FBI Misconstrued Content Of Doc Leaker Reality Winner's Jailhouse Calls

from the press-'record'-and-be-done-with-it dept

The ongoing prosecution of document leaker Reality Winner has developed some new wrinkles. Despite having a very traceable leaked document in hand, the FBI is pitching in by misleading government lawyers -- and by extension, the presiding court. Maybe it's deliberate. Maybe it isn't. Either way, the administration wants desperately to crack down on leakers, and having a high-profile case result in a multi-year sentence would be a good start.

Right now, the government just wants to keep Winner locked up until her trial. Prosecutors have been arguing against her being released from jail by misconstruing the contents of recorded calls from Winner. (h/t Jeremy Scahill)

In arguing for her to be kept in the Lincoln County Jail in Lincolnton, Assistant U.S. Attorney Jennifer Solari told a judge Winner was recorded in a jailhouse phone call discussing some “documents” — plural — raising concerns she might have gathered other top-secret information beyond the NSA report she is accused of leaking. Solari said she was also overheard directing the transfer of $30,000 from her savings account to her mother’s account because the court had taken away her free appointed counsel.

But none of this is true. And it's not as though it's a matter of interpretation. Recordings exist.

But in an email to Winner’s attorneys on June 29, Solari said Winner could be heard in the recording telling her mom she “leaked a document,” singular. And in another recorded phone call, Solari said, Winner asked her mom to transfer her money because of fears authorities “might freeze it.” Winner’s attorneys said she was afraid she would not be able to pay her bills if her account were frozen.

So, where did this bogus info come from? The FBI, of course, which can't be bothered to let a recording literally speak for itself. US Attorney Solari stated in her email her comments on plural documents and the reasons for the requested funds transfer came from "verbal summaries" of the calls provided by the feds.

If there's anything the FBI has shown a systemic dislike for, it's recordings. Despite several decades of recording tech advancements, the FBI prefers pen-and-paper for "recording" interviews with suspects, indictees, and witnesses. In this case, the FBI could have given the prosecutor the recordings directly. Instead, it chose to provide an inaccurate summary. With the FBI, it's never your word against theirs. It's the FBI's words. Period.

Winner's attorneys have asked for her release pending trial, pointing to former military personnel who were allowed to roam free before having their day in court -- people like Gen. Petraeus, who was allowed to retain his position as CIA director up until he plead guilty to mishandling classified documents. But, as her attorneys are surely aware, a multi-tiered justice system doesn't allow for the release of NSA contractors who don't have Forever War Hero listed on their resumes.

Beneath all of this is one incredible fact: the FBI chose to present a verbal recap rather than hand over recordings. If the prosecutor hadn't bothered to listen to the tapes, the judge would be relying on misstatements made by the FBI when making a decision affecting someone's freedom. And if it had gone further than this, those verbal recaps might have been entered as evidence showing Winner was seeking to cut-and-run and possibly leak more documents -- both of which would have had an extremely adverse effect on her sentencing.

Filed Under: bail, doj, espionage act, fbi, high court, leaking, low court, misleading, reality winner

Court Finds FBI's 'Malware' Deployment To Be Perfectly Constitutional

from the well...-the-darkweb-is-like-an-unlit-highway... dept

The US court system has hosted a large number of lively discussions about the tactics used by the FBI in its Playpen child porn investigation. A lot of new ground was broken by the FBI, not all of it good. First, the agency kept a darkweb child porn site running for two weeks after it seized it. It did this to facilitate the distribution of malware designed to uncover information about the computers (and users) accessing the site.

Adding to the mess was the malware itself. The FBI's Network Investigative Technique (NIT) was deployed across the US (and across the globe) via a single warrant signed by a magistrate judge in Virginia. Plenty of courts have declared the FBI's warrant invalid, as the search performed violated Rule 41's jurisdictional limitations. (Those limitations no longer exist, so chalk up a win for the DOJ.) Many have also called the NIT's extraction of IP addresses and device-identifying info a search. But very few judges have seen fit to suppress the evidence obtained, either finding no privacy expectations in IP addresses or granting the FBI "good faith."

At the appellate level, only two Playpen cases have been heard, but both courts returned decisions in favor of the government. The process continues in full force at the lower levels, where the DOJ is still working its way through the dozens of cases springing from its NIT deployment.

