3 ms·

The legal aspect of this is interesting. It seems like leaving bystanders alone and removing the threat (what the FBI did) is in everyone's best interests. No

The legal aspect of this is interesting. It seems like leaving bystanders alone and removing the threat (what the FBI did) is in everyone's best interests. Nobody wants to get dragged to court over an old Linksys. Still, this isn't a foreign warzone. These are devices that were presumably owned by Americans, working out of American homes. I wonder under what legal authority the FBI can hack into and modify American devices. What if they accidentally brick something? What if they find evidence of personal illegal activity?

nine_k 3y ago
I would say that it could be the same framework as for firefighters, or for a bomb squad. They may need to enter private property in order to protect it, or nearby areas, from an imminent threat. As such, they of course don't have a search warrant, but they have a license to locate and disable a source of threat: a fire, a bomb, a piece of highly radioactive material, etc. IANAL, of course.
- bredren 3y ago
  They applied for and received a Search Warrant (5018) to cover all activity described in the article: >The FBI will identify a list of U.S.-based routers infected with the malware, as described in Attachment A. >The FBI seeks authorization under Federal Rule of Criminal Procedure 41(b)(6)(B) to remotely search those routers and seize the evidence and instrumentalities of the hackers' criminal offenses, as described in Attachment B. >As part of this search and seizure, the FBI will remove the malware from the infected routers and take limited, reversible steps to prevent re-infection. To GP’s questions, the scenarios would be handled as in any other search warrant. Though I’d presume this is rather unusual and to increase the likelihood of future approval, the agent would try to avoid stumbling into having to decide if some completely unrelated crime needs to be prosecuted. Aside from this, it’s intriguing that they state the changes they planned to make to the routers would be reversible. I wonder how practical this might be if needed, given potential shift in IP. Also, when, if ever the owners will be notified of the activity. This may be covered in one of the filings.
  - bsimpson 3y ago
    Thanks for doing the legwork!
BytesAndGears 3y ago
I don’t usually love parallels from digital to physical worlds, especially with regards to laws, since there is a lot of nuance that gets lost. But, with that said… If I own a property that I don’t use, and people start making and selling drugs there, without me knowing… to what degree am I liable? And what do the police/FBI do in that situation? I would be totally fine with them entering the property, dealing with the specific threat, not looking at more than they need to for that investigation, and letting me know what happened. It seems like the exact same thing. These people were allowing illegal activity on their property (devices), unknowingly. So the police come in and deal with the threat, only look at what they need for the specific investigation, and let people know afterwards.
- username135 3y ago
  Makes a lot of sense to me
bell-cot 3y ago
"Before the takedown could be conducted legally, FBI agents had to receive authority—technically for what’s called a seizure of infected routers or "target devices"—from a federal judge. An initial affidavit seeking authority was filed in US federal court in Houston in December. Subsequent requests have been filed since ..." - https://arstechnica.com/security/2024/01/chinese-malware-removed-from-soho-routers-after-fbi-issues-covert-commands/ https://arstechnica.com/security/2024/01/chinese-malware-rem... That story notes that the FBI's actions also prevented re-infection...at least until the routers are rebooted.
redserk 3y ago
I have a mild rant on the notion of legal authority. I think it should come down to intent. If this is an action purely done for the benefit of end-users with an honest-to-goodness attempt at no snooping around, I fail to see this as a problem. This is an example of government doing it's job to protect it's citizens. I'd like to see this go a step further. I'd love to get an email or phone call saying that they noticed my router was part of a botnet, they remoted in to fix the issue, and (if applicable) run a software update to permanently apply the fix. It concerns me that we possess so much skepticism around the idea that government _can_ act benevolently. This is extremely harmful as it prevents us from putting forth any meaningful guardrails around these kinds of activities. We defer too much to the false idea that we're protected from tyranny by refusing to acknowledge we can have a government work for us.
- chmod775 3y ago
  You're attacking a strawman. Nobody "refuses to acknowledge" any of that. To many, missing out on the upsides is simply preferable, because they consider those powers falling into the hands of a bad government an unacceptable risk. They recognize that taking power away from the government is infinitely harder than not bequeathing power in the first place and also that they might not trust next year's government - even if they trust the current bunch. Personally I'd prefer there be so many limitations, checks, and balances, that no trust in my government is necessary at all, but as a German I'm strongly biased.
- qingcharles 3y ago
  This is called "the ends justify the means" in legal terms. It is used (illegally) regularly in criminal cases and 99% of the time the government gets away with it. It is technically frowned upon though for the possibility of it running away with itself -- where is the line drawn once you say the line we have (laws) can be crossed.
GoblinSlayer 3y ago
You say it as if p2p works. It doesn't. Everything is behind NAT and you can't just go connect there by yourself.
lupire 3y ago
The FBI has the legal authority, under judicial supervision, to break and enter, search and seize, and shoot to kill. Destruction of property is less lethal.
qingcharles 3y ago
The FBI has done it before -- with the Playpen malware it installed on PCs using a Firefox exploit: https://www.eff.org/pages/playpen-cases-frequently-asked-questions https://www.eff.org/pages/playpen-cases-frequently-asked-que... It was challenged in court, but the courts did a bunch of hand-waving and said it all sounds constitutional. You find that a lot of the time with criminal cases involving bad people, the courts will often find a way to let things slide using the "ends justify the means" tactic.
- halJordan 3y ago
  This is certainly not the same thing as your case study. You can be just anti-govt. That's ok. But you can't do these sweeping conflations to hoodwink people yourself. If you can criticize them for "hand-waving" then do not lower yourself to that level.

