10 ms·

USA Today resists FBI subpoena seeking IP addresses of readers of a story

234 points by panarky 5y ago

doggodaddo78 5y ago
This is insane. I guess it's a best practice to not disclose real personal details for library cards, store discount programs, and such where it's not absolutely required and where it can be avoided.
midasuni 5y ago
And HN still has the view websites should collect and store every morsel of data about every visitor because nothing to hide, nothing to fear.
- poundofshrimp 5y ago
  Quite the opposite. The HN crowd is very privacy-conscientious.
  - midasuni 5y ago
    Any post about the gdpr has dozens of googlers saying how awful it is they can’t just capture every bit of data they want from visitors.
    - trasz 5y ago
      Of course, since they directly profit from violating people’s privacy, but Google is not HN.
tpmx 5y ago
The perp is already dead. https://www.bbc.com/news/world-us-canada-55908105 https://www.bbc.com/news/world-us-canada-55908105 According to the Miami Herald, the suspect was barricaded inside a home for several hours before shooting and killing himself.
joelbondurant 5y ago
Twitter would print out nudes for the communist police state.
h2odragon 5y ago
I recall hunting stories on this one, because there was an 8chan rumor that one of the FBI agents shot had been "their head kiddie porn investigator" and they'd been working on the Hunter Biden laptop case for over a year in secret. There appeared to be no correlation at all. The rumor died down fast too.
barelysapient 5y ago
My mind immediately went to trying to match a screenshot of the article that someone posted. The USA Today website does a little bit of localization in the navigation bar. If that's visible together with the system clock its probably enough to narrow to a very small set of IPs.
mc32 5y ago
That would be quite a wide net and quite the "fishing expedition" and why the FBI has earned itself a bad rep (in addition to things like getting people on unrelated charges like "lying" while they are free to make things up.
neilv 5y ago
> “The FBI’s subpoena asks for private information about the readers of our journalism. We have asked the court to quash the subpoena to protect the important relationship and trust between USA TODAY’s readers and our journalists.” Yet it looks like usatoday.com article pages continuously leak this same information, and more, to at least a dozen commercial third parties. Is the difference that the government was trying to get the information for free?
- jl2718 5y ago
  Maybe they could have easily gotten the data otherwise,but decided to do the right thing by requesting it through the direct channel and allowing this process to take place through the legal system.
  - throwaway0a5e 5y ago
    Yup. I read pedos or terrorists combined with a different than usual request for information as a red flag for "fishing for a precedent".
- oss2020 5y ago
  Advertisers don't raid your house.
  - nyokodo 5y ago
    > Advertisers don't raid your house. No, but they can give that data to the FBI who do raid houses.
    - isomorphic 5y ago
      As the parent post noted, the USA Today home page makes requests to dozens of third-parties--including Amazon, Facebook, Google, Twitter, and something called "summerhamster". I'm sure one of the dozens will take the FBI's call. Hilariously, the USA Today homepage also hits OneTrust, who has the slogan "Privacy, Security and Data Governance" right in the <title>. What is there to govern if nearly all the major tech players have your access logs? USA Today is shouting its readers' reading behavior from the mountain top.
rapjr9 5y ago
Talk about a chilling effect, i.e., do not read the news because law enforcement can subpoena the list of what you read. Lawyers recommend never sharing anything with law enforcement because it can be used against you. So the news articles you read can now be used against you? The FBI seems to think so. This is exactly the reason there are laws prohibiting law enforcement from ask libraries for lists of what patrons read. Someone at the FBI is way out of bounds.
- helsinkiandrew 5y ago
  To be fair this doesn't sound like a fishing expedition - they're looking for readers in a 35 minute period. Presumably they have a crime suspect or suspects who may have viewed it in that time. Ideally they would be able to narrow it down to specific IP addresses, but perhaps this is not possible.
  - chii 5y ago
    if they can produce a warrant for this data, there's no reason why the site cannot comply. But to get the warrant must require a judge to grant it, and it must be lawful.
    - A4ET8a8uTh0 5y ago
      Lawful is an interesting term. Patriot Act was voted in and is the law of the land. It allows for NSLs and other rather controversial if not unconstitutional practices. Warrant is not a must. This is not a movie. You would be surprised how many companies give you what you want just by calling as LEO.
      - atatatat 5y ago
        > Patriot Act was voted in and was the law of the land.
        A4ET8a8uTh0 5y ago
boomboomsubban 5y ago
This seems like a crafted case to set some kind of precedent. The request involves cop killing and child abuse, though it's really hard to see how the requested information is useful as the "suspect" killed himself. My guess would be they're trying to prove a related person saw the incident and wiped their drives or something, but that's some weak evidence. Additionally, the FBI likely could just buy this data. Also, why is this challenge which featured a gag order not be dealt with in a secret court? Doesn't our knowledge of events already make the USA Today guilty of a crime even if this subpoena doesn't stand?
- 2cb 5y ago
  I’m also wondering how this got public so easily if there was a gag order, but it sounds like the court made it public initially and USA Today just responded to that news.
  - boomboomsubban 5y ago
    That's still pretty suspect. The info was important enough that the courts issues a gag order, but the courts then broke it themselves?
DreamSpinner 5y ago
It's interesting, the article discusses that the request is for a relatively short period of time (35 minutes) - however for a popular website that could still be thousands of viewers. It suggests that there's something they're specifically looking to match against - but if that was the case, I would think that specific IP addresses could be provided in the request - e.g. Did any one of these 10 IP addresses view the article in the time period. Much more specific and likely easier to justify. I'd rampantly speculate that perhaps that time matches to the link being posted in a pedophilia related forum (with the forum behind TOR) - and the FBI would like to get a list of who might have followed it there.
- curryst 5y ago
  > Did any one of these 10 IP addresses view the article in the time period. Much more specific and likely easier to justify. It is, but it also leaks information. Now people know you're looking at those IP addresses. If you were going to leak that, a major news outlet is probably not the place you want it to leak to. You might be right and it might be an easy cover for a fishing expedition, but it doesn't seem inherently malicious on its face.
  - weird-eye-issue 5y ago
    They could hash them if that really was the problem.
    - nucleardog 5y ago
      That's only 4 billion hashes to search the entire IPv4 address space. I don't think the entire search space is big enough for that really to provide much privacy while still being functional. Whatever you put in the way, that's somewhere in the neighbourhood of cracking a 6 character lowercase+number password.
      - zapdrive 5y ago
        How about adding a salt? Check your records and if sha256([salt] + ipaddress]) matches this hash, let us know. Where salt is a long random string.
ls15 5y ago
https://archive.is/kL7Zm https://archive.is/kL7Zm

