FBI Tries New Rule 41 Changes On For Size In Fight Against Long-Running Botnet

from the one-warrant;-all-the-computers dept

The DOJ is proud to announce it's flexing its new Rule 41 muscle. The changes proposed in 2015 sailed past a mostly-uninterested Congress and into law, giving the FBI and other DOJ entities permission to hack computers anywhere in the world with a single warrant.

With the new rules, the law has finally caught up with the FBI's activities. It deployed a Network Investigative Tool -- the FBI's nifty nickname for intrusive malware that sends identifying info from people's computers to FBI investigators -- back in 2012 during a child porn investigation and mostly got away with it. It tried it again in 2015 and ran into a bit more resistance.

Rule 41's (former) jurisdictional limitations meant the FBI wasn't supposed to be able to "search" computers all over the US using a single warrant issued in Virginia. This activity was supposed to be confined to the state of Virginia. The aftermath of the Playpen investigation has led to a multitude of conflicting judicial opinions. Some have found the warrant invalid and the evidence obtained worthless. Others have granted good faith exceptions or determined no privacy violation took place. In at least one case, the government has dismissed the charges rather than expose any information about its Rule 41-flouting NIT.

In this case, the FBI isn't hacking computers to uncover child porn site visitors. Instead, it's going to be fiddling with a lot of computers to take down a botnet. The DOJ press release makes particular note of how lawful this all is now, post-Rule 41 amending:

In seeking authorization to disrupt and dismantle the Kelihos botnet, law enforcement obtained a warrant pursuant to recent amendments to Rule 41 of the Federal Rules of Criminal Procedure. A copy of this warrant along with the other court orders are produced below.   The warrant obtained by the government authorizes law enforcement to redirect Kelihos-infected computers to a substitute server and to record the Internet Protocol addresses of those computers as they connect to the server. This will enable the government to provide the IP addresses of Kelihos victims to those who can assist with removing the Kelihos malware including internet service providers.

The search warrant [PDF] application leads off with this as well, waving it in front of its unusual request like a wary vampire hunter's cross.

I make this affidavit in support of an application for a warrant under Federal Rule of Criminal Procedure 41 to authorize an online operation to disrupt the Kelihos botnet currently under the control of Peter Yuryevich LEVASHOV, a criminal hacker. The operation, which is particularly described in Attachment A and Attachment B, involves the distribution of updated peer lists, job messages and/or IP filter lists, further described in Attachment B, to the TARGET COMPUTERS currently infected with the Kelihos botnet malware in violation of Title 18, United States Code, Sections 1030, L343, and 2511, as described in Attachment A. This operation will also obtain the Internet Protocol addresses and associated routing information of those infected computers, and those addresses are evidence of crimes committed by LEVASHOV. A PRTT order has been requested for the purpose of attaining those IP addresses and associated routing information. This operation will not capture content from the TARGET COMPUTERS or modify them in any other capacity except limiting the TARGET COMPUTERS' ability to interact with the Kelihos botnet.

The intent here is to dismantle the botnet by freeing zombie computers. All well and good, except it's not the government pointing victims to malware removal tools, but rather letting themselves into the "house" to size up infections before passing this info on to third parties to actually perform the removals.

This new form of intrusion raised concerns in Congress, but the DOJ insisted the changes were innocuous and please let's all stop talking about this before someone stops the Rule 41 amendments slow roll to tacit approval.

Here it is in action: thousands of computers temporarily hosting digital G-men. We're in unknown territory right now with the FBI's anti-botnet work. The FBI itself doesn't even appear all that sure about the extent of its new Rule 41 powers. As is noted in the warrant, the FBI also applied for a Pen Register/Trap and Trace (PRTT) order [PDF] just in case.

Other than the three elements described above, federal law does not require that an application for an order authorizing the installation and use of a pen register and a trap and trace device specify any facts. The following additional information is provided to demonstrate that the order requested falls within this Court's authority to authorize the installation and use of a pen register or trap and trace device under 18 U.S.C. g 3123(a)(1).

This is the FBI basically saying the law doesn't require this application, but here it is anyway. A CYA PRTT for the interception of communications metadata that might help identify botnet victims. And for all its talismanic waving of Rule 41, the FBI isn't even sure it's really required to seek a warrant to perform this botnet cleanup. From the warrant affidavit:

To effectively combat the P2P structure of the Kelihos botnet, the FBI with assistance of private partners will participate in the exchange of peer lists and job messages with other infected computers. The FBI's communications, however, will not contain any commands, nor will they contain IP addresses of any of the infected computers. Instead, the FBI replies will contain the IP and routing information for the FBI's "sinkhole" server. As this new routing information permeates the botnet, the Kelihos infected computers will cease any current malicious activity and learn to only communicate with the sinkhole. The effect of these actions will be to free individual infections from exchanging information with the Kelihos botnet and with LEVASHOV. This will stop Kelihos's most immediate harm, the harvesting of personal data and credentials, and the transmittal of that data to servers under LEVASHOV's control.

