Judge Says FBI's Child Porn Investigation Bordered On 'Outrageous,' Lets It Keep All Of Its Evidence

from the this-troubles-me-but-not-enough-to-actually-do-anything-about-it dept

Another ruling [PDF] has been handed down in the FBI's multitudinous Playpen cases, this one consolidating four defendants in a Washington federal court. While the court does find aspects of the FBI's child pornography distribution unpleasant, it's not enough to result in anything more than some stern words. All evidence remains unsuppressed and all motions to compel discovery are denied. (h/t Brad Heath)

This was everything that was done with a single, Virginia-issued warrant.

For approximately 14 days, from February 20, 2015 through March 4, 2015, the FBI administered Website A from a government-controlled computer server located in Virginia, which forwarded a copy of all website communications to FBI personnel in Linthicum, Maryland. Once deployed by the Government, the NIT gathered approximately nine thousand IP addresses, approximately seven thousand of which were associated with computers in one of more than one-hundred countries other than United States. Dkt. 90-1 at 3, 5. The FBI maintains that it did not post content itself, but concedes that it allowed registered users to access the site, view and download child pornographic content for distribution, and post new content, including 44 “new” series of data. Id. at 3. Some website users commented on technical improvements to the site while under FBI control. Dkt. 90-3. A NIT has been relied on by the FBI in at least twenty-three other investigations. Dkt. 100.

Following this, the court explains that the FBI's in camera, ex parte submissions justify its refusal to release more information on its NIT. Because of the nature of the submissions, there's obviously not much to be gleaned from this "discussion," other than it won't be happening.

From there, the court lists several FBI activities that could be labeled "outrageous conduct:"

(1) The Government ignored the statute forbidding such conduct: “In any criminal proceeding, any property or material that constitutes child pornography . . . shall remain in the care, custody and control of either the Government or the Court.” 18 U.S.C § 3509(m).

(2) The Government facilitated the continued availability of Website A, a site containing hundreds of child pornographic images for criminal users around the world.

(3) The Government, in fact, improved Website A’s technical functionality.

(4) The Government re-victimized hundreds of children by keeping Website A online.

(5) The Government used the child victims as bait to apprehend viewers of child pornography without informing the victims and without the victims’ permission—or that of their families.

(6) The Government’s actions placed any lawyer involved in jeopardy for violating ABA Model Rules of Professional Conduct 8.4, and raise serious ethical and moral issues for counsel.

The court even calls out the government for its backward thinking -- that such things shouldn't be considered "outrageous" by courts because the criminals they were after were such terrible people.

The only justification for the acts of the Government, as provided by counsel, is that the end justifies the means, or in the Government’s words, “Because those who create, obtain, trade, distribute and profit from the imagery of the rape and sexual exploitation of children have turned to Tor in an effort to hide their activities, the United States has been forced to employ creative means to unmask the individuals engaging in the destructive and heinous criminal conduct.”

Despite all of this, the court lets the government slide. The balancing test doesn't tip in the defendants' favor. The government can cross many, many lines before the court starts adding tension to the leash. In these consolidated cases, the court doesn't like what it sees in terms of the FBI's actions, but still doesn't see enough to dismiss the charges.

Not only that, but the court finds that the violations of Rule 41 jurisdictional limits and alleged lack of probable cause should have no effect on the collected evidence. The information collected by the NIT -- namely, the suspects' IP addresses -- has "no expectation of privacy." Anything else that colored outside the lines of statutes and laws can be excused through the good faith exception. The NIT warrant was facially valid, according to the court, even if the agent filing the affidavit may have known the search would exceed jurisdictional limits. The court finds a way around this by citing the DOJ's letter containing its proposed Rule 41 changes (introduced by the defendants as evidence that the DOJ knew it was breaking the rules with the NIT warrant), rather than the expected precedential case law.

The DOJ letter reveals an intent to improve the rule, which does not rule out the possibility that DOJ could have considered Rule 41(b) sufficiently flexible to address changes in technology. See also, Dkt. 104-1. Furthermore, the record is silent as to the magistrate judge’s thoughts regarding the scope of the warrant at the time it was issued, and speculation on that subject is fruitless. The record does not show deliberate disregard.

In the end, the government wins. It gets to walk away from its outrageous conduct with (most likely) four new convictions and nothing but some lightly-singed feelings from an opinion front-loaded with a judicial benchslap. The rest is pretty much history. Whatever cases might fall apart because of what Rule 41 used to be will no longer be an issue in the future, as the DOJ's jurisdiction "fix" is now law.

Filed Under: 4th amendment, child porn, doj, fbi, malware, nit, outrageous, playpen

FBI's NIT Hit 8,000 Computers In 120 Countries... As Did The Child Porn It Was Redistributing

from the any-means-necessary dept

On the other hand, who needs to wait for the Rule 41 changes to kick in?

In January, Motherboard reported on the FBI's “unprecedented” hacking operation, in which the agency, using a single warrant, deployed malware to over one thousand alleged visitors of a dark web child pornography site. Now, it has emerged that the campaign was actually an order of magnitude larger.

In all, the FBI obtained over 8,000 IP addresses, and hacked computers in 120 different countries, according to a transcript from a recent evidentiary hearing in a related case.