In Texas, a federal judge has decided [PDF] against suppressing evidence obtained with the FBI's NIT. But Judge Xavier Rodriguez does so while using a descriptive term the government vehemently disagrees with. [h/t Brad Heath]

In December 2014, the Government became aware of a website named Playpen that contained child pornography. One of the servers for that website was in North Carolina. Ultimately the Government seized that server pursuant to a warrant, relocated the server to Virginia, and assumed the role of administrator. When the Government was unable to identify the identity of the approximate 150,000 members of the website, the Government obtained a warrant on February 20, 2015 to deploy Network Investigative Technique (NIT) malware. The warrant authorized the search for persons located in the Eastern District of Virginia. The malware, however, reached all computers accessing the website, including Defendant Halgren’s computer in San Antonio, Texas.

Through the malware the Government discovered that a user named “Platch” accessed the site, and the Government discovered the IP address associated with “Platch.” Defendant Halgren was the user associated with the IP address.

The FBI has argued its NIT isn't malware, even though it seems to fit the description. It's a payload designed to reveal IP addresses and device info without the target's permission or awareness. If deployed by anyone else other than the government, the government would take issue with the exploit's operation and delivery method.

Thus ends the things the government won't like in this opinion. The judge goes a route few others have, treating the malware like a tracking device. By casting it as something it really isn't, the judge is able to sustain the warrant's viability. If the NIT is a tracking device, no jurisdictional violations occurred. The tracking device simply "traveled" out of the jurisdiction and that can't possibly be the government's fault.

Magistrate Judges have authority “within the district in which sessions are held by the court that appointed the magistrate judge . . . and elsewhere as authorized by law.” 28 U.S.C. § 636(a). Former Rule 41 that was in effect in 2015 authorized a Magistrate Judge “to issue a warrant to search for and seize a person or property located within the district.” The Former Rule 41 provided “exceptions to this jurisdictional limitation for property moved outside of the jurisdiction, for domestic and international terrorism, for the installation of a tracking device, and for property located outside of a federal district. None of these exceptions [in 2015] expressly allow[ed] a magistrate judge in one jurisdiction to authorize the search of a computer in a different jurisdiction.”

But see United States v. Darby, 190 F. Supp. 3d 520, 536 (E.D. Va. 2016) (“Rule 41(b)(4) allows a magistrate judge to issue a warrant for a tracking device to be installed in the magistrate's district. Once installed, the tracking device may continue to operate even if the object tracked moves outside the district. This is exactly analogous to what the NIT Warrant authorized. Users of Playpen digitally touched down in the Eastern District of Virginia when they logged into the site. When they logged in, the government placed code on their home computers. Then their home computers, which may have been outside of the district, sent information to the government about their location. The magistrate judge did not violate Rule 41(b) in issuing the NIT Warrant.”)

Even if the court would have found the warrant invalid (which it didn't), it still would have allowed the FBI to keep the evidence because the Fourth Amendment doesn't cover IP addresses.

Given that the Defendant’s IP address was required to be disclosed to various third parties and Playpen to access the website, any subjective expectation of privacy the Defendant may have possessed was not objectively reasonable.

And if that wasn't enough, good faith is also granted, so any lack of a valid warrant still wouldn't have resulted in evidence suppression.

The warrant was not void at its issuance. Even if it had been, the Court concludes that the good faith exception would apply and that suppression would not be warranted.”); but see Levin, 186 F. Supp. 3d at 44 (NIT Warrant was issued without jurisdiction and thus was void ab initio and the good-faith exception is inapplicable). This Court disagrees with Levin and the three or four other courts that have ordered suppression. If a judge signed a warrant without the necessary probable cause determination that warrant was akin to being void. But if an officer reasonably relies upon that signing and acts in good faith, Leon holds that the evidence seized should not be suppressed.

This will almost certainly be appealed. There's still plenty of appeals courts left that haven't explored these issues. The first two tries went the government's way, but more eyes on more cases may actually result in a successful suppression effort. The problem is the rules (well, Rule 41 anyway) have changed. Courts may see little value in suppressing evidence the government can now acquire lawfully with last year's Rule 41 changes. The Eighth Circuit Appeals Court came to exactly that conclusion earlier this year.

The thing is, the government should still be deterred from breaking rules they know still exist, even if governing statutes may change in the future. The government hasn't stopped locking up marijuana users and dealers even though legalization in a majority of US states seems inevitable. This standard should be applied to the government by the only entities capable of doing it: the US courts.

Filed Under: doj, fbi, malware, nit, playpen, rule 41

GCHQ Knew FBI Wanted To Arrest MalwareTech, Let Him Fly To The US To Be Arrested There

from the so-much-for-those-'flight-risk'-fears dept

It looks like the UK found an easy way to avoid another lengthy extradition battle. Its intelligence agency, GCHQ, knew something security research Marcus Hutchins didn't -- and certainly didn't feel obliged to tell him. Not only that, but it let a criminal suspect fly out of the country with zero pre-flight vetting. (Caution: registration wall ahead.)

