Another Court Finds FBI's NIT Warrants To Be Invalid, But Credits Agents' 'Good Faith' To Deny Suppression

from the sure,-someone-screwed-up-but-it's-not-going-to-help-you dept

Yet another court has found that the warrant used by the FBI in the Playpen child porn investigation is invalid, rendering its NIT-assisted "search" unconstitutional. As USA Today's Brad Heath points out, this is at least the sixth court to find that Rule 41's jurisdictional limitations do not permit warrants issued in Virginia to support searches performed all over the nation.

While the court agrees that the warrant is invalid, it places the blame at the feet of the magistrate judge who issued it, rather than the agents who obtained it.

That Congress has “not caught up” with technological advances does not change the fact that the target of the NIT in Werdene’s case was located outside of the magistrate judge’s district and beyond her jurisdiction under subsection (b)(1). The property to be seized pursuant to the NIT warrant was not the server located in Newington, Virginia, but the IP address and related material “[f]rom any ‘activating’ computer” that accessed Playpen. (Gov’t’s Opp., Ex. 1 Attach. A.) Since that material was located outside of the Eastern District of Virginia, the magistrate judge did not have authority to issue the warrant under Rule 41(b)(1).

So, unlike other cases, this will not result in a suppression of evidence, thanks to the "good faith exception."

Werdene claims that the Government acted with intentional and deliberate disregard of Rule 41 because the FBI misled the magistrate judge “with respect to the true location of the activating computers to be searched.” (Def.’s Mem. at 17.) This argument is belied by both the warrant and warrant application. Agent Macfarlane stated in the warrant application that the “NIT may cause an activating computer—wherever located—to send to a computer controlled by or known to the government, network level messages containing information that may assist in identifying the computer, its location, other information about the computer and the user of the computer.” With this information, the magistrate judge believed that she had jurisdiction to issue the NIT warrant. Contrary to Werdene’s assertion, this is not a case where the agents “hid the ball” from the magistrate or misrepresented how the search would be conducted.

[...]

[T]o the extent a mistake was made in this case, it was not made by the agents in “reckless . . . disregard for Fourth Amendment rights.” Davis, 564 U.S. at 238 (quoting Herring, 555 U.S. at 144). Rather, it was made by the magistrate when she mistakenly issued a warrant outside her jurisdiction.

Added to this is another wrinkle that doesn't work in the defendant's favor. The court also follows Third Circuit precedent in finding that there is "no expectation of privacy" in an IP address, even if a person has taken measures to hide that information from others.

Werdene had no reasonable expectation of privacy in his IP address. Aside from providing the address to Comcast, his internet service provider, a necessary aspect of Tor is the initial transmission of a user’s IP address to a third-party: “in order for a prospective user to use the Tor network they must disclose information, including their IP addresses, to unknown individuals running Tor nodes, so that their communications can be directed toward their destinations.” United States v. Farrell, No. 15-cr-029, 2016 WL 705197, at *2 (W.D. Wash. Feb. 23, 2016). The court in Farrell held that “[u]nder these circumstances Tor users clearly lack a reasonable expectation of privacy in their IP addresses while using the Tor network.”

The FBI is struggling to keep its many Playpen cases from falling apart, thanks to bogus warrants, a tool it refuses to discuss, and unexpected pushback from usually ultra-compliant courts. The proposed changes to Rule 41 will remove jurisdiction limits, but it isn't law yet. (Fortunately, there's an actual effort to prevent this from happening, as it would only take Congressional inactivity to see it become codified.) This outcome doesn't necessarily hurt this particular case, but yet another judge finding the warrants invalid from word one isn't exactly a confidence-builder either.

Filed Under: doj, fbi, malware, nit, playpen, rule 41, warrant

Judge In Child Porn Case Reverses Course, Says FBI Will Not Have To Turn Over Details On Its Hacking Tool

from the no-unending-solitary-confinement-for-special-agents,-apparently dept

Back in February, the judge presiding over the FBI's case against Jay Michaud ordered the agency to turn over information on the hacking tool it used to unmask Tor users who visited a seized child porn site. The FBI further solidified its status as a law unto itself by responding that it would not comply with the court's order, no matter what.

Unfortunately, we won't be seeing any FBI officials tossed into jail cells indefinitely for contempt of court charges. The judge in that case has reversed course, as Motherboard reports.

