New Indictment Tries To Tie Julian Assange To A Hacking He Had Nothing To Do With

from the several-versions-of-truth-and-this-one-is-the-DOJ's dept

The government is still trying to get Julian Assange out of the UK so it can ring him up on a variety of charges related to obtaining and publishing a large number of sensitive documents. Most of the charges are still related to the documents obtained from Chelsea Manning. The DOJ wants to use the oft-abused CFAA to put Assange behind bars because he supposedly helped Manning hack a CIA database.

Another indictment [PDF] has been issued by the DOJ, making this its third attempt to throw the book at Assange. If the DOJ can prove Assange contributed to hacking attempts, it may end up with a case worth pursuing. But much of what the indictments deal with is normal journalism behavior: the cultivation of sources and the encouragement of sources to locate/leak newsworthy documents. The blurry line the DOJ is walking on is the same line the previous administration seemed to feel wasn't worth crossing, no matter how much harm/embarrassment Assange had caused with the release of sensitive documents.

The latest indictment expands the government's espionage theories. The government's second superseding indictment deals with Assange's alleged "unlawful overt acts:" the hacking attempts supposedly made targeting Defense Department computers, possibly with the aid of Chelsea Manning and other Wikileaks associates.

Much of this expanded narrative seems to rely on the input of FBI informants, including Sigurdur Thordarson, who was convicted twice for sex with minors after he began working for the FBI in 2011. Sketchy contributors aside, there are some major omissions in the government's narrative.

First, as Dell Cameron points out for Gizmodo, the indictment casually ignores the government's contribution to cyber attacks on American businesses located overseas, as well as some foreign government targets. But there is a significant omission in the new indictment. And the purpose of this crucial admission appears to be an attempt to link Assange to a data breach he never participated in.

A section of the indictment titled “Sabu, Hammond, and ASSANGE” begins on the date December 25, 2011, and refers to an attack on servers belonging to a private firm identified only as “Intelligence Consulting Company.” This is obviously Stratfor, the Austin-based private intelligence company whose millions of pilfered emails comprise the WikiLeaks drop known as the Global Intelligence Files.

DOJ omits several crucial details about the Stratfor hack in its attempts to name Assange as a conspirator in a breach that happened without his knowledge. Most notably, prosecutors exclude that the actual breach of Stratfor’s security, in late 2011, occurred 83 days prior to the events they describe, unknownst by anyone DOJ identifies as part of the conspiracy, including Assange.

Assange and Wikileaks may have helped distribute the documents obtained in the breach and there does appear to be evidence Assange provided the hackers with some tools for searching the stash of five million emails, but there's nothing in the indictment that ties Assange to the underlying hacking. The only thing in the indictment is stuff the DOJ is generously calling "evidence."

At best, these are copies of exchanges taken from chat rooms in which a user claims to be Assange, which is not likely to hold up in court.

To be sure, indictments are often a pile of helpful omissions designed to speedily initiate prosecutions. But the more the government adds to its accusations, the more glaring its omissions become. This case was already problematic -- willing to walk right up to the First Amendment and dare it to do something about it. Now it's become more farcical, with the government accusing someone of doing something it appears clear they didn't do and bolstering it with half-truths about the FBI's own involvement in malicious hacking efforts.

Filed Under: cfaa, doj, extradition, hacking, indictment, julian assange, leaks
Companies: stratfor, wikileaks

Texas Dept. Of Public Safety Forced To Admit Its Stratfor-Crafted Surveillance Tech Isn't Actually Catching Any Criminals

from the past-failure-no-indication-TrapWire-will-be-useless-for-years-to-come,-right? dept

Concerns over pervasive surveillance are often shrugged off with "ends justify the means" rationalizing. If it's effective, it must be worth doing. But as more information on domestic surveillance programs surfaces, we're finding out that not only are they intrusive, but they're also mostly useless.

TrapWire -- software produced by Stratfor and used by security and law enforcement agencies around the world -- utilizes facial and pattern recognition technology to analyze CCTV footage for "pre-attack patterns," meshing this information with other law enforcement databases, including online submissions from citizens reporting "suspicious behavior."

The Texas Department of Public Safety utilizes TrapWire and has touted its success to multiple entities over the past several months.

