5 ms·

> Today, it came to the Government’s attention—based on data obtained through the use of a pen register on the defendant’s gmail account—that the defendant used

> Today, it came to the Government’s attention—based on data obtained through the use of a pen register on the defendant’s gmail account—that the defendant used a VPN or “Virtual Private Network” to access the internet on January 29, 2023, and February 12, 2023. https://en.wikipedia.org/wiki/Pen_register https://en.wikipedia.org/wiki/Pen_register

gzer0 4y ago
I mean, I knew that there was mass surveillance occurring, but to this extent... perhaps I needed a refresher on just how much warrantless data is being collected on the citizens of the United States. The DEA has warrantless access to with no judicial oversight under "administrative subpoenas" originated by the DEA. The DEA pays AT&T to maintain employees throughout the country devoted to investigating call records through this database for the DEA. The database grows by 4 billion records per day, and presumably covers all traffic that crosses AT&T's network. Internal directives instructed participants never to reveal the project publicly. Information that is legally collectible according to 2014 pen trap laws includes: Phone * Dialed numbers * Received call numbers * The time the call was made * Whether the call was answered, or went to voice-mail * The length of each call * Content of SMS text messages * The real-time location of a cell phone to within a few meters Email * All email header information other than the subject line * The email addresses of the people to whom an email was sent * The email addresses of people whom received the email * The time each email is sent or received * The size of each email that is sent or received Internet * IP address, port, and protocol used * The IP address of other computers on the Internet that information was exchanged with * Time-stamp and size information of Internet access * Protocol traffic analysis to obtain URL web addresses surfed on the web, emails posted or read, instant messages exchanged, and information posted onto message boards The last one is particularly damning. Interesting that no warrant is needed for any of this. [1] https://www.nytimes.com/2013/09/02/us/drug-agents-use-vast-phone-trove-eclipsing-nsas.html?hp&_r=0&pagewanted=all https://www.nytimes.com/2013/09/02/us/drug-agents-use-vast-p... [2] https://archive.nytimes.com/www.nytimes.com/interactive/2013/09/02/us/hemisphere-project.html#p19 https://archive.nytimes.com/www.nytimes.com/interactive/2013... --- Crucially, they said, the phone data is stored by AT&T, and not by the government as in the N.S.A. program. It is queried for phone numbers of interest mainly using what are called “administrative subpoenas,” those issued not by a grand jury or a judge but by a federal agency, in this case the D.E.A. Administrative subpoena authorities allow executive branch agencies to issue a compulsory request for documents or testimony without prior approval from a grand jury, court, or other judicial entity. --- Planting AT&T employees and deeply embedding them within the government like that, utilizing "administrative subpoena's" that require no grand jury OR judge (just the DEA themselves) is, in my personal opinion, a breach of my 4th amendment right.
- RhodesianHunter 4y ago
  What makes you assume no warrant in this case?
  - sho_hn 4y ago
    The Wikipedia page on "Pen register" suggests you don't need a warrant.
    - cldellow 4y ago
      The Wikipedia page talks about the history of pen registers over the last 100 years. It's a lengthy, complicated page, and I'm not a lawyer... but I think the relevant section that describes their current use is this one, which suggests to me that you do need a warrant: > For law enforcement agencies to get a pen register approved for surveillance, they must get a court order from a judge. According to 18 U.S.C. § 3123(a)(1), the "court shall enter an ex parte order authorizing the installation and use of a pen register or trap and trace device anywhere within the United States, if the court finds that the attorney for the Government has certified to the court that the information likely to be obtained by such installation and use is relevant to an ongoing criminal investigation".
      - sho_hn 4y ago
        As I understood it, a court order is not a warrant. A warrant requires probable cause, a court order does not? I may be wrong.
        deleted 4y ago
        [deleted]
- munk-a 4y ago
  While I agree this level of surveillance is worrying since it's probably also being applied to normal people.... SBF has been charged and has been awaiting trial domestically since Dec 30, 2022. They are, from a spectator[1] point of view, quite clearly guilty of a lot of shady stuff and it would honestly be pretty bonkers if they had access to private communication for non-privileged conversations at this point. 1. Edited as per comment below.
sschueller 4y ago
So in this case it's basically a BCC on his Gmail?
- Tostino 4y ago
  More than that it seems, pretty much Google sharing all activity logs on the account in question when told to by a court. So, no matter what you do to try and hide your trail, if you try and interact with your existing account at all LE will be informed.
alwayslikethis 4y ago
Should have gone with Mullvad (not affiliated). They don't require or send emails.
- shaugen 4y ago
  I think you misunderstood what they are tracking. Google would still see him login into his gmail account from a know VPN provider IP address. And Google is the entity logging and sharing logs, not the VPN provider.
  - alwayslikethis 4y ago
    Possibly. The document doesn't say exactly how, but I was thinking of a scenario where SBF received an email from a VPN company, since email metadata can be collected under the Pen Register Act. Though what you said about Google logging IPs might be the case instead.
Animats 4y ago
It's amusing that the Government calls what they're doing with Google a "pen register". They usually do that to squeeze through the small exception in the Fourth Amendment created by Smith v. Maryland. The pen register shown in that Wikipedia article is mine. To use it, you need physical access to a phone line, probably at the central office. You put in a blank spool of paper tape, add stamp pad ink to the ink roller, and wind it up with a big brass key. When it detects a dial pulse, the clockwork mechanism starts the tape moving, and each dial pulse produces a dash on the tape. There's a mechanical idle timer which stops tape movement after a few seconds of idle time. I built a box with a phone dial to run that brass device as a demo. That's what law enforcement had to use in the days of electromagnetic central offices. Only long distance calls were logged. Local calls were, at most, counted. That's why the Supreme Court decision refers to a pen register as an "extremely limited" device.
- joshspankit 4y ago
  Sounds like for transparency there should be another photo added to the article: the (probably ominous) currently-used “internet pen register”.
  - Animats 4y ago
    Look up "CALEA", the US law that requires telecom and internet providers to build in wiretapping. It's mostly software in routers, but there's something called a "CALEA Mediation Device", which is the interface between the network and the wiretapping agency. Here's one: [1] [1] https://www.shoghicom.com/fixed-line-lawful-interception.php https://www.shoghicom.com/fixed-line-lawful-interception.php
- cloudripper 4y ago
  Fascinating.. Thank you for the history lesson. Do you happen to have video of your demo functioning that you'd be willing to share?
  - Animats 4y ago
    No, I haven't made a video. I'm not a YouTuber. I might should make a video and upload it to the Internet Archive, for historical reference. These seem to be rare devices.
deleted 4y ago
[deleted]

