6 ms·

For anyone not following what was done here: they added a tracking pixel. This is a single-pixel image with "src=<myserver>". You send it to someone and get the

by mabbo 7y ago

For anyone not following what was done here: they added a tracking pixel. This is a single-pixel image with "src=<myserver>". You send it to someone and get the IP address of everyone who opens the email because they download the image. (This is why your email client asks if you want to open images). It's not malware, really, and it can't harm a local computer that opens it. But it is a sign that the prosecutors in this case believed the reporter would forward the email on to their source, giving the prosecutors the IP address of that person. And there is some question of whether that's ethical or not.

heyyyouu 7y ago
There's no question, really. It's not ethical by any means. If it wasn't a military court the judge would spank them, hard. But the defense could still report the prosecuting attorneys to the state bar.
- torstenvl 7y ago
  I think it's ethical. Why do you think otherwise? What is your hypothetical basis for reporting it to the state bar? What Model Rule do you have in mind that it could possibly violate?
  - heyyyouu 7y ago
    Where there's plenty of cases out there but I'd ask you why you think that opposing counsel attempting to violate attorney/client privilege is ethical?
    - deleted 7y ago
      [deleted]
    - torstenvl 7y ago
      If there are "plenty of cases," then cite one. You're making the accusation. Provide the basis.
      - chrischen 7y ago
        Perhaps if this is a courtroom in a trial, but he is under no obligation, legal or otherwise, to do research for you. All information he provides is free and under no warranty to be correct. Think of it as a pro-bono donation of the truth (from his perspective of course). It is up to you, or the reader, to choose to believe him or not and the information he provided is already more than he is obligated to give to enrich your life with. It is, as you put it, a “good place to start” if you wish to google more yourself.
        torstenvl 7y ago
        No. It is up to the proponent of a proposition to offer evidence of its truth. Perhaps those with no legal training should be the ones Googling, since many here clearly have no idea what they're talking about.
        chrischen 7y ago
        There is no oxygen in space (any area reasonably far from a planet). My lack of citation does not make it any less true. And if I were to try to convince you of that fact it would be simply for your benefit. Think of any comment by anyone here as someone graciously providing you with free counsel out of the time of their day, with the big disclaimer that they are not your client, and that the information is under no warranty. This disclaimer is implicit on all internet comments. It is up to you to consider their claims, and verify them. If you’re not willing to research their claims yourself then it’s pretty clear that 1) you’re just here to argue for one side to the public (aka propaganda) 2) pursuit of the truth is not actually your goal Given that your profile states that you are both part of the military and also a government lawyer may indicate that both 1) and 2) are true. I think you’ll be hard pressed to convince people they are wrong simply by accusing them that they are wrong due to lack of evidence. There is no court here, no jury to decide you win or lose. You can contribute more to this discussion by offering your unique perspective given your background.
        torstenvl 7y ago
  - chuckgreenman 7y ago
    This is clearly an attempt to gather evidence about the defense and the journalists involved. It is also likely that they are attempting to identify the source for the Navy Time's reporting. Here's an analogy from the civilian world: An employee reports an OSHA violation. Their employer is fined and forced to spend money on fixing the violation. Angered by this, the employers management tries to find who reported them to OSHA. They were caught doing something wrong, and now they are trying to identify who caught them doing it. The ethical response is to admit wrong doing and make it right, not intimidate your opponents. If you don't understand that I'm not sure there's much debate to be had.
