Trump Fires FBI Director Comey

from the you're-fired dept

So... not quite sure what to make of this yet, but according to the NY Times, just a little while ago, Donald Trump fired FBI Director James Comey (of course, just after our podcast came out talking about how Comey seemed to be hopeful the Trump administration would approve his encryption backdoor plans).

“While I greatly appreciate you informing me, on three separate occasions, that I am not under investigation, I nevertheless concur with the judgment of the Department of Justice that you are not able to effectively lead the bureau,” Mr. Trump said in a letter dated Tuesday to Mr. Comey.

“It is essential that we find new leadership for the F.B.I. that restores public trust and confidence in its vital law enforcement mission,” Mr. Trump wrote.

The full letter is... even more crazy:

If you can't read that, it says:

Dear Director Comey:

I have received the attached letters from the Attorney General and Deputy Attorney General of the United States recommending your dismissal as the Director of the Federal Bureau of Investigation. I have accepted their recommendation and you are hereby terminated and removed from office, effective immediately.

While I greatly appreciate you informing me, on three separate occasions, that I am not under investigation, I nevertheless concur with the judgement of the Department of Justice that you are not able to effectively lead the Bureau.

It is essential that we find new leadership for the FBI that restores public trust and confidence in its vital law enforcement mission.

I wish you the best of luck in your future endeavors.

Donald J. Trump

I'm not sure why it even bothers to mention that Trump himself is not a target of an investigation (or that Comey told him that three times). It's already known that the wider administration is subject to an investigation, and even if you don't believe that such an investigation will turn up anything, it's still happening. At the very least, this should call into question whether or not there can effectively be any investigation into the administration that won't involve meddling by the administration. That alone should be a big concern.

I don't think we've ever said anything particularly supportive of Comey, who we've disagreed with on a large range of issues, but it's difficult to see how this is going to be a good thing. It's already been admitted that the FBI was investigating potential ties between Russia and the administration. Whether or not that investigation had anything at all to do with the firing, there's no way to spin this that looks good.

Yes, the President has the power to fire the head of the FBI... but when that FBI was conducting an independent investigation of the President, any such firing is clearly going to be seen as politically motivated. And, yes, it's important to note that this is NOT entirely unprecedented. President Clinton fired FBI director William Sessions soon after taking office as well, though there wasn't the stench of an FBI investigation into the President going around at the time. If anything, the comparison that seems slightly more apt that people are making is to Archibald Cox, the independent special prosecutor that Richard Nixon fired, leading to the resignations of the Attorney General and Deputy Attorney General (contrast that to today's news, where it was those two roles who recommended this firing...).

Comey was not a particularly good FBI director, and we've covered numerous problems with his leadership. But that doesn't mean that whoever replaces him won't be even worse.

Filed Under: doj, donald trump, fbi, fired, investigation, james comey, jeff sessions

DHS Boss Drums Up Fear Using The FBI's Useless Terrorism Investigation Stats

from the [extremely-Count-Floyd-voice]-'threat-assessments-ooooooooh' dept

Want to know how much of a threat terrorism poses to the United States? Just ask an agency whose relevance and budget depends on projecting the appearance of a constant threat. Here's John Kelly, the new head of the DHS:

The threat to our nation and our American way of life has not diminished. In fact, the threat has metastasized and decentralized, and the risk is as threatening today as it was that September morning almost 16 years ago.

As I speak these words the FBI has open terrorism investigations in all 50 states, and since 2013, there have been 37 ISIS-linked plots to attack our country.

The problem with swearing on a stack of FBI statements is these assertions are completely meaningless. The FBI's a well-oiled terrorist-crafting machine at this point, so it can come up with whatever number of ISIS-linked plots is needed to further the agenda of multiple government agencies.

As for "open terrorism investigations," it would be much more helpful if the FBI didn't term nearly everything it does an "investigation," even when there's nothing worth investigating. As we've covered here before, there are a few different types of investigations the FBI engages in, starting with something that looks a whole lot like an investigation (in terms of information the FBI can obtain), but really isn't. These "investigations" are called assessments, and it takes almost nothing at all to get one of these underway. Emily Hockett and Michael German of Just Security explain how the guidelines for assessments changed radically after the passage of the FISA Amendments Act in 2008.