No need to sit back and wait for the DOJ's proposed Rule 41 changes -- including the stripping of jurisdictional limitations for search warrants -- to default their way into adoption on December 1st. This worldwide search, performed under the authority of a single warrant issued by a single judge in Virginia, is just the FBI acting first and asking for forgiveness codification later. From the day two transcript [PDF]:

Every time Your Honor grants a discovery request and we get new information, it's like -- to use an appropriate metaphor, like peeling an onion. There's just another layer of fact there that we did not know about. I mean, we did not know this was a truly global warrant before. There are 120 countries and territories listed outside the United States that the FBI hacked into, and they also hacked into something called a "satellite provider." So now we are into outer space as well.

It's not just the hacking of computers around the world. It's also the FBI's brief stint as perhaps the world's largest distributor of child porn. From the day one transcript [PDF]:

Your Honor, starting with Michaud, and what we know now is there was no discussion of trying to limit the distribution. There were no protocols for these agents for handling or limiting the distribution of child pornography. And the scale of the distribution now went out to at least 120 countries, at least 1 million images. And it is absolutely mind boggling, we have not seen something like this.

And for all the area covered by the investigation -- the number of computers scattered all over the world the FBI sent its NIT to -- there, so far, seems to be very little to show for the agency's efforts. Defense lawyer Colin Fieman:

We have never, in our nation's history as far as I can tell, seen a warrant so utterly sweeping. 100,000 potential targets. Something like 8700 IP addresses captured. At least 1152 open investigations. And now oddly enough only, about 214 arrests.

[...]

What's even more disturbing, even if they disagree about the efficacy of some of those methods, we now know from Agent Alfin's recent testimony which we cited, there was absolutely no discussion at the Department of Justice or the FBI about protocols in terms of handling this stuff or whether these methods of limiting, at least limiting the most egregious distribution were viable. Nobody cared.

Fieman quotes an earlier case dealing with the FBI's physical distribution of child porn in hopes of netting some arrests. The FBI actually created a child porn "catalog," mailed it to sting targets, and sent the targets the child porn they requested. The court in that case was not happy with the FBI's actions.

The Court took it upon itself to make these statements, because they were so troubled by it. So first they start "we are aware of the necessity of such tactics" -- in terms of undercover operations and baiting with contraband -- "we are aware of the necessity of such tactics in so-called victimless crimes such as drug offenses, but the use of these methods when victims are actually harmed" -- and they are talking about the children depicted in these images -- "is inexplicable."

And "moreover" -- this is again Sherman, continuing with the quote from 549 -- "the government's dissemination of the pornographic materials could hardly be described as a 'controlled' delivery." Well, if it's not a controlled delivery where they were able to send it to the defendant and it sat in his house, I think for a period of time, several weeks, and they recovered it ultimately, the scale of lack of control and heedless distribution in this case is mind boggling.

Fieman goes on to point out that on top of ignoring Rule 41 restrictions, on top of acting as child porn distribution kingpins, the FBI's prized NIT could have been delivered and executed without the collateral damage caused by the redistribution of illegal pornographic images.

One of the very troubling things here, as you know from the NIT warrant, the authorization allowed the FBI to deploy the NIT and complete their searches in a matter of a fraction of a second, at the time the targets landed on the home page. So they had authorization to collect all the information they wanted before anybody actually got the content…

Instead, the government kept the site live and not only distributed what was already hosted there, but allowed users to upload new images to be shared and redistributed.

[I] don't know the exact quantity, because all we know from the disclosure is 43 new series [of photos/videos]. But during just that window of time that the FBI was running this site, 43 new series. That means things that haven't been seen from the National Center for Missing & Exploited Children were launched onto, uploaded with the assistance of the FBI through their file hosting feature, onto the site, and have now circulated globally and will never be recovered.

So, not only was the FBI unconcerned about Rule 41, but it was also not that worried that it would be contributing to the world's child porn problem during its investigation. And, it should be pointed out that this is the second time the FBI has seized a child porn site only to keep it running. It did the same thing back in 2012, but that one flew almost entirely underneath the judicial radar.

Filed Under: child porn, doj, fbi, malware, nit, playpen

Unsealed Warrant Shows FBI Malware Affected Innocent Tor Users While Agency Ran More Than 20 Child Porn Sites

from the supporting-justifications-cited:-1.-the-ends dept

Thanks to the ACLU's push to unseal documents related to the FBI's targeting of TorMail users and Freedom Hosting, the warrant affidavits supporting its NIT deployment have been released by the agency. Joseph Cox of Motherboard reports:

In 2013, the FBI received permission to hack over 300 specific users of dark web email service TorMail. But now, after the warrants and their applications have finally been unsealed, experts say the agency illegally went further, and hacked perfectly legitimate users of the privacy-focused service.

“That is, while the warrant authorized hacking with a scalpel, the FBI delivered their malware to TorMail users with a grenade,” Christopher Soghoian, principal technologist at the American Civil Liberties Union (ACLU), told Motherboard in an email.

The 99-page affidavit [PDF] is lightly-redacted but contains some completely uncensored and surprising admissions from the agency. Contrary to its post-release statements about the scope of the "narrowly-tailored" warrant not being exceeded, the actual contents show the deployment of the NIT to unmask Tor users is much more aligned with Soghoian's "grenade" description.

As Cox points out, the TorMail affidavit [PDF] says the NIT would only be delivered to logged-in, specifically-targeted TorMail users.

[T]he NIT… will be deployed on the TARGET ACCOUNTS while the TARGET ACCOUNTS operate in the District of Maryland, to investigate any user who logs into any of the TARGET ACCOUNTS by entering a username and password.