Officials at the intelligence agency knew that Marcus Hutchins, from Devon, who was hailed as a hero for helping the NHS, would be walking into a trap when he flew to the US in July for a cyber-conference.

Hutchins’s arrest by the FBI on August 2 while he was returning from Las Vegas freed the British government from the “headache of an extradition battle” with their closest ally, say sources familiar with the case.

Certainly no one expected GCHQ to give Hutchins a heads-up on the legal troubles awaiting him on the other side of the pond, but there's something a bit mean-spirited about allowing a UK citizen to walk into custody in another country. And as for the "headache," too bad. That's just part of the deal when you make promises to other countries you'll ship them your citizens to face an uphill battle in an unfamiliar judicial system while facing charges for laws that may not apply the same way -- or as harshly -- at home.

This is even more disconcerting when it was Hutchins who was instrumental in killing off the WannaCry ransomware that wreaked havoc pretty much everywhere earlier this year. In gratitude for his efforts, a few publications outed the person behind the "MalwareTech" pseudonym, which probably made it a bit easier to tie Hutchins to various online personas.

As Marcy Wheeler pointed out on Twitter, it works out pretty well for the UK. It gets to outsource its prosecutions to a nation where punishments for malicious hacking are much, much higher. It also gets to dodge the publicity black eye of handing over its (inadvertent) WannaCry hero to the feds and their threat of a few decades in jail. It also suggests the Five Eyes partnership is paying off in questionable ways and, sooner or later, it's going to be an American citizen walking into the same sort of trap overseas.

Filed Under: doj, extradition, fbi, gchq, malwaretech, marcus hutchins, uk

FBI Terrorism Sting Nets Paranoid Schizophrenic Previously Found Incompetent By A State Court

from the FBI-Darwinism dept

It looks like the FBI has secured another anti-terrorism "win." Once again, the agency controlled the terrorism sting from beginning to end, ensuring the suspect communicated with no one but confidential informants and undercover agents. And, once again, the FBI has utilized the sort of person who probably poses more harm to themselves than others.

The FBI has arrested an Oklahoma man on charges that he tried to detonate what he thought was a 1,000-pound bomb, acting out of a hatred for the U.S. government and an admiration for Oklahoma City bomber Timothy Mc­Veigh, according to court papers.

Jerry Drake Varnell was arrested shortly after an attempt early Saturday morning to detonate a fake bomb packed into what he believed was a stolen cargo van outside a bank in Oklahoma City, according to a criminal complaint filed in federal court. He was charged with attempted destruction of a building by means of an explosive.

This is taken from the FBI's statements and criminal complaint [PDF]. There's another side to the story -- some of which can be sussed out from the complaint itself. Varnell's family, however, has stepped up to offer their side of the story -- one that involves Varnell's paranoid schizophrenia, which goes unmentioned in the government's filings.

We as a family are extremely distraught about this situation with our son Jerry Drake Varnell, but what the public must understand is that he is a paranoid schizophrenic and is extremely susceptible to different types of ideology that normal people would deem immoral. Underneath his condition, he is a sweet-hearted person and we are extremely shocked that this event has happened. However, what truly has us flabbergasted is the fact that the FBI knew he was schizophrenic. The State of Oklahoma found him mentally incompetent and we, his parents have legal guardianship over him by the Court. These documents are sealed from the public, which is why no news media outlet has been able to obtain them. The FBI clearly knew that he was schizophrenic because they have gathered every ounce of information on him.

If true, this prosecution will make the FBI's counterterrorist operations look even worse. This isn't the first time the FBI has exploited the weakest of humans to rack up terrorist busts. This includes the prosecution of a man agents referred to as a "retarded fool" and the dumping of an 18-year-old with a 51 IQ into the lap of local prosecutors. Now we have the FBI steering a paranoid schizophrenic into a self-destructive path, utilizing a confidential informant who apparently made several misrepresentations during his work with the FBI.

The CI claimed to have seen a "bunker" at Varnell's home (where he lived with his parents because he is mentally unable to live on his own). The Varnells claim the "bunker" is nothing more than a partially-buried storage container, meant to be used as a storm shelter. Adding to its un-bunkerlike aspects are the fact that it locks from the outside and contains no food, water, or source of electricity.

From the criminal complaint, other facts emerge. Varnell lived with his parents and only had access to the full residence occasionally. Varnell talked about bombing US government buildings but was unable to secure a vehicle to house the explosives. (He told the undercover agent he might be able to "borrow" a vehicle from some relatives.) The affidavit says the undercover agent supplied everything needed to build the explosive device -- not a single element came from the alleged terrorist. The undercover agent also supplied the vehicle.

