent to monetize you. Even if you believe Zuckerberg has changed, it does put a quite apropo spin on those IMs from when he first started Facebook [1]: Zuckerberg: Yeah so if you ever need info about anyone at Harvard Zuckerberg: Just ask. Zuckerberg: I have over 4,000 emails, pictures, addresses, SNS [Redacted Friend's Name]: What? How'd you manage that one? Zuckerberg: People just submitted it. Zuckerberg: I don't know why. Zuckerberg: They "trust me" Zuckerberg: Dumb fucks. And now people give away vastly more than the data he had back then. [1] - http://www.businessinsider.com/well-these-new-zuckerberg-ims-wont-help-facebooks-privacy-problems-2010-5 http://www.businessinsider.com/well-these-new-zuckerberg-ims...
  - TangoTrotFox 9y ago
    It doesn't need to be in the ToS. In the US your information has no legal protection, with a handful of exceptions like medical information. You should assume any information you give to any company is being shared, sold, and utilized to the fullest extent to monetize you. Something many do not consider especially in today's era of social media and AI capable of scraping any tidbit of information you reveal about yourself. As an example, this [1] is an extremely primitive tool that generates a profile of Reddit users based on nothing but what they've publicly submitted. The profiles the companies people 'trust' with their information today are going to be orders of magnitude more detailed, and accurate. [1] - https://snoopsnoo.com/ https://snoopsnoo.com/

arca_vorago 9y ago

Violation of the 3rd amendment if trojan/rat installed. Chilling effect potentially violation of 1st amendment due to going public. Workaround violation of 4th amendment. Get a fucking warrant. It's the law. The supreme law of the land in fact. ps. informants are the real criminals, they just want to make it seem noble when they violate the rights of people en mass because they caught a bad guy via fruit of the poison tree

kevin_thibedeau 9y ago

What legitimate purpose would a Best Buy employee have scanning unallocated storage specifically looking for images? It sounds like they were deliberately running FBI provided porn detection software. That is way beyond the scope of what Best Buy's employees should be permitted to do.

wmf 9y ago
Maybe the customer asked the Geek Squad to recover some deleted files.
- kevin_thibedeau 9y ago
  They aren't stored in unallocated space. The only legit thing to look for there are virus signatures.
  - kaslai 9y ago
    Most drive filesystems essentially have two parts: A hierarchical index and a bulk storage area. The index stores a small amount of file metadata (such as the file name, child index nodes, etc) as well as references to chunks of data in the bulk storage area which actually contains the file data. Unless you go out of your way to do otherwise, when you delete a file, the data isn't actually purged from the bulk data storage area. The references to the data in the index are just deleted or marked as deleted. For all intents and purposes, the file was deleted, but the data is still on the drive, in "unallocated space." Every time data is written to the drive, there's a chance that some of the "deleted" file will get overwritten, but until it is, the file data is on the drive. If you accidentally deleted all the data off of a drive in this manner (such as with a quick format, which just wipes the index and writes a new one) you could still recover a good amount of the data. Fragmented data would be nigh impossible to automatically recover after a quick format since the data isn't contiguous and the mapping was nuked when the index was wiped, though if you had known data patterns to search for (such as a few 512 byte chunks of illicit data) then you could trivially flag a drive for deeper forensic inspection. For small or unfragmented files, you can recover them in full.
- 9y ago

Overtonwindow 9y ago

Snitches get riches at Best Buy.

upofadown 9y ago

I guess this is another example of the sort of tension caused when we make laws intended to have law enforcement save us from ourselves. So you work for the child porn police. You sit in your office and wait for someone to call you ... but no one does. It turns out that the people who have and trade child porn are not interested in talking to you. Everyone else tends to avoid child porn. So what do you do? The very fact that you are being paid to police child porn means that the citizens must agree that you should be able to do your job. So that means that it is OK to start rooting around in the normally private places that child porn is stored. So you do that. Now the citizens are complaining that you are invading their privacy. Well OK then. Why did was this law made if it was not intended to be enforced? Oh, it was intended to be enforced? Whatever, this is stupid, so you continue doing your job, but in total secrecy, now that it is obvious that that is the only way you are going to to be able to do your job. A good employee is often willing and able to compensate for the irrationality of management. This is a common problem in all forms of human endeavour.

TACIXAT 9y ago

The original image found by Best Buy techs was in unallocated space which did not hold up in court as justification for a warrant. Unfortunately, the charges against him have been dropped. The accused had child pornography on 5 devices when the FBI searched his home.

Slansitartop 9y ago

I'm thinking it might be a good idea to run a Boot & Nuke on any used computer or used hard disk you get. Who knows what the previous owner put there?

deleted 9y ago

[deleted]

diyseguy 9y ago

I'm surprised they have to resort to this. I thought they already had backdoors into our digital private lives.