19 ms·

I have second hand knowledge of lawsuits that have been dropped by the FBI during discovery because it would require them revealing zero days they have on Tor.

• PartiallyTyped 4y ago
  Is there really any way to hide from a motivated state actor? Asking about it on HN is definitely not one. Relevant xkcd: 538 [1] [1] https://xkcd.com/538/ https://xkcd.com/538/
  • Jerrrry 4y ago
    No. Which is why Agora marketplace, digital lawyers, and a slew of others have simply said: "we no longer operate under any assumption of privacy regardless of measures taken, and have simple refused to operate on the internet any longer." Which is what the 3 letters want, a chilling-effect to reduce their Herculean-effort to just an Athenian one.
    • danuker 4y ago
      Physical measures might make yourself much more expensive to surveil, to the point of not being worth it. You can avoid being the "easy picking".
      • r3trohack3r 4y ago
        Bingo. Tor is just a layer. You still have to take measures to separate your identity from the device, the behavior, and the location. When tor falls, the next question is "what do they see?" You have control over that.
  • deleted 4y ago
    [deleted]
  • vorpalhex 4y ago
    Just as there is no perfect boat or perfect date, there is no perfect security or privacy. You can make things more and more difficult for your adversary (and usually for yourself too) but if they are dedicated enough they can basically outspend you. Therefore you need to minimize the apparent cost of your actions and their duration. You can afford to be a passing pain in their butt but you can't afford to be the focus of their eye.
  • hinata08 4y ago
    it depends on what you're doing (as far as I understand as a criminal news nerd) the police-justice system is usually broke for commoners. So yeah, if you're not doing a serious offense, they will never catch you. Where I live, you can buy weed. Even if the government says they're motivated to stop it, they don't have the resources to plant police everywhere. If your home was 'visited' by burglars, they would just take fingerprints. They wear gloves, and that's enough to avoid the state actor. if you're doing a real serious crime, you can kind-ish avoid attention, if you know retention laws and stuff. if the (mostly digital) traces you generated are too old, they would have disappeared or would not be usable in court. if you appeared on mall CCTV months before you did the crime, have been browsing sites over a year before, ... these data should technically have been deleted.- Just don't create new data in the meantime. In a similar fashion, some white collar criminals host data in their lawyers office. it is so hard to have a warrant for a lawyers office that you can be safe. A law teacher at our engineering college said it was convenient to hang out with a lawyer - just drop your phone in their purse if cops show up. then, you can avoid some digital communications. Putin and friends are well known for being mostly offline, unlike some ministers at western governments, for example. Send letters, and you will have that perfect forward secrecy. there has also been some stories about plausible deniability ( https://en.wikipedia.org/wiki/Plausible_deniability https://en.wikipedia.org/wiki/Plausible_deniability ), especially among rogue corporations and corrupt politicians. ie when you create data, you can do it in a way where it says what it says, but it's not meaningful in court. don't drag attention on you. cops shows teach you how so many criminals are found out after a traffic stop, when they were speeding or ran a red light. The government can't check everyone, so they check those who stand out. Lastly, I remember watching a youtuber who got out of prison, and who said that three people could only keep a secret if 2 are dead. it's a bit pessimistic and dark, but maybe don't just involve everyone in your crimes. I would like to know if series like Breaking Bad are (or were) realistic. I know some criminals learned a lot from movies. Edit : or just befriend politicians, you would be above any law in most places. Someone in France once stole 2.5 billions $ in one shot from the government. It what became known as the uramin scandal, and nobody was caught. So everything is possible.
    • AlbertCory 4y ago
      > three people could only keep a secret if 2 are dead Exactly. Which is why, not to start a JFK war, I think the Mafia killed JFK. If it were the CIA, or LBJ, someone would have talked. Anyone who knew what happened got whacked.
  • bumby 4y ago
    Possibly with the help of another motivated state actor. I believe one of the theories about the proliferation of the current organization of political entities is that the only organization that can reliably compete with one nation-state is another nation-state.
  • kerpotgh 4y ago
    Probably. If you use a laptop once, on a public Wi-Fi hundreds of miles from where you live, while not being caught on surveillance, while using a stripped down privacy based OS, and then route yourself through Tor, you might be okay.
    • magnat 4y ago
      Not if you brought your cellphone on the trip. Or used a car that has a built-in SIM card and cellular modem. Or you bought that laptop from a supplier that registers all MAC addresses of sold devices. Or that laptop had Computrace or some other firmware-based anti-theft mechanism.
      • kerpotgh 4y ago
        Okay so in addition to the above, use a burner and change your MAC address. “Lojacks” on laptops is still mostly pretty unheard of.
        • generalizations 4y ago
          > mostly pretty unheard of Yeah, but if there is an exception to that, it'd be the scenario we're talking about.