The government's motion has been granted, and the FBI does not have to provide the exploit code to the defense as previously ordered. That means that the defense in the case will probably be unable to examine how the evidence against their client was collected in the first place.

It is not totally clear why Judge Robert J. Bryan changed his mind. On Thursday, the government and Bryan held a private meeting, where the government presented its reasons for nondisclosure of the Tor Browser exploit.

The judge apparently believes the defense should still be able to examine the code but apparently can't be bothered with ensuring this will happen.

Despite backtracking somewhat, Bryan still thinks the defense has a reason to see that code, according to audio of the public section of Thursday’s hearing provided by activist Phil Mocek. Of course, whether the FBI decides to then provide it is another matter.

Given the FBI's earlier promise to withhold the details of the NIT despite being ordered to disclose them, I'd say there's about a 0% chance of the FBI voluntarily turning this information over to the defense. Right now, the agency is working overtime just trying to keep the evidence it obtained with its hacking tool from being tossed out of three other courts. It's also facing the prospect that third-party interlopers like Mozilla may still result in it having to release these details to someone outside of its own offices. At this point, hardly anything's going the FBI's way, so it will take whatever it can get, even if it's only temporary relief.

Filed Under: discovery, doj, fbi, hacking, jay michaud, malware, nit, playpen

Mozilla Asks Court To Force FBI To Turn Over Information On Hacking Tool It Used In Child Porn Case

from the only-criminals-use-patched-browsers-amirite? dept

An indirectly-involved party in the FBI's Playpen case has waded into the fray and is demanding answers. Mozilla wants to know about the security flaw the FBI exploited so it can fix it. (h/t Brad Heath, Nate Cardozo)

Mozilla now seeks to intervene in relation to the Government’s pending Motion to request modification of the Order, or in the alternative, to participate in the development of this issue as amicus curiae in favor of neither party, for the purpose of requesting that the Court modify its Order to require the government to disclose the vulnerability to Mozilla prior to disclosing it to the Defendant. Absent great care, the security of millions of individuals using Mozilla’s Firefox Internet browser could be put at risk by a premature disclosure of this vulnerability. This risk could impact other products as well. Firefox is released under an open source license. This means that as Firefox source code is continuously developed, it is publicly available for developers to view, modify, share, and reuse to make other products, like the Tor Browser. The Tor Browser comprises a version of Firefox with some minor modifications to add additional privacy features, plus the Tor proxy software that makes the browser’s Internet connection more anonymous.

With the Tor browser being built on the Firefox framework, any exploit of Tor could affect vanilla Firefox users. Not only that, but the FBI is apparently sitting on another Firefox vulnerability it used in a previous investigation to unmask Tor users. (This refers to the FBI's 2012 child porn sting, which also used a NIT to obtain information about visitors to a seized website.) The filing notes the FBI has been less than helpful when approached for info about this Firefox/Tor-exploiting NIT.

Mozilla has contacted the Government about this matter but the Government recently refused to provide any information regarding the vulnerability used, including whether it affects Mozilla’s products. Accordingly, Mozilla requests that the Court modify its order to take into account how such disclosure may affect Mozilla and the safety of the several hundred million users who rely on Firefox.

Mozilla wants to see this information two weeks before it's disclosed to the defendant so it can patch the hole. While it's not unopposed to the information being turned over to the defendant, this headstart would allow it to fix the vulnerability before it becomes public knowledge and turned into a weapon to be wielded against millions of Firefox users.

There's a Fifth Amendment implication here as well: the due process right of third parties to act on behalf of properties or interests affected by criminal investigations or court decisions.

To consider the weight of Mozilla’s interests, this Court must determine whether the Exploit to be disclosed takes advantage of an unfixed Firefox vulnerability. If it does, Mozilla will suffer harm if the Court orders the government to disclose the vulnerability to the Defendant under the existing protective order. Likewise, Mozilla continues to suffer harm by the Government’s refusal to confirm at this point whether Firefox is the target of the vulnerability. [...] Due process compels this Court to hear Mozilla’s arguments and consider its interests before rendering a decision.

The proposed protective order doesn't do enough to prevent discovery of the vulnerability, according to Mozilla.

