3 ms·

'I find it highly dubious that the FBI has legal authority to access that server without the permission of its "owner" or a warrant.' The server was public, th

by nemo 12y ago

'I find it highly dubious that the FBI has legal authority to access that server without the permission of its "owner" or a warrant.' The server was public, the Feds don't need a warrant to investigate public facing web content any more than they'd need a warrant to look at a storefront. They fuzzed some content to get the thing to leak an IP (according to their account). Given the incompetence of the Silk Road admin, that's honestly not a real stretch. There were SQL injection bugs in the search on the site, and he left PHPMyAdmin running on the server. It was amateur hour. With that IP they contacted the ISP in Iceland who gave up the data since the server was violating it's TOS, and the Iceland authorities got legally involved (with no legal issues in that search). The fuzzing of input to get the IP is iffy, but it's certainly not a cut and dry case where a warrant would be required. The investigators did get warrants for some of the evidence they collected (esp. the evidence that tied , and I'd imagine if there was a a clear legal requirement for a warrant to investigate the web server, since they had overt probable cause it would have been trivial to get one. Besides that the only way Ulricht can claim that the search was illegal is to admit that he owned the server, at which point that admission will certainly put him in prison, so an appeal isn't going to do him any good.

pyrophane 12y ago
The defense wasn't arguing that the FBI didn't have the right to fuzz the captcha. They were arguing that the FBI was not being honest about how they had located the server IP, and that they found it by some other means that they may not have had the legal authority to use at the time. That's why the defense was asking for permission to cross-examine the FBI. They wanted to try to pick holes in the FBI's story. If they could show that IP had been obtained illegally, then they could challenge the subsequent search as well and try to get all of the evidence thrown out. Also, the article specifically states that the defense could have "claimed" the server as part of their motion to suppress evidence in such a way that the claim could not have been used as evidence against Ulbricht.
- nemo 12y ago
  Yeah, I've seen them claiming that the captcha wasn't leaky, which well could be the case. Having looked at the config files and logs now, the Feds account seems somewhat shaky. They were hitting the PHPMyAdmin page and authenticating, but didn't mention this, which is very iffy. It sounds more like the "typing in miscellaneous entries into the username, password, and CAPTCHA fields" wasn't exactly 'miscellaneous' so much as using some kind of a targeted exploit that they used to get the machine to leak enough to pwn it pretty well. Ulbricht was not nearly as skilled as he gets credit for, his machine had leaked the IP on the login screen in March and May, and his notes show he was scrambling to patch bugs, but if the Feds. had gotten PHP dumping $_SERVER or something just by fuzzing they would have mentioned it which makes their account suspicious. So that's in the air. On a separate note, there are two separate cases against Ulbricht, one in New York happening now, and the other Maryland (which is where the contract murder charges are). So he probably does need to be very cagey about any claim of ownership of the server given that this isn't the only trial he faces. As I understand it, while the claim wouldn't be admissible as evidence in the NY case, it could still be germane to the future case. It also means the "Fruit of the poisonous tree" issue could be mitigated even if the NY case is dismissed, given there's different evidence and claims presented in the MD case, and some of that evidence is not tied to the IP leak at all.

by nemo 12y ago

pyrophane 12y ago

The defense wasn't arguing that the FBI didn't have the right to fuzz the captcha. They were arguing that the FBI was not being honest about how they had located the server IP, and that they found it by some other means that they may not have had the legal authority to use at the time. That's why the defense was asking for permission to cross-examine the FBI. They wanted to try to pick holes in the FBI's story. If they could show that IP had been obtained illegally, then they could challenge the subsequent search as well and try to get all of the evidence thrown out. Also, the article specifically states that the defense could have "claimed" the server as part of their motion to suppress evidence in such a way that the claim could not have been used as evidence against Ulbricht.

nemo 12y ago
Yeah, I've seen them claiming that the captcha wasn't leaky, which well could be the case. Having looked at the config files and logs now, the Feds account seems somewhat shaky. They were hitting the PHPMyAdmin page and authenticating, but didn't mention this, which is very iffy. It sounds more like the "typing in miscellaneous entries into the username, password, and CAPTCHA fields" wasn't exactly 'miscellaneous' so much as using some kind of a targeted exploit that they used to get the machine to leak enough to pwn it pretty well. Ulbricht was not nearly as skilled as he gets credit for, his machine had leaked the IP on the login screen in March and May, and his notes show he was scrambling to patch bugs, but if the Feds. had gotten PHP dumping $_SERVER or something just by fuzzing they would have mentioned it which makes their account suspicious. So that's in the air. On a separate note, there are two separate cases against Ulbricht, one in New York happening now, and the other Maryland (which is where the contract murder charges are). So he probably does need to be very cagey about any claim of ownership of the server given that this isn't the only trial he faces. As I understand it, while the claim wouldn't be admissible as evidence in the NY case, it could still be germane to the future case. It also means the "Fruit of the poisonous tree" issue could be mitigated even if the NY case is dismissed, given there's different evidence and claims presented in the MD case, and some of that evidence is not tied to the IP leak at all.