FBI Bungles Malware Attempt As Courts Begin To Question Its Legality
from the fbi-as-script-kiddies dept
Back during the summer, we wrote about how the FBI was increasingly using malware to spy on people (though they apparently tried to avoid using it with technically savvy people to avoid having its capabilities "discovered"). However, the Washington Post has more details on how the FBI uses malware in trying to track down someone, based on court documents -- though it also notes that at least some courts have balked at such techniques, pointing out that they go way too far and probably violate the 4th Amendment.The FBI has been able to covertly activate a computer’s camera — without triggering the light that lets users know it is recording — for several years, and has used that technique mainly in terrorism cases or the most serious criminal investigations, said Marcus Thomas, former assistant director of the FBI’s Operational Technology Division in Quantico, now on the advisory board of Subsentio, a firm that helps telecommunications carriers comply with federal wiretap statutes.Still, the report details how the FBI can insert malware in a variety of ways, and that the malware can often do things like turn on your camera without the light turning on. Most reports of malware concerning turning on cameras in the past still had the light go on. It appears that this is all the more reason for people to tape over their cameras. That said, it could be even worse. If they can turn on your camera remotely, they can almost certainly turn on your microphone remotely also. And, of course, with a microphone there is no light in the first place and you can't just cover it up. Voila, instant wiretaps beyond just phone calls. Seems extreme, but does anyone doubt that the FBI can do this, and likely does do this?
The FBI’s technology continues to advance as users move away from traditional computers and become more savvy about disguising their locations and identities. “Because of encryption and because targets are increasingly using mobile devices, law enforcement is realizing that more and more they’re going to have to be on the device — or in the cloud,” Thomas said, referring to remote storage services. “There’s the realization out there that they’re going to have to use these types of tools more and more.”
The ability to remotely activate video feeds was among the issues cited in a case in Houston, where federal magistrate Judge Stephen W. Smith rejected a search warrant request from the FBI in April. In that case, first reported by the Wall Street Journal, Smith ruled that the use of such technology in a bank fraud case was “extremely intrusive” and ran the risk of accidentally capturing information of people not under suspicion of any crime.
Smith also said that a magistrate’s court based in Texas lacked jurisdiction to approve a search of a computer whose location was unknown. He wrote that such surveillance software may violate the Fourth Amendment’s limits on unwarranted searches and seizures.
Yet another federal magistrate judge, in Austin, approved the FBI’s request to conduct a “one-time limited search” — not involving the computer’s camera — by sending surveillance software to the e-mail account of a federal fugitive in December 2012.
Of course, the Washington Post report also shows that while the FBI may be able to create and install malware like this, it also seems to make an awful lot of mistakes:
It looks like this is the typical case of once law enforcement has a tool it's looking to use it more and more, even as it clearly has not yet worked out the kinks -- and there's been no real chance for a comprehensive look at whether or not the use of such tools is legal, beyond what individual judges are deciding on a case by case basis.Federal magistrate Judge Kathleen M. Tafoya approved the FBI’s search warrant request on Dec. 11, 2012, nearly five months after the first threatening call from Mo. The order gave the FBI two weeks to attempt to activate surveillance software sent to the texan.slayer@yahoo.com e-mail address. All investigators needed, it seemed, was for Mo to sign on to his account and, almost instantaneously, the software would start reporting information back to Quantico.
The logistical hurdles proved to be even more complex than the legal ones. The first search warrant request botched the Yahoo e-mail address for Mo, mixing up a single letter and prompting the submission of a corrected request. A software update to a program the surveillance software was planning to target, meanwhile, raised fears of a malfunction, forcing the FBI to refashion its malicious software before sending it to Mo’s computer.
The warrant authorizes an “Internet web link” that would download the surveillance software to Mo’s computer when he signed on to his Yahoo account. (Yahoo, when questioned by The Washington Post, issued a statement saying it had no knowledge of the case and did not assist in any way.)
The surveillance software was sent across the Internet on Dec. 14, 2012 — three days after the warrant was issued — but the FBI’s program didn’t function properly, according to a court document submitted in February,
“The program hidden in the link sent to texan.slayer@ÂÂyahoo.com never actually executed as designed,” a federal agent reported in a handwritten note to the court.