The protective order does not contain restrictions on disclosing knowledge learned through examining NIT Protected Material. This alone marks a serious deficiency in the Protective Order as the damaging information about the vulnerability is likely something that someone can easily remember. Rather, the Protective Order’s disclosure restrictions are limited to the further distribution of the copies of information the defense receives from the government. Without more restrictive provisions, the protective order relies too heavily on the Defendant’s representations he and his defense team will not share copies, but not on any explicit agreement that they will not share or use information learned or that they will put security safeguards in place

Not that the NIT's specifics are necessarily secure if the court refuses to order disclosure to Michaud or Mozilla. The declaration entered by defendant Jay Michaud's expert witness points out that the previous use of the NIT in the 2012 case resulted in the FBI turning over information about the exploit to the defendant. So, there's precedent for disclosure, which is what Michaud's lawyer is demanding. But there's also evidence the FBI is hardly the best repository for exploits and vulnerabilities.

The Cottom case, which also involved an FBI NIT, provides a helpful comparison. In Cottom, the government agreed to cooperate with the defense's discovery requests. However, the FBI later reported to the Nebraska court that it had lost part of the NIT source code. Given the potential harms and security issues the government has raised in connection with the disclosure information, the FBI's loss of NIT code in Cottom is still hard to understand. But there at least the government did not dispute the defense's need to analyze all of the available components and code to prepare pre-trial motions, a Daubert challenge, and potential trial defenses.

Hard to understand, indeed. How does someone lose "part" of an exploit's code, especially considering the FBI's obvious interest in deploying it in other investigations? Might just be stupidity, but considering its evidentiary implications and the FBI's extreme reluctance to expose "means and methods," it also smells a bit of maliciousness.

While Mozilla's attempted intervention may force the FBI to turn over information on its NIT, it's unlikely to be much of a direct benefit to Michaud. His lawyer is opposed to Mozilla's request for exploit info and its offer to appear as an amicus in support of Michaud's motion to compel. His filing notes that while Mozilla is not opposed to the FBI also turning over this information to Michaud, he and his client have no interest in returning the favor should the court side with Michaud, rather than Mozilla.

Mr. Michaud has no stake in Mozilla’s dispute with the Government. Further, the defense has no intention of disclosing any NIT discovery to Mozilla, a third party, or the public in general under any circumstances. To the extent that Mozilla is concerned that the existing NIT protective order does not provide “adequate safeguards” (dkt. 195 at 12), the defense has stated that it is amenable to any and all additional security measures and modifications to the existing NIT protective order that the Court deems appropriate.

Not an unreasonable response, as Michaud's lawyer's ultimate duty is to serve his client, not millions of Firefox/Tor users. As for the government, it's likely incredibly irritated that its super-secret tool is gaining it no traction in supposedly open-and-shut child porn prosecutions. Not only are courts finding the warrants used to perform this extrajurisdictional searches invalid from word one, but defendants are pushing back hard against the FBI's "investigative methods" secrecy and dismissive attitude towards the Fourth Amendment. I'm sure it had no idea it would be 198 documents deep into a single child porn case at this point -- much less being nowhere closer than day one to securing a conviction.

Filed Under: doj, fbi, malware, nit, playpen, tor
Companies: mozilla

DOJ Deploys Highly-Questionable Legal Arguments In Attempt To Save FBI's Hacking Warrants

from the let-us-tell-you-how-to-read-the-applicable-statutes-and-precedent dept

The proposed Rule 41 changes recently adopted by the US Supreme Court can't go into force fast enough for the FBI. The changes -- if approved by Congress (which needs to do nothing more than literally nothing for this to happen) -- would allow it to hack computers anywhere in the nation by removing jurisdictional restrictions.

Its decision to keep a child porn site up and running in order to deploy a hacking tool to sniff out obscured user information now appears to have been a colossal mistake. The warrant for the search performed by the FBI's NIT was issued in Virginia, but the actual searches took place all over the nation. While the seized server may have been located in the state, the users identified by the NIT were located as far away as the opposite coast. The FBI's decision to ignore jurisdiction limits under Rule 41 is now costing it loads of evidence.

