DOJ Lets Cops Know SESTA/FOSTA Is For Shutting Down Websites, Not Busting Sex Traffickers

from the work-dumber,-not-harder dept

SESTA/FOSTA was pushed through with the fiction it would be used to target sex traffickers. This obviously was never its intent. It faced pushback from the DOJ and law enforcement agencies because pushing traffickers off mainstream sites would make it much more difficult to track them down. The law was really written for one reason: to take down Backpage and its owners, who had survived numerous similar attempts in the past. The DOJ managed to do this without SESTA, which was still waiting for presidential approval when the feds hits the site's principal executives with a 93-count indictment.

The law is in force and all it's doing is hurting efforts to track down sex traffickers and harming sex workers whose protections were already minimal. Sex traffickers, however, don't appear to be bothered by the new law. But that's because the law wasn't written to target sex traffickers, as a top DOJ official made clear at a law enforcement conference on child exploitation. Acting Assistant Attorney General John P. Cronan's comments make it clear SESTA/FOSTA won't be used to dismantle criminal organizations and rescue victims of sex traffickers. It's there to give the government easy wins over websites while sex traffickers continue unmolested.

In April, Backpage.com – the internet’s leading forum to advertise child prostitution – was seized and shut down, thanks to the collective action by CEOS and our federal and state partners. The Backpage website was a criminal haven where sex traffickers marketed their young victims. The Backpage takedown – and the contemporaneous arrests of individuals allegedly responsible for administering the site – struck a monumental blow against child sex traffickers.

But other sites inevitably will seek to fill the void left by Backpage, and we must be vigilant in bringing those criminals to justice as well. With the recent passage of the SESTA-FOSTA legislation, state and local prosecutors are now positioned to more effectively prosecute criminals that host online sex trafficking markets that victimize our children.

"Criminals" that "host sex trafficking markets." That's the target. That's any website that might be used by actual sex traffickers to engage in actual sex trafficking. There's no dedicated web service for sex trafficking -- at least not out in the open where Section 230 immunity used to matter. This is all about taking down websites for hosting any content perceived as sex trafficking-related. It wasn't enough to hang Backpage and its execs. The government will be scanning sites for this content and then targeting the website for content posted by third parties it seems mostly uninterested in pursuing.

Hosts of third-party content are usually easy to find. The actual third parties are far more difficult to track down. Intermediary liability is back. Section 230 is no longer an effective defense. The edges have been trimmed back and the government knows it can rack up easy wins over web hosts and slowly start destroying the web under the facade of saving sex trafficking victims. The DOJ knew this law would make it harder to track down traffickers. But it also knows the law allows it to target websites instead. And here it is touting the law it fought against to a conference full of law enforcement officials, letting them know targeting websites will give them wins and accolades and far fewer headaches than tracking down the individuals actually engaged in illegal activity.

Filed Under: doj, fosta, intermediary liability, jeff sessions, john cronan, sesta, sex trafficking, shutting down websites

Inspector General Not Too Happy With James Comey's Handling Of The Clinton Email Investigation

from the FBI-still-sucks-but-in-exciting-new-ways! dept

The damning report the President has been waiting for has arrived. The Inspector General's report covering everything from James Comey's handling of the Clinton email investigation (terribly with bonus insubordination) to a couple of FBI agents forming a two-person #Resistance (stupid and made the FBI look bad, but not illegal) runs almost 600 pages and won't make anyone looking to pin blame solely on one side of the partisan divide very happy.

It's been claimed the report would finally show the FBI to be an agency filled with partisan hacks, further solidifying "Deep State" conspiracy theories that the government Trump runs is out to destroy Trump. It was somehow going to accomplish this despite many people feeling the FBI's late October dive back into the Clinton email investigation handed the election to Trump.

Whatever the case -- and whatever side of the political divide you cheer for -- the only entity that comes out of this looking terrible is the FBI. That the FBI would engage in questionable behavior shouldn't come as a surprise to anyone, but the anti-Trump "resistance" has taken Trump's attacks on the FBI as a reason to convert Comey, the FBI, and the DOJ into folk heroes of democracy.

The summary of the report [PDF] runs 15 pages by itself and hands out enough damning bullet points to keep readers occupied for hours. Then there's the rest of the report, which provides the details and may take several days to fully parse.

Here are some of the low lights from Inspector General Michael Horowitz, possibly the only person who should be touting "Deep State" theories since he's spent his IG career being dicked around by the DEA, DOJ, FBI, and DEA.

The report says everything about the Clinton email investigation was unusual. Termed the "Midyear Exam" by the FBI, the investigation was mostly a voluntary affair. Most of the evidence and testimony obtained was obtained from consenting witnesses and participants. The FBI rarely felt the need to compel testimony or evidence with subpoenas. It also did not access the contents of multiple devices used by Clinton's senior aides, devices that may have contained classified info that had been circulated through a private email server. As the report notes, this is at odds with Comey's sudden interest in Anthony Weiner's laptop, where his estranged wife (and former Clinton personal assistant) Huma Abedin apparently had stored copies of Clinton emails.

The IG says the tactics used were unusual but does not pass official judgment on them. However, the actions of five FBI employees involved in the investigation did further damage to the FBI and its reputation by taking an investigation already viewed as politically-questionable and aggravating the perception.