The most drastic change came in 2008 with a set of guidelines issued by then-Attorney General Michael Mukasey, who today is an ally of President Trump. The 2008 Guidelines created a new type of investigation called an “assessment.” Assessments permit physical surveillance, database searches, interviews, racial and ethnic mapping, and the recruitment and tasking of informants without any factual or criminal predicate, that is, without any objective basis to suspect the target of the investigation has violated any law, or is likely to in the future.

Because Kelly's statement doesn't clearly define what sort of investigations the FBI is engaged in, it's quite possible the FBI only has assessments underway in several states. Rather than portray the nation as a hotbed of potential terrorism, the presence of assessments indicates nothing at all. That the FBI can engage in surveillance without "any factual or criminal predicate" is disturbing enough. Misrepresenting the depth of these investigations to further a narrative of fear is carelessness at best. It's deeply dishonest at worst.

But even if we are to take the DHS head's word at face value -- that the FBI actually has real investigations opened in all 50 states, the word "investigation" still doesn't mean much. It should never be assumed an investigation is actually an indicator of terrorist activity. There are also "preliminary investigations" -- a step above assessments but below the FBI's standard for an actual investigation. These, too, can be based on almost nothing.

Preliminary investigations require only “information or an allegation,” and contrary to Comey’s testimony, the allegation does not need to be “credible.” A 2010 Inspector General report found the FBI opened preliminary investigations on political advocacy organizations based on mere speculation that the subjects might commit a crime in the future, and the agents themselves often made the required “allegations.”

Comey's statement -- the one cited by John Kelly -- claimed all FBI investigations need "a credible allegation of wrongdoing or reasonable basis…" This obviously isn't true. Using the presence of FBI investigations to support claims of a persistent terrorist threat gives the FBI far too much credit.

The extremely low bar the FBI must avoid tripping over on its way to unwarranted (in both senses of the word) surveillance gives it plenty of busywork to keep agents and analysts busy. It does not, however, make the United States any safer.

From 2009 to 2011, the first two years the Mukasey guidelines were in place, the FBI opened over 82,325 assessments, of which only 3,315 found information that warranted opening preliminary or full investigations.

Given the preliminary investigation hurdle doesn't rise above shin-high, assessments seem to be a convenient excuse for surveilling Americans and adding this to the FBI's overstuffed databases. FBI terrorism investigations are a completely useless metric for gauging the domestic terrorism threat. But, hey, whatever sells more government power.

Filed Under: dhs, fbi, fear mongering, investigations, john kelly, terrorism

'Backdoor' Search Of FBI Records Helps Parents Learn How Local Cops Killed Their Son

from the Texas-gives-bad-cops-free-rides dept

This long Austin American-Statesman investigative report details apparent police brutality as discovered by parents who were kept in the dark by local cops about how their teenaged son actually died. It all started with their 5'4" 110-lb. 18-year-old suffering through a bad acid trip while hanging out with friends. It ended in the hospital with their son brain-dead, on life support, and the arresting agency unwilling to say anything more than their son had suffered a "head injury."

To the law enforcement agency, it's just another in-custody death. To the parents of Graham Dyer, it's long-delayed closure to a chapter kept deliberately unfinished by the law enforcement agencies who took Dyer into custody and returned him to his parents more dead than alive.

In Texas, the system is stacked against victims of police misconduct. State law, upheld by court decisions, make it almost impossible to mount a lawsuit against law enforcement officers. Courts are generally receptive to law enforcement claims and extremely hesitant to strip officers of immunity, no matter how egregious the apparent civil rights violation. This situation is made much, much worse in Texas where documents needed to propel a lawsuit past a judge's first reading often can't be obtained from the law enforcement agency holding them.

State law says a police agency isn’t required to turn over records for incidents that don’t result in a conviction. Graham, who’d been charged with assaulting a police officer after the confrontation, had died before his case could be litigated. So, the department reasoned, his records were confidential. Asked to weigh in on the dispute, then-Attorney General Greg Abbott agreed the Mesquite police could refuse the Dyers’ request.

The most important part of this paragraph is two words in the last sentence: "could refuse." The law does not forbid departments from handing over this information. It simply gives them a legal excuse not to. The Mesquite PD could have closed this tragic chapter in the Dyers' lives, but doing so would have guaranteed a lawsuit. So, it withheld the records, ensuring the officers involved in Graham Dyer's death remained free of accountability. It continued to deny release of the record, citing "ongoing investigations" that apparently involved one dead "suspect" and another arrestee, who had only been charged with public intoxication.

