3 ms·
>The government alleges the defendants and other members of ViLE use various methods to obtain victims’ personal information, including: -tricking customer ser
by curmudgeon22 4y ago
>The government alleges the defendants and other members of ViLE use various methods to obtain victims’ personal information, including:
-tricking customer service employees;
-submitting fraudulent legal process to social media companies to elicit users’ registration information;
-co-opting and corrupting corporate insiders;
-searching public and private online databases;
-accessing a nonpublic United States government database without authorization
-unlawfully using official email accounts belonging to other countries.
>Prosecutors say they tied Singh to the government portal hack because he connected to it from an Internet address that he’d previously used to access a social media account registered in his name. When they raided Singh’s residence on Sept. 8, 2022 and seized his devices, investigators with Homeland Security found a cellular phone and laptop that allegedly “contained extensive evidence of access to the Portal.”
>The complaint alleges that between February 2022 and May 2022, Ceraolo used an official email account belonging to a Bangladeshi police official to pose as a police officer in communication with U.S.-based social media platforms.
- dmix 4y ago> because he connected to it from an Internet address that he’d previously used to access a social media account registered in his name. Is the implication here that the US gov has broad access to accounts IDs->IP address which access social media accounts? Or can the FBI/three letter agencies can go to Twitter/FB/etc (or some NSA db) and ask which accounts logged in via x IP address? Or, less conspiratorial, the investigators had some leads on x group of accounts -> got warrants for account IP addresses -> confirmed hypothesis.
- ajross 4y agoI don't see where you're getting "conspiratorial". It's no doubt just that, y'know, warrants shall issue upon probable cause. If you give information about yourself to someone else, and the cops reasonably suspect you of a crime and can convince a court to that effect, then they can get the info. There's absolutely no new or weird law enforcement powers needed.
- dmix 4y agoI said less conspiratorial in context of the third option because the other two were obviously much more sketchy options? Obviously if the investigators had a lead on particular social media usernames they could get warrants for them. Unless you mean you think it's "normal" for police to ask Google/Twitter/etc for data dumps of every single account that ever connected from x IP address?
- ajross 4y ago> Unless you mean you think it's "normal" for police to ask Google/Twitter/etc for data dumps of every account that ever connected from x IP address? I don't see where "data dumps of every account" is substantiated anywhere, you're introducing that as a prior. They no doubt had a suspect[1], got something incriminating, took it to a judge and that was enough to get Meta or whoever to cough up the logs. If you're genuinely curious just wait for the court case and follow it. The defense will be presented with all the warrants and will challenge things if they don't look legal. [1] No doubt because someone got sloppy with opsec and posted something from the wrong account. It's always something like that. Crime is actually really hard to do anonymously.
- dmix 4y ago> They no doubt had a suspect[1], got something incriminating, took it to a judge and that was enough to get Meta or whoever to cough up the logs. So literally what I said in my original comment: >> Or, less conspiratorial, the investigators had some leads on x group of accounts -> got warrants for account IP addresses -> confirmed hypothesis.
- mc32 4y agoDidn't Snowden give us some insight into how these things happen? What would lead us to believe they do not currently happen?
- runnerup 4y agoIt definitely implies one of these, and at face value, they're both terrible. A single IP being used somewhere makes sense to go to the ISP and ask "hey who was this IP assigned to at this time?". It does not make sense that the police should be able to get a warrant for data from every single website in the western world based only on a single IP. But Snowden already proved that PRISM is a thing. Also why stop at Facebook/Twitter/Discord? Should police also get warrants for AshleyMadison.com, Tryst.link, UnitedNuclear.com, DonateToPoliticalParty.org, INeedAnAbortion.org, etc etc? "Hey did anyone with this IP perform a transaction on your site and can you give us their name?"
- vkou 4y ago> It does not make sense that the police should be able to get a warrant for data from every single website in the western world based only on a single IP. Why not? The police can go around every single business in town, and ask if a man matching some particular description patronized it. This isn't a fishing expedition, this is the police asking for particular information about a particular person, who they are investigating for a particular crime. This is... Normal police work.