In reality, the deployment occurred the moment a user landed on any site utilizing Freedom Hosting -- not just the child porn sites the FBI had taken control of. And the number of sites the FBI was running during this investigation is staggering.

According to the new documents, the NIT was used against users of 23 separate websites.

If you thought the FBI's admin efforts for two separate child porn websites (in two investigations spaced a couple of years apart) were questionable, you have to wonder about the morality (or legality) of the US government becoming one of the world's largest distributor of child pornography. Researcher Sarah Jamie Lewis notes that, according to her numbers, the FBI could have been operating close to half (if not more) of the child porn websites in existence.

And, as for the claims the FBI didn't exceed the scope of the warrant: that's clearly not true. The warrant was issued in Maryland and was delivered to users all over the world. The supporting affidavit contains descriptions of one site apparently located in Hungary, but never makes any attempt to limit the FBI efforts to within US borders, much less Maryland.

The NIT violated Rule 41 limitations and then exceeded the FBI's own assertions about targeting specific users. It continues to deploy the same malware against Tor users with a similar lack of concern for jurisdictional restrictions or its implicit invitation for foreign law enforcement agencies to engage in the same tactics against US citizens.

Filed Under: 4th amendment, child porn, doj, fbi, malware, nit, playpen, warrant

Judge Orders FBI To Turn Over Information On How Many People Around The World It Snagged With Its Playpen NIT

from the malware-whereabouts dept

This might be big, depending on how much of this information is passed on to the general public, rather than delivered ex parte or under seal. Joseph Cox of Vice/Motherboard was the first to snag this ruling [PDF] by a Washington district court judge ordering the FBI to turn over tons of info about the NIT it deployed in the Playpen child porn investigation.

As we're already aware, the NIT was deployed by the FBI in Virginia but obtained identifying information about Tor-cloaked site visitors not just all over this country, but all over the world. The motion to compel discovery asked for several details about the NIT and its deployment and most of them have been granted.

Here's the full list (with additional commentary):

1. All records related to the Government’s review and approval of Operation Pacifier.

The Court has taken this discovery request under advisement. An order is soon forthcoming.

2. Copies of any reports made to the National Center for Missing and Exploited Children (NCMEC) regarding child pornography posted on the Playpen web site.

Defendants’ motions are granted.

3. Copies of any notifications that were sent to victims by the Government for obtaining restitution related to images that were posted on, or distributed from, the Playpen web site.

Defendants’ motions are granted.

4. The number of new images and videos (i.e. content not previously identified by NCMEC) that was posted on the site between February 20, 2015 and March 5, 2015.

Defendants’ motions are granted.

(This information -- whether or not actually useful in suppression motions -- should at least provide some insight into how much additional child porn made its way to site visitors as a result of the FBI's decision to seize [and act as administrators of] the server, rather than shut it down. Information obtained in other court cases suggests the FBI not only acted as hosts during the NIT deployment, but actually made the site faster and more responsive.)

5. The names of all agents, contractors or other personnel who assisted with relocating, maintaining and operating Playpen while it was under Government control.

Defendants’ motions are granted.

6. Copies of all notes, emails, reports, postings, etc. related to the maintenance, administration and operation of Playpen between February 20, 2015 and March 5, 2015.

Defendants’ motions are granted.

(Again, this info could confirm whether or not the FBI improved the child porn site's performance during its two-week turn as administrators, as well as provide additional insight into how much child porn distribution was aided and abetted by the agency.)

7. Copies of all legal memoranda, emails and other documents related to the legality of the FBI’s operation of Playpen (and the distribution of child pornography by the Government), including requests for agency/departmental approvals of the undercover operation of Playpen and any communications with Main Justice or the Office of General Counsel at the FBI.

The Court has taken this discovery request under advisement. An order is soon forthcoming.

(This would be the government's legal rationale for running a child porn site rather than shutting it down. Chances are this will remain under seal and is probably FOIA-proof, as most legal guidance documents are.)

8. Copies of all correspondence, referrals and other records indicating whether the exploit used in the Playpen operation has been submitted by the FBI or any other agency to the White House’s Vulnerability Equities Process (VEP) and what, if any, decision was made by the VEP.

The Court has taken this discovery request under advisement. An order is soon forthcoming.

(Little is known about the government's actual handling of the VEP. On one hand, we have public statements which pay lip service to not screwing US companies by hoarding vulnerabilities. On the other hand, we have the exact opposite in practice.)

9. Copies of invoices and other documents for the hosting facility/facilities where the Government operated the Playpen server, the server from which the Government delivered the NIT malware and the server that NIT targets sent their identifying information back to, including documents revealing whether the Government informed the hosting provider(s) that child pornography would be stored in their facility or transmitted over their networks.

Defendants’ motions are granted. To the extent that the Playpen hosting provider was the Government, not a private party, it appears there may not be much discovery responsive to this request.

(There may be nothing here. Or there could be third party hosts involved who were never informed about their participation in the FBI's sting operation. If so, fun times ahead for the US government.)

10. The number of Playpen-related investigations that have been initiated but did not result in criminal charges, beyond the approximately 200 cases now pending across the country.

Defendants’ motions are granted.

(Another can of worms the FBI would probably like to remain closed. According to the government's own arguments in these cases, users would have connected to the site for a single purpose: to engage in criminal activity. A lack of charges would be a surprise and somewhat undermine the government's assertions about the criminal intent of visitors to the site.)