Another portion of the Kelihos job messages is a list, known as the IP filter list. This list functions as a type of blacklist, preventing communication with those IPs contained within the filter list. If necessary, the FBI also seeks authorization to send a filter list to TARGET COMPUTERS to block Kelihos infected computers from continuing to communicate with router nodes.

The footnote attached to this reads:

The law is unsettled as to whether the operation authorized by the proposed warrant constitutes a search or seizure. However, in an abundance of caution, the United States is seeking a warrant.

It looks like the FBI is tentatively exploring its new powers, making sure it has the paper trail it needs to stave off courtroom challenges. If it sticks to disrupting a botnet, it shouldn't face any. If it takes advantage of its new access privileges, it might.

Filed Under: botnet, doj, fbi, hacking, nit, rule 41, warrant

Attorney General Kills Off Study Of DOJ's Highly-Flawed Forensic Practices And Evidence

from the better-many-innocent-people-be-jailed-than-we-not-look-tough-on-crime dept

Trump's DOJ -- led by Jeff Sessions -- is rolling the clock back… on everything. Sessions has problems with the country's interest in decriminalizing personal marijuana use. Weed has been a big moneymaker for the FBI and DOJ, and no one likes losing paying customers -- especially not the private prisons that bad drug laws have kept full of taxpayer-supported "guests."

He also wants to roll back the DOJ's Civil Rights Division to the good old days. You know, before it actually existed and/or did anything about unconstitutional policing. Even though crime rates in most cities are still at historical lows, Trump and Sessions believe the country is under siege by violent criminals, who must be dealt with in the harshest, most expensive way.

Now, there's this: Spencer Hsu of the Washington Post reports the DOJ will be reversing course on the junk science it so often refers to as "forensic science."

Attorney General Jeff Sessions will end a Justice Department partnership with independent scientists to raise forensic science standards and has suspended an expanded review of FBI testimony across several techniques that have come under question, saying a new strategy will be set by an in-house team of law enforcement advisers.

In a statement Monday, Sessions said he would not renew the National Commission on Forensic Science, a roughly 30-member advisory panel of scientists, judges, crime lab leaders, prosecutors and defense lawyers chartered by the Obama administration in 2013.

The DOJ's reliance on sketchy forensic science has long been a problem -- one the FBI even admitted to after its lab techniques and expert witness overstatements were examined by outside forensic scientists. Government "experts" were routinely overstating the "scientific certainty" of DNA matches of lab-tested evidence, resulting in the wrongful convictions of hundreds of people. The evidence given an appearance of authenticity by the government's "experts" on the stand was anything but:

• a 2002 FBI re-examination of microscopic hair comparisons the agency’s scientists had performed in criminal cases, in which DNA testing revealed that 11 percent of hair samples found to match microscopically actually came from different individuals;

• a 2004 National Research Council report, commissioned by the FBI, on bullet-lead evidence, which found that there was insufficient research and data to support drawing a definitive connection between two bullets based on compositional similarity of the lead they contain;

• a 2005 report of an international committee established by the FBI to review the use of latent fingerprint evidence in the case of a terrorist bombing in Spain, in which the committee found that “confirmation bias”—the inclination to confirm a suspicion based on other grounds—contributed to a misidentification and improper detention; and

• studies reported in 2009 and 2010 on bitemark evidence, which found that current procedures for comparing bitemarks are unable to reliably exclude or include a suspect as a potential biter.

The committee reexamining the DOJ's lab practices got off to a rocky start when a federal judge appointed to the committee resigned after it became apparent the DOJ wasn't interested in seeing all of its junk science undone. The committee's work continued, but the DOJ publicly stated it wouldn't be changing much about how it handled forensic evidence. It would simply ask government witnesses to dial back their assertions of "scientific certainty."

On the (formerly) bright side, the DOJ had been reviewing its forensic work, hopefully with the intent of improving it. That's over now. Anyone involved with making the government's forensic science better is being replaced with more "traditional" lab staffers who will make sure the government always wins.

A path to meet needs of overburdened crime labs will be set by a yet-to-be-named senior forensic adviser and an internal department crime task force, Sessions’s statement said.

So long, reexamination. Hello, "crime task force."

This turns any examination of DOJ forensic science into a wholly internal affair. This confirms the conclusion Judge Rakoff came to when he resigned from the examination committee: the government wants its dubious evidence to remain unquestioned and its submitted evidence to be safe from examination by defense experts. "Trial by ambush," as Judge Rakoff referred to it.

With Sessions' latest move, the DOJ moves even further away from the word "justice."