gzer0 4y ago

I mean, I knew that there was mass surveillance occurring, but to this extent... perhaps I needed a refresher on just how much warrantless data is being collected on the citizens of the United States. The DEA has warrantless access to with no judicial oversight under "administrative subpoenas" originated by the DEA. The DEA pays AT&T to maintain employees throughout the country devoted to investigating call records through this database for the DEA. The database grows by 4 billion records per day, and presumably covers all traffic that crosses AT&T's network. Internal directives instructed participants never to reveal the project publicly. Information that is legally collectible according to 2014 pen trap laws includes: Phone * Dialed numbers * Received call numbers * The time the call was made * Whether the call was answered, or went to voice-mail * The length of each call * Content of SMS text messages * The real-time location of a cell phone to within a few meters Email * All email header information other than the subject line * The email addresses of the people to whom an email was sent * The email addresses of people whom received the email * The time each email is sent or received * The size of each email that is sent or received Internet * IP address, port, and protocol used * The IP address of other computers on the Internet that information was exchanged with * Time-stamp and size information of Internet access * Protocol traffic analysis to obtain URL web addresses surfed on the web, emails posted or read, instant messages exchanged, and information posted onto message boards The last one is particularly damning. Interesting that no warrant is needed for any of this. [1] https://www.nytimes.com/2013/09/02/us/drug-agents-use-vast-phone-trove-eclipsing-nsas.html?hp&_r=0&pagewanted=all https://www.nytimes.com/2013/09/02/us/drug-agents-use-vast-p... [2] https://archive.nytimes.com/www.nytimes.com/interactive/2013/09/02/us/hemisphere-project.html#p19 https://archive.nytimes.com/www.nytimes.com/interactive/2013... --- Crucially, they said, the phone data is stored by AT&T, and not by the government as in the N.S.A. program. It is queried for phone numbers of interest mainly using what are called “administrative subpoenas,” those issued not by a grand jury or a judge but by a federal agency, in this case the D.E.A. Administrative subpoena authorities allow executive branch agencies to issue a compulsory request for documents or testimony without prior approval from a grand jury, court, or other judicial entity. --- Planting AT&T employees and deeply embedding them within the government like that, utilizing "administrative subpoena's" that require no grand jury OR judge (just the DEA themselves) is, in my personal opinion, a breach of my 4th amendment right.