nine_k 3y ago

I would say that it could be the same framework as for firefighters, or for a bomb squad. They may need to enter private property in order to protect it, or nearby areas, from an imminent threat. As such, they of course don't have a search warrant, but they have a license to locate and disable a source of threat: a fire, a bomb, a piece of highly radioactive material, etc. IANAL, of course.

bredren 3y ago
They applied for and received a Search Warrant (5018) to cover all activity described in the article: >The FBI will identify a list of U.S.-based routers infected with the malware, as described in Attachment A. >The FBI seeks authorization under Federal Rule of Criminal Procedure 41(b)(6)(B) to remotely search those routers and seize the evidence and instrumentalities of the hackers' criminal offenses, as described in Attachment B. >As part of this search and seizure, the FBI will remove the malware from the infected routers and take limited, reversible steps to prevent re-infection. To GP’s questions, the scenarios would be handled as in any other search warrant. Though I’d presume this is rather unusual and to increase the likelihood of future approval, the agent would try to avoid stumbling into having to decide if some completely unrelated crime needs to be prosecuted. Aside from this, it’s intriguing that they state the changes they planned to make to the routers would be reversible. I wonder how practical this might be if needed, given potential shift in IP. Also, when, if ever the owners will be notified of the activity. This may be covered in one of the filings.
- bsimpson 3y ago
  Thanks for doing the legwork!

BytesAndGears 3y ago

I don’t usually love parallels from digital to physical worlds, especially with regards to laws, since there is a lot of nuance that gets lost. But, with that said… If I own a property that I don’t use, and people start making and selling drugs there, without me knowing… to what degree am I liable? And what do the police/FBI do in that situation? I would be totally fine with them entering the property, dealing with the specific threat, not looking at more than they need to for that investigation, and letting me know what happened. It seems like the exact same thing. These people were allowing illegal activity on their property (devices), unknowingly. So the police come in and deal with the threat, only look at what they need for the specific investigation, and let people know afterwards.

username135 3y ago
Makes a lot of sense to me

bell-cot 3y ago

"Before the takedown could be conducted legally, FBI agents had to receive authority—technically for what’s called a seizure of infected routers or "target devices"—from a federal judge. An initial affidavit seeking authority was filed in US federal court in Houston in December. Subsequent requests have been filed since ..." - https://arstechnica.com/security/2024/01/chinese-malware-removed-from-soho-routers-after-fbi-issues-covert-commands/ https://arstechnica.com/security/2024/01/chinese-malware-rem... That story notes that the FBI's actions also prevented re-infection...at least until the routers are rebooted.

redserk 3y ago

I have a mild rant on the notion of legal authority. I think it should come down to intent. If this is an action purely done for the benefit of end-users with an honest-to-goodness attempt at no snooping around, I fail to see this as a problem. This is an example of government doing it's job to protect it's citizens. I'd like to see this go a step further. I'd love to get an email or phone call saying that they noticed my router was part of a botnet, they remoted in to fix the issue, and (if applicable) run a software update to permanently apply the fix. It concerns me that we possess so much skepticism around the idea that government _can_ act benevolently. This is extremely harmful as it prevents us from putting forth any meaningful guardrails around these kinds of activities. We defer too much to the false idea that we're protected from tyranny by refusing to acknowledge we can have a government work for us.

chmod775 3y ago
You're attacking a strawman. Nobody "refuses to acknowledge" any of that. To many, missing out on the upsides is simply preferable, because they consider those powers falling into the hands of a bad government an unacceptable risk. They recognize that taking power away from the government is infinitely harder than not bequeathing power in the first place and also that they might not trust next year's government - even if they trust the current bunch. Personally I'd prefer there be so many limitations, checks, and balances, that no trust in my government is necessary at all, but as a German I'm strongly biased.
qingcharles 3y ago
This is called "the ends justify the means" in legal terms. It is used (illegally) regularly in criminal cases and 99% of the time the government gets away with it. It is technically frowned upon though for the possibility of it running away with itself -- where is the line drawn once you say the line we have (laws) can be crossed.

GoblinSlayer 3y ago

You say it as if p2p works. It doesn't. Everything is behind NAT and you can't just go connect there by yourself.

lupire 3y ago

The FBI has the legal authority, under judicial supervision, to break and enter, search and seize, and shoot to kill. Destruction of property is less lethal.

qingcharles 3y ago

The FBI has done it before -- with the Playpen malware it installed on PCs using a Firefox exploit: https://www.eff.org/pages/playpen-cases-frequently-asked-questions https://www.eff.org/pages/playpen-cases-frequently-asked-que... It was challenged in court, but the courts did a bunch of hand-waving and said it all sounds constitutional. You find that a lot of the time with criminal cases involving bad people, the courts will often find a way to let things slide using the "ends justify the means" tactic.

halJordan 3y ago
This is certainly not the same thing as your case study. You can be just anti-govt. That's ok. But you can't do these sweeping conflations to hoodwink people yourself. If you can criticize them for "hand-waving" then do not lower yourself to that level.