8 ms·

The brave new world of overzealous law enforcement data warehouse searches just continues to wreak havoc on "cloud" services and content. It's akin to digging u

by ldayley 15y ago

The brave new world of overzealous law enforcement data warehouse searches just continues to wreak havoc on "cloud" services and content. It's akin to digging up the neighborhood to search somebody's house. What can the Feds/providers do differently to prevent this from happening so often?

owenmarshall 15y ago
>What can the Feds/providers do differently to prevent this from happening so often? The feds could do plenty, but won't. The legal system is slow to react, and the feds likely fear that just taking virtual disks would lead to evidentiary issues at trial. Hosting providers might be able to provision in a way that the servers hosting evil.site could be taken by the feds but backups existed of the other sites, but it would be an extremely hard -- if not impossible -- task. In the end, cloud computing doesn't change the rules of safely deploying your site to the world -- if you care about uptime & your data, your site must be running on at least two different hosts.
- SoftwareMaven 15y ago
  Two different hosts separated by a distance.
  - jacques_chester 15y ago
    Two different hosts separated by a border would be better.
- seabee 15y ago
  > and the feds likely fear that just taking virtual disks would lead to evidentiary issues at trial. Honest question: why are physical hard disks more valid as evidence than virtual ones? Aren't they equally easy to tamper with?
  - wmf 15y ago
    You probably can't take a virtual disk; you could copy it, which answers your question: a copy is considered less valid than the original.
    - seabee 15y ago
      I don't think it does answer the question, though. The data is the evidence rather than the medium it exists on. What guarantee is made that the disk wasn't tampered with that cannot be made by a cryptographic signature... ...or is the answer that the law has no adequate treatment of abstract evidence?
  - owenmarshall 15y ago
    Well, sure. But the police have a well designed chain of custody system to at least reduce the possibility of tampering. Not everybody in the office can tamper with evidence behind lock and key with seals -- of course it still happens, but the goal is to reduce the possibility. This falls apart when the evidence in question is data that can be copied, altered, etc. And of course we can likely come up with clever cryptographic answers to this problem, but in the end, it's far easier and a more understood procedure for the police just to grab hardware and seal it up.
    - jleader 15y ago
      Keep in mind that ultimately the chain of custody must be explained to a jury, to convince them that what they're being shown actually comes from the defendant's computer, while a defense attorney does his best to sow doubt in the jury's minds. Do you want to explain to 12 randomly selected people how virtual disks work, and the cryptographic algorithms you used to ensure that the data you're showing them is identical to the data the defendant had on their system? Could you explain it so well that a reasonably skilled defense attorney couldn't confuse them enough to produce reasonable doubt?
troutwine 15y ago
> What can the Feds/providers do differently to prevent this from happening so often? In the United States we might start considering computer equipment as private spaces, not unlike our residents and vehicles. With so much of our lives increasingly digital in nature, it's not that screwy of an idea that law enforcement should require a search warrant for computer equipment and storage media.
- owenmarshall 15y ago
  > In the United States we might start considering computer > equipment as private spaces, not unlike our residents and > vehicles. With so much of our lives increasingly digital > in nature, it's not that screwy of an idea that law > enforcement should require a search warrant for computer > equipment and storage media. That's not at all the issue. The 4th amendment has been extended to digital media: http://www.cybercrime.gov/ssmanual/index.html http://www.cybercrime.gov/ssmanual/index.html I'd be willing to bet my house that the law enforcement had a search warrant to take the data in question. The problem is that the government's strategy -- grab the hardware -- doesn't work well when the hard drive is a virtual disk that sits on a server with a ton of other virtual disks. Ultimately though, I think this isn't a question that can be solved by technical means. The solution is going to come when law enforcement can come up with a way of "confiscating" the virtual disks that doesn't open the door for claims of tampering & evidence planting.
  - CWuestefeld 15y ago
    In a sane environment, you'd be right. But the government is going to claim that its "right" to get at the evidence is stronger than the property rights of the other co-resident users. Consider: the 4th Amendment isn't in effect when you're within 100 miles (?) of the border; the chance of smuggling, etc., is greater there, so the need to detain and search people in that zone outweighs our rights. Or, consider a case in which my buddy borrows my car, and is seen driving through an unsavory neighborhood, is stopped, and found with a big sum of cash. This gives them the "right" to confiscate my car because it was involved in drug trafficking, even though no crime has been committed, and I wasn't involved in any case.
mapgrep 15y ago
It seems ridiculous that this is affecting so many customers - pinboard, Curbed, one Instapaper eval/test server, bunch of individuals - when there was one FBI warrant. Apparently the FBI took three racks. If those are whole racks, it seems excessive. https://twitter.com/#!/Pinboard/status/83256217174147072 https://twitter.com/#!/Pinboard/status/83256217174147072 But another issue is that Digital One told Pinboard this was due to bad router firmware -- how do you confuse a software issue and an FBI raid? https://twitter.com/#!/Pinboard/status/83257679023325186 https://twitter.com/#!/Pinboard/status/83257679023325186
- bradleyland 15y ago
  When there's an FBI goon breathing down your neck telling you to keep your mouth shut, and you're pressured by customers to say something, your options aren't real attractive.
- evan_ 15y ago
  Maybe the router issue asserted itself when they removed the machines they had a warrant for and took out the pinboard et al servers.
- idlewords 15y ago
  These are blade servers so you can fit a whole bunch of them into one chassis. Still trying to figure out why they told us initially it was router trouble, and what exactly the sequence of events was.
- michaelf 15y ago
  Most likely, DigitalOne doesn't have support staff sleeping in hammocks at the colo. If you were an admin, logged in remotely (from switzerland, say, where DigitalOne is headquartered), and you saw a few racks of equipment go offline, would you: 1. suspect that someone had walked away with 3 racks, or 2. guess that some network hardware had gone bad? Usually it's a horse, but sometimes it's a zebra.
tdfx 15y ago
Letting people that are familiar with what they're investigating to actually run the investigations would be a fairly decent start. In my experience with federal law enforcement, the support personnel and a few agents are usually quite knowledgeable and on top of things. The supervisory agents, however, are promoted into the positions based on their performance in completely unrelated types of investigations.
wmf 15y ago
There may be safety in numbers. One can imagine that if the FBI showed up at an Amazon data center and was told "it's somewhere in these thousand racks" they'd rethink the "seize it all" approach.
- protomyth 15y ago
  I wouldn't bet any money on them changing their approach unless an Amazon lawyer is present.
  - wmf 15y ago
    In the time it would take them to load a thousand racks of equipment into the truck, I suspect Amazon's lawyers would indeed spring into action.
    - pyre 15y ago
      Unless they threatened the local staff to keep quiet (or whipped out the 'National Security Theater' card). I'll bet in either case, they would get smacked down hard by Amazon's lawyers though.
    - protomyth 15y ago
      probably, but the FBI could also round up all the data center employees for questioning.
- jacques_chester 15y ago
  In 2009, the FBI seized an entire data centre in Dallas. Not a server. Not a rack. Not a cage. [1] Everything. Moving rack after rack into waiting trucks makes for excellent TV. Somewhere in the FBI, right now, is a man or woman powerful enough and ignorant enough to order such a seizure. It's pretty much inevitable. [1] The original link is broken, but I discussed it at the time here: http://clubtroppo.com.au/2009/04/05/on-a-risk-i-had-not-considered/ http://clubtroppo.com.au/2009/04/05/on-a-risk-i-had-not-cons...

