11 ms·

Federal agents seek to loosen rules on hacking computers during investigations

101 points by jamesbritt 12y ago

danso 12y ago
Wow, well I just had a moment of self-reflection on what a Pollyanna I am...my first thought at reading the headline was, "Oh good, now people like Aaron Swartz can't be threatened with 15 year prison sentences, or (in other cases) become felons for violating certain interpretations of Terms of Service". And of course, it is not that.
- masonhensley 12y ago
  You are not alone, that's exactly what I thought from reading the title.
cinquemb 12y ago
“The proposed amendment would enable investigators to conduct a search and seize electronically stored information by remotely installing software on a large number of affected victim computers pursuant to one warrant issued by a single judge” I wonder if we'll start to see researchers/people come across more of things like this in the wild? Which makes me wonder if federal agents are going to be enlarging the attack surface against their own systems?
- zeroday01 12y ago
  I believe there have already been at least 2 cases of the FBI using the very mass exploitation technique discussed in the article. The 2012 investigation dubbed "Operation Torpedo"[0] and the Freedom Hosting exploit in 2013 dubbed "Torsploit"[1]. There were 25 arrests in the first operation and those suspects are currently fighting the search warrant because the FBI failed to give notice to the those who had the virtual search warrant executed on them within the required 30 days. Nothing has really come of the second operation (after over 10 months now) except for an arrest of someone the FBI was able to identify without the help of their exploit (they used the same user name on Tor as they did on the clearnet). [0]: http://www.wowt.com/news/headlines/Fed-Tactics-on-Trial-in-Porn-Case-255716621.html http://www.wowt.com/news/headlines/Fed-Tactics-on-Trial-in-P... [1]: http://www.propublica.org/nerds/item/is-the-u.s.-government-behind-torsploit http://www.propublica.org/nerds/item/is-the-u.s.-government-...
- nitrogen 12y ago
  If your quote means that one warrant can force a victim of hacking to install FBI spyware on their systems, this is very troubling, and seems like it would dissuade many organizations from reporting a hack at all, because the cure will be worse than the disease
devconsole 12y ago
A couple weeks ago, when I asked someone how to verify on demand that a BIOS isn't compromised, someone else quipped "Could be the processors too, better forge those by hand." https://news.ycombinator.com/item?id=7609780 https://news.ycombinator.com/item?id=7609780 In fact, it turns out the future is probably headed in that direction. All mobile phones are already compromised; every phone has a proprietary baseband chip with full remote DMA access that no amount of open software running on your phone can stop. And as laptops become more and more mobile, it's going to seem strange that we've spent so long trying to tether our mobile phones to our laptops. Perhaps future laptops are going to have 3G access embedded right into them which consumers can subscribe to for some low monthly fee. Consumers would probably love it, because it's very enticing: you get internet access in most of the world without having to find a public hotspot or tether your phone. No more dealing with hotel wifi; no more dealing with logging in to someone else's. The takeaway is that your children may grow up in a world where it's impossible to guarantee the government can't get into your computer if it really wanted to. Desktop computers aren't ever going to go away, but hardware design seems to be trending towards having built-in theft prevention. One feature of theft prevention is having the ability to locate the computer, or send it remote kill signals. If trends like that do catch on with consumers, it's "gg no re," because once our hardware is compromised to the point of third parties being able to remotely access it on demand, we've all lost something precious, and there won't be any opportunity to fix it. The more I think about it, the more it seems like it's just a matter of time until this happens, precisely because once it's here, it's never going away. More and more network adapters seem to have DMA access to your computer. It would be interesting if the protections afforded by open source software were defeated at the hardware level without most people noticing. There doesn't seem to be any way to defend against it, because open source hardware simply can't survive: no money is necessary to develop open source software, whereas large investment would be necessary for development of open source hardware down to the chip level.
- aliakbarkhan 12y ago
  > Perhaps future laptops are going to have 3G access embedded right into them which consumers can subscribe to for some low monthly fee. The future is now. http://www.dell.com/learn/us/en/19/campaigns/4g-3g-mobile-broadband-laptops http://www.dell.com/learn/us/en/19/campaigns/4g-3g-mobile-br... http://www.amazon.com/Samsung-XE303C12-H01US-Chromebook-3G-11-6-Inch/dp/B009M2YNWI http://www.amazon.com/Samsung-XE303C12-H01US-Chromebook-3G-1... http://www.bestbuy.com/site/mobile-phones/mobile-broadband-comparison-chart/pcmcat214500050010.c?id=pcmcat214500050010 http://www.bestbuy.com/site/mobile-phones/mobile-broadband-c...
bediger4000 12y ago
Didn't these folks take an oath to defend the US constitution? This pretty clearly violates 4th Amendment protections against unreasonable search and seizure. Yes, I'm not a lawyer, so I don't know what "doctrine", "touchstone" or "Three Pronged Test" makes the clearly unconstitutional into something lawfully constitutional, but that's a lawyer problem. Beyond practical considerations, like this makes the FBI into an ethically dubious organization, doesn't doing this kind of thing grate on lawyers and officers who take very solemn oaths against doing bad things? Clearly, this will have undesired side effects, and make the police into something even less trustworthy than they already are.
- dragontamer 12y ago
  Last time I checked, the 4th Amendment was about "due process" and "but upon probable cause". Everyone seems to forget about the "Probable Cause" line.
  - leorocky 12y ago