    - torstenvl 7y ago
      Okay so what ethics rule are you claiming was violated? https://www.americanbar.org/groups/professional_responsibility/publications/model_rules_of_professional_conduct/model_rules_of_professional_conduct_table_of_contents/ https://www.americanbar.org/groups/professional_responsibili...
      - chrischen 7y ago
        I don’t think they meant “ethics rules of just lawyers.” It’s unethical because the only reason they are trying to unsurface the leaker is so that they can potentially punish them to discourage that behavior which revealed bad behavior in the first place.
        torstenvl 7y ago
        The comment discussed reporting them to the state bar. The state bar only enforces ethics rules of the type I'm discussing. If the original comment far upthread was contemplating reporting someone to the state bar for something that didn't violate state bar ethics rules, then that's even more egregiously inflammatory.
        chrischen 7y ago
        That is true, but I think those were two unrelated points. That is “... is unethical” and also “they should report to the state bar.” I believe that was the original intent of the commenter, since the sentences did not directly follow each other in his paragraph.
- cjhopman 7y ago
  Right. It's just like how we consider lawyers sending certified mail totally unethical because it allows the sender to know that the receiver received it. Shame on them.
  - deleted 7y ago
    [deleted]
Xylakant 7y ago
Technically speaking, you don’t add a tracking pixel. You add a link to something the client loads. The server on the other side can send whatever he wants, even different things to different clients. And given that there have been vulnerabilities in image parsers more than I wish to remember, that may quite well be malware.
- bdamm 7y ago
  You just defined a tracking pixel. Ok, technically it is larger than a pixel, but if the server with the image is harvesting information about the client to learn something about the user, then it's tracking the user.
JohnFen 7y ago
I'm really surprised that the recipients aren't following basic email security protocols here: don't allow HTML rendering of emails, don't allow linked images to be referenced and used, and don't open attachments that you weren't expecting to receive.
- dgzl 7y ago
  Are you really surprised though?
  - JohnFen 7y ago
    I am, although I know that I shouldn't be. I just would like to think that people in professions that are more likely to attract attackers take more care about these things than the average person.
    - dgzl 7y ago
      At the very least, you could chalk it up to human error.
- ajross 7y ago
  Seems like they were. It was discovered, after all.
londons_explore 7y ago
It's worth noting that some email services automatically add such tracking pixels (usually marketed as "email open notification"). The user normally has the option to turn it off, but might not be fully aware that they are in effect violating the privacy of the email recipient and any places the email is forwarded. It is pretty normal in the advertising world to use these features. Some mail clients (for example gmail) load these images without prompt by default (although they do so via an anonymizing proxy).
zaroth 7y ago
It was a visible logo apparently, not just a pixel. > The tracking software appears to be “an unusual logo of an American flag with a bald eagle perched on the scales of justice” included in an email from the lead prosecutor, Navy Commander Christopher Czaplak. Images in email are routinely used for tracking purposes, though the image files are typically transparent. Navy technology, it seems, is less subtle. http://www.caaflog.com/2019/05/14/navy-prosecutors-accused-of-spying-on-defense-counsel-in-a-high-profile-case/ http://www.caaflog.com/2019/05/14/navy-prosecutors-accused-o...
inetknght 7y ago
> It's not malware, really, and it can't harm a local computer that opens it. Can't harm a local computer? I think you're wrong. Malware has often hidden inside of specially-crafted images.
deleted 7y ago
[deleted]