According to an email from [Texas DPS spokesman Tom] Vinger to DMN columnist Dave Lieber, TrapWire in Texas “has resulted in, 21 patterns identified (12 with connections outside Texas); 44 arrests made; 36 investigations launched; 14 sent to a Joint Terrorism Task Force, ICE, other federal agencies.”

The 44 arrests claim is also part of an email to the agency’s lobbyists from Robert Bodisch, deputy director of Homeland Security & Services at DPS, which was reported by Lieber/DMN Watchdog in a May report.

But when faced with FOIA requests for data backing up this claim, the DPS was unable to find anything to corroborate its public assertions.

The Texas Department of Public Safety has backed off its statement that the citizen monitoring program TrapWire has resulted in 44 arrests after a Texas Watchdog inquiry, the second time since May the department has publicly misrepresented the agency’s accomplishments.

Instead, the department could not directly link a single arrest by the DPS to the program.

Despite this being repeated to journalists and lobbyists, the DPS is now claiming its "44 arrests" claim was just an honest mistake.

“In attempting to answer a question in good faith, there was an internal miscommunication that led to misinterpretation of the arrest data set — and as a result, the arrest number was not properly qualified,” DPS spokesman Tom Vinger said in a Thursday email to Texas Watchdog. “We are unable to state that the arrest is directly linked to a specific suspicious activity report.”

Even in bogus public statements, a law enforcement agency wants the benefit of the "good faith" exception. It still wants people to believe TrapWire is a beneficial law enforcement tool, despite the lack of evidence. Vinger's "clarification" isn't the only non-apology the DPS has to offer for its misleading claims. It also has this bit of hedging, which only serves to portray TrapWire as being as integral to law enforcement investigations as, say, a local police blotter.

The Thursday statement admitted there were no arrest records, but rather the “arrest number illustrates that individuals who have been arrested due to a criminal act were also reported in the TrapWire program.”

So, expensive software and multiple databases managed to result in some arrests. Or, rather, attempted to garner post facto credit for criminals that had already been arrested. As a nexus for law enforcement leads, TrapWire -- at least in the hands of the Texas DPS -- appears to be no more useful than a phone book, another "database" where arrested individuals might be listed.

Filed Under: face recognition, pattern recognition, surveillance, texas, trapwire
Companies: stratfor

Feds Dismiss Charges Against Barrett Brown For Linking After Realizing They Had No Case

from the and-it-shouldn't-be dept

Well, well, well. We were about to put up the post below, describing the arguments that Barrett Brown's lawyers filed about why the criminal charges against him for sharing a link (which they claimed was trafficking in stolen credit card details) were completely bogus... and it appears that the DOJ itself was convinced. Just hours after Brown's lawyers filed their comprehensive argument, the DOJ has filed a motion to dismiss the criminal charges that stem from the cutting and pasting of the link. The other charges, concerning threatening acts (described below) and "obstruction of justice" (for hiding his laptop in a cabinet) remain, meaning that he is still facing significant jail time. But the core charge, concerning cutting and pasting a link, is now being dismissed. Of course, it's still a travesty that the DOJ ever included that in the indictment in the first place.

Our original post, about Brown's now obsolete filing is below:

---

We've covered the deeply troubling case of Barrett Brown before. The DOJ has been working overtime to lock up Brown, whose main "crime" appears to have been taking a link that was publicly available that pointed to documents taken by members of Anonymous from the consulting/media company Stratfor, and pasting that link into an online chat. Brown did not hack Stratfor. Instead, he was working on his ongoing project to dig into the various documents leaked via Anonymous for journalistic purposes. While Brown's case was initially messy due to some ill-advised public statements by Brown (in which he ranted publicly about law enforcement, to the point of threatening to shoot those who came after him), when you dig into the fundamentals of the case, there's not much there other than taking that publicly available link and pasting it into a chat room. The government is claiming that since the documents from Stratfor included credit card info, Brown's copy/paste was the equivalent of trafficking in stolen credit cards. Think about that for a second.