Faced with this hurdle, the Dyers approached the FBI, asking it to investigate Graham's death. It performed an investigation, but informed the couple it could not find enough evidence to move forward with a federal civil rights lawsuit on the couple's behalf. But it did open a door for the Dyers to obtain the evidence the Mesquite PD wouldn't release.

Using the federal Freedom of Information Act, in early 2015 Kathy asked the FBI to turn over any records it had accumulated in its investigation of Graham’s death in Mesquite. That fall, police videos of the fatal evening started arriving.

The recordings are disturbing. Graham's parents haven't watched them, on the advice of their lawyer. (All images below a screengrabs from the video posted at the Statesman.)

There was, for example, the image of a Mesquite police officer standing with his foot on Graham’s head.

There was the image of Graham in the backseat of the police cruiser, his hands and feet bound — yet also unseatbelted or otherwise restricted — in obvious distress, hurling himself about the car. And then the ghostly image of a police officer’s hand with a Taser stun gun appearing in the camera frame, shocking Graham on the leg.

And then, pushing him on his back and shocking him again — this time directly, and apparently deliberately, in his testicles. And Graham screaming silently as the electric shock to his genitals appeared to be repeated.

The Statesman has also released 24 seconds of audio from the arrest. It contains just enough to add even more horror to the images above. It contains the tortured screams from the 18-year-old as he is tased by an officer. It contains another disheartening scream from Dyer, who was suffering through a bad LSD trip at the time of his arrest: "Where the fuck am I?" And, disturbingly, it contains an officer's brutal statement as he tased the bound teenager: "Motherfucker, I'm going to kill you."

That officer was correct. The Mesquite PD did kill Graham Dyer. It killed him to save him from himself, according to the PD.

“A Taser was deployed in an effort to control decedent, prevent escape and prevent him from injuring himself,” the city stated in court documents, adding the officer had been aiming for Graham’s leg and it was dark.

The PD also killed Dyer with indifference. By the time Dyer arrived at the jail, he was in terrible shape. But to the five officers on the scene, he was just a piece of inconvenient meat.

The videos of Graham as he was delivered to the jail also seemed at odds with the police department’s explanation of what occurred. According to the agency’s in-custody death report, upon arriving at the jail Graham had still needed to be placed in a special restraint chair “until the jail personnel noticed he was having labored breathing.”

Yet the video the Dyers received from the FBI depicts Graham lying limp on the sally-port floor after being lifted out of the cruiser. As he tries to raise his head, one of the officers pushes it back to the ground.

Records show it would be more than two hours before an ambulance was called.

The Dyers can finally move forward with their lawsuit. The presiding judge says the evidence obtained -- no thanks to the Mesquite PD -- shows they have a plausible civil rights claim. The PD obviously hoped its public records exemptions would keep the Dyers from successfully suing it, much less actually finding out what happened that night.

The government, far too often, insulates the worst of its employees against the public that's entrusted it with power. In many ways, the system is deliberately designed to push citizens towards resigned acceptance of abuse by authority figures. The courts, meant to be a check against government power, have been far too compliant for far too long. The end result is the ugliness above where no one in a position of power will do anything to assist constituents until forced to. And they'll will follow this up by doing as possible to deter future acts of violence and brutality. The cops involved in this arrest -- and every government official that's assisted in erecting a wall between police and accountability -- should take a good, long look at the terrorized teen captured by the police cruiser's camera and see if they still feel comfortable with their decisions.

Filed Under: fbi, graham dyer, police, public records

Ahead Of His Senate Hearing, James Comey Pushes His 'Going Dark' Theory

from the same-old-Comey,-same-bad-arguments dept

Ahead of his testimony before the Senate Judiciary Committee on Wednesday, FBI Director James Comey released his planned testimony, which covers a variety of subjects Comey hoped to cover during the hearing. A lot of the talking points were touched on, but Comey spent most of his time fielding questions from pissed-off senators about how much they were disappointed in recent FBI investigations.

The testimony Comey planned to give contains another discussion of the FBI-centric "going dark" issue. According to Comey, device encryption has blocked FBI's searches nearly 50% of the time, preventing it from pulling data from more than 3,000 phones. Comey also says other approaches -- such as using metadata or cellphone forensic software -- won't work. They're too expensive and won't scale. Left unsaid is Comey's desire for legislation or a few precedential court decisions to force manufacturers to compromise their customers' security.