      • heavyset_go 4y ago
        Even if you had a car without a cell connection, license plate readers and cameras make it easy for anyone with access to replay and reverse any traveling you do with any car.
        • at-fates-hands 4y ago
          This is basically how the prosecutor in the Idaho case is putting Kohberger at the scene. They've also used where his cell phone was pinging during the night of the murders as additional evidence he was there. Meanwhile, detectives scoured video footage from cameras in the area and picked out a white Hyundai Elantra driving past the house three times before stopping on the fourth pass shortly after 4am. The car left 16 minutes later “at a high rate of speed”, according to Payne Meanwhile, FBI investigators trawled through Kohberger’s cellphone records and discovered that he turned it off shortly before the attack, perhaps thinking it would help him to avoid detection. The phone springs to life again at 4.48am on a road out of Moscow. The records also showed that Kohberger was in the area near the house at least a dozen times in the months before the attack, usually in the early morning or late evenings. Investigators said they were examining whether he “conducted surveillance on the King Road residents and was in contact with any of the victim’s associates before or after the alleged offense”.
  • timwaagh 4y ago
    Hole in the ground far away? Not on the internet presumably. In any case any would be terrorists should take note: don't use grannies computer.
  • dmux 4y ago
    One of my favorite HN comments of all time [0] suggested that MMO's provide plentiful means of covertly communicating: >MMO's are packed with possible communication channels in addition to chat. Ever wonder if that annoying gnome in the auction hall is jumping in morse code? Could signals be sent with bids? Could a character's inventory contents be arranged to leave a message to someone else who shares the login info? Is that nonsense coming from what you presume to be a bot-controlled gold-farming crew really nonsense? When a game goes to great lengths to simulate a world, the possibilities for covert communication are nearly limitless! [0] https://news.ycombinator.com/item?id=6874143 https://news.ycombinator.com/item?id=6874143
    • bmn__ 4y ago
      > MMO's provide plentiful means of covertly communicating This is a plot device in <http://enwp.org/Little_Brother_%28Doctorow_novel%29 http://enwp.org/Little_Brother_%28Doctorow_novel%29>.
      • skippyboxedhero 4y ago
        Also in the film Four Lions where terrorists use an online game to communicate (basically an unbranded Club Penguin). Wouldn't particularly recommend watching the film (it isn't bad, it is just depressing...which is the aim) but the media coverage of this does suggest it is occurring.
        • plugin-baby 4y ago
          > Wouldn't particularly recommend watching the film (it isn't bad, it is just depressing...which is the aim) It’s a comedy, I don’t think it aims to depress.
        • spott 4y ago
          Also in the first season of the Jack Ryan show (which only bears a very passing resemblance to Tom Clancy’s Jack Ryan, but has good action)
    • PartiallyTyped 4y ago
  • oceanplexian 4y ago
    If I were hiding from a state actor I'd use a high-bandwidth communications medium like video. In another life I worked for a large live streaming service, the infrastructure required to process terabits of video is mind-boggling in size, extremely technically challenging, and usually involves custom built ASICs and hardware that's expensive and in short supply. Even with the NSA's budget and infrastructure, I don't think it's technologically feasible for them to decrypt and then semantically process or store that much content. Video is also the vast majority of traffic on the Internet so it would be trivial to hide in plain sight with some creativity (Using stenography to hide content in the video) With 4k you can pack a ridiculous amount of information into even a single frame, and that's one frame among hundreds of thousands, among billions of videos.
    • autoexec 4y ago
      > Even with the NSA's budget and infrastructure, I don't think it's technologically feasible for them to decrypt and then semantically process or store that much content. I have little doubt that they can store terabits of video content. They let us know about their utah data center (https://en.wikipedia.org/wiki/Utah_Data_Center https://en.wikipedia.org/wiki/Utah_Data_Center) which was estimated to have as much as 12 exabytes in 2013 and who knows what data centers they have they aren't mentioning. Back in 2003 they had no problems capturing every bit of data that moved over AT&Ts network. Storage is dirt cheap and they can just hang onto everything until they see a reason to dig into it. No need to process everything right away. You'd think your video would be blending in with all the other video on the internet, but it really wouldn't. Streaming video put out by netflix is going to look very different than streaming video served via youtube vs streaming video over P2P etc.
      • derangedHorse 4y ago
        OP said he doesn't "think it's technologically feasible for them to decrypt and then semantically process or store that much content" meaning it's more about just storing the raw data. Assuming they could store it perfectly fine (which is a big 'if' considering Cisco estimated 7.7 Exabytes of data would be generated per day by 2021), they'd still have to decrypt all the videos, semantically analyze each video (subtitles, object detection, face recognition, etc), find a way to index that information to make it queryable, and run analytics on that data regularly. Ideally they wouldn't have to search everything when needed and could keep a running file on everyone (because lazily parsing data could be expensive and probably a waste on their existing current resources). That's not to say they can't do it, given that they probably have a huge budget, but it's also not a sure thing they can do it effectively for those who are trying to stay hidden.