So, in the end, the FBI got its man: Jerry Drake Varnell, lifelong schizophrenic with the inability to obtain a vehicle, much less build his own bomb. Varnell talked a lot about sending a message to the government using violent means, but it's unclear how much he actually would have done if he hadn't been nudged towards self-destruction by an overly-helpful CI and FBI undercover agent.

According to the Varnells, this may never have gone this far if the FBI's informant had simply done what he'd been told. The Varnells claim Jerry Varnell's father kicked the CI off the property and told him he'd be arrested for trespassing if he came back. This was due to apparent drug abuse by the CI. And yet, the CI returned, presumably at the behest of the FBI, which was willing to overlook the CI's drug use if it could keep its terrorism sting on track.

Varnell's lawyer has asked for a hearing [PDF] to determine whether Varnell is competent to stand trial. Based on Varnell's long history of mental illness, it would seem apparent the man can't be expected to stand trial, much less carry out an attack on a federal building… at least not without a lot of outside help from the feds themselves.

Filed Under: fbi, terrorism

Guy Who Accidentally Stopped WannaCry Ransomware Detained After Defcon

from the and-thank-you-for-your-service dept

Update: He's been indicted for his alleged role in creating a different malware, Kronos. More below.

As you may recall, earlier this year, when the WannaCry ransomware was spreading like wildfire, it was accidentally stopped by a security researcher in the UK who was (mostly) known only by the pseudonym MalwareTech. He wrote about the whole experience after having tweeted about it earlier. Basically he spotted the domain that WannaCry was pinging and saw that it wasn't registered -- so he registered it, if just to track the spread of the malware. But, that process actually stopped WannaCry from spreading due to the way the ransomware was designed. The story of someone accidentally stopping a massive malware breakout was a good one and it was widely covered by the press. MalwareTech got lots of good press out of it... and as a thank you, at least one UK publication doxxed him and revealed his name, his age, some of his social media photos and even what he liked to eat. That wasn't very nice. Still, now it's known that Marcus Hutchens is MalwareTech, and people should be thanking him.

Anyway, like many security folks and hackers, MalwareTech made his way to Defcon and Black Hat this year... and got his second big "thank you." According to Motherboard, US authorities have detained him in an undisclosed location.

At the time of writing it is not clear what charges, if any, Hutchins may face. According to the now public indictment, Hutchins is accused of developing the Kronos malware that was a trojan that targeted banks. There's a second defendant, whose name and information is redacted (suggesting he hasn't been arrested just yet...) who then went out and appears to have promoted Kronos and tried to sell it.

So the specific charge includes:

MARCUS HUTCHINS, aka "Malwaretech" knowingly disseminated by electronic means an advertisement of any electronic, mechanical, or other device, knowing and having reason to know that the design of such device renders it primarily useful for the purpose of the surreptitious interception of electronic communications, knowing the content of the advertisement and having reason to know that such advertisement will be transported in interstate and foreign commerce.

In violation of Title 18, United States Code, Sections 2512(1)(c)(i), and 2.

There's also a conspiracy charge tying all of this together. As always, an indictment is just one side of the story, and at least from what's in there, the evidence isn't that strong (there may be a lot more evidence to come). There appears to be a lot more evidence against the other, unnamed, defendant who tried to sell Kronos. The only thing they say about Hutchins, really, is that he wrote it, and then the indictment tries to make it a conspiracy, claiming he conspired with the other defendant who tried to sell Kronos.

Needless to say this will be an interesting case to pay attention to.

On a separate note, in what hopefully is just a coincidence, the Bitcoin addresses that were connected to WannaCry (where they asked victims to send Bitcoins to decrypt their computers) were drained of all their money this morning...

Filed Under: defcon, detained, fbi, malwaretech, marcus hutchens, wannacry

Another Appeals Court Denies Suppression Of Evidence Obtained With An Invalid FBI Warrant

from the so-much-for-valid-warrants-being-better-than-invalid-ones dept

A second appeals court has handed down a ruling on the constitutionality of the Network Investigative Technique (NIT) deployed by the FBI during its Playpen child porn investigation. The Tenth Circuit Appeals Court overturned the suppression of evidence granted by the lower court, ruling that the FBI's NIT warrant was invalid but that the agent's "good faith" reliance on the warrant prevented exclusion of the evidence.

Multiple courts have found the NIT warrant invalid. The warrant was obtained in Virginia but the search the FBI's malware performed accessed computers all over the world. Prior to the recent Rule 41 changes, warrant execution was limited to the jurisdiction it was obtained in. The Appeals Court worked around the jurisdictional limit by reasoning the NIT was sent from Virginia and returned info gathered in the same jurisdiction. It just kind of glossed over the part where computers located all over the nation were briefly infected by the NIT to obtain the information needed to pursue suspects.