Judges in Massachusetts, Oklahoma and Kansas have found the searches to be illegal because they're based on invalid warrants. The government is now fighting these suppression orders. In Oklahoma, it recently entered its challenge of the court's decision to suppress evidence obtained with the NIT, using an interesting take on Rule 41 that attempts to align it with the infamous All Writs Act -- mainly that Rule 41 should be construed liberally to allow the FBI to do anything Congress hasn't expressly forbidden it to do.

Rule 41(b) is meant to be applied flexibly, not rigidly. United States v. Koyomejian, 970 F.2d 536, 542 (9th Cir. 1992). When emerging technologies create a situation in which the specific language of Rule 41 does not explicitly permit a warrant, the Supreme Court has concluded that Rule 41 “is sufficiently flexible to include within its scope electronic intrusions authorized upon a finding of probable cause.” United States v. New York Tel. Co., 434 U.S. 159, 169 (1977). The Supreme Court goes on to explain that a flexible application of Rule 41 is supported by Fed. R. Crim. P. 57(b), which provides in the absence of controlling law, “a judge may regulate practice in any manner consistent with federal law, these rules and the local rules[.]”

Just as the DOJ government would prefer we focus on a case that's almost four decades old (1979's Smith v. Maryland) when discussing bulk surveillance, Stingray devices and cell site location info, it wants us to page through late 70s court decisions when discussing the FBI's actions during the last couple of years.

In the middle of its paragraph stating that courts should be granting the FBI much more leeway when it deploys previously-unused investigative techniques, the DOJ slips in a reference to 1977's US v. New York Telephone Company -- the same Supreme Court decision it says justifies its use of the All Writs Act to force Apple to comply with demands to unlock encrypted iPhones.

The problem with the DOJ's argument is that this isn't a case where a warrant isn't "explicitly permitted." Warrants were permitted, but deployment was supposed to be limited to the jurisdiction where they were issued. The DOJ basically wants the court to forget its position as a check against government overreach and validate the FBI's invalid warrants. In doing so, it misleadingly portrays the Supreme Court's statements on the matter by selectively quoting from the decision. The wording surrounding the DOJ's pull quotes only shows the court determining that Rule 41(h) does not restrict warrants to justifying the search and seizure of "tangible items."

Although Rule 41 (h) defines property "to include documents, books, papers and any other tangible objects," it does not restrict or purport to exhaustively enumerate all the items which may be seized pursuant to Rule 41. Indeed, we recognized in Katz v. United States, 389 U. S. 347 (1967),which held that telephone conversations were protected by the Fourth Amendment, that Rule 41 is not limited to tangible items but is sufficiently flexible to include within its scope electronic intrusions authorized upon a finding of probable cause. 389 U. S., at 354-356, and n. 16 See also Osborn v. United States, 385 U. S. 323, 329-331 (1966).

This obscures the real issue here: Rule 41(b), which currently limits deployment of warrants to the jurisdictions where they were issued.

Going beyond this legal sleight of hand, the DOJ also claims that the entire two-week period it ran the child porn site while it deployed its NIT was fraught with "exigent circumstances."

The magistrate judge’s Report and Recommendation rejects the assertion that exigent circumstances would have justified the warrant. The judge’s analysis identifies the underlying exigency as being the “downloading and distribution of child pornography,” exigent “only because the Government opted to keep the Playpen site operating while it employed the NIT.” Doc. 42, p. 27. The exigent circumstances that would have justified the use of the NIT, however, were tied to the on-going rape and abuse of children—as opposed to simply its depiction.

Even if you buy the DOJ's argument that a two-week period -- in which warrants were obtained -- is still somehow "exigent," you have to get over the hurdle that exigent circumstances is almost always used to salvage the results of warrantless searches. It can't be used -- or at least hasn't been used until now -- to salvage the warrants themselves. The court here declared the warrant to be "void ab initio," meaning the warrant was never valid at any point.

Circumstances cannot be declared "exigent" if the time exists to obtain warrants. The DOJ's argument here isn't even coherent enough to be circular. It's simply nonsensical. Either the situation is exigent and warrants must be put on the back burner, or circumstances are not exigent and warrants can be obtained. It can't be both things at once, even if it would be oh so convenient for the DOJ if they were.

Exigent circumstances or not, the warrant obtained was invalid. The DOJ is hoping to turn a search with a void warrant into a warrantless search in order to bypass the Rule 41(b) restrictions it argues one paragraph earlier shouldn't prevent it from performing its searches wherever it feels like it.

