7 ms·

This article is making it seem like tracking pixels are illegal and require a search warrant. This is definitively not the case. Search warrants are required on

This article is making it seem like tracking pixels are illegal and require a search warrant. This is definitively not the case. Search warrants are required only when requesting that information from a third party or against a person's will. When through the normal course of using a technology you reveal information to the government (in this case the military) they can use that information against you. Having an embedded image from a third party server in an email is well within normal usage of email. Logging IP addresses of machines that access content on a web server is also well within the normal usage of that server. I'm also not sure what the journalist is afraid of in this case. Your IP address reveals almost nothing about you beyond a rough physical location on its own. Considering the Navy sent this email they already know WHO the recipient is. From an editor or authors name I could most likely find what city they live in with no extra help beyond Google. There absolutely isn't anything illegal or even suspicious about this. If you want to go absolutely crazy mad with paranoia maybe they could collude with another federal agency to tap that network connection... but that is INCREDIBLY unlikely for this.

will_brown 7y ago
>When through the normal course of using a technology you reveal information to the government (in this case the military) they can use that information against you. That’s not the legal standard for searches and seizures under the 4th amendment. It’s about the reasonable expectation of privacy, and when a defense attorney emails their client the client has a reasonable expectation of privacy. A reasonable person doesn’t think the prosecutor has embedded tracking into emails sent to their attorney which will relay information back to the prosecutor when shared forwarded to the client by the defense attorney.
- soulofmischief 7y ago
  I have what I consider to be a reasonable expectation of privacy not to have 3rd party tracking pixels embedded in websites I visit via a secure connection on the internet.
  - will_brown 7y ago
    Well I’m not so sure that is a reasonable expectation (certainly visiting a website isn’t the same as an attorney client communication), but either way the 4th amendment only applies to searches and seizures by the government not 3rd party websites.
    - inetknght 7y ago
      I fully believe it to be a reasonable expectation which is unfortunately violated daily and routinely often under the nefarious guise of marketing.
      - will_brown 7y ago
        Well as I previously mentioned the 4th amendment only protects from unreasonable searches and seizures by the government...reasonable belief or not the 4th amendment isn’t going to protect you from data collected by non-government actors (unless the government directed them to collect it for them).
        inetknght 7y ago
        It's unfortunate that the U.S. has such lack privacy protections compared to Europe.
        soulofmischief 7y ago
        And it starts with expectations, which our government belittles us for having.
- MaupitiBlue 7y ago
  >>When through the normal course of using a technology you reveal information to the government (in this case the military) they can use that information against you. >That’s not the legal standard for searches and seizures under the 4th amendment. Was Katz overruled?
  - will_brown 7y ago
    No the holding/Law is still: Regardless of the location, a conversation is protected from unreasonable search and seizure under the Fourth Amendment if it is made with a "reasonable expectation of privacy". The law is not and never was: >When through the normal course of using a technology you reveal information to the government (in this case the military) they can use that information against you.
rebuilder 7y ago
>“He was instructed that the embedded image contained a cyber-tool known as a ‘splunk’ tool,’ which can allow the originator full access to his computer, and all the files on the computer,” It seems the journalist here believes some tool much more powerful than a tracking pixel may have been used. I've never heard of a "splunk tool" and frankly it seems like BS, but if the journalist believes this then the tone of the article is explained.
- TrueDuality 7y ago
  From the technical perspective of how emails work and the limited subset of HTML being available inside them. I think this is a case of crying wolf without understanding technical capabilities. The only way the access described there is even remotely possible is using a vulnerability in a systems image parser or network client stack (using only the URL and server response). Burning an unknown 0-day vulnerability with that level of power wouldn't be wasted on even a high profile military court case.
- harimau777 7y ago
  Does Splunk (https://en.m.wikipedia.org/wiki/Splunk https://en.m.wikipedia.org/wiki/Splunk) do anything with tracking emails? Perhaps that's what they meant?
- dillondoyle 7y ago
  This stood out to me too. Maybe there is some image breakout vuln that is exploited, which would be HUGE. I would think there'd be a wider attack surface to attach a PDF though...
ejfox 7y ago