11. The total number of IP addresses and MAC IDs that were seized during the time the FBI was operating Playpen, over and above those related to these approximately 200 pending cases.

Defendants’ motions are granted.

12. The number of IP addresses and MAC IDs obtained during the investigation from foreign computers and the countries in which this data was obtained.

Defendants’ motions are granted.

(These are the potential goldmine. This will show how far-flung the FBI's net actually was, as well as provide more ammo for suppression motions predicated on Rule 41 jurisdictional limitations. The FBI is well aware it can't perform searches outside the jurisdiction covered by the warrant, but it chose to do so anyway. So far, its evidence has mostly held up, thanks to courts deciding suppression isn't the correct remedy, or crediting the FBI for unearned "good faith." The FBI and DOJ are pushing for changes to Rule 41 that eliminate the jurisdictional limits, so it's disingenuous for the agency to claim its agents acted in good faith when securing the warrant.)

This now becomes the Playpen case to watch, even if most of this information is likely to remain in the hands of defense lawyers only. Dismissal and suppression motions will contain references to the content of these documents, however, which will shed more light on the FBI's NIT deployment and its child porn site administration.

Filed Under: doj, eavesdropping, fbi, malware, nit, playpen, rule 41, warrants

Two More Courts Find In Favor Of The FBI And Its NIT Warrant; No Suppression Granted

from the malware-deployment-is-a-go dept

Two more rulings on suppression motions in FBI Playpen cases have been handed down. (h/t Riana Pfefferkorn) The ruling [PDF] in Tennessee agrees with the defendant that the FBI's NIT warrant exceeded Rule 41 jurisdiction limits. The following quotes are from the more substantive "Report and Recommendation" [PDF] by the magistrate judge, which has been adopted by the court overseeing the criminal trial.

The undersigned agrees with the majority of courts to analyze the Virginia search warrant that it violates Rule 41(b) because the magistrate judge in the Eastern District of Virginia lacked authority to issue a search warrant to search property located outside of her district.

Defendant’s computer was never located in the Eastern District of Virginia. See Fed. R. Crim. P. 41(b)(1) & (2). Moreover, the FBI was not investigating a crime of terrorism in the Eastern District of Virginia, nor was it attempting to seize property located in a United States territory or foreign state. See Fed. R. Crim. P. 41(b)(3) & (5). The Government argues that Rule 41(b)(4) is persuasive because the NIT is analogous to a tracking device, which was installed on the Defendant’s computer when his electronic transmission “touched down” in the Eastern District of Virginia, where Playpen was hosted. However, as observed by the Western District of Washington, applying Rule 41(b)(4) to the Virginia warrant “stretches the rule too far…"

That being said, the court decides suppression is not the right remedy for this violation:

In balancing the present facts and circumstances, the magistrate judge first correctly concluded that suppressing the evidence in this case would not meaningfully deter future law enforcement misconduct. The defendant’s objections that officers acted deliberately, recklessly, or with gross negligence, and that it should have been apparent to law enforcement that the Virginia magistrate lacked authority to sign the warrant, are simply unsupported by the record.

[...]

To the extent that there was error in this investigation, such error “rests with the issuing magistrate, not the police officer, and ‘punish[ing] the errors of judges’ is not the office of the exclusionary rule.”

Interestingly (and a bit infuriatingly), the court grants good faith to the FBI for its apparent inability to fully comprehend the "intricacies of the jurisdictions of federal magistrates." This gives the FBI credit for pretending to misunderstand the very statutes it's in the process of trying to change. The FBI -- and the DOJ above it -- very much want the jurisdictional limitations of Rule 41 removed precisely for cases like these: where a search and seizure is performed on remote computers located far outside the jurisdiction where the warrant was issued.

The Nebraska decision [PDF] is much, much worse. First, the court finds there's no expectation of privacy in an IP address, even if the defendant has taken affirmative steps to obscure it.

With or without Tor, Defendant was sharing his IP address with others—total strangers, to potentially include law enforcement officers—with the hope and belief that the users of the first “node” computer would keep his IP address secret. While Defendant’s choice to use Tor may be evidence of his “actual, (subjective) expectation of privacy” in his IP address, using Tor does not elevate that expectation to “one that society is prepared to recognize as ‘reasonable.’”

Not only that, but the court rules the NIT is not a search (nor a "tracking device," as the government argued in the Tennessee case), even though it had to extract this information from the user's computer.

But deploying the NIT to reveal the IP address was not a computer search. Defendant’s IP address is not a “physical component” of the computer or a file residing on his computer like electronic documents or pictures. Rather, the IP address is assigned to a user by the ISP and typically is “maintained on the internet modem that connects an internet device to the internet.” Thus, the NIT essentially compelled Defendant’s computer to produce its IP address (similar to a return address on an envelope) when the NIT instructed the computer to send other information identified in the Virginia Warrant. And the NIT was deployed only after Defendant sought out and visited the Playpen website. “The FBI did not come looking for Defendant. Instead it waited until he came to them and engaged in illicit activity by downloading content from Playpen.”

And here we have another reason why digital-to-analog so often fails. Comparing the compelled production of an IP address to a return address on an envelope is a non-starter because utilizing the postal service does not require the use of a return address, whereas an internet connection almost always requires an IP address.