RhodesianHunter 4y ago
What makes you assume no warrant in this case?
- sho_hn 4y ago
  The Wikipedia page on "Pen register" suggests you don't need a warrant.
  - cldellow 4y ago
    The Wikipedia page talks about the history of pen registers over the last 100 years. It's a lengthy, complicated page, and I'm not a lawyer... but I think the relevant section that describes their current use is this one, which suggests to me that you do need a warrant: > For law enforcement agencies to get a pen register approved for surveillance, they must get a court order from a judge. According to 18 U.S.C. § 3123(a)(1), the "court shall enter an ex parte order authorizing the installation and use of a pen register or trap and trace device anywhere within the United States, if the court finds that the attorney for the Government has certified to the court that the information likely to be obtained by such installation and use is relevant to an ongoing criminal investigation".
    - sho_hn 4y ago
      As I understood it, a court order is not a warrant. A warrant requires probable cause, a court order does not? I may be wrong.
      - deleted 4y ago
        [deleted]
munk-a 4y ago
While I agree this level of surveillance is worrying since it's probably also being applied to normal people.... SBF has been charged and has been awaiting trial domestically since Dec 30, 2022. They are, from a spectator[1] point of view, quite clearly guilty of a lot of shady stuff and it would honestly be pretty bonkers if they had access to private communication for non-privileged conversations at this point. 1. Edited as per comment below.

sschueller 4y ago

So in this case it's basically a BCC on his Gmail?

Tostino 4y ago
More than that it seems, pretty much Google sharing all activity logs on the account in question when told to by a court. So, no matter what you do to try and hide your trail, if you try and interact with your existing account at all LE will be informed.

alwayslikethis 4y ago

Should have gone with Mullvad (not affiliated). They don't require or send emails.

shaugen 4y ago
I think you misunderstood what they are tracking. Google would still see him login into his gmail account from a know VPN provider IP address. And Google is the entity logging and sharing logs, not the VPN provider.
- alwayslikethis 4y ago
  Possibly. The document doesn't say exactly how, but I was thinking of a scenario where SBF received an email from a VPN company, since email metadata can be collected under the Pen Register Act. Though what you said about Google logging IPs might be the case instead.

Animats 4y ago

It's amusing that the Government calls what they're doing with Google a "pen register". They usually do that to squeeze through the small exception in the Fourth Amendment created by Smith v. Maryland. The pen register shown in that Wikipedia article is mine. To use it, you need physical access to a phone line, probably at the central office. You put in a blank spool of paper tape, add stamp pad ink to the ink roller, and wind it up with a big brass key. When it detects a dial pulse, the clockwork mechanism starts the tape moving, and each dial pulse produces a dash on the tape. There's a mechanical idle timer which stops tape movement after a few seconds of idle time. I built a box with a phone dial to run that brass device as a demo. That's what law enforcement had to use in the days of electromagnetic central offices. Only long distance calls were logged. Local calls were, at most, counted. That's why the Supreme Court decision refers to a pen register as an "extremely limited" device.

joshspankit 4y ago
Sounds like for transparency there should be another photo added to the article: the (probably ominous) currently-used “internet pen register”.
- Animats 4y ago
  Look up "CALEA", the US law that requires telecom and internet providers to build in wiretapping. It's mostly software in routers, but there's something called a "CALEA Mediation Device", which is the interface between the network and the wiretapping agency. Here's one: [1] [1] https://www.shoghicom.com/fixed-line-lawful-interception.php https://www.shoghicom.com/fixed-line-lawful-interception.php
cloudripper 4y ago
Fascinating.. Thank you for the history lesson. Do you happen to have video of your demo functioning that you'd be willing to share?
- Animats 4y ago
  No, I haven't made a video. I'm not a YouTuber. I might should make a video and upload it to the Internet Archive, for historical reference. These seem to be rare devices.

deleted 4y ago

[deleted]