He makes this argument by conflating privacy and security and using this conflation to arrive at a completely wrong conclusion. From Comey's testimony [PDF]:

Some observers have conceived of this challenge as a tradeoff between privacy and security. In our view, the demanding requirements to obtain legal authority to access data—such as by applying to a court for a warrant or a wiretap — necessarily already account for both privacy and security. The FBI is actively engaged with relevant stakeholders, including companies providing technological services, to educate them on the corrosive effects of the Going Dark challenge on both public safety and the rule of law. The FBI thanks the committee members for their engagement on this crucial issue.

Warrants and court orders cover the "privacy" end of the argument, but using court orders (or legislation) to force device makers to build backdoors in users' devices throws security out the window. The balancing act in the encryption debate has never been "privacy vs. security." It's been "security vs. insecurity." Comey's false equation presents privacy and security as two sides to the same coin, yet somehow completely separable in the presence of a court order. Fourth Amendment protections cover the privacy end, but showing up at a device backdoor with a warrant in hand does nothing for anyone's security.

Comey doesn't want a balancing act, despite all his assertions about "adult conversations" and deferring to the "smart people" at tech companies. He wants device owners to sacrifice security in exchange for protections they're already guaranteed by the Fourth Amendment.

Filed Under: backdoors, encryption, fbi, going dark, james comey

James Comey Says Real Journalists Check With The Government Before Publication

from the by-all-means,-let's-allow-the-DOJ-to-decide-who's-a-real-journalist dept

In his testimony yesterday in front of the Senate Judiciary Committee, FBI Director James Comey became the latest government official to speak out against Wikileaks. In doing so -- even though he very carefully worded his answers to Sen. Ben Sasse's softballs -- Comey also made a very dangerous insinuation about what separates "real" journalists from Wikileaks.

From the transcript published at the Washington Post:

SASSE: [T]here is room for reasonable people to disagree about at what point an allegedly journalistic organization crosses a line to become some sort of a tool of foreign intelligence. There are Americans, well-meaning, thoughtful people who think that WikiLeaks might just be a journalistic outfit. Can you explain why that is not your view?

COMEY: Yes and again, I want to be careful that I don't prejudice any future proceeding. It's an important question, because all of us care deeply about the First Amendment and the ability of a free press, to get information about our work and -- and publish it.

To my mind, it crosses a line when it moves from being about trying to educate a public and instead just becomes about intelligence porn, frankly. Just pushing out information about sources and methods without regard to interest, without regard to the First Amendment values that normally underlie press reporting. And simply becomes a conduit for the Russian intelligence services or some other adversary of the United States just to push out information to damage the United States. And I realize, reasonable people as you said, struggle to draw a line…

So, where does the journalistic publishing of leaked documents cross the line into "intelligence porn?" Comey says the difference between real journalists and Wikileaks is real journalists seek input from the government before publishing.

Comey: [T]here's at least a portion and people can argue that maybe this conduct WikiLeaks has engaged in, in the past that's closer to regular newsgathering. But in my view, a huge portion of WikiLeaks's activities has nothing to do with legitimate newsgathering, informing the public, commenting on important public controversies, but is simply about releasing classified information to damage the United States of America. And -- and -- and people sometimes get cynical about journalists.

American journalists do not do that. They will almost always call us before they publish classified information and say, is there anything about this that's going to put lives in danger, that's going to jeopardize government people, military people or -- or innocent civilians anywhere in the world. And then work with us to try and accomplish their important First Amendment goals while safeguarding those interests. This activity I'm talking about, WikiLeaks, involves no such considerations whatsoever. It's what I said to intelligence porn, just push it out in order to damage.

The First Amendment contains no such requirement to run leaked documents past the government first. This can be an ethical decision on the part of the publisher, but the notion that the First Amendment only covers publishing after government input has been sought is a dangerous one. This assertion by Comey also just isn't true. As Trevor Timm pointed out on Twitter, Wikileaks has attempted to contact the US government in the past before publication, but has been ignored.

Furthermore, Comey and Sasse both claim Wikileaks' publications have caused some sort of damage to government employees. They offered unproven assertions it has endangered lives, even though the evidence shows the worst the US government (and its employees) suffered is some embarrassment.