The Eighth Circuit Appeals Court decision [PDF] finds more problems with the NIT warrant and execution than the Tenth Circuit did. The consolidated appeal, however, ultimately finds in favor of the government, overturning two lower court suppression orders.

First, the good news. The appeals court finds the FBI does indeed need warrants to perform these searches, even if IP addresses aren't necessarily protected by the Fourth Amendment.

In this case, the FBI sent computer code to the defendants’ respective computers that searched those computers for specific information and sent that information back to law enforcement. Even if a defendant has no reasonable expectation of privacy in his IP address, he has a reasonable expectation of privacy in the contents of his personal computer. [...] Moreover, the NIT retrieved content from the defendants’ computers beyond their IP addresses. We conclude the execution of the NIT in this case required a warrant.

The court also disposes of the government's "but it's kind of just a tracking device" argument:

Although plausible, this argument is belied by how the NIT actually worked: it was installed on the defendants’ computers in their homes in Iowa. The government rightly points out that our court interprets Rule 41 flexibly in light of advances in technology... but we agree with the district court that the “virtual trip” fiction “stretches the rule too far,” We agree with the majority of courts that have reviewed the NIT warrant. These courts have concluded that “the plain language of Rule 41 and the statutory definition of ‘tracking device’ do not . . . support so broad a reading as to encompass the mechanism of the NIT used in this case.” Id. Thus, we hold that the NIT warrant exceeded the magistrate judge’s jurisdiction.

It also agrees with the lower courts' findings the warrant was invalid from the moment it was obtained, since the NIT was clearly going to be traveling outside of the issuing judge's jurisdiction. But that's where the good news ends. The appeals court applies the "good faith" exception and declares the requesting agent -- who knew the NIT would travel outside the jurisdiction and suggested as much in the warrant request -- could rely on a warrant signed by a judge to execute these extrajurisdictional searches.

The defendants also argue that the NIT warrant was facially deficient because FBI agents should have known that a warrant purporting to authorize thousands of searches throughout the country could not be valid. Specifically, Horton argues that “there can be no credible argument that officers reasonably believed that none of the 214,898 members of [Playpen] were located outside of Virginia.” We, however, will not find an obvious deficiency in a warrant that a number of district courts have ruled to be facially valid. Further, we have declined to impose an obligation on law enforcement to “know the legal and jurisdictional limits of a judge’s power to issue interstate search warrants.” Law enforcement did not demonstrate bad faith, and we will apply the Leon balancing test as instructed by the Supreme Court.

So, law enforcement officers are not required to know the legal limits of the warrants they seek. Apparently, neither are judges, as the judge signed off on this warrant despite being told it would be executed outside of his jurisdiction.

But that's not the worst part of the opinion. The worst part is this: the court says there's no deterrent value in suppressing evidence obtained with a facially-invalid warrant because the law changed after the fact.

Because Rule 41 has been updated to authorize warrants exactly like this one, there is no need to deter law enforcement from seeking similar warrants.

Under this rationale, anyone currently incarcerated for marijuana possession or distribution in states where weed is now legal should have their sentences immediately vacated. After all, there's no deterrent effect in keeping them locked up, now that both actions have become legal.

So, it's now 2-0 in favor of the FBI in federal appeals courts. In the future, its NIT activities won't receive much scrutiny. But it appears everything it did in violation of Rule 41 prior to the rule changes is being forgiven by higher courts -- whether with generous applications of the "good faith" doctrine or by making the Rule 41 changes effectively retroactive.

Filed Under: 10th circuit, 4th amendment, 8th circuit, appeals court, evidence, fbi, malware, nit, playpen

First Playpen FBI Spyware Warrant Hits The Appeals Court Level; Is Upheld On 'Good Faith'

from the faith-based-decision-making dept

The first FBI Playpen investigation warrant challenge to reach the appellate level has been denied. Andrew Workman moved to suppress evidence obtained by the FBI's Network Investigative Technique (NIT) because warrant was deployed far outside its Eastern District of Virginia jurisdiction. Workman lives in Colorado.

The Tenth Circuit Appeals Court decision [PDF] starts with a light treatise on how technology is outpacing the law and the difficulties this poses for law enforcement agencies used to obtaining identifying information with nothing more than a subpoena.

The advent of the internet created new opportunities for viewers of child pornography, allowing immediate access to illicit websites. Use of these sites frequently leaves a computerized trail, allowing the FBI to find viewers of child pornography. But technological advances have allowed viewers of child pornography to access illicit websites without leaving a trail. To monitor access to one such website, the FBI has tried to keep up; in this case, the FBI seized and assumed control, using malware to identify and find the individuals accessing child pornography.