Worse, the opinion cites Virginia judge Henry Morgan Jr.'s decision in another Playpen case -- where he asserted the FBI could hack computers with invalid warrants because, hey, computers get hacked all the time.

See also Matish, --- F. Supp. 3d ---, 2016 WL 3545776 at *22-24 (holding that with the prevalence of computer hacking and the “compromise of unprecedented amounts of data previously thought to be private,” all individuals have a diminished expectation of privacy once they log onto the internet.)

The court also finds that the FBI's NIT reach didn't exceed Rule 41 geographical limitations. Instead, the defendant made a virtual "trip" to the warrant's jurisdiction to access content stored on the seized server.

Finally, even if the defendant had raised a Fourth Amendment challenge the court found valid, the good faith exception would have prevailed. As in the Tennessee decision, the court finds the FBI held up its side of the deal by providing the magistrate with an affidavit full of technical language and specifics about the search method to be deployed.

This appears to be the broader finding across the large number of Playpen/NIT cases. The FBI's warrant may be invalid but either there's no expectation of privacy in the information obtained or the good faith exception prevents suppression of the obtained evidence.

The first is less problematic than the latter. While some users may undertake efforts to obscure their IP addresses, their expectation of privacy is no more "reasonable" than that of those who don't. Either the info has an expectation of privacy or it doesn't. The legal justifications used by judges, however, haven't been all that great, with the worst being that having your anonymity stripped and your information absconded with is just the price of doing business on the internet -- whether it's a criminal or law enforcement performing the actions apparently matters very little.

The latter part -- the reliance on the FBI's good faith -- is more of an issue. The FBI clearly knew its NIT would travel far beyond the jurisdiction the warrant was issued in. It apparently felt that it benefited heavily from good faith rulings as it made little attempt to obscure this fact from the magistrate judge it presented its affidavit to. But it still withheld some information, including the fact that it would actually be delivering a malware package that would "phone home" once it reached its destination. Just because the search sort of originated at a seized server in Virginia does not excuse seizures performed all over the nation utilizing a single, jurisdictionally-limited warrant.

Filed Under: fbi, hacking, malware, nit, playpen, rule 41

Another Judge Declares FBI's Playpen Warrant Invalid, Suppresses All Evidence

from the playing-fast-and-loose-with-the-Fourth-Amendment dept

Cyrus Farivar of Ars Technica reports that another federal judge has found the warrant used by the FBI to deploy its Tor-busting malware is invalid. This finding isn't unique. Multiple judges in various jurisdictions have found the warrant invalid due to Rule 41, which limits execution of warrants to the jurisdiction where they were issued. But only in a few of the dozens of cases stemming from the FBI's child porn investigation has a judge ruled to suppress the evidence obtained by the FBI's NIT.

A federal judge in Iowa has ordered the suppression of child pornography evidence derived from an invalid warrant. The warrant was issued as part of a controversial government-sanctioned operation to hack Tor users. Out of nearly 200 such cases nationwide that involve the Tor-hidden child porn site known as "Playpen," US District Judge Robert Pratt is just the third to make such a ruling.

In other cases, judges have found the warrant invalid, but have granted the FBI the "good faith" exception or found that the information harvested by the agency's hacking tool isn't protected under the Fourth Amendment. In one particularly memorable case, the presiding judge wandered off script and conflated security and privacy, suggesting that because computer hacking is so commonplace, the FBI should be allowed to peek into compromised computers (and compromise them!) and extract whatever it can without worrying about tripping all over the Fourth Amendment.

With hundreds of cases all over the nation (and many more handed off to foreign law enforcement agencies) stemming from a single warrant, this collection of rulings is far from coherent. But, more often than not, judges have found that the reach of the FBI's NIT deployment far exceeded its Rule 41 grasp. That all could change by the end of the year, making future investigations handled in this manner (running seized websites to deploy hacking tools) much less likely to be successfully challenged in court.

Judge Pratt's ruling [PDF], however, did at least shut down the government's Third Party Doctrine arguments.

There is a significant difference between obtaining an IP address from a third party and obtaining it directly from a defendant’s computer.

[...]

If a defendant writes his IP address on a piece of paper and places it in a drawer in his home, there would be no question that law enforcement would need a warrant to access that piece of paper—even accepting that the defendant had no reasonable expectation of privacy in the IP address itself. Here, Defendants' IP addresses were stored on their computers in their homes rather than in a drawer.

Analogies to physical objects are seldom perfect, but Pratt's does better than most.

"Judge Pratt correctly interpreted the NIT's function and picked the correct analogy," Fred Jennings, a New York-based lawyer who has worked on numerous computer crime cases, told Ars. Jennings continues:

[Pratt] correctly points out that the usual analogies, to tracking devices or IP information turned over by a third-party service provider, are inapplicable to this type of government hacking. A common theme in digital privacy, with Fourth Amendment issues especially, is the difficulty of analogizing to apt precedent—there are nuances to digital communication that simply don't trace back well to 20th-century precedent about physical intrusion or literal wiretapping.

The evidence suppression will likely result in charges being dropped, as anything located on the defendant's devices would have stemmed from the invalid NIT warrant. Outcomes like these don't do much to appease the general public, as the actions alleged are often viewed as indefensible. But the ugliness of the crime has no bearing on the Constitution and the rules governing search warrants.