The only mitigating factor was Comey's assertion that the DOJ isn't interested in using espionage laws to prosecute journalists for publishing leaked documents. As he correctly points out, the culpability lies with the person leaking the documents, not the journalists publishing them. Of course, this statement isn't being made in a vacuum. It's being made in the current political climate where the president has expressed an interest in reducing free speech protections. The DOJ itself appears to be working towards prosecuting Julian Assange for publishing leaked documents. All that can really be gathered from Comey's assertions is that the DOJ may not prosecute journalists who run everything past the government before publication.

This delineation between "legitimate" journalism and "intelligence porn" is disturbing. It suggests the government still wants to have the final say on who is or isn't a journalist and punish accordingly. If this had been the attitude since the beginning of this nation, it's doubtful we'd have as many protections as we enjoy today. Rob Graham of Errata Security sums up Comey's statements in a single, unforgettable sentence:

If this were 1776, Comey would of course be going after Thomas Paine, for publishing "revolution porn", and not being a real journalist.

Filed Under: fbi, first amendment, free speech, james comey, journalism, julian assange, news
Companies: wikileaks

At Senate Hearing, Comey Hints At Expanded NSL Powers And Encryption Backdoors

from the now-has-a-president-willing-to-cater-to-his-desires dept

James Comey testified in front of the Senate Judiciary Committee today where he faced an oddly-unified bipartisan group of senators irritated with the FBI (but for different reasons). Most senators took a large amount of the their time during the first round of questions to not actually ask questions, but to express their displeasure with the Clinton email investigation and the ongoing Trump-Russia investigation.

The opening statements varied depending on the party of the senator addressing James Comey. Comey had very few answers about various Trump-related investigations (which are still ongoing), but made the most of his opening statement by dodging the questions and making a sales pitch for the renewal of Section 702 -- the statute permitting the NSA's internet data/communications collection the FBI makes frequent use of.

According to Comey, the 702 collection is essential to national security. Possibly true. But not so essential that concerns about Fourth Amendment violations should be swept aside. This was only one of the sales pitches Comey managed to squeeze in during questioning.

He also touched on a couple of other issues worth noting. Both involve legislation. After pitching a clean Section 702 renewal, Comey spent some time talking around the subject of backdoor 702 searches, noting that "all courts" have found the FBI's secondhand domestic surveillance lawful… without specifying the only court to really reach this conclusion is the FISA Court. And this court also found the NSA had abused its collection repeatedly. This court also approved zero 702 applications in 2016 and the NSA itself has shut down part of its upstream collection because it kept grabbing too many communications from US persons.

This shutdown will affect the FBI's backdoor searches. Comey, of course, didn't refer to them as backdoor searches, but did make it clear the FBI would be ever so pleased if Section 702 was renewed with a minimum of legislator interference.

The FBI's own collection efforts were a concern to Comey as well. Comey continued his misrepresentation of the statutes governing what the FBI can collect with National Security Letters. According to the FBI director, the only thing standing between what the FBI can legally get with NSLs (subscriber info and billing records) and what it wants (a very long list of things, including web history and geolocation data) is a "typo." Not sure which part of the statute contains the typo, but Comey claimed to be able to channel the intent of legislators who passed it back in 1986.

Not that the lack of statutory authority has prevented the FBI from demanding more than it's supposed to get. An NSL published by Yahoo contained a much longer list of requested data than is permissible under the law. Comey expressed his desire to have Congress take another look at the statute and see if it doesn't agree with Comey's assessment.

The other legislative issue near and dear to Comey's heart was addressed a bit more obliquely, but managed to make it clear the current administration would be far more sympathetic to Comey's other backdoor plan. Both Sen. Orin Hatch and Sen. Dianne Feinstein spoke favorably about encryption backdoors. Comey noted the Obama Administration wasn't interested in passing bills containing encryption bans or backdoors, but the new team in the White House has possibly expressed an interest in doing just that.

The Obama administration was not in a position where they were seeking legislation. I don't know yet how President Trump intends to approach this. I know he spoke about it during the campaign, I know he cares about it, but it's premature for me to say.

There were a lot of things that Comey wouldn't say. Many things he wouldn't confirm or deny in an open hearing. But he let us know he's still pushing encryption legislation, even if he's opted for more of a soft sell in recent months.