- runnerup 4y agoThey can go around to every business in town and ask, they can’t get a warrant though.
- vkou 4y agoIt's quite likely that the police came to Facebook et al with warrants.
- runnerup 4y agoYes and some people think the issuance of those presumed warrants are inappropriate. However, it’s been proven that the government doesn’t necessarily need warrants as they’ve had unlimited access to the firehouse of data directly through the PRISM program.
- monero-xmr 4y agoI think you are looking too closely. They were being investigated for instagram extortion. They had an IP. Therefore subpoena instagram for that IP. Not exactly rocket science
- dmix 4y agoThat's probably most likely
- beepbooptheory 4y agoI kind of thought even the second option here was pretty much a given these days.. Is it even more conspiratorial than the third?
- raincom 4y agoIt sounds like "Parellel construction".
- bagels 4y agoFbi asks twitter, Facebook etc who used this ip address. They will probably tell them. If they don't, it gets a subpoena, and then they get the accounts. It's regular everyday police work. No secret spy programs required.
- catminou 4y agoThis. For the feds they're called 2703d orders to request for information. It's a pretty common thing.
- CapstanRoller 4y agoThe US government requires that all ISPs install wiretapping devices as a precondition for doing business. Failure to install and maintain wiretapping devices incurs a penalty of $130,000 per day, with a maximum of $1,325,000 per violation (unlimited violations). Assume every ISP is compromised and that every government agency can see everything. https://en.wikipedia.org/wiki/Communications_Assistance_for_Law_Enforcement_Act https://en.wikipedia.org/wiki/Communications_Assistance_for_...
- Nextgrid 4y agoDue to HTTPS, an ISP will not see which social media account someone is logging in unless it's somehow leaked in unencrypted form (unlikely).
- CapstanRoller 4y agoThey don't need to leak it. ISPs, web hosts, social media companies, etc. give up the information willingly, and the feds take care of all the correlation work as needed. Remember "SSL added and removed here :^)"? https://archive.is/W3PDG https://archive.is/W3PDG
- Nextgrid 4y ago"SSL added and removed here :^)" was over a decade ago now? HTTPS and encryption since became commonplace. Not to mention, there's really no reason for the feds to try and break/work around HTTPS in this case when they have more than enough to subpoena the provider and they'll happily surrender the logs.
- CapstanRoller 4y ago>"SSL added and removed here :^)" was over a decade ago now? Yes, and surveillance has become even more entrenched since then. >HTTPS and encryption since became commonplace. HTTPS only protects the information in transit. It can't protect you from a backdoored load balancer or other endpoint, which is what that infamous slide was about. The NSA wasn't breaking encryption, but rather compromising the devices that were communicating via HTTPS with you. The little padlock icon in your browser says nothing about the trustworthiness of the server on the other end. It's like talking on a secure line with someone who is actually a spy.
- temp2022account 4y agoDoesn't have to be a govt conspiracy, facebook will sell you IDs->IP address. It's literally their business model, answering the question "Who bought stuff where, or when do people want to buy stuff?". "where" and "when" can be derived from a time-series of IPs, for example to know if you observed something on your phone over wifi (implying you live with others, so network-based ads would be most effective) or cellular (implying you're alone rn + targeted ads are better).
- wolongong942 4y agoI wouldn't be surprised, but parallel construction is also likely in these cases. E.g. they have some god-mode global network analytics to link most VPNs to real IPs, and simply make up some alternative plausible but bs story about how they tracked them.
- edgyquant 4y ago> parallel construction is also likely in these cases Source? Why is this likely?
- j0hnyl 4y agoThese investigations take a ton of time and involve lots of subpoenas.
- 0cf8612b2e1e 4y agoIf he had kept the phone and laptop encrypted would he have gotten away with it? IP address is something, but not a smoking gun.