In suspending reviews of past testimony and the development of standards for future reporting, “the department has literally decided to suspend the search for the truth,” said Peter S. Neufeld, co-founder of the Innocence Project, which has reported that nearly half of 349 DNA exonerations involved misapplications of forensic science. “As a consequence innocent people will languish in prison or, God forbid, could be executed,” he said.

The move is, of course, being applauded by prosecutors. Eliminating any questioning of the DOJ's forensic science and evidence allows them to obtain more convictions. The fact that the underlying evidence may be flawed doesn't appear to matter. The National District Attorneys Association is completely behind a closed shop operation -- one that allows the DOJ to start with conclusions and mold the "science" to fit its predetermined ends.

Filed Under: doj, forensics, jeff sessions, science, wrongful convictions

Kim Dotcom Asks US Supreme Court Not To Allow US Government To Steal All His Stuff Without Due Process

from the due-process-matters dept

Over the past few years we've covered what may seem like a side issue in the many legal issues facing Kim Dotcom, but it's an important one: is the US able to legally take all of his money and stuff, despite (1) him not being found guilty of anything and (2) that stuff not being anywhere near the US? As we've said, even if you think Dotcom is guilty of horrible crimes and should rot in jail, how the US is going about taking his assets should concern you massively. The fact that courts have blessed the DOJ's actions doesn't make it any less concerning.

On Friday, Dotcom (along with some powerhouse legal help) asked the Supreme Court to review this issue. The real issue here is one that we've covered a lot in other contexts: civil asset forfeiture, in which the US seizes and sues stuff rather than people. That's why this lawsuit is not actually against Kim Dotcom (there are other such lawsuits), but rather the United States v. All Assets Listed in Attachment A (no, really, that's the case). Of course, "Attachment A" is all of Dotcom's assets, mostly in Hong Kong. But the situation with Dotcom takes the normal questions about asset forfeiture and adds layer upon layer of complexity.

There are three specific issues that Dotcom is asking the Supreme Court to review, and all are important here. The first is whether or not a US court can allow for asset forfeiture for assets that are outside the US and outside of US government control. As the dissent pointed out in the appeals court ruling in this case, a federal court issuing a ruling is supposed to be a binding ruling, not an advisory ruling. And if the assets are held outside the US and not under the jurisdiction of the US courts, the ruling can't be binding.

The second two issues are connected: and it's basically the question of whether the courts were right in saying that the federal government could take Dotcom's stuff and that Dotcom could not protest, because he was "a fugitive." Of course, he's not a "fugitive." He's just fighting extradition to a place he's never been. He isn't running away and is going through the full legal process he's entitled to in New Zealand. That's not someone hiding from the US, it's someone who is following the basic rules of due process, which the US wishes to deny him. The specific questions are at what stage of the process he can be declared a fugitive and the other is whether or not intent needs to be shown.

As we have noted repeatedly, the Supreme Court rejects most requests to hear cases, but the lawyers here (Dotcom's long-term lawyer Ira Rothken along with legal giant Quinn Emanuel) have done a good job demonstrating real circuit splits in appeals courts on each of the three questions, which is often important in convincing the Supreme Court to actually take a case. As the filing notes:

This Court has previously admonished that the “harsh sanction” of fugitive disentitlement in a civil forfeiture action is “most severe and so could disserve the dignitary purposes for which it is invoked,” because it “foreclos[es] consideration of claims on the merits.” ... The Court noted that it “ha[d] held it unconstitutional to use disentitlement similar to this as punishment for rebellion against the United States,” but left open the question of “whether enforcement of a disentitlement rule under proper authority would violate due process.” ... Nonetheless, a divided panel of the Fourth Circuit affirmed civil forfeiture based on fugitive disentitlement.

I imagine that the federal government will insist there's no reason for the Supreme Court to weigh in here, but hopefully the court decides to review the case. Again, even if you dislike Dotcom or think he's guilty of a "megaconspiracy" to infringe on copyrights, the due process questions around civil asset forfeiture should concern you -- and hopefully they concern the Supreme Court.

Filed Under: doj, kim dotcom, scotus
Companies: megaupload

Attorney General's Memo Indicates Trump's DOJ Is Only Interested In The Blue Side Of The Justice Equation

from the lol-'civil-rights'-GET-A-JOB-HIPPIES dept

Here comes the rollback. As President Trump made clear with his pick for Attorney General, the days of police reform are over. The administration is only willing to put its weight behind efforts that give cops more power, weapons, and funding. Everything else -- including several years-worth of consent agreements with dysfunctional police departments -- is unimportant.

The first wave of Trump's planned United Police State was a series of divisive directives seeking to bolster support for law enforcement by informing them the president had their back and anyone who didn't was simply wrong.

A Trump Administration will empower our law enforcement officers to do their jobs and keep our streets free of crime and violence. The Trump Administration will be a law and order administration. President Trump will honor our men and women in uniform and will support their mission of protecting the public. The dangerous anti-police atmosphere in America is wrong. The Trump Administration will end it.