> The Navy email to Navy Times contained hidden computer coding designed to extract the IP address of the Navy Times computer network and to send that information back to a server located in San Diego. Under U.S. criminal law, authorities normally have to obtain a subpoena or court order to acquire IP addresses or other metadata. Not using one could be a violation of existing privacy laws, including the Electronic Communications Privacy Act. They lay it out pretty clearly in the article. What you are describing might be true for a private company, but that same behavior from a military branch of our government is very different. This is a really interesting area of law that I don't think has been settled. One could argue that attaching this tracking pixel to an email is similar to attaching a GPS tracker to a vehicle. In United States v Jones in 2012, the supreme court ruled that placing a GPS device on violated the 4th amendment. > "the Government's installation of a GPS device on a target's vehicle, and its use of that device to monitor the vehicle's movements, constitutes a 'search'" Regardless of whether it was "well within normal usage of email" or not is kind of irrelevant. It is also very different coming from the government as opposed to a private institution. It is also very different to be targeting a news outlet (especially one that has been critical of you!). I would absolutely challenge you on both points - this is ABSOLUTELY suspicious, and as they pointed out in the article, likely illegal – and I haven't gone crazy mad with paranoia.
- TrueDuality 7y ago
  I've already argued against your first quote in the post. The privacy acts only apply when the government is getting the data from third parties such as from an email provider or ISP. In this case the image is directly communicating back to their servers and no third parties are involved. Communications between two parties are not subject to the privacy laws when you are one of those two parties. The target is irrelevant in the case of legality. The only additional protections a journalist has is on not revealing their sources. This doesn't impact or interact with other emails so no sources could be compromised via a tracking pixel. Being "shady" isn't illegal and I wouldn't even say a tracking pixel is shady. The closest approximation of what this tracking pixel is doing is as a read receipt for a piece of mail. If you want to quote "United States v Jones in 2012" against others you should probably be aware of what the presiding judges actually ruled. It was determined that the action was illegal only because physically attaching the device was considered trespass of private property not because the tracking of the vehicle's location required a search warrant. If you wanted to make a similar argument you would have to instead refer to the Computer Fraud and Abuse Act to cover something similar to digital trespass. A tracking pixel does not violate that law under any circumstance that I'm aware of.
zamadatix 7y ago
If it doesn't provide anything useful then why was it included in the first place?
- TrueDuality 7y ago
  There are plenty of reasons. Many people use these in their emails to get effectively "read receipts". It's not even clear that this was an official military action or just one officer using a browser extension that embeds these images. There is very very little information you can get from an individual image being loaded by a user agent.
  - evanb 7y ago
    If they're worried about leaks, it seems much more likely that they're interested in who is talking to who, which they can figure out if the email with the tracking pixel gets forwarded.
6gvONxR4sf7o 7y ago
'It's normal usage' doesn't mean it's okay to a normal person or in any way reasonable. Hence all the privacy debate in recent years. Personally, I'm not okay with tracking pixels and would turn them off if I could.
- joemi 7y ago
  You can turn them off. Just use an email client that doesn't fetch images/load images. For the most part, email is very usable without images.
  - Loughla 7y ago
    Honestly, 99% of e-mails that force you to use images to be able to read them are garbage sales e-mails anyway, in my experience. Substantive e-mails will have attachments most of the time, and be from trusted sources obviously, or will just be text. Maybe that's just my experience?
    - inetknght 7y ago
      That is also my experience.
    - mywittyname 7y ago
      Gmail will download images and serve them from Google servers to prevent this issue. Perhaps you can setup a similar plugin to automatically upload images to imgur or similar before the client displays them.
  - 6gvONxR4sf7o 7y ago
    An email client fetching images is useful, and shouldn't need to be turned off. If someone sends me an email with a graph embedded, it's a great feature that it will show up where it's supposed to. Using that feature for tracking is an abuse of it, plain and simple. There's no way that was an intended part of the design.
    - 7y ago
JohnFen 7y ago
> Having an embedded image from a third party server in an email is well within normal usage of email. It is "normal" in the sense that it is a common practice, but it's also nefarious and shouldn't be done. Fortunately, it's easy to defend against.
nitwit005 7y ago
There are some legal limits on user tracking for government websites and the like: https://obamawhitehouse.archives.gov/omb/memoranda_m03-22 https://obamawhitehouse.archives.gov/omb/memoranda_m03-22 Which they seem to have gotten in trouble for violating on occasion: https://www.cnet.com/news/government-web-sites-are-keeping-an-eye-on-you/ https://www.cnet.com/news/government-web-sites-are-keeping-a...