Brown's legal team has now filed a motion asking the court to dismiss the key claims concerning the copy pasting of the link, which underpin pretty much the entire case. This is an issue that is important to anyone who believes both in the freedom of the press as well as the idea that merely sharing a link shouldn't make one liable (especially criminally liable) for what's in the content that's being linked to. The filing makes three basic arguments.

First, it notes that merely sharing a link clearly does not meet the standard of a criminal act under the law that Brown is being charged under, with the key question being whether merely pasting a link is "transferring" ... "authentication features."

As a matter of pleading, the Indictment is fatally flawed because (1) it fails to allege an essential element—“the transfer of authentication features”—altogether, and (2) it fails to allege that Mr. Brown “transferred” anything other than a hyperlink. Instead, the government claims that Mr. Brown violated the statute by republishing a (publicly available) hyperlink which caused a (publicly available) file to be made “available to others online.” However, as shown in POINT I, the government’s theory of the case fails to satisfy any valid construction of the charging statutes.

Second, the filing notes that even if the court actually believes that merely copying and pasting a publicly available link is "the transfer of authentication features" under the law, then that law clearly violates the First Amendment:

First, Mr. Brown is alleged to have engaged in pure speech, not merely conduct with expressive elements. The act of republishing a hyperlink is unquestionably an act of pure communication and expression. Thus, applying Section 1028 to Mr. Brown’s republication of a hyperlink is a substantial burden on his right to free speech. Pure speech also warrants the highest protection, and laws burdening pure speech must face heightened scrutiny. Only a “‘need... of the highest order’” can justify “a regulation of pure speech.”....

Second, Mr. Brown’s speech (by republishing the hyperlink) addressed political issues—namely the uncovering of improprieties within the private intelligence contracting industry. As such, it is entitled to the First Amendment’s highest protection. “[L]awful political speech [is] at the core of what the First Amendment is designed to protect.” ....

Third, Mr. Brown’s speech (by republishing the hyperlink) was part of his routine press activity: gathering, disseminating and publishing information about the Stratfor hack and, more generally, private intelligence contractors.

If the court still isn't convinced, Brown's lawyers offer up a third argument, noting that even if copying and pasting the link is covered by the specific law and if pasting a link isn't protected by the First Amendment (as it clearly should be), then Brown's lawyers point out that the law in question, 18 USC 1028 is "unconstitutionally vague on their face" and "unconstitutionally overbroad and chills speech in violation of the First Amendment."

This is going to be an important case to follow. In the past whenever we've covered Brown, we've heard from some people who had personal run-ins with Brown and didn't like him, as if that means that his legal case isn't important and the legal issues should be overlooked. We disagree. No matter what people think of Brown, the key legal issues in this case are vitally important in an era when federal prosecutors are piling on excessive charges against people they don't like and, even worse, when there has been a ratcheting up of rhetoric against journalists reporting on leaked information. Some of the most important cases you will see involve people that you probably wouldn't like very much in person -- but that matters little when it comes to the importance of the underlying legal points and the wider impact they may have. In fact, it makes the issues more important, because once the precedent is set, they can be used against people you do like in the future.

Filed Under: anonymous, barrett brown, doj, free speech, linking
Companies: stratfor

Hacktivist Jeremy Hammond Gets 10 Years In Prison; Explains How FBI Gave Him The Targets To Hack

from the of-course-they-did dept

We wrote, earlier this year, about LulzSec/Antisec/Anonymous hacktivist Jeremy Hammond pleading guilty to hacking Stratfor. While the other Lulzsec hackers who were arrested in the UK got sentences of one to three years, the fact that here in the US we have the CFAA, and the fact that the DOJ saw another hacktivist to railroad, it was expected that Hammond would get a much longer sentence. Indeed, he did: he was sentenced today to ten years in prison plus another three years of supervised release.

