5 ms·

> Proving who accessed it has become a huge forensic investigation at that point. If you have some simple logging and a foolish "hacker", it's a pretty trivial

> Proving who accessed it has become a huge forensic investigation at that point. If you have some simple logging and a foolish "hacker", it's a pretty trivial investigation.

seasoup 6y ago
With everyone sharing a single user name and password for access, I don't have a high level of confidence they have simple logging.
- ogre_codes 6y ago
  The fact that they were able to get a search warrant suggests they have some evidence pointing to her. The most obvious evidence is server logs. It doesn't take a ton of expertise to set logging, most web services log access by default.
  - tremon 6y ago
    I'd say the most obvious is an old e-mail sent to her containing the username and password. Do we know for certain that the judge who issued the warrant was aware that the same username/password was repeatedly issued to different persons?
  - rascul 6y ago
    > The fact that they were able to get a search warrant suggests they have some evidence pointing to her. Warrants do not require evidence, just a signature.
shakna 6y ago
> If you have some simple logging and a foolish "hacker", it's a pretty trivial investigation. The system is Internet-exposed. Even proving the user is in the country that you think they are is nontrivial.
- ogre_codes 6y ago
  > The system is Internet-exposed. Even proving the user is in the country that you think they are is nontrivial. If you run an internet exposed service and you log IP addresses and have the ability to issue a warrant, it is entirely trivial to trace a request back to a specific house. There are a lot of ways to obfuscate your IP address, but if you don't know how to cover your tracks, it's easy to get caught.
  - shakna 6y ago
    > If you run an internet exposed service and you log IP addresses and have the ability to issue a warrant, it is entirely trivial to trace a request back to a specific house. Having an IP address alone is not generally probable cause enough to get a warrant, because they are regularly rotated, and shared, across geographic areas. And that's assuming nothing proxying that connection at all.
    - ogre_codes 6y ago
      > Having an IP address alone is not generally probable cause enough to get a warrant, because they are regularly rotated, and shared, across geographic areas. It might not be enough to convict her, it is enough to get a warrant. While they do rotate, ISPs do this with law enforcement a fair amount and I'm pretty sure they keep track of who owns which IP at any given moment. > And that's assuming nothing proxying that connection at all. A clever knowledgeable person would proxy, most people wouldn't know how. This is why I said it would be a foolish hacker. It's also possible someone else tapped into her wifi and did it. Or maybe there was no IP. I'm just suggesting what is the most obvious piece of evidence which a judge would accept to grant a warrant here.
    - jonstewart 6y ago
      Is this merely an assertion or do you have evidence to back up that this isn’t enough for probable cause? I believe a whole lot of people have been served search warrants due to ISP logs.
btilly 6y ago
It can be a trivial investigation. It is also a trivial piece of data to plant. Given the facts, I see no particular motivation for her to have sent the message. However I do see a motivation for the department to try to frame her. And they've already established a willingness to make stuff up. And I'd also want to know more about the setup. What is the machine used for? What else is on it? How is the logging set up? Given the general incompetence shown, I wouldn't be surprised if the machine needed to provide ingress is also one that is publicly accessible for downloading data from the public. With lots of stuff in unlogged POST requests. If so, they could indeed have a request from her close in time to when the message was sent. And it might be legitimately hard to figure out whether she was doing something authorized or not.
- unityByFreedom 6y ago
  I agree, looks like a setup. She had already gone viral and didn't need more attention. Nothing gained, tons risked means she had no motive.
- tptacek 6y ago
  Those sound like the kind of things you establish at a trial, right?
  - WaxProlix 6y ago
    Right, a fair and honest trial that you hold after seizing her property and assaulting her family in front of her with the full legal backing of the state. Seems good.
    - tptacek 6y ago
      I don't see how you're connecting the dots between executing a search warrant and "unfair trial".
  - btilly 6y ago
    Not in the USA. Our plea bargain system is so lopsided that 97% of criminal charges end with a guilty plea without a trial. Even if she is 90% sure of winning at trial, unless she has a million dollars lying around and a deathwish, it STILL isn't worth it to fight the system. I first looked into this after Aaron Swartz's suicide. Every time I've looked since it has seemed even more broken. This is bad news for anyone who cares about justice. And good news for any authorities who are trying to target someone that they don't like.