will_brown 7y ago

>When through the normal course of using a technology you reveal information to the government (in this case the military) they can use that information against you. That’s not the legal standard for searches and seizures under the 4th amendment. It’s about the reasonable expectation of privacy, and when a defense attorney emails their client the client has a reasonable expectation of privacy. A reasonable person doesn’t think the prosecutor has embedded tracking into emails sent to their attorney which will relay information back to the prosecutor when shared forwarded to the client by the defense attorney.

soulofmischief 7y ago
I have what I consider to be a reasonable expectation of privacy not to have 3rd party tracking pixels embedded in websites I visit via a secure connection on the internet.
- will_brown 7y ago
  Well I’m not so sure that is a reasonable expectation (certainly visiting a website isn’t the same as an attorney client communication), but either way the 4th amendment only applies to searches and seizures by the government not 3rd party websites.
  - inetknght 7y ago
    I fully believe it to be a reasonable expectation which is unfortunately violated daily and routinely often under the nefarious guise of marketing.
    - will_brown 7y ago
      Well as I previously mentioned the 4th amendment only protects from unreasonable searches and seizures by the government...reasonable belief or not the 4th amendment isn’t going to protect you from data collected by non-government actors (unless the government directed them to collect it for them).
      - inetknght 7y ago
        It's unfortunate that the U.S. has such lack privacy protections compared to Europe.
        soulofmischief 7y ago
        And it starts with expectations, which our government belittles us for having.
MaupitiBlue 7y ago
>>When through the normal course of using a technology you reveal information to the government (in this case the military) they can use that information against you. >That’s not the legal standard for searches and seizures under the 4th amendment. Was Katz overruled?
- will_brown 7y ago
  No the holding/Law is still: Regardless of the location, a conversation is protected from unreasonable search and seizure under the Fourth Amendment if it is made with a "reasonable expectation of privacy". The law is not and never was: >When through the normal course of using a technology you reveal information to the government (in this case the military) they can use that information against you.

rebuilder 7y ago

>“He was instructed that the embedded image contained a cyber-tool known as a ‘splunk’ tool,’ which can allow the originator full access to his computer, and all the files on the computer,” It seems the journalist here believes some tool much more powerful than a tracking pixel may have been used. I've never heard of a "splunk tool" and frankly it seems like BS, but if the journalist believes this then the tone of the article is explained.

TrueDuality 7y ago
From the technical perspective of how emails work and the limited subset of HTML being available inside them. I think this is a case of crying wolf without understanding technical capabilities. The only way the access described there is even remotely possible is using a vulnerability in a systems image parser or network client stack (using only the URL and server response). Burning an unknown 0-day vulnerability with that level of power wouldn't be wasted on even a high profile military court case.
harimau777 7y ago
Does Splunk (https://en.m.wikipedia.org/wiki/Splunk https://en.m.wikipedia.org/wiki/Splunk) do anything with tracking emails? Perhaps that's what they meant?
dillondoyle 7y ago
This stood out to me too. Maybe there is some image breakout vuln that is exploited, which would be HUGE. I would think there'd be a wider attack surface to attach a PDF though...