In undertaking our analysis, our task was made significantly more difficult because of text and instant messages exchanged on FBI devices and systems by five FBI employees involved in the Midyear investigation. These messages reflected political opinions in support of former Secretary Clinton and against her then political opponent, Donald Trump. Some of these text messages and instant messages mixed political commentary with discussions about the Midyear investigation, and raised concerns that political bias may have impacted investigative decisions.

However, the IG did not uncover evidence suggesting any of these FBI employees had the power to steer the investigation. Some of those engaged in anti-Trump texts actually pushed for additional subpoenas and search warrants in an investigation that seemingly had little use for any testimony not obtained voluntarily. But that doesn't mean these actions were harmless.

Nonetheless, these messages cast a cloud over the FBI’s handling of the Midyear investigation and the investigation’s credibility.

From there, it moves on to James Comey's surprising decision to go public with the email investigation's conclusions in July of 2016. This followed the softening of language in the FBI's investigative report. Clinton's handling of classified info went from "grossly negligent" to "extremely careless." The possibility of hostile actors accessing Clinton's email server went from "reasonably likely" to "possible." Then Comey decided to go public, cutting plenty of people out of the loop so they wouldn't prevent him from doing so.

Comey acknowledged that he made a conscious decision not to tell Department leadership about his plans to make a separate statement because he was concerned that they would instruct him not to do it. He also acknowledged that he made this decision when he first conceived of the idea to do the statement, even as he continued to engage the Department in discussions about the “endgame” for the investigation.

Comey admitted that he concealed his intentions from the Department until the morning of his press conference on July 5, and instructed his staff to do the same, to make it impracticable for Department leadership to prevent him from delivering his statement. We found that it was extraordinary and insubordinate for Comey to do so, and we found none of his reasons to be a persuasive basis for deviating from well-established Department policies in a way intentionally designed to avoid supervision by Department leadership over his actions.

[...]

We concluded that Comey’s unilateral announcement was inconsistent with Department policy and violated long-standing Department practice and protocol by, among other things, criticizing Clinton’s uncharged conduct. We also found that Comey usurped the authority of the Attorney General, and inadequately and incompletely described the legal position of Department prosecutors.

The late October letter to Congress about the reopening of the investigation isn't viewed as any better by the OIG. Comey claimed he needed to do this because withholding the discovery of emails on Anthony Weiner's laptop might have been viewed as swinging the election in Clinton's favor. The IG disagrees.

Much like with his July 5 announcement, we found that in making this decision, Comey engaged in ad hoc decisionmaking based on his personal views even if it meant rejecting longstanding Department policy or practice. We found unpersuasive Comey’s explanation as to why transparency was more important than Department policy and practice with regard to the reactivated Midyear investigation while, by contrast, Department policy and practice were more important to follow with regard to the Clinton Foundation and Russia investigations.

Comey’s description of his choice as being between “two doors,” one labeled “speak” and one labeled “conceal,” was a false dichotomy. The two doors were actually labeled “follow policy/practice” and “depart from policy/practice.” Although we acknowledge that Comey faced a difficult situation with unattractive choices, in proceeding as he did, we concluded that Comey made a serious error of judgment.

Then comes the irony. As Comey became the front-mouth for an investigation he shouldn't have been talking about, he routinely engaged in the same behavior he was currently investigating.

We identified numerous instances in which Comey used a personal email account to conduct unclassified FBI business. We found that, given the absence of exigent circumstances and the frequency with which the use of personal email occurred, Comey’s use of a personal email account for unclassified FBI business to be inconsistent with Department policy.

In addition to being a violation of FBI policy, James Comey -- currently idolized by some as a speaker of truth to power for being fired by the president -- also violated FOIA law by using a private email account for government communications. Comey wasn't the only one -- other agents involved in the investigation routinely used private email accounts -- but he was the FBI's personification of the Clinton email investigation. On top of this, he told other FBI agents the use of personal email accounts would subject them to harsh punishment.

In an October 2016 speech at an FBI conference in San Diego, Comey said, "I have gotten emails from some employees about this, who said if I did what Hillary Clinton did I'd be in huge trouble. My response is you bet your ass you'd be in huge trouble. If you used a personal email, Gmail or if you [had] the capabilities to set up your own email domain, if you used an unclassified personal email system to do our business... you would be in huge trouble in the FBI."

Some may quibble about the lack of classified info being circulated by these agents and their Gmail accounts, but the fact remains the use of private email accounts increases the risk of circulation exponentially. Sticking to government accounts reduces this possibility to zero.

There's much more in the report, including some discussion about the propriety of the Russian influence investigation that Trump claims is a witch hunt. Nothing in the report suggests the investigation isn't valid, even if the actions of agents (the anti-Trump texting) and Andrew McCabe's non-recusal (his wife took money from a Clinton-connected PAC) managed to cover everything with a slimy gloss of impropriety.