Though the FBI controlled the website, users lived throughout the nation. To find the users, the FBI needed a warrant. But, a paradox existed. The FBI maintained the website in the Eastern District of Virginia, but users were spread out all over the country. Finding those users could prove difficult because of geographic constraints on the FBI’s ability to obtain a warrant. Notwithstanding these constraints, the FBI obtained a warrant that led to the discovery of hundreds of viewers of child pornography. One was the defendant, who faced prosecution in the District of Colorado.

This gives the reader early notice on where the decision is heading. The lower court found [PDF] the FBI's warrant invalid because its NIT traveled far outside its authorized jurisdiction. The appeals court agrees the warrant is invalid, but says the evidence shouldn't be suppressed.

The district court shot down the government's arguments for the warrant's validity, pointing out that while the seized child porn server resided in Virginia, the information gathered by the FBI's malware was obtained from computers outside the district. The government also tried to portray the NIT as a tracking device, in hopes of putting its warrant back on firmer Rule 41 ground, but the lower court shot that down as well.

In this decision, the Appeals Court grants the FBI "good faith." While doing so, it directly contradicts the lower court's findings on both issues.

We start with the presumption that the executing agents “acted in good-faith reliance upon the warrant.” United States v. Campbell, 603 F.3d 1218, 1225 (10th Cir. 2010). This presumption is bolstered by what the executing agents would have known:

1. The software was installed in a government server located in the Eastern District of Virginia.

2. The magistrate judge, who issued the warrant, was in the Eastern District of Virginia.

3. All of the information yielded from the search would be retrieved in the Eastern District of Virginia.

With these facts, the executing agents could reasonably rely on the magistrate judge’s authority to issue a warrant authorizing installation of software and retrieval of information in the Eastern District of Virginia.

This was the lower court's finding:

I am not persuaded by the government’s argument. Rule 41(b)(2) applies to property located in the same district as the magistrate judge at the time the warrant is issued. As stated above, the NIT was designed to search “activating computers,” and, in this case, Mr. Workman’s computer was located in the District of Colorado when the warrant was issued. Further, there is no evidence that the property (information) to be seized, such as Mr. Workman’s IP address, was located in the Eastern District of Virginia at the time the warrant was issued either.

Here's the lower court on the "tracking device" argument:

While it is tempting to view the NIT as a tracking device, the reality of the technology at issue here is that the NIT did not “track the movement of . . . property” as Rule 41(b)(4) contemplates. The government did not obtain Mr. Workman’s IP address by tracking the data as it moved through various relay nodes back to Mr. Workman’s computer. Rather, the government, through the NIT, searched Mr. Workman’s computer and seized his IP address along with various other pieces of information.

In response, the appeals court just says the FBI needs to defer to the magistrate issuing the warrant because technical things are too complicated for agents to sufficiently grasp.

It is true that the affiant and magistrate judge never mentioned the term “tracking device,” and the FBI’s method differs from more conventional tracking devices. But the executing agents lacked precedents on these issues and could reasonably defer to the magistrate judge on these nuanced legal issues.

In fact, it's ignorance that saves the day, as it often does when courts hand down "good faith" rulings. The less law enforcement knows, the more likely it is the evidence won't be suppressed.

We expect agents executing warrants to be “reasonably well-trained,” but we do not expect them to understand legal nuances the way that an attorney would.

No, we don't expect law enforcement officers to be lawyers but we do expect them to be aware of the same jurisdictional limits the FBI was petitioning the government to have lifted. It's inconceivable the agent requesting the warrant -- an agent the government uses as an expert witness -- didn't know the reach of the NIT would extend far beyond the jurisdiction it was approved for.

Filed Under: 10th circuit, 4th amendment, fbi, good faith, network investigative technique, nit, playpen, privacy, warrant

Automattic Releases Five Un-Gagged National Security Letters

from the ask-and-you-have-slightly-better-chance-of-receiving dept

Another batch of FBI National Security Letters has been released, thanks to the expedited review process instituted by the USA Freedom Act. Automattic, the company behind Wordpress, has released five NSLs dating back to 2010, as the result of successful nondisclosure challenges.

Each of the NSLs that we are publishing initially included an indefinite nondisclosure requirement that prohibited us from sharing any information about the letter or publicly acknowledging that we received an NSL.

We recently requested that these nondisclosure requirements be lifted, under the “reciprocal notice” procedures of the USA FREEDOM Act. More detail on the procedures that we followed is below.