No one denies that he broke into Stratfor's computers (as well as other sites and even governments). However, many people quite reasonably argue that he was doing so for the purposes of activism, not for personal wealth or benefits, and that fact should have been taken into account in his sentencing. The DOJ, of course, want to use Hammond as yet another example case of how they can throw the book at hacktivists. The Sparrow Project has a good account of what happened in the courtroom:

Jeremy’s lead counsel, Sarah Kunstler, who is 9 months pregnant and due to give birth today, delivered a passionate testimonial as to the person that Jeremy is, and the need for people like Jeremy during our changing socio-political landscape. She was followed by co-counsel, Susan Keller, who wept as she recalled her experiences reading the hundreds of letters from supporters to the court detailing the Jeremy Hammond’s selflessness and enthusiastic volunteerism. She pointed out that it was this same selflessness that motivated Jeremy’s actions in this case. She closed her testimony by underscoring that, “The centerpiece of our argument is a young man with high hopes and unbelievably laudable expectations in this world.”

They also include Hammond's statement, in which he clearly states why he did what he did, and repeatedly points out that most of the sites he hacked (including Stratfor and foreign governments) were done under the direction of Sabu (real name: Hector Xavier Monsegur) who had already turned into an FBI informant. In other words, he's suggesting that the FBI was more or less telling him who to hack, and then they get to turn around and throw the book at him.

The acts of civil disobedience and direct action that I am being sentenced for today are in line with the principles of community and equality that have guided my life. I hacked into dozens of high profile corporations and government institutions, understanding very clearly that what I was doing was against the law, and that my actions could land me back in federal prison. But I felt that I had an obligation to use my skills to expose and confront injustice--and to bring the truth to light.

Could I have achieved the same goals through legal means? I have tried everything from voting petitions to peaceful protest and have found that those in power do not want the truth to be exposed. When we speak truth to power we are ignored at best and brutally suppressed at worst. We are confronting a power structure that does not respect its own system of checks and balances, never mind the rights of it’s own citizens or the international community.

The full statement is long, but well worth reading. The court forced everyone to redact part of the speech -- where he names who else he hacked at the direction of Sabu, including foreign governments. When you think about this, it seems particularly obnoxious. Basically, the FBI had Sabu tell Hammond to hack into the computers of foreign governments and now Hammond gets the book thrown at him because of that. Does anyone think that the feds didn't make use of that access to foreign government computers? It's a pretty neat trick: trick a hacktivist to break into the computers of foreign governments for you and then throw him in jail for ten years.

In an interview Hammond gave to The Guardian prior to the sentencing, Hammond notes that his days of hacking "are done" but remains pretty defiant and supportive of hacktivism in general and against oppressive government action. He notes that one of the reasons he was such a target was he had access to an exploit that it appears the NSA didn't yet have, which allowed him to get into those foreign government servers:

“I felt betrayed, obviously. Though I knew these things happen. What surprised me was that Sabu was involved in so much strategic targeting, in actually identifying targets. He gave me the information on targets.”

Part of Sabu’s interest in him, he now believes, was that Hammond had access to advanced tools including one known as PLESK that allowed him to break into web systems used by large numbers of foreign governments. “The FBI and NSA are clearly able to do their own hacking of other countries. But when a new vulnerability emerges in internet security, sometimes hackers have access to tools that are ahead of them that can be very valuable,” he said.

In that same interview, he notes he never would have hacked Stratfor if it weren't for Sabu, noting he'd never even heard of the organization before that.

Clearly, Hammond broke the law. But it seems very, very wrong that the federal government clearly used him to break into places they wanted to get into (all of which now remains classified), and then threw the book at him and will lock him up for a decade.

Filed Under: cfaa, fbi, hacking, hacktivism, hector xavier monsegur, jeremy hammond, sabu, sentencing
Companies: stratfor

NSA Leaks Bring New Attention To DOJ Piling On Charges Against Barrett Brown

from the it-all-comes-around dept

A few months back we wrote about the DOJ's overprosecution of Barrett Brown, who helped publicize some of Anonymous/Antisec's hacks that revealed just some of the dirty underbelly of the intelligence-industrial complex, whereby private contractors working with the government would resort to various dirty tricks to try to "expose" Anonymous and destroy the careers of journalists like Glenn Greenwald. The charges against Brown seemed fairly ridiculous. He was charged with "concealing evidence" because he hid a laptop in his mother's dish cabinet. He was charged with threatening law enforcement agents for an admittedly ill-conceived video he posted online, in which he ranted angrily about law enforcement persecution, where he did say that he would shoot those who came after him (as I said, extremely ill-conceived). However, his main "crime," it seems, was to have been closely associated with those involved with the HBGary, Booz Allen and Stratfor hacks that helped to expose some of the tricks pulled by private contractors. And, for that, the feds just kept piling on charge after charge.