The upshot of the report is this: James Comey deserved to be fired, although probably not for the reasons Trump had in mind when he did it. The people employed by the FBI are not always able to set aside their personal biases when engaged in investigations. But the FBI is no one party's political tool. It's a blend of both sides, which makes it unlikely anything was done intentionally to harm Trump or Clinton's political prospects. For all the complaining done by Trump, he's the one in office. If the election was "thrown" by Comey's fourth quarter audible in the email investigation, Trump was the beneficiary of the FBI's actions. This makes complaints about a Russian investigation "witch hunt" incoherent, as it tries to retcon the FBI's actions to portray them as being #NeverTrump even when they were (not officially) helping him. The simultaneous investigations of Clinton and Trump make it difficult to craft a coherent conspiracy theory, but it certainly isn't stopping anyone from trying. The FBI is untrustworthy, but it's not a kingmaker.

Filed Under: doj, donald trump, email, fbi, hillary clinton, inspector general, james comey, michael horowitz, private email, procedures

Apple Pulls Plug On Phone-Cracking Tech Vendors, Will Prevent Data Transfer From Locked Phones

from the law-enforcement's-access-hole-is-everyone-else's-security-problem dept

The FBI lost control of the "going dark" narrative. Part of it unraveled thanks to outside vendors. Two vendors -- Cellebrite and Grayshift -- announced they could crack any iPhone made. This shot holes in the FBI's theory that locked phones stayed locked forever and thereafter were only useful for hammering legislators over the head with until they cranked out an anti-encryption law.

The second unraveling was the FBI's own unforced error. Supposedly it couldn't count phones without software and the software it had couldn't count phones. What the FBI and others claimed was 8,000 uncrackable threats to the safety of the American public was actually a little over 1,000 phones. As for the latent threat posed by these locked devices, that's still pure speculation until the FBI starts handing over some info on what criminal acts these phones are tied to.

The FBI will probably be looking to restart its "going dark" campaign, thanks to Apple's latest effort, which will render Cellebrite and Grayshift's phone cracking boxes obsolete.

Apple is closing the technological loophole that let authorities hack into iPhones, angering police and other officials and reigniting a debate over whether the government has a right to get into the personal devices that are at the center of modern life.

Apple said it was planning an iPhone software update that would effectively disable the phone’s charging and data port — the opening where users plug in headphones, power cables and adapters — an hour after the phone is locked. While a phone can still be charged, a person would first need to enter the phone’s password to transfer data to or from the device using the port.

Law enforcement may be angered by this but private companies are not obligated to make law enforcement's job easier. Apple's official statement on the software update is probably meant to be placating, but is unlikely to change the mind of any law enforcement official who sees this reaction to phone cracking devices as another extended middle finger from tech companies. According to Apple spokesman Fred Sainz, this fix is being issued to fix a security hole, not "frustrate" law enforcement efforts.

But law enforcement efforts will be frustrated. The same goes for criminal efforts. Any device that can crack any iPhone exploits a flaw in the software or hardware. There's no such thing as a security hole that can only be exploited for good. Grayshift's GrayBox could end up in the hands of criminals and it may well be that both vendors have already sold tech to law enforcement agencies in countries where civil liberties aren't as valued as they are in the United States.

The article quotes several law enforcement officials complaining about being locked out of iPhones again. And while the frustration is understandable, the fact is plenty of data and communications are stored in the cloud, untouched by device encryption. Generally speaking, companies like Apple and Google have been cooperative when approached directly by law enforcement, as long as the request doesn't involve breaking device encryption.

This isn't the end of the discussion. Nor should it touch off another skirmish in the Encryption War 2.0. This setback should be viewed as temporary. Holes with be found and exploits deployed and these will be met with patches and firmware upgrades by the tech companies affected. This all can be traced back to the earlier days when it was only criminals looking for ways to defeat personal security measures. Law enforcement was late to the game, but its arrival shouldn't mean companies forgo protecting their customers to avoid inconveniencing the government.

Filed Under: doj, encryption, fbi, going dark, phone cracking
Companies: apple

Following AT&T's Lead, Comcast Makes A $65 Billion Bid For Fox

from the merge-ALL-The-things! dept

Encouraged by AT&T's massive merger victory this week, Comcast has made its own $65 billion acquisition offer for a large chunk of 21st Century Fox. According to the Comcast announcement, the company's all cash $65 billion dollar offer is a notable step up from Disney's own $52.4 billion all-stock package, setting up a showdown between two companies that have had a contentious relationship since Comcast's 2004 failed hostile takeover attempt of Disney.

The deal includes the FX Channel, numerous regional sports networks, and a minority stake in European cable TV giant Sky, which would all be tacked on to the NBC Universal assets Comcast acquired back in 2011. Fox will however retain Fox News, Fox Sports, and Fox broadcasting, which will all remain under the existing Fox brand. In its statement, Comcast rolled out the usual claptrap about how the combination would be lovely for all involved:

"We have long admired what the Murdoch family has built at Twenty-First Century Fox. After our meetings last year, we came away convinced that the 21CF businesses to be sold are highly complementary to ours, and that our company would be the right strategic home for them."

Comcast had previously hinted that it was waiting to see the outcome of AT&T's own merger battle with the DOJ before making its own bid for Fox. Comcast and many analysts believe that the comically broad nature of AT&T's court victory (based on a pinhole narrow reading of the markets by U.S. District Court Judge Richard Leon, who clearly has never heard of things like zero rating or net neutrality), means the precedent set will likely result in a DOJ that's more hesitant to intervene in potentially problematic merger moving forward.