Generally speaking, the hearing ended up being more about how the FBI plans to continue expanding its power and decreasing civil liberties. Comey wants a clean 702 reauth, even with the NSA shutting down part of the collection because it can't comply with the law otherwise. He wants legislators to hand him greater NSL powers, even though the FBI's history of NSL abuse is well-documented. And he still wants the government to solve his "going dark" problem, even though the problem has been greatly exaggerated and no amount of harder nerding is going to generate a safe, government-only backdoor in encryption.

Filed Under: fbi, going dark, investigation, james comey, section 702, senate judiciary commitee

FBI Tries New Rule 41 Changes On For Size In Fight Against Long-Running Botnet

from the one-warrant;-all-the-computers dept

The DOJ is proud to announce it's flexing its new Rule 41 muscle. The changes proposed in 2015 sailed past a mostly-uninterested Congress and into law, giving the FBI and other DOJ entities permission to hack computers anywhere in the world with a single warrant.

With the new rules, the law has finally caught up with the FBI's activities. It deployed a Network Investigative Tool -- the FBI's nifty nickname for intrusive malware that sends identifying info from people's computers to FBI investigators -- back in 2012 during a child porn investigation and mostly got away with it. It tried it again in 2015 and ran into a bit more resistance.

Rule 41's (former) jurisdictional limitations meant the FBI wasn't supposed to be able to "search" computers all over the US using a single warrant issued in Virginia. This activity was supposed to be confined to the state of Virginia. The aftermath of the Playpen investigation has led to a multitude of conflicting judicial opinions. Some have found the warrant invalid and the evidence obtained worthless. Others have granted good faith exceptions or determined no privacy violation took place. In at least one case, the government has dismissed the charges rather than expose any information about its Rule 41-flouting NIT.

In this case, the FBI isn't hacking computers to uncover child porn site visitors. Instead, it's going to be fiddling with a lot of computers to take down a botnet. The DOJ press release makes particular note of how lawful this all is now, post-Rule 41 amending:

In seeking authorization to disrupt and dismantle the Kelihos botnet, law enforcement obtained a warrant pursuant to recent amendments to Rule 41 of the Federal Rules of Criminal Procedure. A copy of this warrant along with the other court orders are produced below.   The warrant obtained by the government authorizes law enforcement to redirect Kelihos-infected computers to a substitute server and to record the Internet Protocol addresses of those computers as they connect to the server. This will enable the government to provide the IP addresses of Kelihos victims to those who can assist with removing the Kelihos malware including internet service providers.

The search warrant [PDF] application leads off with this as well, waving it in front of its unusual request like a wary vampire hunter's cross.

I make this affidavit in support of an application for a warrant under Federal Rule of Criminal Procedure 41 to authorize an online operation to disrupt the Kelihos botnet currently under the control of Peter Yuryevich LEVASHOV, a criminal hacker. The operation, which is particularly described in Attachment A and Attachment B, involves the distribution of updated peer lists, job messages and/or IP filter lists, further described in Attachment B, to the TARGET COMPUTERS currently infected with the Kelihos botnet malware in violation of Title 18, United States Code, Sections 1030, L343, and 2511, as described in Attachment A. This operation will also obtain the Internet Protocol addresses and associated routing information of those infected computers, and those addresses are evidence of crimes committed by LEVASHOV. A PRTT order has been requested for the purpose of attaining those IP addresses and associated routing information. This operation will not capture content from the TARGET COMPUTERS or modify them in any other capacity except limiting the TARGET COMPUTERS' ability to interact with the Kelihos botnet.

The intent here is to dismantle the botnet by freeing zombie computers. All well and good, except it's not the government pointing victims to malware removal tools, but rather letting themselves into the "house" to size up infections before passing this info on to third parties to actually perform the removals.

This new form of intrusion raised concerns in Congress, but the DOJ insisted the changes were innocuous and please let's all stop talking about this before someone stops the Rule 41 amendments slow roll to tacit approval.

Here it is in action: thousands of computers temporarily hosting digital G-men. We're in unknown territory right now with the FBI's anti-botnet work. The FBI itself doesn't even appear all that sure about the extent of its new Rule 41 powers. As is noted in the warrant, the FBI also applied for a Pen Register/Trap and Trace (PRTT) order [PDF] just in case.

Other than the three elements described above, federal law does not require that an application for an order authorizing the installation and use of a pen register and a trap and trace device specify any facts. The following additional information is provided to demonstrate that the order requested falls within this Court's authority to authorize the installation and use of a pen register or trap and trace device under 18 U.S.C. g 3123(a)(1).