With the focus on Ed Snowden suddenly drawing a lot more attention to the role that Booz Allen and other contractors play within and around our intelligence community, some are once again remembering Barrett Brown, and how he was associated with a bunch of hacks that helped expose some of that way before all of this broke -- but mainly because all Brown really seems to have done was help draw the attention of the world to the results of those hacks. And now people are wondering why he's been sitting in prison all this time.

Ahmed Ghappour, attorney for Brown, calls the charges "prosecutorial overreach", and maintains most are related to legitimate journalistic practices, such as cutting-and-pasting a link and refusing to give the FBI access to his sources on a laptop, "a modern-day notebook". In contrast to the FBI's aggressive pursuit of Brown, no probe of the Team Themis project was launched – despite a call from 17 US House representatives to investigate a possible conspiracy to violate federal laws, including forgery, mail and wire fraud, and fraud and related activity in connection with computers. Ghappour asks:

"What length will the government go to prosecute journalists reporting on intelligence contractors? Brown was one of the first to report on the plan to take down Glenn Greenwald.

"It was clear Booz Allen Hamilton [whistleblower Edward Snowden's former employer] was consulting with the NSA, at least supporting their mass-surveillance program, and this was one of the leads Barrett was chasing at the time of the arrest."

Obviously, there are many who will argue that Brown was not a "journalist" and that he must have been much more involved, but it's not clear if that's the case at all. What is clear is that he did help draw attention to a problem that is just now getting a bit more sunlight, and the response of the feds was to throw every possible book they could find at him.

Filed Under: anonymous, antisec, barrett brown, doj, intelligence industrial complex
Companies: booz allen, hbgary federal, stratfor

LulzSec Hacker Jeremy Hammond Pleads Guilty To CFAA Charge; Faces 10 Years

from the doj-pile-on dept

In yet another Computer Fraud and Abuse Act case, in which the DOJ piled on charge after charge after charge until the person they were pressuring accepted a plea bargain, Jeremy Hammond has officially accepted a plea deal for helping LulzSec/Anonymous hack Stratfor. He admits that he did it, and given that, it's perfectly reasonable to suggest that some punishment is warranted, but it still seems troubling the amount of pressure that the DOJ used to get him to take a plea bargain. We've talked about this for years: very few cases go to trial, because the DOJ pulls out everything possible to pressure you to take a plea:

There were numerous problems with the government's case, including the credibility of FBI informant Hector Monsegur. However, because prosecutors stacked the charges with inflated damages figures, I was looking at a sentencing guideline range of over 30 years if I lost at trial. I have wonderful lawyers and an amazing community of people on the outside who support me. None of that changes the fact that I was likely to lose at trial. But, even if I was found not guilty at trial, the government claimed that there were eight other outstanding indictments against me from jurisdictions scattered throughout the country. If I had won this trial I would likely have been shipped across the country to face new but similar charges in a different district. The process might have repeated indefinitely. Ultimately I decided that the most practical route was to accept this plea with a maximum of a ten year sentence and immunity from prosecution in every federal court.

It's worth noting that others involved in the same case have been sentenced to much lower sentences in the UK, so it will be interesting to see what the final sentencing yields.

Hammond insists that he still stands by what he did:

Now that I have pleaded guilty it is a relief to be able to say that I did work with Anonymous to hack Stratfor, among other websites. Those others included military and police equipment suppliers, private intelligence and information security firms, and law enforcement agencies. I did this because I believe people have a right to know what governments and corporations are doing behind closed doors. I did what I believe is right.

As I've said before, while I understand why people think this is reasonable strategy, such hacks almost always lead to more backlash than forward momentum. Yes, governments and companies are doing questionable things behind closed doors, but hacking into them to "prove" that takes away much of the value of finding out that information, and only increases the power of the government to create and use laws like the CFAA broadly to stifle perfectly legitimate uses of computers.

Filed Under: anonymous, cfaa, cracking, doj, hacking, jeremy hammond, lulzsec
Companies: stratfor