The DOJ's Civil Rights Division -- which has entered into several consent decrees with police departments engaged in unconstitutional policing -- is seeing its budget cut. The "law and order" focus of the Trump/Sessions DOJ is taking shape.

Via Reason's CJ Ciaramella comes the next step in the Making America Great Again:Blue Lives Matter program -- the DOJ's courtroom announcement [PDF] that it will be rewriting (or at least reconsidering) its recent consent decree with the Baltimore Police Department. Accompanying the DOJ's request for a delay in proceedings is a memo [PDF] from Attorney General Jeff Sessions, which spells out the Department's new priorities.

The Department will use its resources to effectively promote a peaceful and lawful society, where the civil rights of all persons are valued and protected. To that end, I expect that all Department components will adhere to and support principles that will advance those two goals, including, but not limited to the following:

The safety and protection of the public is the paramount concern and duty of law enforcement officials.

Law enforcement officers perform uniquely dangerous tasks, and the Department should help promote officer safety, officer morale, and public respect for their work.

In the context of the DOJ's courtroom request for a continuance to examine the consent decree in light of Sessions' new memo, this likely means the DOJ will be looking to serve law enforcement first and the general public second. Note the "uniquely dangerous" phrase, which suggests the DOJ will be cutting officers more slack on force deployment since they're apparently in near-constant "fear for their safety."

Local law enforcement must protect and respect the civil rights of all members of the public.

This is a nice touch, but it's the only thing in there that nods to citizens' rights, rather than simply granting a powerful subset of government employees even more power. That the Baltimore PD consent decree appears to be on the verge of being rolled back indicates -- along with the following bullet point -- Sessions is pulling the DOJ out of the civil rights business completely.

Local control and local accountability are necessary for effective local policing. It is not the responsibility of the federal government to manage non-federal law enforcement agencies.

The misdeeds of individual bad actors should not impugn or undermine the legitimate and honorable work that law enforcement officers and agencies perform in keeping American communities safe.

This is the "bad apple" argument, reduced to a bullet point in Sessions' "Bootlicking Best Practices" memo.

The collection and analysis of timely, reliable statistics on crime and criminals are essential for effective law enforcement strategies.

This suggests we'll only be seeing the FBI's roundup of crime stats from now on. Years after announcing it would do so, the DOJ finally got around to tracking the number of people killed by on-duty police officers. The voluntary system that never worked was replaced with one with a bit more coercion. This appears to be headed for an early retirement.

Recruitment and training of law enforcement officers should focus on making law enforcement a rewarding career, and attracting and retaining well-qualified personnel.

I don't have any argument with this point, other than the fact that, in this context, it means law enforcement pay increases will be uncoupled from increased accountability or transparency. The DOJ is getting out of the oversight business. Presumably any members of its civil rights division that survive culling will be expected to don Go Blue! cheerleading outfits and assist the other federal agencies (DHS, CBP, ICE, etc.) with the compilation of their "dangerous foreigners" lists.

Collaboration between federal and local law enforcement is important, and jurisdictions whose law enforcement agencies accept funding from the Department are expected to adhere to the Department's grant conditions as well as to all federal laws.

It's all wrapped up with an implicit threat of funding cuts and grant denials should local agencies police themselves too harshly or refuse to play along with the feds' increased immigration enforcement efforts.

The Department of Justice is being retooled to protect a single side of the justice equation. We may have a new president, but the old "Dept. of Just Us" jokes will return from their brief hibernation.

Filed Under: civil liberties, civil rights, doj, jeff sessions, police, police brutality

Well, That Was Quick: Twitter Dismisses Lawsuit After Feds Drop Attempt To Unmask Rogue Tweeter

from the quick-flip dept

Yesterday we wrote about Twitter suing the US government after officials at the Department of Homeland Security sought to use a law designed to gather information for figuring out import duties, to unmask the operator of @ALT_uscis, alleging to comment on immigration issues from within the US Citizenship and Immigration Service. Twitter broke out the big guns for that case, as the lead attorney representing it was Seth Waxman, a former Solicitor General in the Clinton administration.

Apparently, the US government realized that it was going to be fairly difficult to make much of a case here and agreed to drop the summons it had issued to Twitter, leading Twitter to dismiss the case:

On April 6, 2017, Twitter filed a Complaint in the above-captioned matter. On April 7, 2017, counsel for Defendants from the Department of Justice contacted counsel for Twitter, to advise that U.S. Customs and Border Protection has withdrawn the summons and that the summons no longer has any force or effect. Because the summons has now been withdrawn, Twitter voluntary dismisses without prejudice all claims against Defendants in the above captioned matter.