by ldayley 15y ago

owenmarshall 15y ago

>What can the Feds/providers do differently to prevent this from happening so often? The feds could do plenty, but won't. The legal system is slow to react, and the feds likely fear that just taking virtual disks would lead to evidentiary issues at trial. Hosting providers might be able to provision in a way that the servers hosting evil.site could be taken by the feds but backups existed of the other sites, but it would be an extremely hard -- if not impossible -- task. In the end, cloud computing doesn't change the rules of safely deploying your site to the world -- if you care about uptime & your data, your site must be running on at least two different hosts.

SoftwareMaven 15y ago
Two different hosts separated by a distance.
- jacques_chester 15y ago
  Two different hosts separated by a border would be better.
seabee 15y ago
> and the feds likely fear that just taking virtual disks would lead to evidentiary issues at trial. Honest question: why are physical hard disks more valid as evidence than virtual ones? Aren't they equally easy to tamper with?
- wmf 15y ago
  You probably can't take a virtual disk; you could copy it, which answers your question: a copy is considered less valid than the original.
  - seabee 15y ago
    I don't think it does answer the question, though. The data is the evidence rather than the medium it exists on. What guarantee is made that the disk wasn't tampered with that cannot be made by a cryptographic signature... ...or is the answer that the law has no adequate treatment of abstract evidence?
- owenmarshall 15y ago
  Well, sure. But the police have a well designed chain of custody system to at least reduce the possibility of tampering. Not everybody in the office can tamper with evidence behind lock and key with seals -- of course it still happens, but the goal is to reduce the possibility. This falls apart when the evidence in question is data that can be copied, altered, etc. And of course we can likely come up with clever cryptographic answers to this problem, but in the end, it's far easier and a more understood procedure for the police just to grab hardware and seal it up.
  - jleader 15y ago
    Keep in mind that ultimately the chain of custody must be explained to a jury, to convince them that what they're being shown actually comes from the defendant's computer, while a defense attorney does his best to sow doubt in the jury's minds. Do you want to explain to 12 randomly selected people how virtual disks work, and the cryptographic algorithms you used to ensure that the data you're showing them is identical to the data the defendant had on their system? Could you explain it so well that a reasonably skilled defense attorney couldn't confuse them enough to produce reasonable doubt?