That's especially true of vertical integration mergers, where modern U.S. antitrust law tends to be ill-equipped to handle some of the more complex new media anti-competitive concerns that pop up. Combined with the death of ISP privacy rules and the neutering of net neutrality, we're creating a brave new landscape where there's very little to stop giants like Comcast and AT&T from using their last mile monopolies--combined with massive ownership of content needed to compete with these giants--as anti-competitive bludgeons against consumers and competitors alike.

For example, there's now nothing of note preventing AT&T and Comcast from exempting its own content (like HBO or a regional sports game) from arbitrary and unnecessary usage caps, while penalizing those who use a competitor's service (Netflix, or the next Netflix). Similarly, there's nothing stopping Comcast or Verizon from arbitrarily throttling competitors at interconnection points, driving up the cost for competitors to access their broadband subscribers. There's an ocean of creative ways to hamstring competitors the government is now largely helpless to effectively police, and as the AT&T court win shows, the ISP claim that this isn't a problem because antitrust will save us all clearly isn't a valid argument.

With the FCC making it very clear it's a glorified rubber stamp, that leaves the DOJ as the only real wild card in terms of whether any meaningful conditions get applied to this deal. Granted if you followed the NBC Universal merger, you'll recall that Comcast has a pretty terrible history of ignoring merger conditions when it suits it, and regulators from both parties tend to do little more than grumble when the company tap dances around imposed restrictions (though that was a major reason why Obama-era regulators blocked Comcast's 2014 attempted acquisition of Time Warner Cable (not to be confused with Time Warner)).

Obviously there's still plenty of folks that see zero problems with massive broadband monopolies gobbling up countless media empires while paying millions of dollars to neuter state and federal oversight. And their theory that these kinds of deals are no problem because the market self-regulates (ignoring there is no free market competition in broadband to organically hold them accountable) will soon have a perfect opportunity to put their theories to the test.

Filed Under: antitrust, broadband, competition, content, doj, mergers, streaming
Companies: at&t, comcast, disney, fox, time warner

AT&T Defeats DOJ In Merger Fight, Opening The Door To Some Major Competitive Headaches

from the what-could-possibly-go-wrong dept

AT&T has defeated the DOJ in a court battle over whether or not the company will be allowed to acquire Time Warner for $86 billion.

In a ruling (pdf), U.S. District Court Judge Richard Leon stated that the government failed to make its case that the merger would harm AT&T's competitors, most of which are now trying to keep pace in the streaming video space. Consumer advocates have routinely warned that AT&T will use its greater leverage to make must-have content (like Time Warner owned CNN or HBO) significantly more costly for companies hoping to compete with AT&T's own TV services, including its newish streaming video effort, DirecTV Now.

That a company with a thirty-year history of anti-competitive behavior will likely use this greater leverage to behave badly shouldn't have been a particularly hard case to make, suggesting that DOJ lawyers may have flubbed key components of its case. The DOJ sued to thwart the deal last November, and while the agency claimed it was to protect consumers, the incongruity with other Trump administration consumer policies (like, well, everything) have fueled speculation that Trump's disdain for Time Warner owned CNN, or his close relationship with Rupert Murdoch may have colored the DOJ's decision to sue.

It's an indisputable and massive win for AT&T, and the DOJ's first antitrust court loss since 2004. Leon didn't just kill the lawsuit, he didn't offer any conditions to mitigate potential anti-competitive problems, and largely urged the DOJ not to appeal. AT&T, as you might expect, was thrilled with the court's failure to block its latest megamerger:

"We are pleased that, after conducting a full and fair trial on the merits, the Court has categorically rejected the government’s lawsuit to block our merger with Time Warner. We thank the Court for its thorough and timely examination of the evidence, and we compliment our colleagues at the Department of Justice on their dedicated representation of the government. We look forward to closing the merger on or before June 20 so we can begin to give consumers video entertainment that is more affordable, mobile, and innovative."

Anybody that has witnessed AT&T's versions of "affordable" and "innovative" likely isn't to buy that claim. This is, after all, a company that thought it would be a good idea to charge consumers more money just to protect their own privacy. It's also the same company that has been repeatedly dinged by government for either ripping off its own customers, or turning a blind eye while all manner of others did. Not surprisingly, more consumer-oriented folks like former FCC staffer and consumer advocate Gigi Sohn had a decidedly different take on AT&T's court win:

"Big media conglomerates are the winners and consumers are the losers with Judge Leon’s decision. Merging AT&T, one of the largest cable, satellite and mobile broadband companies with Time Warner will lead to higher prices, fewer choices and perhaps more importantly, fewer voices. Coupled with the demise of the 2015 net neutrality rules yesterday, AT&T will be free to favor Time Warner content over its cable and its fixed and mobile broadband networks."

Numerous companies were waiting on the AT&T decision before pursuing their own, previously-unthinkable merger ambitions. Comcast, for example, has stated the company was holding off on making its $60 billion offer for Fox's remaining assets until it saw the outcome of the case. Sprint and T-Mobile are also considering a merger that's likely to reduce competition in wireless and kill tends of thousands of sector jobs.

It's not just the AT&T merger that's problematic. The wave of major consolidation this loss will trigger, combined with the death of net neutrality protections opens the door to an absolute ocean of bad behavior by companies that have already clearly documented they'll stop at nothing to keep real competition at bay. And while the rise of streaming competitors crafting original content may mitigate some of this, you'd have to be pretty naive to think AT&T's stranglehold over broadband and media, combined with Trump era regulatory capture ends particularly well for the consumers and small businesses caught in its wake.