There have been some folks who have questioned Twitter's motives in filing this lawsuit, but that seems misguided. Twitter has a long history of going above and beyond most everyone else in the tech industry in fighting back in court attempts by government officials to get info on its users without proper due process.

Filed Under: customs, doj, free speech, homeland security, immigration service, rogue accounts
Companies: twitter

DOJ Memo Shows NSA And White House Lawyers Mainly Unconcerned About Evidence Obligations In Criminal Trials

from the let's-temporarily-sort-of-care-about-something dept

Charlie Savage of the New York Times has obtained another document detailing the internal guidelines of the NSA's STELLAR WIND program as a result of the NYT's long-running FOIA lawsuit against the government. The new document is a memo from the Department of Justice, which details its lawyers' attempts to suss out the government's obligation to defendants when it comes to evidence derived from classified surveillance programs.

As Savage points out in his post, much of the NSA program's inner workings (and abuses) have been detailed in previously-released documents, including an Inspector General's report obtained by the Times in 2015. That doesn't make this document [PDF] unworthy of a read, however. It doesn't provide more detail on the program or its apparent abuse, but it does make it clear the government didn't seem too concerned about potential due process violations arising from the obscuring of surveillance-derived evidence.

First, the memo points out very few DOJ lawyers and prosecutors have been "read in" to the program, which immediately makes it more difficult to balance adversarial issues in criminal prosecutions where the paper trail leads back to the NSA's warrantless surveillance.

But the OLC (Office of Legal Counsel) doesn't have the right lawyers on staff to make this determination. Then-OLC head John Yoo himself admits (via a quotation in the memo) that "criminal law is not [his] area." To remedy this, the OLC brought in two lawyers from the DOJ's Criminal Division -- Patrick Rowan and Christopher Wray -- to analyze processes and check for adherence to Rule 16 (defendant' communications and statements in the government's possession) and Brady (exculpatory evidence) obligations. But it appears once the two DOJ lawyers were "read in," they were forgotten about.

Wray told the OIG that after his and Rowan's read-in, they "were kind of left on our own." He said that no one directed him or Rowan to continue studying the Rule 16 issues or the government's Brady obligations in connection with international terrorism prosecutions, nor did anyone tell them to develop any judgments or opinions on the subject.

What is clear is that whatever changes were made at the NSA and DOJ were the result of journalism. According to Rowan's statements to the NSA's Inspector General, the NSA was, at best, "generally aware" of its evidence disclosure obligations "prior to the December 2005 disclosure… of the Stellar Wind program in The New York Times."

But the process in place -- and likely the process that continues today with the OLC's blessing -- was to spot cases that might present discovery issues and take steps to hide the origin of that evidence.

Rowan stated that if the NSA located any responsive but classified information, it would be expected to notify senior Justice Department officials with the requisite clearances about the information. Rowan said he was confident that if Brady information were known to the NSA, it would be brought to the attention of the Department and steps would have been taken to dismiss the case or otherwise ensure the program was not disclosed.

If the government wanted both program secrecy and a successful prosecution, the FBI would engage in something that looks an awful lot like parallel construction.

[Rowan] stated that the FBI had "walled off" any evidence it collected from inclusion in criminal cases by tipping out Stellar Wind-derived information under [REDACTED] with a caveat that the information in the tipper was "for lead purposes only." Rowan noted that OIPR [the DOJ's Office of Intelligence Policy and Review] also had in place a scrubbing process to delete program-derived information from FISA applications. Rowan expressed confidence that these mechanisms ensured that no program information was used in international terrorism prosecutions. Finally, Rowan stated that the FBI is "very quick to get FISAs up," thereby minimizing the likelihood that the NSA's Stellar Wind database would be the sole repository of Brady material.

The DOJ lawyers felt evidence issues still remained mostly unaddressed, but the OLC apparently lost interest shortly thereafter. The new head of the OLC discussed some issues with Rowan but told the DOJ "he did not believe the OLC followed up on Rowan's request that it continue researching these issues." Another OLC official said he had seen Rowan's work, but the office apparently decided Yoo's memo (the same Yoo who stated criminal law "wasn't his area") was the final word on the subject. This same official also stated he wasn't aware of any "formal procedures" for handling surveillance-derived evidence arising from the DOJ's examination of the subject.

The other DOJ lawyer "read in" to the program confirmed the OLC official's statement.

Wray also told us there was no organized Departmental effort to establish formal procedures for reviewing international terrorism prosecutions to comply with Rule 16 disclosure requests and Brady obligations. He said "the thinking was" that the Rowan memorandum was the "first step" toward devising "some kind of systematized process" for such reviews. However, we found no indication that OLC followed up on Rowan's request to further study these discovery issues with any kind of written product.