In response to our requests, the FBI lifted the gag orders with respect to all information in each of the NSLs we are making available today. Before publishing the letters publicly, however, we decided to redact the following information from each letter: (1) the site URL about which the government requested information, (2) names of Automattic personnel to whom the request was addressed, and (3) name and contact information for the FBI personnel involved in making the information request.

We made these limited redactions in order to protect privacy interests. The NSLs are otherwise what we received when they were served onto us.

The five NSLs are identical. (PDF links included at the bottom of the Automattic post.) Automattic responded to four of those, but had none of the information requested for the fifth. After the gag orders were lifted by the FBI, Automattic informed the targeted users.

The boilerplate NSLs ask for far more info than the FBI's own legal guidance suggests it should be able to request. A 2008 DOJ legal memo says NSLs should be constrained to "phone billing records." The FBI has apparently decided to interpret this as any and all electronic transactional records when it comes to internet service providers. Here's what's requested in the Automattic NSLs:

• Subscriber name and related subscriber information
• Account number(s)
• Date the account opened or closed
• Physical and or postal addresses associated with the account
• Subscriber day/evening telephone numbers
• Screen names or other on-line names associated with the account
• All billing and method of payment related to the account including alternative billed numbers or calling cards
• All e-mail addresses associated with the account to include any and all of the above information for any secondary or additional e-mail addresses and/or user names identified by you as belonging to the targeted account in this letter
• Internet Protocol (IP) addresses assigned to this account and related e-mail accounts
• Uniform Resource Locator (URL) assigned to the account
• Plain old telephone(s) (POTS), ISDN circuit(s), Voice over internet protocol (VOIP), Cable modem service, Internet cable service, Digital Subscriber Line (DSL) asymmetrical/symmetrical relating to this account
• The names of any and all upstream and providers facilitating this account's communications

This is where the FBI starts digging, apparently. By demanding all this info from a single service provider, the FBI can issue NSLs and subpoenas to a large number of additional third parties, even though the DOJ's legal guidance suggests the FBI's NSL requests should be far more constrained.

The recently-instituted challenge options are better than what was in place previously, but Automattic points out there's still plenty of room for improvement.

We also continue to believe that NSLs pose serious constitutional concerns, particularly because they indefinitely prevent companies like us from speaking about them, and informing our users or the public about the NSLs that we receive. The procedures used to lift nondisclosure requirements are flawed because they put the burden of seeking an end to secrecy almost entirely on the companies, like Automattic, who receive NSLs.

The FBI has almost zero legal obligation to perform proactive reviews of issued NSL gag orders. Recipients must spend their time and money challenging them. Fortunately, the challenge process now requires much less of these scarce resources. Automattic has its own boilerplate form for challenging boilerplate NSL gag orders -- one it's willing to share with any NSL recipient --- so we should be seeing more of these released in the near future.

Filed Under: fbi, gag orders, national security letter, nsl, nsls, secrecy, transparency, wordpress

FBI Informant Helped Out In Terrorism Stings While Running A 'Stranded Traveler' Scam

from the pros,-cons,-and-pro-cons dept

It's well known many confidential informants are criminals. Acting as informants is supposed to keep their criminal acts to a minimum while providing access to bigger criminal fish. The same goes for undercover officers and agents. Some illegality is presumed but those running CIs are expected to be making the world a better place, not ignoring vast amounts of criminal activity simply because the informant is now on their side. But that doesn't seem to be the case.

The DEA's informant program is being run with almost no oversight, according to an Inspector General's report. Money flowed to informants who were still under federal investigation and no one up top seemed too concerned about the program's bang/buck ratio. The FBI made abusable programs worse by hiding payments to informants and giving them a cut of forfeited property.

It's not that informants can't break the law. In some cases, they must. But the illegal acts must be done with permission and as an integral part of an investigation. But that's not how things work out. Trevor Aaronson of The Intercept tells the story of FBI informant Mohammed Agbareia, who participated in terrorism stings while making a healthy, illegal profit on the side.

According to court records, Agbareia began working for the FBI only after being convicted in U.S. District Court in Alabama for conspiracy to commit wire fraud.

[...]

After pleading guilty to the wire fraud case in March 2006, Agbareia was ordered to report to immigration authorities for possible deportation. But instead of being removed from the United States, Agbareia signed up with the FBI.

The threat of removal and/or the dangling of citizenship is a powerful motivator. This is why multiple federal law enforcement agencies have turned the nation's borders into unofficial recruitment posts.

But old habits die hard. The Intercept reports Agbareia has again been indicted for the same criminal activity.

