ACLU Seeks To Unseal Docket In FBI's Tor-Exploiting Takedown Of Freedom Hosting

from the keeping-the-public-at-arm's-length dept

The ACLU would like to take a closer look at the government's activities regarding its seizure of Freedom Hosting back in 2013. To date, the docket remains sealed -- as is the case in far too many DOJ prosecutions. In this case, the FBI basically took over Freedom Hosting to serve up its Network Investigative Tool to unmask anonymous Tor users.

The difference between this and its more recent NIT deployment in the Playpen child porn case is that many of those exposed by the malware weren't suspected of any wrongdoing. While letting the exploit run its course, the FBI also helped itself to TorMail's email database, later acquiring a warrant to access the contents of the seized communications.

The ACLU would like to take a look at the warrant authorizing the NIT deployment, especially in light of recent Playpen prosecutions where federal judges have found the warrant used invalid. But the first step is unlocking the docket itself, which remains blocked from public view. Joseph Cox of Motherboard was the first to report on the ACLU's recent filing.

The Washington Post recently confirmed that the FBI used a “network investigative technique” or NIT—the agency's term for a hacking tool—on the TorMail site. According to the article, the FBI had obtained a warrant to hack the owners of certain email accounts suspected of being involved in child pornography, and anonymous sources claimed that, with this approach, only suspects who had been linked to child pornography would be hacked.

But journalists, dissidents, and other individuals used TorMail too, and it seems that the error page was presented to every TorMail user—raising questions about how broad the operation really was.

“That the FBI engaged in a bulk hacking operation against all visitors to TorMail, which had many lawful, valid uses, raises serious concerns about the appropriateness of bulk hacking, and the extents to which courts should be authorizing and supervising such operations,” reads the motion to unseal the docket, which was written by ACLU attorneys Brett Kaufman, Nathan Wessler, and David Rocah and filed last week.

As the ACLU points out in its filing [PDF], the public should be apprised of the details of questionable actions taken by the FBI -- especially the contents of the warrant supposedly authorizing the bulk distribution of malware to Tor users who weren't suspects in criminal investigations.

Even if the government were to argue that unsealing the docket and the contents of the warrant would negatively affect future investigations/prosecutions (and it surely will argue this…), the court shouldn't find that assertion particularly compelling. From the motion to unseal:

Once the First Amendment right of access attaches, the burden to overcome it “rests on the party seeking to restrict access, and that party must present specific reasons in support of its position.” Access may only be denied if the party can demonstrate a “compelling governmental interest” in support of closure and prove that closure is “narrowly tailored to serve that interest.”

There is, to be sure, a legitimate governmental interest in protecting the integrity of an ongoing investigation. As the Fourth Circuit has recognized, however, “it is not enough simply to assert this general principle without providing specific underlying reasons for the district court to understand how the integrity of the investigation reasonably could be affected by the release of [the] information [sought].”

[...]

The malware warrant in question here was issued by this Court in mid-2013, and by the end of 2014 the sole prosecution known to the ACLU to have resulted from it had already been resolved. See Klein Press Release. The existence of the malware operation, moreover, has been officially acknowledged by the FBI. 2013 Pouslen Article. Thus, “the genie is out of the bottle” with respect to information the government may have once had a legitimate interest in protecting.

What remains secret, however, is the very “index” to the proceedings that authorized the deployment of malware. Perversely, then, the public is aware of the investigation’s existence, and experts have even been able to analyze the malware used by the government, but the most basic details regarding the circumstances under which this operation was judicially authorized remain hidden. The public has a vital interest in knowing this information, which would greatly contribute to the ongoing public debate about the use of malware by law enforcement, and the government has no legitimate interest in keeping it secret.

The deployment of malware by a law enforcement agency -- a deployment that affected website visitors from around the world -- using a single warrant issued by a single judge is something that has never specifically been addressed by legislators. When cases like this arrive, the DOJ is quick to point out that the lack of a specific legislative permission slip should be construed as a lack of definitive "no," rather than a suggestion the agency shouldn't allow its reach to extend its statutory grasp.

But despite having the permanent ear of many sympathetic legislators, the FBI has never sought to codify its questionable hacking tactics. The closest it's come is the proposed Rule 41 changes, which would allow the agency to obtain a search warrant from the most accommodating magistrate judges and deploy them in jurisdictions where permission might not be so easily obtained.

As the ACLU points out, the FBI's refusal to discuss this openly with legislators is being aided and abetted by courts far too willing to lock up any supposedly public documents the DOJ feels the public -- including legislators -- shouldn't be able to access.