234 points by panarky 5y ago

This is insane. I guess it's a best practice to not disclose real personal details for library cards, store discount programs, and such where it's not absolutely required and where it can be avoided.

midasuni 5y ago

And HN still has the view websites should collect and store every morsel of data about every visitor because nothing to hide, nothing to fear.

poundofshrimp 5y ago
Quite the opposite. The HN crowd is very privacy-conscientious.
- midasuni 5y ago
  Any post about the gdpr has dozens of googlers saying how awful it is they can’t just capture every bit of data they want from visitors.
  - trasz 5y ago
    Of course, since they directly profit from violating people’s privacy, but Google is not HN.

tpmx 5y ago

The perp is already dead. https://www.bbc.com/news/world-us-canada-55908105 https://www.bbc.com/news/world-us-canada-55908105 According to the Miami Herald, the suspect was barricaded inside a home for several hours before shooting and killing himself.

joelbondurant 5y ago

Twitter would print out nudes for the communist police state.

h2odragon 5y ago

I recall hunting stories on this one, because there was an 8chan rumor that one of the FBI agents shot had been "their head kiddie porn investigator" and they'd been working on the Hunter Biden laptop case for over a year in secret. There appeared to be no correlation at all. The rumor died down fast too.

barelysapient 5y ago

My mind immediately went to trying to match a screenshot of the article that someone posted. The USA Today website does a little bit of localization in the navigation bar. If that's visible together with the system clock its probably enough to narrow to a very small set of IPs.

mc32 5y ago

That would be quite a wide net and quite the "fishing expedition" and why the FBI has earned itself a bad rep (in addition to things like getting people on unrelated charges like "lying" while they are free to make things up.

neilv 5y ago

> “The FBI’s subpoena asks for private information about the readers of our journalism. We have asked the court to quash the subpoena to protect the important relationship and trust between USA TODAY’s readers and our journalists.” Yet it looks like usatoday.com article pages continuously leak this same information, and more, to at least a dozen commercial third parties. Is the difference that the government was trying to get the information for free?

