5 ms·

Here’s the scary part to me. They say they identified searches from certain networks and make it sound like those were the ONLY searches for those terms. Howe

Here’s the scary part to me. They say they identified searches from certain networks and make it sound like those were the ONLY searches for those terms. However, it seems obvious they took his IP address, went through his search history, picked relevant terms, and presented it like they started by finding out who searched for specific terms. I call bullshit. There’s no way he’s the only one that searched for those terms in that time period, right?

jeffbee 6y ago
> There’s no way he’s the only one that searched for those terms Why not? Why would anyone search for both dcleaks and guccifer months before dcleaks was a web site or guccifer was a persona?
- donmcronald 6y ago
  IMO they’d say that explicitly if it was the case. In reality I bet lots of people searched for those individual terms and linking a combo back to a pair of /24s seems iffy to me. Why can’t they link it back to his exact IP? If the answer is that Google and Facebook have logs and the ISP doesn’t, that’s another whole conversation, especially if they can be linked back to a specific individual like in this case. I doubt anyone would be ok with having a lifetime search history.
  - jeffbee 6y ago
    > Why can’t they link it back to his exact IP? Because permanent logs don't contain full addresses, because of GDPR.
- donmcronald 6y ago
  https://trends.google.com/trends/explore?date=2016-03-01%202016-09-30&geo=US&q=guccifer https://trends.google.com/trends/explore?date=2016-03-01%202... What’s the spike on May 5 there? It’s 12 days earlier.
mike_d 6y ago
At the time the terms likely did not have statistically significant search volume. I'm not going to say he was the only one, but the other three might have been people who then corrected their search from "dcleaks" to "dc voltage leak" or something. If you search for "[government agency] mailing address" three days before they receive anthrax in the mail, it isn't a slam dunk case. But if it was also mailed from your zip code, you had placed 6 phone calls to that agency in the prior month, etc. it makes you a pretty damn good candidate.
- donmcronald 6y ago
  What was the search volume? That’s relevant and they should have to list it.
  - mike_d 6y ago
    I don't know. But everything the FBI got from Google was also given to the defense. If it was a popular set of terms, the defense would have raised that argument.
    - srtjstjsj 6y ago
      It wouldn't be popular if they also filtered it to a suspect's geoip range or other qualifiers.
  - jessaustin 6y ago
    https://trends.google.com/trends/explore?date=today%205-y&geo=US&q=guccifer https://trends.google.com/trends/explore?date=today%205-y&ge... There has been some interest throughout the last five years. The first big spike was the first week of May, 2016. However, there were smaller peaks in March and April.
- RandoHolmes 6y ago
  This is known as circumstantial evidence and I think part of what scares the shit out of people is seeing posts like yours arguing that purely circumstantial evidence should be used in this way. Imagine being the unibombers neighbor and getting arrested for the crimes because you searched for the same things he did.

jeffbee 6y ago

> There’s no way he’s the only one that searched for those terms Why not? Why would anyone search for both dcleaks and guccifer months before dcleaks was a web site or guccifer was a persona?

donmcronald 6y ago
IMO they’d say that explicitly if it was the case. In reality I bet lots of people searched for those individual terms and linking a combo back to a pair of /24s seems iffy to me. Why can’t they link it back to his exact IP? If the answer is that Google and Facebook have logs and the ISP doesn’t, that’s another whole conversation, especially if they can be linked back to a specific individual like in this case. I doubt anyone would be ok with having a lifetime search history.
- jeffbee 6y ago
  > Why can’t they link it back to his exact IP? Because permanent logs don't contain full addresses, because of GDPR.
donmcronald 6y ago
https://trends.google.com/trends/explore?date=2016-03-01%202016-09-30&geo=US&q=guccifer https://trends.google.com/trends/explore?date=2016-03-01%202... What’s the spike on May 5 there? It’s 12 days earlier.

mike_d 6y ago

At the time the terms likely did not have statistically significant search volume. I'm not going to say he was the only one, but the other three might have been people who then corrected their search from "dcleaks" to "dc voltage leak" or something. If you search for "[government agency] mailing address" three days before they receive anthrax in the mail, it isn't a slam dunk case. But if it was also mailed from your zip code, you had placed 6 phone calls to that agency in the prior month, etc. it makes you a pretty damn good candidate.

donmcronald 6y ago
What was the search volume? That’s relevant and they should have to list it.
- mike_d 6y ago
  I don't know. But everything the FBI got from Google was also given to the defense. If it was a popular set of terms, the defense would have raised that argument.
  - srtjstjsj 6y ago
    It wouldn't be popular if they also filtered it to a suspect's geoip range or other qualifiers.
- jessaustin 6y ago
  https://trends.google.com/trends/explore?date=today%205-y&geo=US&q=guccifer https://trends.google.com/trends/explore?date=today%205-y&ge... There has been some interest throughout the last five years. The first big spike was the first week of May, 2016. However, there were smaller peaks in March and April.
RandoHolmes 6y ago
This is known as circumstantial evidence and I think part of what scares the shit out of people is seeing posts like yours arguing that purely circumstantial evidence should be used in this way. Imagine being the unibombers neighbor and getting arrested for the crimes because you searched for the same things he did.