The FBI can't play by different rules just because the targets are less sympathetic. That's why the push back against the proposed Rule 41 changes is important, because alterations to jurisdictional limits won't solely be used to chase down the worst of the worst. It will greatly expand the reach of questionable search warrants and investigative tools and encourage magistrate shopping by law enforcement to lower the level of scrutiny their deficient affidavits might otherwise receive.

Filed Under: doj, evidence, fbi, nit, playpen, warrant

FBI Apparently Made Darkweb Child Porn Site Faster During Its Hosting Of Seized Server

from the porn-harder! dept

Another FBI/Playpen/NIT case has moved to the point of a motion to dismiss. The lawyer for defendant Steven Chase is arguing the government should abandon its prosecution because the FBI's activities during its conversion of child porn site Playpen into its own Rule 41-flouting watering hole were "outrageous." What did the FBI do (besides traveling beyond -- far beyond -- the warrant's jurisdiction to strip Tor users of their anonymity) to merit this accusation? It made Playpen a better, faster child porn website. Joseph Cox reports for Motherboard:

Newly filed court exhibits now suggest that the site performed substantially better while under the FBI's control, with users commenting on the improvements. The defense for the man accused of being the original administrator of Playpen claims that these improvements led to the site becoming even more popular.

“The FBI distributed child pornography to viewers and downloaders worldwide for nearly two weeks, until at least March 4, 2015, even working to improve the performance of the website beyond its original capability,” Peter Adolf, an assistant federal defender in the Western District of North Carolina, writes in a motion to have his client’s indictment thrown out.

The government generally isn't known for efficiency or immediate improvements, but the filing [PDF] points out that the gains were exponential.

From there the FBI distributed child pornography to viewers and downloaders worldwide for nearly two weeks, until at least March 4, 2015, even working to improve the performance of the website beyond its original capability. As a result, the number of visitors to Playpen while it was under Government control from an average of 11,000 weekly visitors to approximately 50,000 per week. During those two weeks, the website’s membership grew by over 30%, the number of unique weekly visitors to the site more than quadrupled, and approximately 200 videos, 9,000 images, and 13,000 links to child pornography were posted to the site.

A better child porn site, brought to thousands of criminal suspects all over the world by your tax dollars. What a time to be alive!

The motion to dismiss points out that making it easier and faster to download child porn images runs contrary to assertions the government has made in support of prosecutions and stricter penalties for child porn viewers.

This behavior is all the more shocking because the federal government itself – in sentencing memoranda, online mission statements, reports to congress, press releases, and arguments before this very Court and many others – has repeatedly emphasized that victims of child pornography are revictimized each and every time their images are viewed online. Despite these frequent pronouncements, the government here made no attempt during the two weeks it was running the site to reduce the harm to innocent third party victims by limiting the ability for users to view or access the images. Indeed, government agents worked hard to upgrade the website’s capability to distribute large amounts of child pornography quickly and efficiently, resulting in more users receiving more child pornography faster than they ever did when the website was running “illegally.”

And once the images have been downloaded from a (faster) source, they can be redistributed elsewhere, furthering the damage done to victims of child pornographers. It really can't be argued that the ends justified the means.

Once the government seized the server hosting the Playpen site, it possessed a wealth of information it could use to criminally prosecute users without resorting to operating the site for two weeks. Even if the government wanted to deploy an NIT, it could have done so without also rendering the Playpen site functional. It could have, for example, disabled access to the images of child pornography, turned off the ability to upload pictures or videos, or even just run the site for a much shorter period of time.

Moreover, as noted above, the government has charged less than 1% of Playpen members, the same percentage of users it already had IP addresses for on the day it seized the site. It cannot be that the government may distribute child pornography to a thousand users for each user it catches, particularly when it already has the necessary information to identify the same number of users before it had distributes a single image.

The defense points to a message [PDF] posted to the forums after the site was seized by the FBI as evidence the agency improved the site to better serve users (with its NIT). A Playpen administrator's account stated the following on February 28th, eight days after it took control of the site.

I upgraded the Token Ring to Ethernet about an hour ago and things seem to be working a bit better.

This is what the FBI will do to further its investigations: it will become a better distributor of illegal material than the criminals it's going after. The filing notes that a conservative estimate of the number of images distributed during the FBI's two-week hosting stint sits around one million.

Also of note: throwaway email accounts are to be expected when users create accounts at child porn sites. But I honestly expected more from the President of the United States.

The motion makes good points about the FBI's apparently hypocritical child porn distribution and points out it had many options -- including disabling image downloads -- to pursue that would still have allowed it to serve up its NIT to the site's visitors. Unfortunately, courts have a hard time finding law enforcement activity to be "outrageous" enough to toss cases. And in this particular prosecution, it's the worst of the worst being prosecuted: a child porn viewer.

Filed Under: child porn, fbi, nit, operations, playpen

Judge In Playpen Case: FBI's Warrant Is Valid, Even If Its Claims About No Privacy In IP Addresses Are Not

from the a-net-win-for-the-feds dept

Another court handling an FBI Playpen case has handed down its decision on a motion to suppress. Like other courts fielding prosecutions resulting from this massive investigation, it has found [PDF] that the FBI's NIT (Network Investigative Technique) is invasive enough to be called a "search." (via FourthAmendment.com)

The FBI must have felt its NIT deployment would be considered a search. That's why it obtained a warrant in the first place. But it's been frantically peddling "not a search" theories as court after court has declared its warrant invalid because the searches were performed outside of the issuing magistrate's jurisdiction.