This is the FBI basically saying the law doesn't require this application, but here it is anyway. A CYA PRTT for the interception of communications metadata that might help identify botnet victims. And for all its talismanic waving of Rule 41, the FBI isn't even sure it's really required to seek a warrant to perform this botnet cleanup. From the warrant affidavit:

To effectively combat the P2P structure of the Kelihos botnet, the FBI with assistance of private partners will participate in the exchange of peer lists and job messages with other infected computers. The FBI's communications, however, will not contain any commands, nor will they contain IP addresses of any of the infected computers. Instead, the FBI replies will contain the IP and routing information for the FBI's "sinkhole" server. As this new routing information permeates the botnet, the Kelihos infected computers will cease any current malicious activity and learn to only communicate with the sinkhole. The effect of these actions will be to free individual infections from exchanging information with the Kelihos botnet and with LEVASHOV. This will stop Kelihos's most immediate harm, the harvesting of personal data and credentials, and the transmittal of that data to servers under LEVASHOV's control.

Another portion of the Kelihos job messages is a list, known as the IP filter list. This list functions as a type of blacklist, preventing communication with those IPs contained within the filter list. If necessary, the FBI also seeks authorization to send a filter list to TARGET COMPUTERS to block Kelihos infected computers from continuing to communicate with router nodes.

The footnote attached to this reads:

The law is unsettled as to whether the operation authorized by the proposed warrant constitutes a search or seizure. However, in an abundance of caution, the United States is seeking a warrant.

It looks like the FBI is tentatively exploring its new powers, making sure it has the paper trail it needs to stave off courtroom challenges. If it sticks to disrupting a botnet, it shouldn't face any. If it takes advantage of its new access privileges, it might.

Filed Under: botnet, doj, fbi, hacking, nit, rule 41, warrant

Oh, Sure, Now Congress Is Serious About Asking NSA About Surveillance On Americans

from the about-freaking-time,-goodlatte dept

For many, many years, Senator Ron Wyden has been directly asking the US intelligence community a fairly straightforward question (in his role as a member of the Senate Intelligence Committee): just how many Americans are having their communications swept up in surveillance activities supposedly being conducted on foreigners under the FISA Amendments Act (FISA being Foreign Intelligence Surveillance Act). Wyden started asking way back in 2011 and got no answers. His continued questioning in 2013 resulted in Director of National Intelligence James Clapper lying to Congress in a public hearing, which Ed Snowden later claimed was a big part of the inspiration to make him leak documents to the press.

Just last month, we noted that Wyden had renewed his request for an accurate depiction of how many Americans have had their communications swept up, this time asked to new Director of National Intelligence, Dan Coats. Unfortunately, for all these years, it's basically felt like Senator Wyden tilting at a seeming windmill, with many others in Congress basically rolling their eyes every time the issue is raised. I've never understood why people in Congress think that these kinds of things can be ignored. There have been a few attempts by others -- notably on the House Judiciary Committee -- to ask similar questions. Almost exactly a year ago, there was a letter from many members of the HJC, and there was a followup in December. But, notably, while there were a number of members from both parties on that letter, the chair of the House Judiciary Committee, Bob Goodlatte, did not sign the letter, meaning that it was unlikely to be taken as seriously.

Suddenly, though, it seems that the ins-and-outs of Section 702, and how the "incidental" information it collects on Americans is used has taken on a much wider interest, following President Trump's misleading suggestion that President Obama tapped his phone lines, and some Trump supporters trying to twist typical 702 surveillance to justify those remarks. Either way, if that leads people to actually look at 702, that may be a good result out of a stupid situation. And, thus, we get to this surprising moment, in which Goodlatte has actually sent a similar letter to Coats (along with ranking member John Conyers) asking about the impact of 702 surveillance on Americans. And since (for reasons that are beyond me) Reuters refuses to link to the actual source materials, you can read the full letter here or embedded below.

The letter demands an answer by April 24th. And, yes, it's notable that Goodlatte has signed on, because Section 702 is up for reauthorization at the end of the year, and if Goodlatte is not on board with reauthorization, then the NSA is going to have some difficulty in getting it through.