Filed Under: antitrust, competition, consolidation, doj, merger, richard leon
Companies: at&t, time warner

DOJ Stacks Charges On MalwareTech, Including Stuff Put Out Of Reach By The Statute Of Limitations

from the 'lying-to-feds'-bingo-card-complete dept

The government's case against Marcus Hutchins, aka MalwareTech, isn't getting any stronger. After detaining him at a Las Vegas airport following some post-conference partying, the FBI decided to hit the guy who inadvertently shut down WannaCry with charges for allegedly creating the Kronos malware. In essence, the case is about criminalizing security research, and the government's indictment decided to hang Hutchins out to dry while allowing the people who actually sold the malware to remain unarrested and unindicted.

The charges were weak and the government appeared to know it. Deployment of malware to cause damage and wreak havoc is one thing, but creating malware -- something lots of security researchers do -- isn't a criminal activity in and of itself. Thrown into the mix were wiretap charges based on the very thin premise that the malware was used to intercept communications.

Hutchins' defense team pushed back, forcing the government to actually show its work. A discovery request intended to show Hutchins was drunk and tired when he was "interviewed" by the FBI was rebuffed by the government. It also appears -- using the FBI's own testimony and recordings -- that Hutchins was never properly Mirandized.

Between them, the agents described how they flew out to Vegas the night before the arrest. Surveilling agents tracked Hutchins as he went to the airport and got through TSA then sat down at a first class lounge. As soon as Hutchins ordered a drink that turned out to be Coke but that the agents worried might be booze, Chartier, wearing business casual civvies, and two CBP agents wearing official jackets pulled Hutchins away from the lounge, placed him under arrest and cuffed him in a stairwell inside the secure area, and walked him to a CBP interview room, where Chartier and Butcher Mirandized him, then interrogated him for 90 to 100 minutes.

Even in telling that story, Chartier and Butcher’s stories conflicted in ways that are significant for determining when Hutchins was Mirandized. He said it took “seconds” to get into the stairwell and then to the interview room. She noted that the “Airport is rather large. Would have taken awhile.” to walk from place to place (it was 36 minutes between the time Hutchins cleared TSA, walked to the lounge, ordered a Coke, and the time Chartier first approached Hutchins). There seems to be a discrepancy on how many CBP agents were where when (that is, whether one or two accompanied Chartier and Hutchins all the way to to the interrogation room). Those discrepancies remained in spite of the fact that, as Butcher admitted, they had spoken, “Generally, about the interview, and Miranda, and making sure that we were on, that our facts were the same.”

Chartier described that the CBP recording equipment in the room “wasn’t functional that day,” which is why they relied on Butcher pressing a record button herself, which she didn’t do until (she said) Chartier started asking “substantive” questions, but after the Miranda warning.

With all of this going on, and the government's charges relying on some very generous interpretations of the CFAA and wiretap laws, the feds appear unable to close this case successfully. Prosecutors were unable to get Hutchins to agree to a plea deal with their first try, so they're going to take another crack at it. A superseding indictment [PDF] has been entered by the government and, as Marcy Wheeler explains, it's even worse than the extremely shaky one it's replacing.

[T]he government, which refuses to cut its losses on its own prosecutorial misjudgments, just doubled down with a 10-count superseding indictment. Effectively, the superseding creates new counts, first of all, by charging Hutchins for stuff that 1) is outside a five year statute of limitations and 2) he did when he was a minor (that is, stuff that shouldn’t be legally charged at all), and then adding a wire fraud conspiracy and false statements charge to try to bypass all the defects in the original indictment.

The government has added another piece of malware to its indictment -- UPAS Kit -- and is attempting to tie it to Hutchins. Even if it's able to do this, it likely won't help the government secure a conviction for two reasons. First, if the date is accurate, it means Hutchins was still a minor when this alleged crime took place. Second, the government has only five years to prosecute and the July 2012 date stated in the indictment means the statute of limitations has tolled.

There's far more to it than that. Wheeler's post detailing everything wrong with the superseding indictment is a masterpiece deconstruction of government desperation. The indictment wants jurors to believe simply writing about malware is a criminal act, even when the post cited actually details how to thwart malware. And it now includes an old DOJ favorite: making false statements to the FBI.

This last one might cause more problems for the FBI than it will solve. This will rely on statements made during the interrogation of Hutchins -- one that's already been marred by conflicting testimony by FBI agents.

First of all, as I’ve noted, one agent Hutchins allegedly lied to had repeatedly tweaked his Miranda form, without noting that she did that well after he signed the form. The other one appears to have claimed on the stand that he explained to Hutchins what he had been charged with, when the transcript of Hutchins’ interrogation shows the very same agent admitting he hadn’t explained that until an hour later.

So the government is planning on putting one or two FBI agents who have both made inaccurate statements — arguably even lied — to try to put Hutchins in a cage for lying. And they’re claiming that they were “conducting an investigation related to Kronos,” which is 1) what they didn’t tell Hutchins until over an hour after his interview started and 2) what they had already charged him for by the time of the interview.