    Probable cause is an under-appreciated term. Every American should know what it means. You'll see actors in movies and TV say to other actors posing as police that they can't enter their home without a warrant and that's not true. Police can enter your home without a warrant, all they need is probable cause. What is probable cause? Probable cause is when a police officer is 51% sure that a crime is occurring. So if police are 51% sure a crime is occurring in your home, they can enter, and you can't stop them and anything illegal they see in line of sight can be used to prosecute you. Police can only go to the place where they think the crime is occurring, so if they have cause to think someone is doing something illegal on the first floor of your house, they can't climb the stairs to the second floor to find illegal drugs in your bedroom closet. Probable cause doesn't give police leeway to search your entire house just because they saw someone smoke pot through the kitchen window. Having said that, when I say police can only go to the 1st floor, that really only means that they'll have a lot of trouble convincing prosecutors and judges that anything they found on the second floor will be admissible, they can physically go up to your second floor and you should not stop them. What police will do is try to use line of sight to find anchors to get deeper into a house. So if they barge in because a suspect ran into the living room, they'll try to find other things that will give them 51% probable cause to move further through the house. tl;dr: Probably never try to physically or even verbally stop police from searching your house, car and person and property. They don't need a warrant, they just need to think something is up. The movies and TV are not reality. Source: Some administration of justice classes in school, experience with police.
sliverstorm 12y ago
Out of curiosity- all I see in the news & on the boards is backlash against the government when these sorts of programs come up. Can anyone provide thoughtful suggestions on how the fundamental adaptation the feds are seeking- improved ability to conduct digital espionage- could be implemented in a positive way? I do think the notion that traditional rules for search & seizure need to be updated for the modern age might hold some water. For example, destruction of evidence has become easier, and catching someone "in the act" is probably harder. I don't believe in the idea that the feds should have zero access & zero surveillance ability. Unfortunately I am unsure how to give the ability to match (in spirit, not in letter) the functions they have in the real world without incurring a big privacy hazard.
ipsin 12y ago
"...no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized." I'm tickled that they're actually getting warrants sometimes, but this sort of warrant doesn't sound like it would meet that test. If you can't describe a physical location of your search, you're opening up all sorts of potential for mischief that would play off the technical ignorance of some judges and the inherent interconnectedness of the Internet. "Machines connecting to the target machine or relaying traffic for the target machine", etc.
- venomsnake 12y ago
  You have to be pretty smart guy to become a judge and pass the whole confirmation grilling. And from what I have seen recently a some of the judiciary have picked up enough tech know how to not be fooled into rubber stamping. But you need wide programs to change the culture of the police departments and prosecutors. If I was doing my job/followed orders is not acceptable excuse at trial it cannot justify put the criminal behind bars by any means necessary.
ipsin 12y ago
So if a botnet operator infects my machine, gaining access to my files... and then the FBI gets a warrant to install further software on my machine, ostensibly to investigate the people operating the botnet, haven't they just gotten a "warrant" that entitles them to everything on my machine, independent of who owns it?
javajosh 12y ago
Sometimes I wish law enforcement would just suck it up, grow some balls and start pushing for the wholesale repeal of the 4th amendment by constitutional amendment. I mean, stop fucking around guys - I thought you guys were tough.
deleted 12y ago
[deleted]
zaroth 12y ago
This sounds a lot like the 'general warrants' which helped spark the first American revolution. LA is tracking cars through cameras / license plate detection. In response to an FOIA request for details on the tracking, their response was that all the data was part of an "active investigation" and would not be disclosed. I think this was the first time a city has tried to hide details of a surveillance dragnet like this, across an metro area, by claiming basically the entire city was being actively investigated. [1] In that light, this development is extremely concerning, and I can only hope the judiciary will push back hard to protect some semblance of the 4th. The average person doesn't typically consider themselves a target, but as the number of dragnets increase, and if the Feds can perform mass-hacking of our personal devices where the results are directly admissible in court (putting aside parallel construction for a moment) this mentality will have to change. The writing has been on the wall for a while, but there's always been some comfort that at least the mass surveillance wouldn't be admissible. Now you start to see, we're getting boiled like frogs. The direction this is all going leads up to a very draconian future just 5 - 10 years out. I'm not sure there's any way to stop it, I don't think enough of the American people can get their heads around how this is cyanide to a free society. [1] - https://www.eff.org/deeplinks/2014/03/los-angeles-cops-argue-all-cars-la-are-under-investigation https://www.eff.org/deeplinks/2014/03/los-angeles-cops-argue...
- wyager 12y ago
  > I'm not sure there's any way to stop it, Ideally, clever technology. We can at least try to stop digital dragnet surveillance with better technology. It might be possible to frustrate physical dragnet surveillance the same way. As a fallback, there's always violence if people get pissed off enough.
- noblethrasher 12y ago
  > I'm not sure there's any way to stop it, It's not enough to campaign, vote, or even lobby. We need to form a vanguard party and run our own candidates and get them elected. We should think more broadly than just legislators and chief executives. Consider sheriffs, judges (where they're elected), district attorneys, city controllers, public utilities commissions, etc.
tom_jones 12y ago
"secretly access suspected criminals’ computers in bunches, not simply one at a time." Note the word "suspected". I really don't think its a good idea to have a legal standard granting authority to a government worker when that standard is based to one degree or another on the level of that government worker's paranoia.
logn 12y ago
I think this violates the 3rd Amendment too. The government wants to (among other things) be able to secretly monitor laptop cameras of people never suspected of wrongdoing. That's basically an electronic-age version of this 3rd Amendment case: http://www.volokh.com/2013/07/04/a-real-live-third-amendment-case/ http://www.volokh.com/2013/07/04/a-real-live-third-amendment...

