13 ms·
Tracking logo found in Navy email to Navy Times amid leak investigation
- jbob2000 7y agoOh my god, they think a tracking pixel is a "secret tracking device". Jesus christ, get over yourselves, EVERY email has these in them...
- dang 7y agoCould you please stop posting unsubstantive comments to Hacker News? That bit of the title is the least interesting and least important thing to post about. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
- java-man 7y agoThe government got away with warrantless widespread surveillance uncovered in 2013. It will get away with this too. We (American people) essentially let it slide, and as a result, we deserve the consequences.
- java-man 7y agoFrom the article: "The Navy email to Navy Times contained hidden computer coding designed to extract the IP address of the Navy Times computer network and to send that information back to a server located in San Diego. Under U.S. criminal law, authorities normally have to obtain a subpoena or court order to acquire IP addresses or other metadata. Not using one could be a violation of existing privacy laws, including the Electronic Communications Privacy Act." "“It is illegal for the government to use [the emails] in the way they did without a warrant,” he said. “What this constitutes is a warrantless surveillance of private citizens, including the media, by the military." "Hicks would not state for the record whether the Navy obtained a search warrant or subpoena in connection with the emails with tracking devices."
- deleted 7y ago[deleted]
- lwf 7y agoIt's just a tracking pixel: > “I am writing regarding your emails from yesterday, which contained an embedded image that was not contained in any of your previous emails,” Parlatore wrote. “At the risk of sounding paranoid, this image is not an attachment, but rather a link to an unsecured server which, if downloaded, can be used to track emails, including forwards. I would hope that you aren’t looking to track emails of defense counsel, so I wanted to make sure there wasn’t a security breach on your end. Given the leaks in this case, I am sure you can understand.”
- arkades 7y agoThe email came from a Navy prosecutor, not a marketing department.
- TrueDuality 7y agoThis article is making it seem like tracking pixels are illegal and require a search warrant. This is definitively not the case. Search warrants are required only when requesting that information from a third party or against a person's will. When through the normal course of using a technology you reveal information to the government (in this case the military) they can use that information against you. Having an embedded image from a third party server in an email is well within normal usage of email. Logging IP addresses of machines that access content on a web server is also well within the normal usage of that server. I'm also not sure what the journalist is afraid of in this case. Your IP address reveals almost nothing about you beyond a rough physical location on its own. Considering the Navy sent this email they already know WHO the recipient is. From an editor or authors name I could most likely find what city they live in with no extra help beyond Google. There absolutely isn't anything illegal or even suspicious about this. If you want to go absolutely crazy mad with paranoia maybe they could collude with another federal agency to tap that network connection... but that is INCREDIBLY unlikely for this.
- will_brown 7y ago>When through the normal course of using a technology you reveal information to the government (in this case the military) they can use that information against you. That’s not the legal standard for searches and seizures under the 4th amendment. It’s about the reasonable expectation of privacy, and when a defense attorney emails their client the client has a reasonable expectation of privacy. A reasonable person doesn’t think the prosecutor has embedded tracking into emails sent to their attorney which will relay information back to the prosecutor when shared forwarded to the client by the defense attorney.
- soulofmischief 7y agoI have what I consider to be a reasonable expectation of privacy not to have 3rd party tracking pixels embedded in websites I visit via a secure connection on the internet.
- will_brown 7y ago
- remyp 7y agoNot only are tracking pixels an invasion of privacy, they've held up in court as proof of receipt. I helped build a product that blocks them at the enterprise level without affecting the presentation of the message or requiring end user effort: https://messagecontrol.com https://messagecontrol.com
- deleted 7y ago[deleted]
- crooked-v 7y agoWhile this looks interesting and useful, there's no pricing info anywhere, so I didn't bother sharing it with anyone at my workplace.
- remyp 7y agoI've always been a fan of upfront pricing, but I don't work there anymore. As near as I can tell not having publicly available pricing seems pretty common for enterprise software.
- GordonS 7y agoThey do say it's for the enterprise, and unfortunately "contact us" pricing is par for the course. It is very annoying though - if I'm interested, I'll need to email/phone. And if I email, nobody will tell me pricing until I speak to a sales bod, at least once, until they figure out how much money they can likely extract from us. Folk selling B2B complain about the long time it takes to convert a lead to a sale, to a PO, to a payment - but these slimey sales tactics are just as much to blame.