The best case scenario, as Wheeler explains, in the government tying the 2012 (past the statute of limitations) criminal act to some "marketing" of the malware in 2014, allowing it to salvage all these charges.

In other words, they’re accusing Hutchins of wiretapping and CFAA crimes because someone else posted a YouTube.

And if it can tie anything to this YouTube video, it can nail down venue because YouTube is a US company. (Hutchins is a UK resident.)

What it may also be is another attempt to get Hutchins to cave to a plea deal. This indictment adds more charges, which could mean additional jail time and fines if he's convicted. But that's a huge if. What the government has shown so far doesn't even meet the lowest standards of competency. It's a garbage prosecution made worse by the FBI's apparent decision to let the two people who actually marketed and sold malware walk away from this -- either because the agency can't locate them or (at least in "Randy's" case) has already agreed to drop charges in exchange for testimony.

Filed Under: doj, fbi, indictment, malware, marcus hutchins, statute of limitations

FBI Hoovered Up Two Years Of A Journalist's Phone And Email Records To Hunt Down A Leaker

from the sorry,-citizens,-we-have-an-omelette-to-make dept

The New York Times reports the FBI has crossed a line it's generally hesitant to cross. An investigation into classified info leaks by a Senate Intelligence Committee aide involved the seizure of two year's worth of a New York Times reporter's phone and email records.

The former aide, James A. Wolfe, 57, was charged with lying repeatedly to investigators about his contacts with three reporters. According to the authorities, Mr. Wolfe made false statements to the F.B.I. about providing two of them with sensitive information related to the committee’s work. He denied to investigators that he ever gave classified material to journalists, the indictment said.

[...]

Mr. Wolfe’s case led to the first known instance of the Justice Department going after a reporter’s data under President Trump. The seizure was disclosed in a letter to the Times reporter, Ali Watkins, who had been in a three-year relationship with Mr. Wolfe. The seizure suggested that prosecutors under the Trump administration will continue the aggressive tactics employed under President Barack Obama.

The war on unofficial transparency continues -- this time ensnaring a reporter. The indictment [PDF] shows Wolfe was in regular contact with four unnamed reporters and the classified info leaked apparently related to the investigation of Carter Page. (The indictment refers only to MALE-1.).

Despite all the dots connected by the Justice Dept. after hoovering up email and phone records of four reporters, none of the charges brought against Wolfe involved mishandling classified info. All three charges listed are for lying to the FBI, not exposing secret info. While the info obtained may have been necessary to prove Wolfe lied to investigators, it does seem like a serious breach first amendment boundaries for nothing but vanilla "lied to the feds" charges. Those charges are mostly there for the government to punish people when it thinks it can't nail down more serious charges.

And it is a breach of expected norms, if not a reliable indicator of how many civil liberties the government is willing to doormat to hunt down leakers and whistleblowers.

Under Justice Department regulations, investigators must clear additional hurdles before they can seek business records that could reveal a reporter’s confidential sources, such as phone and email records. In particular, the rules require the government to have “made all reasonable attempts to obtain the information from alternative, non-media sources” before investigators may target a reporter’s information.

In addition, the rules generally require the Justice Department to notify reporters first to allow them to negotiate over the scope of their demand for information and potentially challenge it in court. The rules permit the attorney general to make an exception to that practice if he “determines that, for compelling reasons, such negotiations would pose a clear and substantial threat to the integrity of the investigation, risk grave harm to national security, or present an imminent risk of death or serious bodily harm.”

It's not clear all these steps were followed. But there are a whole lot of exceptions available to the FBI to bypass these steps meant to protect the First Amendment. No one seems to have been notified beforehand, and it was far more than call/email metadata that was obtained. The indictment cites the content of encrypted messages -- suggesting yet another area where the FBI's "going dark" rhetoric is overblown.

After the story was published, WOLFE congratulated REPORTER #3, using Signal, stating "Good job!" and "I'm glad you got the scoop." REPORTER #3 wrote back, using Signal,"Thank you. [MALE-l] isn't pleased, but wouldn't deny that the subpoena was served."

Going after reporters' records may become standard operating procedure. The Obama Administration prosecuted more leakers and whistleblowers than all previous presidents combined. This administration appears ready to dwarf Obama's numbers.

Attorney General Jeff Sessions said last year that the Justice Department was pursuing about three times as many leak investigations as were open at the end of the Obama administration.

If the DOJ isn't going to give the First Amendment a wide berth, it's not going to be much friendlier to the rest of them -- like the Fourth. Aggressive pursuit of leakers -- and the attendant collection of reporters' communications/data -- will continue. The DOJ may have guidelines meant to limit investigators from obtaining journalists' records, but they're not much practical use when they can be waived to preserve the "integrity of the investigation."

Filed Under: 4th amendment, doj, fbi, first amendment, investigations, james wolfe, jeff sessions, journalists, leaks, whistleblowers

Six More J20 Protest Prosecutions Dismissed As Gov't Admits To Hiding Exculpatory Evidence From Defendants

from the self-defeating dept

The government has dismissed more defendants from the J20 protest prosecution. A mass prosecution that ensnared journalists and activists -- along with those who may have actually participated in damaging property -- has gradually disintegrated as the government has undermined its own efforts again and again. (To say nothing of the multiple times the government tried to undermine the prosecution, starting with the mass First Amendment incursions of arresting journalists, before heading on to broadsides of the Fourth thru Sixth Amendments.)