  • joshlemer 4y ago
    What about www.bitmessage.org ?
• Fnoord 4y ago
  > If you're sitting in front of a computer that you're using for something the U.S. government has significant interest in prosecuting, that device should be considered compromised and adversarial - you should act accordingly. Yep: stop breaking the law. The vast majority the US government has significant interest in prosecuting, the general public is OK with.
  • r3trohack3r 4y ago
    > Yep: stop breaking the law That's certainly one takeaway. I wouldn't say that's "the" takeaway.
  • notch656c 4y ago
    Lol if you don't want to be fucked with by the government, just don't break the law! Unfortunately that doesn't work. Sometimes legal activities are best kept under wraps. I have a signed and executed federal search warrant in my drawer. I was tossed in a cell. I was dragged to a hospital. I was sent the bill for the "search" and am currently being hounded by debt collectors. Nothing was found and I did nothing wrong. Sadly just following the law didn't work.
    • Veen 4y ago
      Aren't you mixing up two different things? There's your problem, being harassed for something you say you didn't do. And there is the criminal's problem, being found out for something they did do. For the latter problem, not doing the illegal thing sounds like a solid strategy.
      • notch656c 4y ago
        Actually I could have avoided the warrant had I broke the law. It was because I followed the law that I was harassed. I could have easily jumped the fence to the US, and as a citizen unless caught in the act it'd be nigh impossible to prove I did anything wrong. Instead I presented at a port of entry where an insane officer claimed there was drugs up my ass.
      • 4y ago
• commandlinefan 4y ago
  > lawsuits that have been dropped by the FBI during discovery because it would require them revealing zero days Schneier himself predicted this in Applied Cryptography in the mid-90's.
  • 23B1 4y ago
    Still one of the best foundational texts on the topic!
• tinus_hn 4y ago
  Could also be like Freenet where they can say it’s likely someone browsed a bad site, but they can’t actually prove it.
• dehrmann 4y ago
  > it would require them revealing zero days they have on Tor I always figured this was the case for a lot of common things like full-disk encryption schemes, AES, root certs, etc. If there's a break, they wouldn't use it in court unless it's taking down a very, very big target.
  • nerbert 4y ago
    Indeed. Very big targets are taken by 0 days, and like Op above mentioned, low hanging fruits are taken by parallel construction. Looks like there is a sweet spot in the middle, where they can’t be bothered.
    • sneak 4y ago
      Parallel construction is illegal. Why do we tolerate government corruption at the highest levels of law enforcement?
      • josteink 4y ago
        > Parallel construction is illegal. Sure. But then first you have to prove it is a parallel construction.
      • ohyoutravel 4y ago
        I don’t think this is true unless the original evidence was obtained in violation of the fourth amendment, which zero days are not necessarily. You’re right though using parallel construction to launder prohibited search is illegal.
        • gregshap 4y ago
          Why wouldn't parallel construction be perjury, even if the real search was legal?
          • vkou 4y ago
            Why would it be? The purpose of laws like the 4A is to prevent the police from harassing innocent people by going on fishing expeditions. The purpose of the poisoned tree doctrine is to prevent the police from committing crimes as part of their work. But if a plains-clothes police officer sees you load a kilo of cocaine into your car every Tuesday, on the same street corner, there's nothing illegal or immoral about him telling a uniformed cop to show up next Tuesday, to observe you doing just that. I see no reason why the uniformed cop should be compelled to reveal his source. Now, if the plains-clothes officer was doing warrant-less break and entry in order to observe you doing the crime, that would be an ethical problem. This does create a bit of a connundrum - where you often can't tell if parallel construction was used to cover for legal, or for illegal behaviour. But I see no reason for why the first case I presented should be forbidden. If pressed on the stand as to why the officer chose that street corner to be on Tuesday, they can avoid prejury by declining to answer, or just say that they were tipped off. I find it doubtful that a judge would compel the officer to answer, or to elaborate - he's not the one that's on trial, after all.
• geepound 4y ago
  [dead]
• markus_zhang 4y ago
  I figured unless working for an intelligence agency or some ideological reasons there is no reason to go against the US government. I don't think there is enough protection against such actor unless you are working directly for another state actor. And even that you won't keep anonymity. Check the North Korean gov cracker case. DoJ managed to figure out his name and photo despite that he works for a state actor. That guy probably won't want to go abroad to most of the countries. Even countries competing with US such as China or Russia might send him to Uncle Sam for some exchange of interest. I actually think the Chinese probably provided some information to DoJ as he worked in the DaLian branch of a NK expo company for some years.