You have described reauthorization of Section 702 as your "top legislative priority." Although Congress designed this authority to target non-U.S. persons located outside of the United States, it is clear that Section 702 surveillance programs can and do collect information about U.S. persons, on subjects unrelated to counterterrorism. It is imperative that we understand the size of this impact on U.S. persons as our Committee proceeds with the debate on reauthorization.

The letter then even points to Coats' response to Wyden during Coats' confirmation hearing that he was "going to do everything I can to work with Admiral Rogers in NSA to get you that number." Of course, back in December, it was said that the intelligence community might finally deliver that number... in January. And it's now April. Still, with Goodlatte finally taking an interest in this, it's a sign that the NSA can't just coast by and continue to completely ignore this.

Filed Under: bob goodlatte, dan coats, fbi, fisa amendments act, house judiciary committee, nsa, ron wyden, section 702, surveillance

Judge Says FBI's NIT Warrant Invalid, Points Out FBI Agent Knew It Was Invalid When He Requested It

from the new-strategy-needed-for-spreading-malware-worldwide dept

A Minnesota judge has granted a motion for suppression in an FBI Playpen case, using an agent's nineteen years of service and expertise against the government's good faith arguments. The court here found the warrant to be invalid from the moment it was signed, meaning everything obtained past that point to be fruit of the poisonous tree. (via FourthAmendment.com)

While other courts have noted the warrant's invalidity under Rule 41's territorial limitations (now nonexistent), no other judge has taken time to point out the FBI agent requesting the warrant knew it was invalid when he requested it.

First, the decision [PDF] points to the breathtaking scope of the single warrant the FBI obtained.

[T]he Government claims legal authority from this single warrant, issued in the Eastern District of Virginia, to hack thousands of computers in 120 countries and to install malicious software for the purpose of investigating and searching the private property of uncounted individuals whose identities and crimes were unknown to the Government before launching this massive worldwide search.

From there, the judge makes the point that the government can't claim it had any "good faith" in its warrant because it knew the scope and reach of the warrant exceeded the jurisdictional limitations imposed by Rule 41. As evidence of this knowledge, Judge Franklin Noel points to sworn statements by Agent Macfarlane, which indicate he knew the request was invalid when he submitted his warrant request.

The search warrant application and the warrant, as issued, expressly limit themselves to the search of persons or property located in the Eastern District of Virginia. Yet paragraph forty-six of Agent Macfarlane's affidavit explains in some detail how the NIT malware might be deployed anywhere on earth. Specifically, paragraph forty-six provides that "the NIT may cause an activating computer wherever located -- to send to a computer controlled or known to the government, network level messages containing information that may assist in identifying the computer." Under these circumstances, Agent Macfarlane must have known that he was acting in reckless disregard of proper procedure. It was not objectively reasonable for Agent Macfarlane, a "law enforcement . . . veteran" employed by the FBI "for 19 years" to believe that the NIT warrant, which he knew could reasonably reach any computer in the world, was properly issued given the specific territorial limits under Rule 41(b) and the language of the warrant itself…

Put differently, it was not objectively reasonable for Agents to believe that a single warrant, which by its terms was explicitly limited to searches in the Eastern District of Virginia, could be used to electronically search Carlson's computer in Minnesota…

The judge goes on to point out the government can't avail itself of the "good faith" argument because it relies on a valid warrant's issuance. In this case, the warrant was invalid the moment it was issued, making this akin to having no warrant at all. Good faith denied.

The court also finds the warrant defective in other ways. The NIT warrant had no particularity -- a requirement for valid warrants. Since the government didn't know who it would infect with its malware or where they were located, its warrant could not possibly satisfy particularity requirements, even if it somehow managed to adhere to Rule 41 jurisdictional limitations.

Identification of the particular place to be searched cannot depend upon facts that have not yet occurred. A warrant must particularly describe the place to be searched at the time it is issued. Just as a warrant must be supported by probable cause at the time it is issued, this Court concludes that the warrant must particularly describe the place to be searched when it is issued.

[...]

As neither the Magistrate Judge nor the affiant know which computers are to be searched until after the search has already occurred, the NIT warrant fails to particularly describe the place to be searched.

This suggests the FBI may not be completely in the clear despite the Rule 41 changes. The malware it deployed targeted individuals who visited the seized server, but the FBI had no way of knowing who would visit or when. This is a take we haven't seen from other judges in Playpen/NIT cases and this order will likely be cited by several defendants still facing prosecution.

Filed Under: 4th amendment, fbi, malware, nit, privacy, warrant