> Proving who accessed it has become a huge forensic investigation at that point. If you have some simple logging and a foolish "hacker", it's a pretty trivial investigation.

seasoup 6y ago

With everyone sharing a single user name and password for access, I don't have a high level of confidence they have simple logging.

ogre_codes 6y ago
The fact that they were able to get a search warrant suggests they have some evidence pointing to her. The most obvious evidence is server logs. It doesn't take a ton of expertise to set logging, most web services log access by default.
- tremon 6y ago
  I'd say the most obvious is an old e-mail sent to her containing the username and password. Do we know for certain that the judge who issued the warrant was aware that the same username/password was repeatedly issued to different persons?
- rascul 6y ago
  > The fact that they were able to get a search warrant suggests they have some evidence pointing to her. Warrants do not require evidence, just a signature.

shakna 6y ago

> If you have some simple logging and a foolish "hacker", it's a pretty trivial investigation. The system is Internet-exposed. Even proving the user is in the country that you think they are is nontrivial.

ogre_codes 6y ago
> The system is Internet-exposed. Even proving the user is in the country that you think they are is nontrivial. If you run an internet exposed service and you log IP addresses and have the ability to issue a warrant, it is entirely trivial to trace a request back to a specific house. There are a lot of ways to obfuscate your IP address, but if you don't know how to cover your tracks, it's easy to get caught.
- shakna 6y ago
  > If you run an internet exposed service and you log IP addresses and have the ability to issue a warrant, it is entirely trivial to trace a request back to a specific house. Having an IP address alone is not generally probable cause enough to get a warrant, because they are regularly rotated, and shared, across geographic areas. And that's assuming nothing proxying that connection at all.
  - ogre_codes 6y ago
    > Having an IP address alone is not generally probable cause enough to get a warrant, because they are regularly rotated, and shared, across geographic areas. It might not be enough to convict her, it is enough to get a warrant. While they do rotate, ISPs do this with law enforcement a fair amount and I'm pretty sure they keep track of who owns which IP at any given moment. > And that's assuming nothing proxying that connection at all. A clever knowledgeable person would proxy, most people wouldn't know how. This is why I said it would be a foolish hacker. It's also possible someone else tapped into her wifi and did it. Or maybe there was no IP. I'm just suggesting what is the most obvious piece of evidence which a judge would accept to grant a warrant here.
  - jonstewart 6y ago
    Is this merely an assertion or do you have evidence to back up that this isn’t enough for probable cause? I believe a whole lot of people have been served search warrants due to ISP logs.

btilly 6y ago

It can be a trivial investigation. It is also a trivial piece of data to plant. Given the facts, I see no particular motivation for her to have sent the message. However I do see a motivation for the department to try to frame her. And they've already established a willingness to make stuff up. And I'd also want to know more about the setup. What is the machine used for? What else is on it? How is the logging set up? Given the general incompetence shown, I wouldn't be surprised if the machine needed to provide ingress is also one that is publicly accessible for downloading data from the public. With lots of stuff in unlogged POST requests. If so, they could indeed have a request from her close in time to when the message was sent. And it might be legitimately hard to figure out whether she was doing something authorized or not.

unityByFreedom 6y ago
I agree, looks like a setup. She had already gone viral and didn't need more attention. Nothing gained, tons risked means she had no motive.
tptacek 6y ago
Those sound like the kind of things you establish at a trial, right?
- WaxProlix 6y ago
  Right, a fair and honest trial that you hold after seizing her property and assaulting her family in front of her with the full legal backing of the state. Seems good.
  - tptacek 6y ago
    I don't see how you're connecting the dots between executing a search warrant and "unfair trial".
- btilly 6y ago
  Not in the USA. Our plea bargain system is so lopsided that 97% of criminal charges end with a guilty plea without a trial. Even if she is 90% sure of winning at trial, unless she has a million dollars lying around and a deathwish, it STILL isn't worth it to fight the system. I first looked into this after Aaron Swartz's suicide. Every time I've looked since it has seemed even more broken. This is bad news for anyone who cares about justice. And good news for any authorities who are trying to target someone that they don't like.