jl2718 5y ago
Maybe they could have easily gotten the data otherwise,but decided to do the right thing by requesting it through the direct channel and allowing this process to take place through the legal system.
- throwaway0a5e 5y ago
  Yup. I read pedos or terrorists combined with a different than usual request for information as a red flag for "fishing for a precedent".
oss2020 5y ago
Advertisers don't raid your house.
- nyokodo 5y ago
  > Advertisers don't raid your house. No, but they can give that data to the FBI who do raid houses.
  - isomorphic 5y ago
    As the parent post noted, the USA Today home page makes requests to dozens of third-parties--including Amazon, Facebook, Google, Twitter, and something called "summerhamster". I'm sure one of the dozens will take the FBI's call. Hilariously, the USA Today homepage also hits OneTrust, who has the slogan "Privacy, Security and Data Governance" right in the <title>. What is there to govern if nearly all the major tech players have your access logs? USA Today is shouting its readers' reading behavior from the mountain top.

rapjr9 5y ago

Talk about a chilling effect, i.e., do not read the news because law enforcement can subpoena the list of what you read. Lawyers recommend never sharing anything with law enforcement because it can be used against you. So the news articles you read can now be used against you? The FBI seems to think so. This is exactly the reason there are laws prohibiting law enforcement from ask libraries for lists of what patrons read. Someone at the FBI is way out of bounds.

helsinkiandrew 5y ago
To be fair this doesn't sound like a fishing expedition - they're looking for readers in a 35 minute period. Presumably they have a crime suspect or suspects who may have viewed it in that time. Ideally they would be able to narrow it down to specific IP addresses, but perhaps this is not possible.
- chii 5y ago
  if they can produce a warrant for this data, there's no reason why the site cannot comply. But to get the warrant must require a judge to grant it, and it must be lawful.
  - A4ET8a8uTh0 5y ago
    Lawful is an interesting term. Patriot Act was voted in and is the law of the land. It allows for NSLs and other rather controversial if not unconstitutional practices. Warrant is not a must. This is not a movie. You would be surprised how many companies give you what you want just by calling as LEO.
    - atatatat 5y ago
      > Patriot Act was voted in and was the law of the land.
      - A4ET8a8uTh0 5y ago

boomboomsubban 5y ago

This seems like a crafted case to set some kind of precedent. The request involves cop killing and child abuse, though it's really hard to see how the requested information is useful as the "suspect" killed himself. My guess would be they're trying to prove a related person saw the incident and wiped their drives or something, but that's some weak evidence. Additionally, the FBI likely could just buy this data. Also, why is this challenge which featured a gag order not be dealt with in a secret court? Doesn't our knowledge of events already make the USA Today guilty of a crime even if this subpoena doesn't stand?

2cb 5y ago
I’m also wondering how this got public so easily if there was a gag order, but it sounds like the court made it public initially and USA Today just responded to that news.
- boomboomsubban 5y ago
  That's still pretty suspect. The info was important enough that the courts issues a gag order, but the courts then broke it themselves?

DreamSpinner 5y ago

It's interesting, the article discusses that the request is for a relatively short period of time (35 minutes) - however for a popular website that could still be thousands of viewers. It suggests that there's something they're specifically looking to match against - but if that was the case, I would think that specific IP addresses could be provided in the request - e.g. Did any one of these 10 IP addresses view the article in the time period. Much more specific and likely easier to justify. I'd rampantly speculate that perhaps that time matches to the link being posted in a pedophilia related forum (with the forum behind TOR) - and the FBI would like to get a list of who might have followed it there.

curryst 5y ago
> Did any one of these 10 IP addresses view the article in the time period. Much more specific and likely easier to justify. It is, but it also leaks information. Now people know you're looking at those IP addresses. If you were going to leak that, a major news outlet is probably not the place you want it to leak to. You might be right and it might be an easy cover for a fishing expedition, but it doesn't seem inherently malicious on its face.
- weird-eye-issue 5y ago
  They could hash them if that really was the problem.
  - nucleardog 5y ago
    That's only 4 billion hashes to search the entire IPv4 address space. I don't think the entire search space is big enough for that really to provide much privacy while still being functional. Whatever you put in the way, that's somewhere in the neighbourhood of cracking a 6 character lowercase+number password.
    - zapdrive 5y ago
      How about adding a salt? Check your records and if sha256([salt] + ipaddress]) matches this hash, let us know. Where salt is a long random string.

ls15 5y ago

https://archive.is/kL7Zm https://archive.is/kL7Zm