troutwine 15y ago

> What can the Feds/providers do differently to prevent this from happening so often? In the United States we might start considering computer equipment as private spaces, not unlike our residents and vehicles. With so much of our lives increasingly digital in nature, it's not that screwy of an idea that law enforcement should require a search warrant for computer equipment and storage media.

owenmarshall 15y ago
> In the United States we might start considering computer > equipment as private spaces, not unlike our residents and > vehicles. With so much of our lives increasingly digital > in nature, it's not that screwy of an idea that law > enforcement should require a search warrant for computer > equipment and storage media. That's not at all the issue. The 4th amendment has been extended to digital media: http://www.cybercrime.gov/ssmanual/index.html http://www.cybercrime.gov/ssmanual/index.html I'd be willing to bet my house that the law enforcement had a search warrant to take the data in question. The problem is that the government's strategy -- grab the hardware -- doesn't work well when the hard drive is a virtual disk that sits on a server with a ton of other virtual disks. Ultimately though, I think this isn't a question that can be solved by technical means. The solution is going to come when law enforcement can come up with a way of "confiscating" the virtual disks that doesn't open the door for claims of tampering & evidence planting.
- CWuestefeld 15y ago
  In a sane environment, you'd be right. But the government is going to claim that its "right" to get at the evidence is stronger than the property rights of the other co-resident users. Consider: the 4th Amendment isn't in effect when you're within 100 miles (?) of the border; the chance of smuggling, etc., is greater there, so the need to detain and search people in that zone outweighs our rights. Or, consider a case in which my buddy borrows my car, and is seen driving through an unsavory neighborhood, is stopped, and found with a big sum of cash. This gives them the "right" to confiscate my car because it was involved in drug trafficking, even though no crime has been committed, and I wasn't involved in any case.

mapgrep 15y ago

It seems ridiculous that this is affecting so many customers - pinboard, Curbed, one Instapaper eval/test server, bunch of individuals - when there was one FBI warrant. Apparently the FBI took three racks. If those are whole racks, it seems excessive. https://twitter.com/#!/Pinboard/status/83256217174147072 https://twitter.com/#!/Pinboard/status/83256217174147072 But another issue is that Digital One told Pinboard this was due to bad router firmware -- how do you confuse a software issue and an FBI raid? https://twitter.com/#!/Pinboard/status/83257679023325186 https://twitter.com/#!/Pinboard/status/83257679023325186

bradleyland 15y ago
When there's an FBI goon breathing down your neck telling you to keep your mouth shut, and you're pressured by customers to say something, your options aren't real attractive.
evan_ 15y ago
Maybe the router issue asserted itself when they removed the machines they had a warrant for and took out the pinboard et al servers.
idlewords 15y ago
These are blade servers so you can fit a whole bunch of them into one chassis. Still trying to figure out why they told us initially it was router trouble, and what exactly the sequence of events was.
michaelf 15y ago
Most likely, DigitalOne doesn't have support staff sleeping in hammocks at the colo. If you were an admin, logged in remotely (from switzerland, say, where DigitalOne is headquartered), and you saw a few racks of equipment go offline, would you: 1. suspect that someone had walked away with 3 racks, or 2. guess that some network hardware had gone bad? Usually it's a horse, but sometimes it's a zebra.

tdfx 15y ago

Letting people that are familiar with what they're investigating to actually run the investigations would be a fairly decent start. In my experience with federal law enforcement, the support personnel and a few agents are usually quite knowledgeable and on top of things. The supervisory agents, however, are promoted into the positions based on their performance in completely unrelated types of investigations.

wmf 15y ago

There may be safety in numbers. One can imagine that if the FBI showed up at an Amazon data center and was told "it's somewhere in these thousand racks" they'd rethink the "seize it all" approach.

protomyth 15y ago
I wouldn't bet any money on them changing their approach unless an Amazon lawyer is present.
- wmf 15y ago
  In the time it would take them to load a thousand racks of equipment into the truck, I suspect Amazon's lawyers would indeed spring into action.
  - pyre 15y ago
    Unless they threatened the local staff to keep quiet (or whipped out the 'National Security Theater' card). I'll bet in either case, they would get smacked down hard by Amazon's lawyers though.
  - protomyth 15y ago
    probably, but the FBI could also round up all the data center employees for questioning.
jacques_chester 15y ago
In 2009, the FBI seized an entire data centre in Dallas. Not a server. Not a rack. Not a cage. [1] Everything. Moving rack after rack into waiting trucks makes for excellent TV. Somewhere in the FBI, right now, is a man or woman powerful enough and ignorant enough to order such a seizure. It's pretty much inevitable. [1] The original link is broken, but I discussed it at the time here: http://clubtroppo.com.au/2009/04/05/on-a-risk-i-had-not-considered/ http://clubtroppo.com.au/2009/04/05/on-a-risk-i-had-not-cons...