The government isn't done blasting holes in its feet just yet. Alan Pyke, reporting for ThinkProgress, says the prosecutorial fiasco the government is trying to abandon contained a host of Constitutional violations.

Federal prosecutors hid scores of videos from the hundreds of anti-Trump demonstrators they charged with serious felonies in an unprecedented crackdown on Inauguration Day protests, defense lawyers alleged in an overnight filing Wednesday.

The new accusations exacerbate an existing crisis for prosecutors, who already admitted last week to hiding one 55-minute video and misrepresented edits they made to another video. That initial screw-up, known to lawyers as a Brady violation, already jeopardized the case.

But that initial, single Brady violation is actually part of a much broader pattern of evidence-concealing, the lawyers now say. The government has concealed another 69 separate recordings — three audio files and 66 videos — of planning meetings for the Inauguration protests known as #DisruptJ20, defense lawyers say in the motion.

The government had an unlikely ally in its prosecution -- right-wing, half-arsed sting operation Project Veritas. The prosecution relied on videos supposedly containing protesters discussing plans for mayhem and violence. This is what the government needed to rope 50-some protesters in on conspiracy charges, something it could salvage when tying defendants to actual violence or destruction proved impossible.

But the videos the government obtained -- but did not turn over to the defense -- showed something else.

The recordings, which were made by employees of the right-wing Project Veritas, purportedly show defendants discussing de-escalation tactics and their intent not to initiate physical violence with anyone unless they are attacked first. The prosecutor had previously told the judge that no recordings existed from the meetings where the newly revealed audio and videos were made.

The government now says it will not use any videos from Project Veritas in the trials of the 59 remaining defendants. This gesture may be too little, too late. It's also completely self-serving. If the government ditches the Veritas videos, the defense will struggle to have charges dismissed because of the government's Brady violation. The court may rule the violation only concerned evidence the prosecution isn't using -- a "no harm, no foul" ruling that lets the government have its Brady violations and its prosecutions too. Hopefully, the court will take note of the government's attempt to have it both ways and deny it in full.

Filed Under: brady violation, doj, free speech, j20, protests, withholding evidence
Companies: project veritas

DOJ, FBI Issuing Corrections To Statements, Testimony Containing Bogus Uncracked Device Numbers

from the cleanup-on-aisle-7800 dept

The FBI's push for encryption backdoors relied on ever-skyrocketing numbers of uncracked devices the agency's best and brightest just couldn't seem to access. "Look!" DOJ and FBI officials said, pointing lawmakers at charts showing an explosion in the number of locked devices over the last couple of years. Unsustainable, it seemed to say. But it was all a lie. Not a deliberate lie, maybe, but a lie nonetheless. A convenient misrepresentation of the problem caused by a software error.

How does an agency with the technical capabilities the FBI has miscount physical items? Apparently, you let software do the counting and hope for the best.

“The FBI’s initial assessment is that programming errors resulted in significant over-counting of mobile devices reported,’’ the FBI said in a statement Tuesday. The bureau said the problem stemmed from the use of three distinct databases that led to repeated counting of phones. Tests of the methodology conducted in April 2016 failed to detect the flaw, according to people familiar with the work.

This inflated the count from somewhere between 1,000-2,000 to nearly 8,000. That was the number used by Director Christopher Wray and AG Jeff Sessions in testimony to Congress and speeches to law enforcement. That was the center of the narrative: a number that kept growing exponentially with no end in sight.

You'd think the agency would track devices better, what with officials constantly claiming each and every phone was "tied to a threat to the American people." Something that important shouldn't be carelessly handled. But the phones "tied to threats" were overcounted, suggesting a severe problem in the FBI's tracking system that might make it difficult to figure out which "threats" each phone is "tied" to if and when it ever gets around to cracking the devices.

Now, the DOJ is in damage control mode. Robyn Greene was the first to notice the corrections made to officials' statements using the FBI's bullshit ~8,000 number. Edits to AG Sessions' recent comments at a law enforcement conference have replaced this:

Last year the FBI was unable to access investigation-related content on more than 7,700 devices…

With this:

Last year the FBI was unable to access investigation-related content on more than ** devices…

The footnote reads:

** Due to an error in the FBI's methodology, an earlier version of this speech incorrectly stated that the FBI had been unable to access 7,800 devices. The correct number will be substantially lower.

The FBI's been doing a bit of cleanup at its own site. Here's one from May 3, 2017 that has since been corrected.

In just the first half of this fiscal year, the FBI was unable to access the content of more than 3,000* mobile devices...

The FBI's footnote is far more concise and vague.

* Due to an error in methodology, this number is incorrect. A review is ongoing to determine an updated number.

It helpfully doesn't mention the FBI screwed up its own count. Nor does it state the new estimate will be "substantially lower." Cowards.

Here's another one, from September 27, 2017:

In the first 10 months of this fiscal year, the FBI was unable to access the content of more than 6,000* mobile devices…

How did this jump -- 3,000 phones in five months -- escape notice? As of November 2016, the number was only around 880 devices. Then it jumped to 3,000 six months later. Then it doubled to 6,000 in less than five months. By the end of that fiscal year four months later, the FBI had supposedly added another 1,775 uncrackable devices.