by mabbo 7y ago

heyyyouu 7y ago

There's no question, really. It's not ethical by any means. If it wasn't a military court the judge would spank them, hard. But the defense could still report the prosecuting attorneys to the state bar.

torstenvl 7y ago
I think it's ethical. Why do you think otherwise? What is your hypothetical basis for reporting it to the state bar? What Model Rule do you have in mind that it could possibly violate?
- heyyyouu 7y ago
  Where there's plenty of cases out there but I'd ask you why you think that opposing counsel attempting to violate attorney/client privilege is ethical?
  - deleted 7y ago
    [deleted]
  - torstenvl 7y ago
    If there are "plenty of cases," then cite one. You're making the accusation. Provide the basis.
    - chrischen 7y ago
      Perhaps if this is a courtroom in a trial, but he is under no obligation, legal or otherwise, to do research for you. All information he provides is free and under no warranty to be correct. Think of it as a pro-bono donation of the truth (from his perspective of course). It is up to you, or the reader, to choose to believe him or not and the information he provided is already more than he is obligated to give to enrich your life with. It is, as you put it, a “good place to start” if you wish to google more yourself.
      - torstenvl 7y ago
        No. It is up to the proponent of a proposition to offer evidence of its truth. Perhaps those with no legal training should be the ones Googling, since many here clearly have no idea what they're talking about.
        chrischen 7y ago
        There is no oxygen in space (any area reasonably far from a planet). My lack of citation does not make it any less true. And if I were to try to convince you of that fact it would be simply for your benefit. Think of any comment by anyone here as someone graciously providing you with free counsel out of the time of their day, with the big disclaimer that they are not your client, and that the information is under no warranty. This disclaimer is implicit on all internet comments. It is up to you to consider their claims, and verify them. If you’re not willing to research their claims yourself then it’s pretty clear that 1) you’re just here to argue for one side to the public (aka propaganda) 2) pursuit of the truth is not actually your goal Given that your profile states that you are both part of the military and also a government lawyer may indicate that both 1) and 2) are true. I think you’ll be hard pressed to convince people they are wrong simply by accusing them that they are wrong due to lack of evidence. There is no court here, no jury to decide you win or lose. You can contribute more to this discussion by offering your unique perspective given your background.
        torstenvl 7y ago
- chuckgreenman 7y ago
  This is clearly an attempt to gather evidence about the defense and the journalists involved. It is also likely that they are attempting to identify the source for the Navy Time's reporting. Here's an analogy from the civilian world: An employee reports an OSHA violation. Their employer is fined and forced to spend money on fixing the violation. Angered by this, the employers management tries to find who reported them to OSHA. They were caught doing something wrong, and now they are trying to identify who caught them doing it. The ethical response is to admit wrong doing and make it right, not intimidate your opponents. If you don't understand that I'm not sure there's much debate to be had.
  - torstenvl 7y ago
    Okay so what ethics rule are you claiming was violated? https://www.americanbar.org/groups/professional_responsibility/publications/model_rules_of_professional_conduct/model_rules_of_professional_conduct_table_of_contents/ https://www.americanbar.org/groups/professional_responsibili...
    - chrischen 7y ago
      I don’t think they meant “ethics rules of just lawyers.” It’s unethical because the only reason they are trying to unsurface the leaker is so that they can potentially punish them to discourage that behavior which revealed bad behavior in the first place.
      - torstenvl 7y ago
        The comment discussed reporting them to the state bar. The state bar only enforces ethics rules of the type I'm discussing. If the original comment far upthread was contemplating reporting someone to the state bar for something that didn't violate state bar ethics rules, then that's even more egregiously inflammatory.
        chrischen 7y ago
        That is true, but I think those were two unrelated points. That is “... is unethical” and also “they should report to the state bar.” I believe that was the original intent of the commenter, since the sentences did not directly follow each other in his paragraph.
cjhopman 7y ago
Right. It's just like how we consider lawyers sending certified mail totally unethical because it allows the sender to know that the receiver received it. Shame on them.
- deleted 7y ago
  [deleted]

Xylakant 7y ago

Technically speaking, you don’t add a tracking pixel. You add a link to something the client loads. The server on the other side can send whatever he wants, even different things to different clients. And given that there have been vulnerabilities in image parsers more than I wish to remember, that may quite well be malware.

bdamm 7y ago
You just defined a tracking pixel. Ok, technically it is larger than a pixel, but if the server with the image is harvesting information about the client to learn something about the user, then it's tracking the user.

JohnFen 7y ago

I'm really surprised that the recipients aren't following basic email security protocols here: don't allow HTML rendering of emails, don't allow linked images to be referenced and used, and don't open attachments that you weren't expecting to receive.

dgzl 7y ago
Are you really surprised though?
- JohnFen 7y ago
  I am, although I know that I shouldn't be. I just would like to think that people in professions that are more likely to attract attackers take more care about these things than the average person.
  - dgzl 7y ago
    At the very least, you could chalk it up to human error.
ajross 7y ago
Seems like they were. It was discovered, after all.

londons_explore 7y ago

It's worth noting that some email services automatically add such tracking pixels (usually marketed as "email open notification"). The user normally has the option to turn it off, but might not be fully aware that they are in effect violating the privacy of the email recipient and any places the email is forwarded. It is pretty normal in the advertising world to use these features. Some mail clients (for example gmail) load these images without prompt by default (although they do so via an anonymizing proxy).

zaroth 7y ago

It was a visible logo apparently, not just a pixel. > The tracking software appears to be “an unusual logo of an American flag with a bald eagle perched on the scales of justice” included in an email from the lead prosecutor, Navy Commander Christopher Czaplak. Images in email are routinely used for tracking purposes, though the image files are typically transparent. Navy technology, it seems, is less subtle. http://www.caaflog.com/2019/05/14/navy-prosecutors-accused-of-spying-on-defense-counsel-in-a-high-profile-case/ http://www.caaflog.com/2019/05/14/navy-prosecutors-accused-o...

inetknght 7y ago

> It's not malware, really, and it can't harm a local computer that opens it. Can't harm a local computer? I think you're wrong. Malware has often hidden inside of specially-crafted images.

deleted 7y ago

[deleted]