101 points by jamesbritt 12y ago

danso 12y ago

Wow, well I just had a moment of self-reflection on what a Pollyanna I am...my first thought at reading the headline was, "Oh good, now people like Aaron Swartz can't be threatened with 15 year prison sentences, or (in other cases) become felons for violating certain interpretations of Terms of Service". And of course, it is not that.

masonhensley 12y ago
You are not alone, that's exactly what I thought from reading the title.

cinquemb 12y ago

“The proposed amendment would enable investigators to conduct a search and seize electronically stored information by remotely installing software on a large number of affected victim computers pursuant to one warrant issued by a single judge” I wonder if we'll start to see researchers/people come across more of things like this in the wild? Which makes me wonder if federal agents are going to be enlarging the attack surface against their own systems?

zeroday01 12y ago
I believe there have already been at least 2 cases of the FBI using the very mass exploitation technique discussed in the article. The 2012 investigation dubbed "Operation Torpedo"[0] and the Freedom Hosting exploit in 2013 dubbed "Torsploit"[1]. There were 25 arrests in the first operation and those suspects are currently fighting the search warrant because the FBI failed to give notice to the those who had the virtual search warrant executed on them within the required 30 days. Nothing has really come of the second operation (after over 10 months now) except for an arrest of someone the FBI was able to identify without the help of their exploit (they used the same user name on Tor as they did on the clearnet). [0]: http://www.wowt.com/news/headlines/Fed-Tactics-on-Trial-in-Porn-Case-255716621.html http://www.wowt.com/news/headlines/Fed-Tactics-on-Trial-in-P... [1]: http://www.propublica.org/nerds/item/is-the-u.s.-government-behind-torsploit http://www.propublica.org/nerds/item/is-the-u.s.-government-...
nitrogen 12y ago
If your quote means that one warrant can force a victim of hacking to install FBI spyware on their systems, this is very troubling, and seems like it would dissuade many organizations from reporting a hack at all, because the cure will be worse than the disease