According to a new wire fraud indictment handed down in Florida on June 27, Agbareia has continued to swindle people with his stranded traveler scheme. He received six Western Union wire transfers from 2012 to 2017 from victims in Texas, Colorado, New York, Ohio, and Germany. Two of the wire transfers — one for $1,414.26 from Berlin and another for $1,000 from Brooklyn — occurred around the time he was working undercover in the FBI’s ISIS sting.

The government is trying to bury this damaging information. It has already asked for evidence of Agbareia's illegal sideline to be placed under a protective order, supposedly for national security reasons. The government is also refusing to turn over information of Agbareia's criminal efforts to one of the accused, despite two of three suspects targeted in the sting having already pled guilty.

Federal prosecutors’ position has been that they do not have an obligation to provide information about the FBI’s informant so far in advance of a trial, since Hubbard’s is not scheduled until October 30. “In a national security case at this point, I mean, we understand our obligations to turn it over, but the trial is in late October,” federal prosecutor Edward Nucci said in the March 14 hearing.

The remaining suspect's defense lawyer has been asking for this information since 2016, pointing out that the proactive nature of sting operations should result in proactive delivery of evidence by the government.

Agbareia is now in the awkward position of having government demands for secrecy work both for him and against him. In the terrorism stings, the government is playing keep-away with anything that might damage his status as a source of evidence. In his wire fraud prosecution, the government is looking to bury info he might use in his defense. National security-related suppression is being asked for in this case as well.

Agbareia’s lawyer, Murrell, noted in a June 30 filing that federal prosecutors haven’t specified the level of classification — top secret, secret, or confidential — the evidence involves, raising questions that the information “is not ‘classified’ simply because it might embarrass law enforcement or in some way hinder prosecution of this or other cases.”

Federal prosecutors have requested Agbareia’s witnesses disclose up front the testimony they intend to offer, giving the U.S. Attorney’s Office an opportunity to agree to the release of “a stipulated, declassified summary of that information.” In other words, federal prosecutors want to use claims of classified evidence to control the information Agbareia can use in his defense

If the government succeeds in this evidence suppression, it might be able to run the prosecutorial table -- convicting a suspected terrorist and the crooked informant it used to rope him in.

Filed Under: fbi, informant, mohammed agbareia, scams, wire fraud

Trump's Pick For FBI Head Sounds A Lot Like The Guy He Fired When It Comes To Encryption

from the BACK-TO-WORK,-NERDS dept

Trump's pick to head the FBI -- former DOJ prosecutor Christopher Wray -- appeared before the Senate to answer several questions (and listen to several long-winded, self-serving statements). Wray's confirmation hearing went about as well as expected. Several senators wanted to make sure Wray's loyalty lay with the nation rather than the president and several others hoped to paint him into a Comey-bashing corner in order to belatedly justify Trump's firing of his (potential) predecessor.

Wray also spent a lot of time not talking about things he claimed he was unfamiliar with -- covering everything from presidential directives, to Donald Trump Jr.'s Russian emails, to questions about CIA human rights violations that went unnoticed/unprosecuted during his tenure in the DOJ.

Sen. Orrin Hatch -- as he did during a recent Comey hearing -- brought up the subject of encryption. Hatch claims he "agrees with Tim Cook," which places him in opposition to Sens. Feinstein and Burr. It also puts him in opposition of the possible new FBI boss, who had this to say about encryption. (h/t Politico's Eric Geller)

I think this is one of the most difficult issues facing the country. There's a balance that has to be struck between the importance of encryption, which I think we can all respect when there are so many threats to our systems, and the importance of giving law enforcement the tools that they need to keep us safe.

You can already tell where this is going. Encryption is great and all, but what's would be really great is some sort of backdoor-type thingy.

Wray continued by swiftly jumping to the other side of the argument -- at least in terms of team uniform. Certainly not in terms of how the "other side" feels about encryption and backdoors.

I don't know sitting here today as an outsider and a nominee before this committee what the solution is, but I do know that we have to find a solution. And my experience in trying to find solutions is that it's more productive for people to work together than to be pointing fingers blaming each other. And that's the approach I've tried to take to almost every problem I've tackled. And that's the approach I would want to take here in working with this committee and the private sector.

One advantage to having been in the private sector for a while is that I think I know how to talk to the private sector, and I would look for ways to try to see if I could get the private sector more on-board to understand why this issue is so important to keep us all safe.

So far, so Comey. New suit in the office, but it fits the same as the last one. Wray thinks both sides should work together but strongly hints the actual work will have to be done by the private sector. The problem, according to a guy who's worked "both sides," is the private sector needs to be more "on-board." And that indicates Wray feels the problem isn't the lack of both sides working together, but the other side not capitulating. That's a problem, and it sounds a whole lot like X more years of Comey.

Filed Under: chris wray, encryption, fbi, going dark, james comey