So, the answer on prosecution evidence obligations comes from a guy who knows little about criminal law. On the plus side (haha), he's a strong proponent of making all rights and liberties subservient to national security concerns. The FBI does its part to protect NSA surveillance programs by erecting parallel evidence gathering, which means defendants might actually be able to see the evidence used against them, but be unable to challenge the constitutionality of the original collection. This all works out very well for the government, which somehow managed to slack its way into a playing field tilted towards the prosecution despite having one of its flagship surveillance programs splashed all over the pages of the New York Times. Remind me again how leaks damage the government's ability to pursue investigations and prosecutions?

Filed Under: christopher wray, discovery, doj, evidence, john yoo, nsa, olc, patrick rowan, stellar wind, surveillance

DOJ Refuses FOIA Request On Emails, Claiming 'Personal Privacy'

from the that's...-not-how-this-works dept

We've talked in the past about how government FOIA officers seem to really love exemption b(5) which covers "inter-agency or intra-agency memorandum or letters which would not be available by law to a party other than an agency in litigation with the agency." But, in my experience, I've seen a ton of the next exemption: the b(6) exemption, often called the "privacy exemption." Officially, the law (5 USC 552(b)(6)), says only that "personnel and medical files and similar files the disclosure of which would constitute a clearly unwarranted invasion of personal privacy."

That seems like a perfectly reasonable exemption. Even if it is part of a government discussion, we don't want the government revealing medical files or something of a similar nature. But, over the years, this has gotten abused in weird ways, such as the time a FOIA officer used b(6) to redact Beyonce's name in a FOIA request about Beyonce. Really.

However, now I think we've seen the b(6) exemption to end all b(6) exemptions. This came to investigative reporter David Sirota, who filed a FOIA request to find out about emails between Makan Delrahim and employees of the DOJ's antitrust division. This is potentially useful info, because Delrahim was just nominated to head that very division. But, more importantly, Delrahim has been a powerful lobbyist for Anthem who tried to help it get its merger with Cigna approved -- an effort that just recently failed in court, but may have another chance with Delrahim in a position of power.

Thus, Sirota made a fairly standard FOIA request for communications between Delrahim and the DOJ's antitrust division during the time that he was working as a lobbyist for Anthem. And, stunningly, the DOJ came back with a Glomar response (you know, the infamous "we can neither confirm nor deny...."), pointing to b(6) as the reason why (along with b(7)(C) which is for records that "could reasonably be expected to constitute an unwarranted invasion of personal privacy" -- kind of a repeat of b(6), really).

If you can't read that, the key paragraph notes:

Please be advised that we can neither confirm nor deny the existence of records responsive to your request. If records did exist, acknowledging communications between Antitrust Division employees and private individuals without their consent would constitute a clearly unwarranted invasion of personal privacy, and could reasonably be expected to constitute an unwarranted invasion of their personal privacy. Such information is, accordingly, exempt from public discourse in accordance with 5 U.S.C. §§(b)(6) and (7)(C)

This is... wrong. That's not even remotely close to how those exemptions work. Tons of FOIA requests to the government regularly turn up emails from private individuals. To say that merely confirming or denying the existence of such records would violate privacy under FOIA is laughable.

The FOIA glomar rejection letter is signed by Sue Ann Slates, who is the chief of the FOIA unit at the DOJ's antitrust division, and has been for years. But it literally took me less than 5 minutes to find an example of Slates signing off on FOIA responses that include tons of personal emails from private individuals. Notice, that one (more properly) notes that some portions of the emails may be redacted under (b)(6), but certainly not any admission that such emails exist. Hell, within that very FOIA response, there's this:

That's an email header revealing a bunch of emails, both of government officials and private individuals. Such revelations in FOIA responses are quite common. Revealing the simple fact that Delrahim -- as a lobbyist working on antirust issues -- might have emailed the DOJ's antitrust division (where he also used to work) is in no way the kind of "privacy violation" that is intended under FOIA's exemptions against revealing "personnel and medical files."

I don't know if Sirota is intending to appeal or file a lawsuit over this, but it feels like, once again, we have FOIA officials abusing their power to avoid responding to legitimate FOIA requests and hiding behind incredibly expansive interpretations of FOIA exemptions.

Filed Under: antitrust, david sirota, doj, foia, foia b(5), foia b(6), makan delrahim, privacy, sue ann slates

FBI Arrests Creator Of Remote Access Tool, Rather Than Those Abusing It To Commit Crime

from the nice-work,-g-men! dept

The DOJ is attempting to prosecute the creator of a remote access software -- not because he used it for nefarious purposes -- but because it can (and has been) used by criminals. Kevin Poulsen has the whole bizarre story at The Daily Beast -- one that involves a 26-year-old programmer and the remote administration tool (RAT) he created and sold.

Taylor Huddleston, creator of NanoCore, a RAT that has been linked to intrusions in ten countries, had his home raided by FBI agents on December 6th. The 14-page indictment paints Huddleston as a willing accomplice -- someone who sold his product to bad people to do bad things.