The worst case scenario, though, is what could happen if everything falls into place for the DOJ. If the jurisdiction limitations are removed with the Rule 41(b) changes, future NIT warrants would be valid and suppression would be nearly impossible. But if the court buys its "exigent circumstances" argument, the FBI may feel more comfortable relying on the exception... and begin deploying its hacking tools anywhere it feels like without ever running it past a judge.

Filed Under: 4th amendment, child porn, doj, fbi, hacking, nit, playpen, warrant

Yet Another Court Says FBI's Hacking Tool In Child Porn Case Was An Illegal Search

from the the-4th-amendment-matters dept

Just last week, we wrote about another ruling in one of the many cases kicked off when the FBI took control over a Tor-based child porn site, called Playpen, and ran it for two weeks. While the courts have said that it was okay for the FBI to run a child porn service for two weeks as part of a sting operation, they've been having a lot more trouble with the fact that the FBI then used its control over the service to infect any visitor with malware in order to figure out who they were. In the ruling last week, in the case against Alex Levin, in the Massachusetts District Court, the court said that the malware/hacking tool represented an illegal search under the 4th Amendment and suppressed the evidence. The key issue was that the warrant was issued for searches in the Eastern District of Virginia, but Levin clearly was not there.

Now a court in the Northern District of Oklahoma, in a case against Scott Arterbury, has more or less reached the same conclusion. Specifically, Artebury's lawyers pointed out that his computer was "seized" by the malware (called the Network Investigative Technique or NIT), and that was clearly in Oklahoma, beyond the bounds of the warrant. The government tried to play some games, arguing that it was the data that was seized in Virginia when it accessed the FBI-hosted site. The court doesn't buy it. The NIT acted in Oklahoma, not Virginia:

The Court is not persuaded by this argument. The property seized in this instance was Arterbury’s computer, which at all relevant times remained in Oklahoma. The NIT warrant allowed the Government to send computer code or data extraction instructions to Arterbury’s computer, wherever it was located. The Government “seized” that computer and directed it to send certain information to the Government – all without Arterbury’s knowledge or permission. Arterbury’s computer was never in the Eastern District of Virginia and subsection (b)(2), therefore, does not apply. Furthermore, even if the property seized was electronic information, that property was not located in the Eastern District of Virginia at the time the warrant was signed. This information only appeared in Virginia after the Warrant was signed and executed and the Government seized control of Defendant’s computer in Oklahoma.

None of this, of course, is to absolve those who were actively engaged in activities around child pornography. But, as the judge notes, the FBI could have easily gotten an appropriate warrant:

Furthermore, the drafters of Rule 41 knew how to avoid the territorial limit on issuance of warrants when they wished to do so. Rule 41(b)((3) removes the territorial limitation in cases involving domestic or international terrorism. In such cases, a magistrate judge “with authority in any district in which activities related to the terrorism may have occurred has authority to issue a warrant for a person or property within or outside that district.” Rule 41(b)(3). The drafters of Rule 41 could easily have included child pornography in Rule 41(b)(3) and, thereby, avoided the territorial limitation of Rule 41(b)(1) & (2). They did not do so. The Court can only conclude that they did not intend to remove the territorial limit in cases such as the one before the Court.

The court then delves a bit deeper to determine if it should order the evidence suppressed. Even in some of the other cases where the court found the NIT to be an illegal search, it still allowed the evidence to be used, often because of the "good faith exception." But not here. After a long discussion about the good faith exception... the court explains it just doesn't apply here, because this wasn't just a technical error, but an error that destroys the entire warrant.

I conclude that where the Rule 41 violation goes directly to the magistrate judge’s fundamental authority to issue the warrant, as in the violation presented here, it is not a “technical violation” of the Rule. The warrant is void ab initio, suppression is warranted and the good-faith exception is inapplicable.

Once again, it's looking like the FBI and DOJ's failure to respect the 4th Amendment means that evidence will be suppressed.