In this case, the issue of whether or not the NIT deployment was a search has not been disputed by either party. The court addresses it anyway because it affects the reasoning that follows.

Before reaching the merits of Defendant's motions, it will be useful to address a preliminary question unaddressed by the parties: Was the deployment of the NIT a "search" of Defendant's computer within the meaning of the Fourth Amendment? If the use of the NIT was not a search, the Fourth Amendment was not implicated, no warrant was required, and any violation of Rule 41(b) irrelevant.

Rule 41(b), which may be drastically altered by the end of this year, restricts searches to the jurisdiction where the warrants were issued. The FBI is well aware of the deficiencies of its NIT warrant, which is why it presented this legal theory to court in response to an earlier motion.

The government in its response to Defendant's First Motion to Suppress never argues that no warrant was required because deployment of the NIT was not a Fourth Amendment search. See Gov't's Resp. to First Mot. at 15-38. In failing to raise this argument when it would have been appropriate, the government has likely waived it. The government does, in justifying the scope of the warrant, argue that Defendant had no reasonable expectation of privacy in his IP address, even though he was using the Tor network.

The court blows past the "no expectation of privacy in IP addresses" for the moment, instead focusing on the execution of the FBI's NIT.

The "contents" of a computer are nothing but its code. In placing code on Defendant's computer, the government literally—one writes code—invaded the contents of the computer. Additionally, the code placed on Defendant's computer caused Defendant's computer to transmit certain information without the authority or knowledge of Defendant. In this manner the government seized the contents of Defendant's computer. Just as in Riley, it is irrelevant that Defendant might not have a reasonable expectation of privacy in some of the information searched and seized by the government. The government's deployment of the NIT was a Fourth Amendment search.

This key element having been decided, the court moves on to the warrant itself, as well as the government's contention that an IP address has no expectation of privacy. As to the latter, the court points out that the government obtained much more than just an IP address with its NIT and that it used an intrusive means to do so. The court ultimately agrees with the assertion about the lack of privacy in IP addresses, but does not agree that obtaining an IP address in this fashion can be considered harmless under the Fourth Amendment. Hence the nod to the Supreme Court's Riley decision. While many records contained on a phone may be subject the Third Party Doctrine and obtained without a warrant, they must be obtained from the third parties, rather than from the phone itself. Replace "phone" with "computer," and information with no built-in expectation of privacy gains a privacy shield due to where these "records" are stored.

The defendant's second motion to suppress brings up the Rule 41(b) issue. But it fails, spectacularly, because of the defendant's location.

Defendant argues that Rule 41(b) only allows magistrate judges to issue warrants for searches outside of their districts in limited, well-defined circumstances, none of which apply to the facts of the instant case. Second Mot. at 6-11. Of course, Defendant acknowledges that the website was being run from within the Eastern District of Virginia, that the magistrate judge sits in the Eastern District of Virginia, and that Defendant's computer was located in the Eastern District of Virginia when the NIT was deployed.

The legal theory advanced by the defense is that the warrant is still invalid, even when deployed in its proper jurisdiction, because it permitted the FBI to search an untold number of computers located all over the country. The court doesn't buy this rationale. In fact, it states it would have denied suppression even if the warrant had failed to hold up because the FBI took every step it could to ensure the legitimacy of its search.

The FBI agents in this case did the right thing. They gathered evidence over an extended period and filed a detailed affidavit with a federal magistrate in support of their search warrant application. They filed the warrant application in the federal district that had the closest connection to the search to be executed. The information gathered by the warrant was limited: primarily the IP addresses of those that accessed Playpen and additional information that would aid in identifying what computer accessed the site and what individual used that computer.

The judge doesn't let the FBI off the hook entirely. It also addresses the FBI's last-minute argument that the defendant shouldn't even have been allowed to challenge the warrant.

The government also argues that Defendant does not have standing to challenge the warrant because the alleged defect in the warrant, that it exceeded the magistrate's jurisdiction, does not apply to him because his computer was in the Eastern District. This seems to be a novel interpretation of standing law in Fourth Amendment cases. The standing inquiry in Fourth Amendment cases asks if the individual seeking suppression had a reasonable expectation of privacy in the thing searched. See Rakas v. Illinois. 439 U.S. 128, 133-34 (1978). Defendant's computer was searched, and he has a reasonable expectation of privacy in his computer.

The Playpen saga is a complete mess. There's nothing in this mixed bag of decisions that tips the scale in either direction. For every win about the lack of privacy in IP addresses the FBI secures, it loses another one to the invasive method it used to obtain these addresses. Every time a court grants its credit for "good faith," multiple courts countered with opinions finding the warrants invalid from the moment they were signed by a magistrate.

About the only "win" the FBI can definitively claim is that its NIT secrets are still mostly secret. And in order to achieve that, it had to watch its evidence be dismissed by a judge who actually believed the FBI had legitimate reasons for refusing to disclose this info.

And yet, it's unlikely that this will result in the FBI examining its investigation methods. As of right now, it has less than six months before the proposed Rule 41(b) changes are adopted by Congress. And there's a good chance they will be because Congress has to have the will and determination to "opt out" while distracted by an extended holiday season of shorter work weeks, the annual budget process, reelection campaigns, and a change in regimes.