ejfox 7y ago

> The Navy email to Navy Times contained hidden computer coding designed to extract the IP address of the Navy Times computer network and to send that information back to a server located in San Diego. Under U.S. criminal law, authorities normally have to obtain a subpoena or court order to acquire IP addresses or other metadata. Not using one could be a violation of existing privacy laws, including the Electronic Communications Privacy Act. They lay it out pretty clearly in the article. What you are describing might be true for a private company, but that same behavior from a military branch of our government is very different. This is a really interesting area of law that I don't think has been settled. One could argue that attaching this tracking pixel to an email is similar to attaching a GPS tracker to a vehicle. In United States v Jones in 2012, the supreme court ruled that placing a GPS device on violated the 4th amendment. > "the Government's installation of a GPS device on a target's vehicle, and its use of that device to monitor the vehicle's movements, constitutes a 'search'" Regardless of whether it was "well within normal usage of email" or not is kind of irrelevant. It is also very different coming from the government as opposed to a private institution. It is also very different to be targeting a news outlet (especially one that has been critical of you!). I would absolutely challenge you on both points - this is ABSOLUTELY suspicious, and as they pointed out in the article, likely illegal – and I haven't gone crazy mad with paranoia.

TrueDuality 7y ago
I've already argued against your first quote in the post. The privacy acts only apply when the government is getting the data from third parties such as from an email provider or ISP. In this case the image is directly communicating back to their servers and no third parties are involved. Communications between two parties are not subject to the privacy laws when you are one of those two parties. The target is irrelevant in the case of legality. The only additional protections a journalist has is on not revealing their sources. This doesn't impact or interact with other emails so no sources could be compromised via a tracking pixel. Being "shady" isn't illegal and I wouldn't even say a tracking pixel is shady. The closest approximation of what this tracking pixel is doing is as a read receipt for a piece of mail. If you want to quote "United States v Jones in 2012" against others you should probably be aware of what the presiding judges actually ruled. It was determined that the action was illegal only because physically attaching the device was considered trespass of private property not because the tracking of the vehicle's location required a search warrant. If you wanted to make a similar argument you would have to instead refer to the Computer Fraud and Abuse Act to cover something similar to digital trespass. A tracking pixel does not violate that law under any circumstance that I'm aware of.

zamadatix 7y ago

If it doesn't provide anything useful then why was it included in the first place?

TrueDuality 7y ago
There are plenty of reasons. Many people use these in their emails to get effectively "read receipts". It's not even clear that this was an official military action or just one officer using a browser extension that embeds these images. There is very very little information you can get from an individual image being loaded by a user agent.
- evanb 7y ago
  If they're worried about leaks, it seems much more likely that they're interested in who is talking to who, which they can figure out if the email with the tracking pixel gets forwarded.

6gvONxR4sf7o 7y ago

'It's normal usage' doesn't mean it's okay to a normal person or in any way reasonable. Hence all the privacy debate in recent years. Personally, I'm not okay with tracking pixels and would turn them off if I could.

joemi 7y ago
You can turn them off. Just use an email client that doesn't fetch images/load images. For the most part, email is very usable without images.
- Loughla 7y ago
  Honestly, 99% of e-mails that force you to use images to be able to read them are garbage sales e-mails anyway, in my experience. Substantive e-mails will have attachments most of the time, and be from trusted sources obviously, or will just be text. Maybe that's just my experience?
  - inetknght 7y ago
    That is also my experience.
  - mywittyname 7y ago
    Gmail will download images and serve them from Google servers to prevent this issue. Perhaps you can setup a similar plugin to automatically upload images to imgur or similar before the client displays them.
- 6gvONxR4sf7o 7y ago
  An email client fetching images is useful, and shouldn't need to be turned off. If someone sends me an email with a graph embedded, it's a great feature that it will show up where it's supposed to. Using that feature for tracking is an abuse of it, plain and simple. There's no way that was an intended part of the design.
  - 7y ago

JohnFen 7y ago

> Having an embedded image from a third party server in an email is well within normal usage of email. It is "normal" in the sense that it is a common practice, but it's also nefarious and shouldn't be done. Fortunately, it's easy to defend against.

nitwit005 7y ago

There are some legal limits on user tracking for government websites and the like: https://obamawhitehouse.archives.gov/omb/memoranda_m03-22 https://obamawhitehouse.archives.gov/omb/memoranda_m03-22 Which they seem to have gotten in trouble for violating on occasion: https://www.cnet.com/news/government-web-sites-are-keeping-an-eye-on-you/ https://www.cnet.com/news/government-web-sites-are-keeping-a...