4 ms·

see page 31: "...An FBI TOR network expert analyzed the data from the Pen/Trap and was able to determine that a significant portion of the traffic from the CHIC

by fpp 15y ago

see page 31: "...An FBI TOR network expert analyzed the data from the Pen/Trap and was able to determine that a significant portion of the traffic from the CHICAGO RESIDENCE to the Internet was TOR-related traffic..." Guess they did not want to provide too much info on that - otherwise they would have had to acknowledge that they are actually screening all traffic with deep inspection.

wmf 15y ago
I don't know what you mean by "all traffic"; on the previous page it says the FBI installed some kind of device to capture the suspect's traffic, which is hardly a controversial practice.
- fpp 15y ago
  Well, this is now called lawful inspection. The deeper meaning of this is that all I-Net traffic can / is inspected through special interfaces at the ISPs (that could of course also be on the edge of the networks) and all (larger) ISPs have to make those available 24/7 without knowing who's accessing them. Generally speaking I guess it might be better to say that all traffic taking certain routes (I certainly don't want to explain this) or using / showing certain patterns will automatically be inspected. From a logical point of view you will have to look into everything if you do not know what you're searching for and identify the unusual or some "patterns" you already know... The general approaches used here are similar to IDS solutions and generally HW based / speed enhanced solutions are used for that (magnitudes faster than software only). Keywords on that - if you want to find out more - are Deep Packet Inspection, lawful inspection and interception, network neutrality, PCRF etc. There is a whole industry providing these services / solutions (to the TelComs and government agencies) and their biggest players are all based in the U.S.
  - wmf 15y ago
    Yeah, we know about CALEA and ECHELON, but there's no evidence that they were used in this case so I don't know why you're bringing it up. It sounds like conspiracy-mongering.
    - fpp 15y ago
      Hold your horses - you're trying to kill the messenger! This is what the congressional hearings with AT&T reg. Bush Mark 2 interceptions were all about - now its all legal so no press on that anymore. And I guess you know that what can be done will be done. No conspiracy, standard practice - 15 years ago everybody involved into such practices would have been called a terrorist, enemy no 1 to our democratic systems now seemingly its the other way around.
      - jrockway 15y ago
        Nobody is shooting the messenger. You're saying "oh noes, the government is evil! look!" where in this case, there is no evidence of that. Without inspecting every packet on the Internet, they still got this guy with something equivalent to a regular wiretap.
eli 15y ago
You're overthinking it. All it means is a bunch of traffic was going to and from known tor nodes.
sliverstorm 15y ago
The FBI has TOR network experts? Hmm. I wonder if they use it themselves?
- smsm42 15y ago
  What's so surprising in that? FBI can probably hire an expert in any existing technology. I'm sure they have very smart people working for them, and if they need they can always use outside consultants. I'd be pretty surprised and disappointed if they didn't have some experts with knowledge in everything that pertains to internet security, cracking, etc. There's a whole industry about that, for years now, so why not?
  - sliverstorm 15y ago
    I guess what I'm saying is, it makes it sound like they have a guy on staff (not contracted) whose whole job is to be the TOR expert. I just wasn't expecting TOR would be that important.
    - smsm42 15y ago
      It doesn't say his whole job is to be TOR expert. He could have knowledge in TOR - one doesn't have to be exceptionally knowledgeable to be considered "expert" in legalese, regular working knowledge of the matter allowing him to make informed conclusions like "this set of packets is a TOR traffic going to this IP" should be enough - and other matters too.

by fpp 15y ago

wmf 15y ago

I don't know what you mean by "all traffic"; on the previous page it says the FBI installed some kind of device to capture the suspect's traffic, which is hardly a controversial practice.

fpp 15y ago
Well, this is now called lawful inspection. The deeper meaning of this is that all I-Net traffic can / is inspected through special interfaces at the ISPs (that could of course also be on the edge of the networks) and all (larger) ISPs have to make those available 24/7 without knowing who's accessing them. Generally speaking I guess it might be better to say that all traffic taking certain routes (I certainly don't want to explain this) or using / showing certain patterns will automatically be inspected. From a logical point of view you will have to look into everything if you do not know what you're searching for and identify the unusual or some "patterns" you already know... The general approaches used here are similar to IDS solutions and generally HW based / speed enhanced solutions are used for that (magnitudes faster than software only). Keywords on that - if you want to find out more - are Deep Packet Inspection, lawful inspection and interception, network neutrality, PCRF etc. There is a whole industry providing these services / solutions (to the TelComs and government agencies) and their biggest players are all based in the U.S.
- wmf 15y ago
  Yeah, we know about CALEA and ECHELON, but there's no evidence that they were used in this case so I don't know why you're bringing it up. It sounds like conspiracy-mongering.
  - fpp 15y ago
    Hold your horses - you're trying to kill the messenger! This is what the congressional hearings with AT&T reg. Bush Mark 2 interceptions were all about - now its all legal so no press on that anymore. And I guess you know that what can be done will be done. No conspiracy, standard practice - 15 years ago everybody involved into such practices would have been called a terrorist, enemy no 1 to our democratic systems now seemingly its the other way around.
    - jrockway 15y ago
      Nobody is shooting the messenger. You're saying "oh noes, the government is evil! look!" where in this case, there is no evidence of that. Without inspecting every packet on the Internet, they still got this guy with something equivalent to a regular wiretap.

eli 15y ago

You're overthinking it. All it means is a bunch of traffic was going to and from known tor nodes.

sliverstorm 15y ago

The FBI has TOR network experts? Hmm. I wonder if they use it themselves?

smsm42 15y ago
What's so surprising in that? FBI can probably hire an expert in any existing technology. I'm sure they have very smart people working for them, and if they need they can always use outside consultants. I'd be pretty surprised and disappointed if they didn't have some experts with knowledge in everything that pertains to internet security, cracking, etc. There's a whole industry about that, for years now, so why not?
- sliverstorm 15y ago
  I guess what I'm saying is, it makes it sound like they have a guy on staff (not contracted) whose whole job is to be the TOR expert. I just wasn't expecting TOR would be that important.
  - smsm42 15y ago
    It doesn't say his whole job is to be TOR expert. He could have knowledge in TOR - one doesn't have to be exceptionally knowledgeable to be considered "expert" in legalese, regular working knowledge of the matter allowing him to make informed conclusions like "this set of packets is a TOR traffic going to this IP" should be enough - and other matters too.