“The breadth and potency of malware as a law-enforcement tool raises concerns that can only be properly debated if legislators and the general public are aware of instances in which it is being used, the ways in which law enforcement seeks to use it, and the extent of judicial supervision,” the motion reads. “The sealing of docket sheets with warrants authorizing the use of malware prevents this critical public debate from happening, in violation of the public’s right of access.”

Allowing the government to maintain this secrecy only encourages further abuse of existing statutes. The longer secrets can be protected, the longer the FBI can use questionable methods backed by even more questionable legal authority. The DOJ's insistence on secrecy in all things tech-related has led it to directly encourage parallel construction, order prosecutors to drop cases rather than reveal means and methods, and basically turn normal law enforcement into Black Ops: Domestic Edition.

Filed Under: exploits, fbi, malware, tor
Companies: aclu, freedom hosting

Yes, The FBI Used Malware To Try To Reveal Tor Users

from the confirmed dept

While some reports had suggested that it was the NSA involved, it seemed much more likely (as we predicted) that the FBI was behind the attempt to control Freedom Hosting's servers and effectively insert a bit of malware designed to identify users of the Tor Browser, who thought they were anonymous. And, now the FBI has more or less admitted it as part of its effort to extradite Eric Eoin Marques, the owner of Freedom Hosting from Ireland. The FBI has been known to use malware like this, though it had repeatedly tried to keep it away from investigations involving more technically savvy folks, who might discover it and reveal it to the world. Too late for that now, of course.

Freedom Hosting clearly hosted some very bad stuff, and there's nothing wrong with law enforcement looking to find and arrest those who are involved in criminal activities -- but when it reaches the level of installing effective malware and re-identifiying a ton of people who chose to be anonymous, many of whom are not criminals at all, it begins to raise questions about how appropriate (or legal) the activity really is. Taking control over all Freedom Hosting servers and inserting some code really seems like an incredibly questionable move.

Filed Under: doj, fbi, malware, privacy, tor
Companies: freedom hosting

Feds Accused Of Distributing Malware That De-Anonymizes Tor Users

from the left-hand,-meet-the-anonymous-right-hand dept

It's somewhat well known that the popular Tor anonymous browsing system gets a significant amount of funding from the US government. In the past, the suggestion had always been that the State Department was a major supporter because of its belief that Tor would help dissidents in other countries communicate better via anonymous systems. However, now there's a lot of buzz because it appears that a bit of malware that was discovered this weekend targeting Tor users, may have come directly from the FBI itself. The implication isn't against the Tor project at all, but rather it appears that whoever pushed out this malware did so by using a vulnerability targreting people using the Tor Browser Bundle -- a Firefox bundle that builds in Tor -- browsing a variety of hidden sites (available only to Tor users) hosted by the somewhat infamous Freedom Hosting. Freedom Hosting's boss, Eric Eoin Marques was arrested in Ireland last week as the US is trying to extradite him. But, what was more interesting was what some people discovered on all Freedom Hosting pages:

Shortly after Marques' arrest last week, all of the hidden service sites hosted by Freedom Hosting began displaying a “Down for Maintenance” message. That included websites that had nothing to do with child pornography, such as the secure email provider TorMail.

Some visitors looking at the source code of the maintenance page realized that it included a hidden iframe tag that loaded a mysterious clump of Javascript code from a Verizon Business internet address located in eastern Virginia.

By midday Sunday, the code was being circulated and dissected all over the net. Mozilla confirmed the code exploits a critical memory management vulnerability in Firefox that was publicly reported on June 25, and is fixed in the latest version of the browser.

Though many older revisions of Firefox are vulnerable to that bug, the malware only targets Firefox 17 ESR, the version of Firefox that forms the basis of the Tor Browser Bundle – the easiest, most user-friendly package for using the Tor anonymity network.

So why do people think the feds are involved? The bit of malware scoops up various identifying information -- MAC address and Windows hostname -- and then sends it to a server in Virginia to find the real IP address of the computer in question. The Virginia server is controlled by the infamous contractor SAIC, who works with numerous government agencies.

It's no secret that law enforcement has wanted to identify folks who are trying to be anonymous. And, as discussed just last week, the FBI has been using malware at an increasing rate. So it wouldn't be a huge surprise to find out that little tricky bit of malware was designed to provide more info on Tor users who might be up to nefarious activity (or, you know, they might just want to surf anonymously). I imagine that this is not the end of this particular story...

Filed Under: eric eoin marques, fbi, government, malware, state department, tor
Companies: freedom hosting, saic