Filed Under: 4th amendment, alex levin, doj, fbi, illegal search, nit, playpen, scott arterbury

Warrant For FBI's Hacking Technique Makes No Mention Of Hacking Or Malware

from the just-a-big-ol'-auto-scoop,-but-delivered-secretly dept

Motherboard has obtained a copy of the warrant used by the FBI to deploy its NIT (Network Investigative Tool) to obtain information about visitors to child porn site "Playpen." This site was seized by the FBI and left running for two weeks while it gathered information.

The prosecutions tied to this investigation have been interesting, to say the least. The FBI's short run as child porn site hosts received a judicial shrug -- something courts have done in the past when confronted with disturbing government behavior in service of combating crime. These have also led to the government arguing -- and the court echoing -- that Tor users have no expectation of privacy, as sooner or later, everything comes down to an IP address.

The warrant itself is slightly redacted, but that's hardly a surprise. More surprising is the fact that it has been released at all, as the FBI usually argues for the sealing of documents related to its investigations, especially in cases where law enforcement tech and methods are discussed.

As far as the details contained within, most of what's known about the FBI's NIT has already been discussed. As Motherboard's Joseph Cox points out, there are a few interesting aspects to the warrant request. For one, it makes it clear the FBI will be running a child porn site for the duration of the "search."

“While the TARGET WEBSITE operates at a government facility, such request data associated with a user's actions on the TARGET WEBSITE will be collected,” the affidavit, signed by Douglas Macfarlane, an FBI special agent, reads.

While the document claims the FBI has no other way to ascertain the IP addresses and locations of users connecting to the website, it also goes light on the details of what it plans to do. The NIT is discussed in terms of what it's capable of gathering, but goes very, very light on technical details. Nowhere in the document does the FBI refer to its NIT in terms more applicable to its function, like "malware," "spyware" or "hacking." The FBI describes its NIT this way:

In the normal course of operation, websites send content to visitors. A user's computer downloads that content and uses it to display web pages on the user's computer. Under the NIT authorized by this warrant, the TARGET WEBSITE, which will be located in Newington, Virginia, in the Eastern District of Virginia, would augment that content with additional computer instructions. When a user's computer successfully downloads those instructions from the TARGET WEB SITE..., the instructions, which comprise the NIT, are designed to cause the user's "activating" computer to transmit certain information to a computer controlled by or known to the government. That information is described with particularity on the warrant (in Attachment B of this affidavit), and the warrant authorizes obtaining no other information. The NIT will not deny the user of the "activating" computer access to any data or functionality of the user's computer.

This lack of details could be problematic.

Critics are worried that the language of NIT applications is too vague for judges to grasp what exactly it is they are authorizing; the words "malware" or "hacking" are never used, for example. (Magistrate Judge Theresa C. Buchanan, who signed off on the NIT, has repeatedly declined to answer questions from Motherboard.) The NIT was used to access computers in the US, Greece, Chile, and likely elsewhere.

Speaking of foreign nations, the FBI apparently had some outside assistance in this case.

In December of 2014, a foreign law enforcement agency advised the FBI that it suspected IP address 192.198.81.106 , which is a US-based IP address, to be associated with the TARGET WEBSITE. A publicly available website provided information that the IP Address 192.198.81.106 was owned by [REDACTED] a server hosting company headquartered at [REDACTED] Through further investigation, FBI verified that the TARGET WEBSITE was hosted from the previously referenced IP address. [...] Further investigation has identified a resident of Naples, FL, as the suspected administrator of the TARGET WEBSITE, who has administrative control over the computer server in Lenoir, NC, that hosts the TARGET WEBSITE.

The fact that documents from sealed cases related to the FBI's Playpen investigation are being released publicly shows that even opposed forces can sometimes arrive at the same plan of actions, even if their motivations are completely different.

In Washington, the lawyer for a defendant captured with the assistance of the FBI's NIT is hoping to put the FBI's apparent overreach on display by requesting the unsealing of documents. The FBI, on the other hand, isn't putting up much of a fight to keep these sealed. The affidavit in this related case contains graphic descriptions of child porn images found on the site. People who generally don't believe the ends justifies the means often make exceptions for more heinous criminal activity like this. The public outing of sealed docs could persuade fence-sitters to come down on the side of the FBI, even if the agency's use of NITs is hardly limited to cases involving crime the public overwhelmingly finds completely repugnant.

Filed Under: darknet, doj, fbi, hacking, malware, network investigative tool, nit, playpen, tor, transparency, warrants