Filed Under: doj, fbi, ip address, nit, playpen, privacy, warrant

FBI Sends Computer Information Collected By Its Hacking Tools In Unencrypted Form Over The Open Internet

from the the-(fraying)-ends-justify-the-(sloppy)-means dept

The FBI doesn't want to talk about its secret malware, but with over 100 child porn prosecutions tied to it, it's had to discuss at least a few aspects of its Network Investigative Technique (NIT).

In yet another prosecution -- this one actually taking place in Virginia for a change -- the FBI is once again struggling to withhold details of its NIT from the defense. Suppression of the evidence likely isn't an option, as the warrant it obtained in Virginia was actually deployed in Virginia. I'm sure the FBI is as surprised as anybody by this fortuitous coincidence. But the defendant still wants access to more information, as he is looking to challenge the evidence the FBI collected with its Tor-defeating exploit.

The defendant, Edward Matish, has questions about the chain of custody. FBI Special agent Daniel Alfin, who has testified in other Playpen/NIT cases inadvertently admits there could be problems here, considering the FBI does nothing to protect the information it collects from suspect's computers from being intercepted or altered. (h/t Chris Soghoian)

I have read the Defendant's reply to the Government's Response to the Motion to Compel dated May 23,2016. In the motion, Matish asserts that there are chain of custody problems caused by the fact that the NIT transmitted data "unencrypted over the traditional internet". This assertion is further supported by the declaration of Matthew Miller who states "the IP address relayed to the FBI was unencrypted and subject to attack by hackers" Miller Dec.

So, the NIT the FBI says is so secret it won't discuss it even if facing contempt orders apparently sends back info over the open internet. Agent Alfin plows past this admission, calling the defense expert "wrong" while refusing to discuss the possibility that unencrypted transmissions could be altered.

He is wrong. In fact, the network data stream that has been made available for defense review would be of no evidentiary value had it been transmitted in an encrypted format. Because the data is not encrypted, Matish can analyze the data stream and confirm that the data collected by the government is within the scope of the search warrant that authorized the use of the NIT. Had the data been transmitted in an encrypted format the data stream would be of no evidentiary value as it could not be analyzed.

This is absurd. If Alfin is to be believed, any communications/data sent utilizing end-to-end encryption would be nothing but useless, scrambled gibberish to recipients. The FBI didn't encrypt these transmissions because it probably didn't seem worth the effort… at least not at the time. The FBI could have encrypted the transmissions and delivered the decrypted results to defendants for them to examine. I'm sure it wishes it had done this, now that it's being challenged in court.

This is one more example of the FBI's overconfidence getting in the way of its better judgment. These were supposed to be open-and-shut child porn prosecutions -- a repeat of its mostly under-the-radar use of the same tools and tactics in 2012. But they aren't. They're being challenged and the FBI is going from courtroom to courtroom, putting out fires. And all that scrambling is leading to half-assed explanations like this, which raises serious questions about the FBI's investigative "techniques."

Filed Under: daniel alfin, doj, edward matish, encryption, fbi, going dark, hacking, malware, nit, playpen

Judge Says The FBI Can Keep Its Hacking Tool Secret, But Not The Evidence Obtained With It

from the hope-the-feds-enjoy-their-victory-over-transparency dept

Judge Robert Bryan -- having set his own house against itself by declaring the FBI could keep its NIT info secret while simultaneously declaring the defendant in the child porn case had every right to see it -- has managed to find a way out of his self-induced conundrum. And it's going to make the FBI very sad. (h/t Ars Technica)

For the reasons stated orally on the record, evidence of the N.I.T., the search warrant issued based on the N.I.T., and the fruits of that warrant should be excluded and should not be offered in evidence at trial.

Well, not quite.

Michaud hasn't had the case against him dismissed, but the government will now have to rely on evidence it didn't gain access to by using its illegal search. And there can't be much of that, considering the FBI had no idea who Michaud was or where he resided until after the malware-that-isn't-malware had stripped away Tor's protections and revealed his IP address.

The FBI really can't blame anyone but itself for this outcome. Judge Bryan may have agreed that the FBI had good reason to keep its technique secret, but there was nothing preventing the FBI from voluntarily turning over details on its hacking tool to Michaud. But it chose not to, despite his lawyer's assurance it would maintain as much of the FBI's secrecy as possible while still defending his client.

Judge Bryan found the FBI's ex parte arguments persuasive and declared the agency could keep the info out of Michaud's hands. But doing so meant the judicial playing field was no longer level, as he acknowledged in his written ruling. Fortunately, the court has decided it's not going to allow the government to have its secrecy cake and eat it, too. If it wants to deploy exploits with minimal judicial oversight, then it has to realize it can't successfully counter suppression requests with vows of silence.

It's doubtful the FBI will learn from this experience. It did the same thing in 2012 and received nothing but deference from the courts. This time around, courts and lawyers are better educated, thanks to Snowden's leaks and a few hundred FOIA warriors -- all of whom have served to expose the massive, secret expansion of the government's surveillance reach and the near-complete dearth of effective oversight.

The FBI will be pushing hard for the adoption of the proposed Rule 41 changes. If these had been in place, every illegal search it performed using its NIT and the invalid warrant it obtained would have been legal. As it stands now, however, multiple courts have examined the warrant and the hacking tool and found the FBI's actions to be in violation of current statutes. What should have been slam-dunk prosecutions against unsympathetic defendants have instead become multiple participants in an ongoing debacle.

Filed Under: doj, evidence, fbi, jay michaud, malware, nit, playpen, robert bryan, rule 41