- GordonS 7y agoI'm interested in how this works at a technical level - is it implemented as plugins for Exchange and other servers, or is it some kind of proxy that clients connect to instead of directly to their email server?
- remyp 7y ago
- inetknght 7y agoTracking peoples' email is no less of a violation of privacy. Laymen do not understand that simply opening an email can be tracked via image loading "secret pixels". I think that makes it an open secret.
- jbob2000 7y agoIn order for it to violate your privacy, it needs to take some kind of data from you that is considered private. What data is a tracking pixel taking from you? The only thing a tracking pixel "takes" is the address of the computer that downloaded it and the time it was downloaded. None of that is your private information.
- inetknght 7y ago> What data is a tracking pixel taking from you? Let me just list a few of the things that I consider private: * The fact that I viewed the email in any way * The fact that the email was opened on more than one date * What IP address is assigned to me by my service provider * What user-agent is used by me (and what version) * Whether or not I share my IP with other email addresses * Bandwidth information about my network * Latency information about my network > None of that is your private information. You are dead wrong on this point.
- remyp 7y agoIn addition to the above, many tracking services log your location and some even measure how long you read the message for. They can also make a good guess at whether you forwarded the message to someone else. Even if you turn off images it's not always good enough: some trackers try to load any external resource they can, like sounds and fonts.
- inetknght 7y ago> Even if you turn off images it's not always good enough: some trackers try to load any external resource they can, like sounds and fonts. Whoa. While that doesn't surprise me, I didn't know about it. Can you demonstrate it with various providers? Gmail, for instance?
- LinuxBender 7y agoWhy was the military not forcing all traffic through a locked down and monitored VPN? Red vs Black not a thing in military crypto any more? When did this change?
- papln 7y agoThe issue here isn't about knowing whether the the recipient read the email, which is not an interesting thing to spy on. It's about the sender seeing whoever the recipient forwards the email to, and about the sender seeing the recipient's network information (although that's a hard sell because the recipient already advertised their network presence by using email), and the use of non-HTTPS servers that could be compromised to intercept traffic.
- cryptonector 7y agoAh yes, this is a good reason to use text-based MUAs. Though it's not the reason I use text-based MUAs. Another good reason is that HTML for e-mail is horrible.
- mabbo 7y agoFor anyone not following what was done here: they added a tracking pixel. This is a single-pixel image with "src=<myserver>". You send it to someone and get the IP address of everyone who opens the email because they download the image. (This is why your email client asks if you want to open images). It's not malware, really, and it can't harm a local computer that opens it. But it is a sign that the prosecutors in this case believed the reporter would forward the email on to their source, giving the prosecutors the IP address of that person. And there is some question of whether that's ethical or not.
- heyyyouu 7y agoThere's no question, really. It's not ethical by any means. If it wasn't a military court the judge would spank them, hard. But the defense could still report the prosecuting attorneys to the state bar.
- torstenvl 7y agoI think it's ethical. Why do you think otherwise? What is your hypothetical basis for reporting it to the state bar? What Model Rule do you have in mind that it could possibly violate?
- heyyyouu 7y agoWhere there's plenty of cases out there but I'd ask you why you think that opposing counsel attempting to violate attorney/client privilege is ethical?
- deleted 7y ago[deleted]
- torstenvl 7y agoIf there are "plenty of cases," then cite one. You're making the accusation. Provide the basis.
- chuckgreenman 7y agoThere is a question as to whether it is legal or not, it is unequivocally unethical.
- dmix 7y agoEspecially when it’s a gov prosecutor sending it to the opposing defence attorneys, when the organization sending it has a known capability to exploit those computers for intelligence gathering. The privacy rights between attorneys and clients is particularly sensitive. Not to mention a government agent sending it to journalists with the freedom of the press rights.
- torstenvl 7y agoIf you're going to make an inflammatory claim like that, you should articulate your basis. What ethics rule are you claiming was violated?
- chuckgreenman 7y agoThe prosecutors embedded a tracking image in an email that they sent to journalists and the defense. It's not just for tracking to see if the recipients have opened the email, but it could help them identify who the email is forwarded to. In this case, the journalists have confidential sources, they may forward that email to them, which would leak the source's IP, which could reveal the identity of the source. A free and strong press is how we keep powerful institutions in check. It is not an inflammatory statement to say that a reprisal by a government institution that has been accused of doing something unethical is unethical. It's just common sense.