But the facts of the case -- things that can be proven with forum chat logs and Huddleston's proactive efforts to prevent his RAT from being abused -- disagree with the government's narrative. NanoCore does all the things an administrative tool is expected to do, including keylogging and granting control to remote administrators. But Huddleston claims he created the tool to be a low-cost solution for cash-strapped businesses and small government agencies. His actions appear to back up the claims that he never intended this to be a plaything for criminal hackers.

While Huddleston did debut and offer his product for sale at HackForums -- hardly the best marketplace if one wants to be seen as purely innocent -- he took corrective actions and issued strict warnings about illegal deployment.

[H]uddleston found himself routinely admonishing people not to use his software for crime. “NanoCore does not permit illegal use,” he wrote in one post. In another, “NanoCore is NOT malware. It is intended to be used legitimately and I don’t want to see words like ‘slave’ and ‘infect.’” Huddleston backed his words with action. Whenever he saw evidence that a particular buyer was using the product to hack, he’d log in to Net Seal and disable that user’s copy, cutting the hacker off from his infected slaves.

Net Seal is another of Huddleston's creations. It allows users to protect their IP by allowing them to shut down questionable copies of their software -- like copies purchased with stolen credit cards. Oddly enough, this IP protection tool is also named in the indictment as more evidence of Huddleston's criminal intent.

“Net Seal licensing software is licensing software for cybercriminals,” the indictment declares. For this surprising charge—remember, Huddleston use the licenses to fight crooks and pirates—the government leans on the conviction of a Virginia college student named Zachary Shames, who pleaded guilty in January to selling hackers a keystroke logging program called Limitless. Unlike Huddleston, Shames embraced malicious use of his code. And he used Net Seal to protect and distribute it.

That ridiculous claim shows how far the government is willing to go to pin the bad deeds of criminals it can't catch on the creator of the software they're abusing. But the government has to show Huddleston created the software with the intent that it be used for criminal activity. That's going to be extremely tough to prove. So, it looks like the government's hoping to turn Huddleston into a cooperative witness or pressure him into a plea deal that will prevent it from having to climb this evidentiary mountain.

One of the tools at the government's disposal is particularly nefarious. Huddleston wrote and sold software to get his head above water financially. The small amount of money he made from selling Net Seal and NanoCore (he fully divested his ownership of the latter late last year for a whole $5,000) allowed him to purchase a very modest $60,000 house for him and his girlfriend. The government wants to seize the house, claiming it was purchased with the proceeds of illegal activity. But it has yet to prove the sale of these two tools was a criminal act in and of itself. The horrible thing about forfeiture is the government can uncouple this from the prosecution and file an administrative claim which would place Huddleston's new home in its hands and shift the burden of proof to the indicted programmer.

The only way this case doesn't blow up in the government's face is if it can convince Huddleston not to go to trial. This placement of secondhand guilt on the creator of a remote administration tool is idiotic and disingenuous. No one's going after Microsoft for building the same functionality into its operating system, even though it's routinely abused by criminals and scam artists.

What this really boils down to is law enforcement laziness, which it commonly refers to as "efficiency." It's incredibly easy to find the creator of software abused by criminals because a creator who doesn't feel he's committed any criminal act isn't going to do much of anything to cover his tracks or get off the grid. It's punishment that only makes sense to misguided prosecutors and FBI officials who feel any successful bust is a good bust. And if they do succeed in putting Huddleston in prison, absolutely no one will be vindicated.

In the meantime, Huddleston has to fight back with his hands tied. He was released on bond but forbidden to use the internet. His arraignment takes place in a city 16 hours from where he lives. His recently-purchased home may not be his for much longer. And all the criminals misusing his product -- the ones he actively fought back against -- are still out there committing criminal acts.

Filed Under: doj, fbi, liability, nanocore, net seal, rat, remote access, secondary liability, taylor huddleston

University Puts 20,000 Lectures Behind A Registration Wall In Response To DOJ Pressure On Website Accessibility Compliance

from the nobody-wins dept

Back in 2012, a federal court ruled US websites were "places of public accommodation." The ruling (overturned on appeal) came in a lawsuit brought against Netflix by the National Association of the Deaf. It seems like an obvious conclusion -- more people get their information, news, and entertainment from the web than other sources. But the ruling had plenty of adverse consequences, especially for smaller, less profitable purveyors of online content.

Professor Eric Goldman -- who analyzes a ton of internet-related lawsuits -- had this to say at the time:

If websites must comply with the ADA, all hell will break loose. Could YouTube be obligated to close-caption videos on the site? (This case seems to leave that door open.) Could every website using Flash have to redesign their sites for browsers that read the screen? I'm not creative enough to think of all the implications, but I can assure you that ADA plaintiffs' lawyers will have a long checklist of items worth suing over. Big companies may be able to afford the compliance and litigation costs, but the entry costs for new market participants could easily reach prohibitive levels.