In fiscal year 2017, we were unable to access the content of 7,775* devices…

Even if the count had been accurate (which it wasn't), the numbers were delivered dishonestly. What appears to be a cumulative total of all devices the FBI had collected over the years is presented in testimony as being the total number of devices the FBI couldn't unlock during a single fiscal year. This vastly misconstrues the severity of the issue and while FBI officials may have been unaware the FBI's software was delivering bogus counts, it didn't stop them from overstating the problem by presenting historical cumulative numbers as a single year's total.

Whatever number the FBI finally delivers will be decidedly underwhelming. Considering it still hasn't provided Congress with details of its attempts to access supposedly uncrackable devices, the FBI has managed to decimate its own forces in the new War on Encryption. It overplayed its hand -- perhaps inadvertently -- and weakened its argument severely. Something this important to the FBI was handled carelessly -- not because the FBI doesn't really want weakened encryption, but because the FBI will not do anything to weaken its anti-encryption position. It never bothered to check the phone count because the number given to officials was sufficiently impressive. That mattered far more than accuracy or honesty. "Fidelity, Bravery, Integrity" my ass.

Filed Under: chris wray, corrections, doj, encrypted phones, errors, fbi, going dark, jeff sessions

FBI Admits It's Been Using A Highly-Inflated Number Of Locked Devices To Push Its 'Going Dark' Narrative

from the seriously-fuck-these-guys dept

Call it a lie. Call it a misrepresentation. Call it a convenient error. Call it what you want. Just don't call it a fact. Devlin Barrett at the Washington Post delivers a bombshell: the thousands of phones the FBI supposedly just can't crack despite a wealth of tech solutions at its disposal? It's nowhere near as many as consecutive FBI directors have claimed.

The FBI has repeatedly provided grossly inflated statistics to Congress and the public about the extent of problems posed by encrypted cellphones, claiming investigators were locked out of nearly 7,800 devices connected to crimes last year when the correct number was much smaller, probably between 1,000 and 2,000, The Washington Post has learned.

This number aligns more with reality than the frequent claims the number of locked phones was nearing 8,000 devices. In 2016, the FBI reported it was only locked out of around 880 devices. Less than two years later, it was stating it had 7,800 impregnable devices in its possession.

This exponential increase followed the FBI's failure to convince a court Apple should be ordered to break a phone's encryption whenever the government wanted access. This courtroom demand was predicated on a deliberately backburnered quest to find a tech solution from a third party, as a recently-released Inspector General's report revealed.

So, we know the FBI can't be trusted to tell the whole story when quizzed about its "going dark" assertions. Now, we know the FBI can't be trusted to count physical devices accurately.

The FBI first became aware of the miscount about a month ago and still does not have an accurate count of how many encrypted phones they received as part of criminal investigations last year, officials said. Last week, one internal estimate put the correct number of locked phones at 1,200, though officials expect that number to change as they launch a new audit, which could take weeks to complete, according to people familiar with the work.

“The FBI’s initial assessment is that programming errors resulted in significant over-counting of mobile devices reported,’’ the FBI said in a statement Tuesday. The bureau said the problem stemmed from the use of three distinct databases that led to repeated counting of phones. Tests of the methodology conducted in April 2016 failed to detect the flaw, according to people familiar with the work.

The FBI's count was inflated by bad software and sloppy record keeping. But it had no incentive to fix it. Even if the error was never detected by the methodology test, someone should have asked how the FBI's stash of locked phones suddenly exploded from less than 900 to nearly 8,000 in 18 months. But, given the IG's findings about its slow-walked search for outside tech solutions in the Apple court battle, any red flags were probably ignored in favor of pushing the most dramatic "going dark" narrative possible. Why ask why? Just go with the more jaw-dropping number, even if there's no physical evidence to back the claim.

This discovery was likely prompted by FOIA requests and demands for answers from Congress. Without this outside pressure, the FBI had no motivation to double check its math. Now that it must answer to both Congressional oversight and tenacious members of the public, it has finally decided to audit its locked phone stash.

AG Sessions has also played a part in expanding the "going dark" narrative. He had this to say earlier this month, painting a picture of thousands of latent threats stored in FBI evidence lockers.

Last year, the FBI was unable to access investigation-related content on more than 7,700 devices — even though they had the legal authority to do so. Each of those devices was tied to a threat to the American people.

Except they're obviously not. Most of the devices don't even exist. Therefore, most of the threats don't exist. And this statement can't be definitively made about the number of actual devices the FBI has on hand because the FBI has yet to provide any info whatsoever about these devices or their relation to ongoing or stalled investigations. We don't know how many are tied to "threats to the American people" and how many are tied to bog standard investigatory work, like drug busts or white collar crime or any number of other non-threatening criminal activities the Bureau investigates.

The "going dark" narrative is a house of cards erected on a loose bedding of bullshit. It always has been. Now the FBI is slowly being forced to admit it has nothing to offer but shadow play in which a small pile of phones is stacked carefully to portray a towering, monstrous threat to the American public. At best, the FBI handled its precious cargo of anti-encryption warriors extremely carelessly. At worst, it looked at the incongruous leap in locked device numbers and figured it better served the "going dark" narrative than an accurate count would.

Filed Under: christopher wray, doj, encryption, fake numbers, fbi, going dark, inflated numbers