devconsole 12y ago

A couple weeks ago, when I asked someone how to verify on demand that a BIOS isn't compromised, someone else quipped "Could be the processors too, better forge those by hand." https://news.ycombinator.com/item?id=7609780 https://news.ycombinator.com/item?id=7609780 In fact, it turns out the future is probably headed in that direction. All mobile phones are already compromised; every phone has a proprietary baseband chip with full remote DMA access that no amount of open software running on your phone can stop. And as laptops become more and more mobile, it's going to seem strange that we've spent so long trying to tether our mobile phones to our laptops. Perhaps future laptops are going to have 3G access embedded right into them which consumers can subscribe to for some low monthly fee. Consumers would probably love it, because it's very enticing: you get internet access in most of the world without having to find a public hotspot or tether your phone. No more dealing with hotel wifi; no more dealing with logging in to someone else's. The takeaway is that your children may grow up in a world where it's impossible to guarantee the government can't get into your computer if it really wanted to. Desktop computers aren't ever going to go away, but hardware design seems to be trending towards having built-in theft prevention. One feature of theft prevention is having the ability to locate the computer, or send it remote kill signals. If trends like that do catch on with consumers, it's "gg no re," because once our hardware is compromised to the point of third parties being able to remotely access it on demand, we've all lost something precious, and there won't be any opportunity to fix it. The more I think about it, the more it seems like it's just a matter of time until this happens, precisely because once it's here, it's never going away. More and more network adapters seem to have DMA access to your computer. It would be interesting if the protections afforded by open source software were defeated at the hardware level without most people noticing. There doesn't seem to be any way to defend against it, because open source hardware simply can't survive: no money is necessary to develop open source software, whereas large investment would be necessary for development of open source hardware down to the chip level.

aliakbarkhan 12y ago
> Perhaps future laptops are going to have 3G access embedded right into them which consumers can subscribe to for some low monthly fee. The future is now. http://www.dell.com/learn/us/en/19/campaigns/4g-3g-mobile-broadband-laptops http://www.dell.com/learn/us/en/19/campaigns/4g-3g-mobile-br... http://www.amazon.com/Samsung-XE303C12-H01US-Chromebook-3G-11-6-Inch/dp/B009M2YNWI http://www.amazon.com/Samsung-XE303C12-H01US-Chromebook-3G-1... http://www.bestbuy.com/site/mobile-phones/mobile-broadband-comparison-chart/pcmcat214500050010.c?id=pcmcat214500050010 http://www.bestbuy.com/site/mobile-phones/mobile-broadband-c...

bediger4000 12y ago

Didn't these folks take an oath to defend the US constitution? This pretty clearly violates 4th Amendment protections against unreasonable search and seizure. Yes, I'm not a lawyer, so I don't know what "doctrine", "touchstone" or "Three Pronged Test" makes the clearly unconstitutional into something lawfully constitutional, but that's a lawyer problem. Beyond practical considerations, like this makes the FBI into an ethically dubious organization, doesn't doing this kind of thing grate on lawyers and officers who take very solemn oaths against doing bad things? Clearly, this will have undesired side effects, and make the police into something even less trustworthy than they already are.

dragontamer 12y ago
Last time I checked, the 4th Amendment was about "due process" and "but upon probable cause". Everyone seems to forget about the "Probable Cause" line.
- leorocky 12y ago
  Probable cause is an under-appreciated term. Every American should know what it means. You'll see actors in movies and TV say to other actors posing as police that they can't enter their home without a warrant and that's not true. Police can enter your home without a warrant, all they need is probable cause. What is probable cause? Probable cause is when a police officer is 51% sure that a crime is occurring. So if police are 51% sure a crime is occurring in your home, they can enter, and you can't stop them and anything illegal they see in line of sight can be used to prosecute you. Police can only go to the place where they think the crime is occurring, so if they have cause to think someone is doing something illegal on the first floor of your house, they can't climb the stairs to the second floor to find illegal drugs in your bedroom closet. Probable cause doesn't give police leeway to search your entire house just because they saw someone smoke pot through the kitchen window. Having said that, when I say police can only go to the 1st floor, that really only means that they'll have a lot of trouble convincing prosecutors and judges that anything they found on the second floor will be admissible, they can physically go up to your second floor and you should not stop them. What police will do is try to use line of sight to find anchors to get deeper into a house. So if they barge in because a suspect ran into the living room, they'll try to find other things that will give them 51% probable cause to move further through the house. tl;dr: Probably never try to physically or even verbally stop police from searching your house, car and person and property. They don't need a warrant, they just need to think something is up. The movies and TV are not reality. Source: Some administration of justice classes in school, experience with police.