Of course, just the fact that the FBI is able to turn on cameras and microphones without letting someone know has some pretty serious consequences. Jon Schwarz pointed out the basic similarities to 1984 about what happens when the government can magically spy on just about anyone without you knowing about it. Making people live in fear is not what "freedom" is about, now is it?
Thank you for reading this Techdirt post. With so many things competing for everyone’s attention these days, we really appreciate you giving us your time. We work hard every day to put quality content out there for our community.
Techdirt is one of the few remaining truly independent media outlets. We do not have a giant corporation behind us, and we rely heavily on our community to support us, in an age when advertisers are increasingly uninterested in sponsoring small, independent sites — especially a site like ours that is unwilling to pull punches in its reporting and analysis.
While other websites have resorted to paywalls, registration requirements, and increasingly annoying/intrusive advertising, we have always kept Techdirt open and available to anyone. But in order to continue doing so, we need your support. We offer a variety of ways for our readers to support us, from direct donations to special subscriptions and cool merchandise — and every little bit helps. Thank you.
–The Techdirt Team
Filed Under: cameras, fbi, malware, microphones, surveillance
Reader Comments
Subscribe: RSS
View by: Time | Thread
No need to watch the watchers
[ link to this | view in chronology ]
Re: No need to watch the watchers
Fucking blackhats.
*spit*
[ link to this | view in chronology ]
Re: No need to watch the watchers
[ link to this | view in chronology ]
"Yahoo, when questioned by The Washington Post, issued a statement saying it had no knowledge of how to run a respectable email service in any way."
[ link to this | view in chronology ]
Re:
[ link to this | view in chronology ]
Every action has a reaction. While I'm doing nothing that would actually be of interest to these spying agencies, I'm pissed that I have to take steps to prevent it on hardware that is mine, bought and paid for.
At this point I am considering that maybe being on the internet in plain view may not be such a good idea. The darknet is becoming more and more attractive as the Snowden leaks continue.
[ link to this | view in chronology ]
Re:
Love or hate Twitter, Facebook etc, they have a tremendous social reach that can result in effective opposition to politicians. The Darknet is closer to the underground magazines of the 60s and 70s, preaching to the converted, but with very limited reach because they were easy to ridicule and write of as being part of a minority culture.
[ link to this | view in chronology ]
Re: Re:
http://allthingsd.com/20131210/facebook-wants-to-be-a-newspaper-facebook-users-have-their-own-ideas/
[ link to this | view in chronology ]
Unfortunatly, there is nothing I can do about the microphone on my cellphone, so if I was going to do anything illegal, my phone would be staying at home anyway.
[ link to this | view in chronology ]
Re:
And if you were to go to a political meeting, well, you would go to a Democratic meeting, or a Republican meeting, and there's really nothing wrong with taking your phone to one of those meetings. You would be absolutely paranoid to worry about taking your phone to a political party meeting. After all, it's not like either the Rs or the Ds are dirty communists. You wouldn't go to a dirty communist meeting with or without your phone now, anyways.
[ link to this | view in chronology ]
[ link to this | view in chronology ]
Xbox One
[ link to this | view in chronology ]
Re: Xbox One
Unplugging the Kinect completely is the safest course if you're concerned. But remember that many 'smart' TVs also have rudimentary cameras and mics..
[ link to this | view in chronology ]
Re: Re: Xbox One
[ link to this | view in chronology ]
Re: Xbox One
The capitalists are as bad or worse than, the feds.
[ link to this | view in chronology ]
Re: Xbox One
Your WiFi can do that.
And MAV(Micro Aerial Vehicles)
Youtube: Air Force Bugbot Nano Drone Technology
[ link to this | view in chronology ]
Re: Xbox One
[ link to this | view in chronology ]
Every cellphone on the market is a proprietary, binary blobbed, back-doored spyware device... that we pay for! lol
Even the SIM cards are back-doored!
[ link to this | view in chronology ]
Unified Solution to this issue
Manufacturers should place a LED directly in line to power the camera so that it would not be possible to turn it on without that light being on. The only drawback would be that the camera would no longer function if the LED burned out but all things considered it would be worth it.
[ link to this | view in chronology ]
WE need more and more secure PCs than ever
[ link to this | view in chronology ]
[ link to this | view in chronology ]
[ link to this | view in chronology ]
Re:
[ link to this | view in chronology ]