  • TechBro8615 4y ago
    Most US law enforcement ability comes from their subpoena power, so you could presumably stay out of reach of that by limiting your infrastructure to be located in countries without friendly relations with the US. I doubt some babushka's VPS provider in Belarus is going to respond to a subpoena from the FBI. (However, the FBI probably knows this, and they know you know this... so they might purchase a VPS from that same babushka, to spy on the traffic of neighboring hosts via ARP spoofing and similar network-level attacks.) Another area of exposure is payment networks (cryptocurrency or otherwise), so ideally you wouldn't purchase any infrastructure at all. But that's not always feasible. And of course, to be absolutely safe you'd also need to limit your own physical location to countries that don't extradite to the US (and hope they don't sign an extradition treaty before the statute of limitations runs out).
• pfisherman 4y ago
  > If you're sitting in front of a computer that you're using for something the U.S. government has significant interest in prosecuting, that device should be considered compromised and adversarial - you should act accordingly. I would say that if you are doing something the US government has a significant interest in prosecuting, you might want to reevaluate your life choices and think about whether it is something you ought to be doing in the first place. I know this is not going to be a hugely popular sentiment on here; but if you are doing something such that the US is going to burn a zero day to get you, the appropriate prior is that you are doing something supremely heinous and evil. You may in fact be on right the side of justice, but you do not get the benefit of the doubt by default.
  • lcnPylGDnU4H9OF 4y ago
    > the appropriate prior is that you are doing something supremely heinous and evil Generally speaking I can agree but more specifically cases like Julian Assange come to mind. Certainly there are at least some people who are at risk of this kind of persecution and otherwise not doing something that would so immediately be considered in such a negative light.
    • pfisherman 4y ago
      Reality Winner is probably a better example since she is a US citizen. How about ransomware gangs bricking hospital IT infrastructure? Seems like that is a much more common occurrence than the types of examples you are referring to. Hence the appropriate prior - absent evidence to the contrary - is that someone is doing heinous shit.
      • lcnPylGDnU4H9OF 4y ago
        Fair points. I appreciate the nuance you bring up.
  • mirkules 4y ago
    The good, old “If you’ve done nothing wrong, you have nothing to hide” argument. Just drop “US” in that statement and then reevaluate it. Then ask yourself why the US should be special in regard to (not) protecting people’s privacy.
• photochemsyn 4y ago
  According to various sources, such as Snowden's "Permanent Record", the tor network was designed to allow spies in remote locations to communicate securely with a known endpoint (such as CIA headquarters) without anyone being able to easily trace their exact location. The content of the communication itself would not be readable due to strong encryption, but the metadata (source and destination headers) could reveal who was talking to who. However, nation-states with enough backdoors to all the servers serving as tor jumpboxes could likely deanonymize the remote user (it's assumed they'd be watching all traffic going to and from the known endpoint, which in Snowden's case was a journalist's email server). Snowden's method IIRC was to acquire a laptop or phone without leaving any identifying marks (ownership information), then drive around until he found an open wireless network which he could log onto, then he'd use that network over tor to connect to the journalists he was talking to. The device was used for no other purpose, never turned on and connected to his home network, etc. There doesn't seem to be any way for two anonymous parties to find and connect with each other across tor in this manner however, without having some other side channel to coordinate time and place and exchange identifying information. You can still hide the content of communication using PGP-style strong encryption, but even then, it's likely that keys could be compromised in some manner.
  • Fnoord 4y ago
    CIA likely hidden in plain sight so you wouldn't figure out their Tor node. Likely hosted in some DC rest of USA also uses, for example a colo or dedicated at Rackspace. As for Snowden you just described a burner however he would still need to find or know that open WiFi hotspot.
    • colordrops 4y ago
      Most coffee shops?
      • deleted 4y ago
        [deleted]
      • mrlonglong 4y ago
• NN88 4y ago
  https://en.wikipedia.org/wiki/Graymail https://en.wikipedia.org/wiki/Graymail https://en.wikipedia.org/wiki/Parallel_construction https://en.wikipedia.org/wiki/Parallel_construction
• hinkley 4y ago
  Given the statute of limitations on some crimes, I'm surprised they don't rotate out zero days and bulk prosecute a bunch of people using the same one. With a big case they're willing to burn one exploit, why not do the same for ten cases?
• 77pt77 4y ago
  > I have second hand knowledge of lawsuits that have been dropped by the FBI during discovery because it would require them revealing zero days they have on Tor. Really? What's stopping them from just lying? Or claiming they had an anonymous tip?