- deleted 7y ago[deleted]
- deleted 7y ago[deleted]
- torstenvl 7y agoI understand why you don't like it. I asked why you think it's an ethical violation. In case you decide to answer that question eventually, the model ethics rules are here: https://www.americanbar.org/groups/professional_responsibility/publications/model_rules_of_professional_conduct/model_rules_of_professional_conduct_table_of_contents/ https://www.americanbar.org/groups/professional_responsibili... I would really be interested in knowing which one you're alleging was violated.
- redwards510 7y agoWow, it's always funny when articles written for laymen dance around simple technical terms with fluffy language ("device", really?). I'm really curious if this would have been considered an issue if it was just a visible header image like a logo. Does making it a single pixel make it more illegal than a image in plain sight? Both perform exactly the same function and both must be explicitly loaded by most email clients.
- mjevans 7y agoThey're probably following the legal description of the technology in question, not the actual method.
- suff 7y agoPretty sure the press would bump their forehead on a journalism bar set that high.
- Retric 7y agoJournalists often use terms they don’t really understand in a context that’s not quite appropriate.
- mjevans 7y agoSomeone who did understand probably explained it IN lawyers terms to them; it may have been a tech-law focused lawyer they consulted on the ramifications, or the journalist covering navy laws in question.
- tedunangst 7y ago“He was instructed that the embedded image contained a cyber-tool known as a ‘splunk’ tool,’ which can allow the originator full access to his computer, and all the files on the computer,” according to a Portier defense motion filed Tuesday. What? How does a tracking pixel do that?
- asspelunker 7y agoAre they... referring to a... Splunk logging agent? I doubt it, but maybe the JPEG packed a binary appended to the end of the image file? Either way, if such were the case, this payload would need to rely on the presence of, and thus exploit, some sort of vulnerability in whichever host cached it. Not impossible, but not exactly a trivial maneuver. If they had suspects in mind, and had an awareness of OS version and patch level, it might be within the realm of possibility to land a working payload. Furthermore, if they were targeting Navy personel, there might even be a level of control to selectively enable a backdoor that permits a more advanced outcome than would ordinarily be possible in the wild against random individuals around the world. Maybe the plan was to hit internal personnel with a specialized payload that only affects Navy assets...
- plonker 7y agoI'm reading this as a fantastically stupid misinterpretation of the technologies in play. We're reading what some clerk wrote, in a game of telephone, as the defense tries to escalate this into utter confusion over what the fuck is going on. Somewhere along the line, they name dropped a log analysis tool (splunk) to explain how, after the pixel/logo/image is requested and loaded, the request is logged (to apache http request logs on the server) and that those SERVER logs can be pulled and inspected... THEN, an admin, with total control over THE SERVER can scrape those logs via querying for the pixel requests with Splunk, which enables highly granular queries against a log stream across load balanced clisters, or what have you. A clerk would have near zero comprehension of the system architecture or the basics of http traffic and server monitoring, so, you know... You can expect some kind of authentic expression of breathless shock at the tale a defense attourney might weave, while they loudly complain... about... a fucking email signature. This is a nothingburger, through and through.
- dimwitted 7y agoGod, can we please change the fucking headline? What a fucking joke. It's not like this is a fucking undersea cable cut to insert a hardware beam splitter and intercept petabytes of indiscriminate network traffic. It's an <img/> tag. The title would make more sense to the HN audience if it read: "Navy Prosecutor Inserts Tracking Pixel Into Email Sent To Journalist, In Effort to Discover and Track Leak From Anonymous Source" That would be a more technically accurate title that retains the spirit of the intended message. The sender of the email was being deceptive, and attempted a poorly conceived effort to use a less than covert, but non-obvious loophole in technology that would fail to work on savvy users and technical folks. Is it scummy? Yeah. Is it secret? Nope. Is it newsworthy? Definitely. Is it respectable behavior? Not in the slightest.
- sys_64738 7y agoMy credit card company has done this too. They sent a letter (via snail mail) saying that my email address on file wasn't being read so they would rescind my online account unless I verify the email address.
- luqven 7y agoPixel tracking is literally everywhere, so assuming this was malicious is a stretch. However, if they can establish the navy did it expressly in the hopes this email would be forwarded to a “leaker”, that might be a bigger deal