The payoff of this lawsuit -- along with the federal government's requirements for making websites "accessible" -- is finally here. A California university is placing 20,000 audio and video lectures behind a registration wall, making them less accessible to everybody, rather than risk being sued for not making them "accessible" to those with disabilities.

The University of California, Berkeley, will cut off public access to tens of thousands of video lectures and podcasts in response to a U.S. Justice Department order that it make the educational content accessible to people with disabilities.

Today, the content is available to the public on YouTube, iTunes U and the university’s webcast.berkeley site. On March 15, the university will begin removing the more than 20,000 audio and video files from those platforms -- a process that will take three to five months -- and require users sign in with University of California credentials to view or listen to them.

This move has more to do with the DOJ's ADA* accessibility stance, although that stance roughly aligns with the court's 2012 findings. The DOJ is named specifically in the university's statements as being the impetus for it locking up its past content. Future releases will be issued with an eye on compliance, but past lectures are gone for good unless you happen to have the right credentials to view them.

*[This acutally stems from the FCC, not the ADA. Nate Hoffelder has more details in the comments. UPDATE: never mind.]

Then there's this part of the university's statement, which hints it may not all be related to accessibility-compliance.

Finally, moving our content behind authentication allows us to better protect instructor intellectual property from ‘pirates’ who have reused content for personal profit without consent.

I'm not sure how much of a problem Berkeley has had with content piracy. This statement could mean it's rampant or could simply mean it's something the university's lawyers have mentioned in passing as a concern. Either way, the move is related to control. What the public can't see, it can't complain about. And that keeps the DOJ at bay, even if it does little for the general public.

However, the piracy part of the statement might become relevant in the near future. It also shows the university's spokesperson isn't aware most of the lectures can't be "pirated." LBRY.io has already mirrored the 20,000 files due for removal, and it notes its move is compliant with the terms governing the sharing and distribution of the recorded lectures.

The vast majority of the lectures are licensed under a Creative Commons license that allows attributed, non-commercial redistribution. The price for this content has been set to free and all LBRY metadata attributes it to UC Berkeley.

The university may have a point about "personal profit," but simply hosting lectures at a site that sells stuff or makes money from ads isn't the same thing as "reusing content for personal profit." And the license the university uses doesn't require permission beforehand.

In the end, what we have is another regulation failure, where best laid plans become self-sabotaging debacles. Attempting to make the web universally-usable is an impossibility. No one's going out of their way to cut the deaf or blind out of the international conversation, but demanding all US sites be compliant with the DOJ's requirements is like demanding all books be made available in Braille and audio format. It's something only a few publishers can afford to do. Even fewer can afford to engage in a legal battle with the federal government over a lack of compliance, which means increased enforcement efforts will only result in less available content. That does nothing to level the playing field for Americans with disabilities.

Filed Under: ada, compliance, doj, websites
Companies: uc berkeley

Just Prior To Hearing Over NSL Gag Orders, Court Allows Cloudflare & CREDO Mobile To Be Named As Plaintiffs

from the about-time dept

In December, we wrote about how (thanks to EFF's lawyering) mobile phone provider CREDO Mobile was finally (after many years) allowed to reveal the National Security Letter (NSL) it had received from the DOJ back in 2013. As per usual, the NSL had a complete gag order, barring the company from admitting it had received such a letter. Then, just about a month later, Cloudflare was similarly ungagged over an NSL it had received in 2013 as well.

On Wednesday, EFF will be back in the 9th Circuit appeals court arguing that these NSLs are First Amendment violations, but for the first time, it can actually name those two companies as its clients. Even though those NSLs were finally allowed to become public in the last few months, the case itself still did not include their names, until Monday, when the court was told by the DOJ, that since the FBI had concluded the various investigations, and because it had enabled each of the companies to reveal those specific NSLs they had received, that it no longer required the plaintiffs' names in the case to be sealed. Of course, we don't know how many other NSLs are still gagged (possibly even with these two companies). Indeed, the EFF's announcement certainly hints at more:

On Wednesday, EFF Staff Attorney Andrew Crocker will tell the United States Court of Appeals for the Ninth Circuit that these gags are unconstitutional restrictions on CREDO and Cloudflare’s free speech and that the FBI’s belated decision to lift some of the gags only underscores why judicial oversight is needed in every case. The gag orders barred these companies from participating in discussion and debate about government use of NSLs—even as Congress was debating changes to the NSL statute in 2015.

Hopefully, the appeals court recognizes the serious First Amendment issues at play here.

Filed Under: doj, fbi, first amendment, free speech, gag order, national security letters, nsl, nsls
Companies: cloudflare, credo mobile, eff