sliverstorm 12y ago

Out of curiosity- all I see in the news & on the boards is backlash against the government when these sorts of programs come up. Can anyone provide thoughtful suggestions on how the fundamental adaptation the feds are seeking- improved ability to conduct digital espionage- could be implemented in a positive way? I do think the notion that traditional rules for search & seizure need to be updated for the modern age might hold some water. For example, destruction of evidence has become easier, and catching someone "in the act" is probably harder. I don't believe in the idea that the feds should have zero access & zero surveillance ability. Unfortunately I am unsure how to give the ability to match (in spirit, not in letter) the functions they have in the real world without incurring a big privacy hazard.

ipsin 12y ago

"...no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized." I'm tickled that they're actually getting warrants sometimes, but this sort of warrant doesn't sound like it would meet that test. If you can't describe a physical location of your search, you're opening up all sorts of potential for mischief that would play off the technical ignorance of some judges and the inherent interconnectedness of the Internet. "Machines connecting to the target machine or relaying traffic for the target machine", etc.

venomsnake 12y ago
You have to be pretty smart guy to become a judge and pass the whole confirmation grilling. And from what I have seen recently a some of the judiciary have picked up enough tech know how to not be fooled into rubber stamping. But you need wide programs to change the culture of the police departments and prosecutors. If I was doing my job/followed orders is not acceptable excuse at trial it cannot justify put the criminal behind bars by any means necessary.

ipsin 12y ago

So if a botnet operator infects my machine, gaining access to my files... and then the FBI gets a warrant to install further software on my machine, ostensibly to investigate the people operating the botnet, haven't they just gotten a "warrant" that entitles them to everything on my machine, independent of who owns it?

javajosh 12y ago

Sometimes I wish law enforcement would just suck it up, grow some balls and start pushing for the wholesale repeal of the 4th amendment by constitutional amendment. I mean, stop fucking around guys - I thought you guys were tough.

deleted 12y ago

[deleted]

zaroth 12y ago

This sounds a lot like the 'general warrants' which helped spark the first American revolution. LA is tracking cars through cameras / license plate detection. In response to an FOIA request for details on the tracking, their response was that all the data was part of an "active investigation" and would not be disclosed. I think this was the first time a city has tried to hide details of a surveillance dragnet like this, across an metro area, by claiming basically the entire city was being actively investigated. [1] In that light, this development is extremely concerning, and I can only hope the judiciary will push back hard to protect some semblance of the 4th. The average person doesn't typically consider themselves a target, but as the number of dragnets increase, and if the Feds can perform mass-hacking of our personal devices where the results are directly admissible in court (putting aside parallel construction for a moment) this mentality will have to change. The writing has been on the wall for a while, but there's always been some comfort that at least the mass surveillance wouldn't be admissible. Now you start to see, we're getting boiled like frogs. The direction this is all going leads up to a very draconian future just 5 - 10 years out. I'm not sure there's any way to stop it, I don't think enough of the American people can get their heads around how this is cyanide to a free society. [1] - https://www.eff.org/deeplinks/2014/03/los-angeles-cops-argue-all-cars-la-are-under-investigation https://www.eff.org/deeplinks/2014/03/los-angeles-cops-argue...

wyager 12y ago
> I'm not sure there's any way to stop it, Ideally, clever technology. We can at least try to stop digital dragnet surveillance with better technology. It might be possible to frustrate physical dragnet surveillance the same way. As a fallback, there's always violence if people get pissed off enough.
noblethrasher 12y ago
> I'm not sure there's any way to stop it, It's not enough to campaign, vote, or even lobby. We need to form a vanguard party and run our own candidates and get them elected. We should think more broadly than just legislators and chief executives. Consider sheriffs, judges (where they're elected), district attorneys, city controllers, public utilities commissions, etc.

tom_jones 12y ago

"secretly access suspected criminals’ computers in bunches, not simply one at a time." Note the word "suspected". I really don't think its a good idea to have a legal standard granting authority to a government worker when that standard is based to one degree or another on the level of that government worker's paranoia.

logn 12y ago

I think this violates the 3rd Amendment too. The government wants to (among other things) be able to secretly monitor laptop cameras of people never suspected of wrongdoing. That's basically an electronic-age version of this 3rd Amendment case: http://www.volokh.com/2013/07/04/a-real-live-third-amendment-case/ http://www.volokh.com/2013/07/04/a-real-live-third-amendment...