Documents Show FBI Impersonated Newspaper's Website To Deliver Spyware To Suspect's Computer

from the a-free-(and-exploitable)-press dept

Spend enough time staring at redacted documents liberated from secretive government agencies and you're bound to miss a thing or two on the first pass. Chris Soghoian, technologist for the ACLU was browsing through some FBI documents [pdf link] obtained by the EFF and came across this:

In 2007, FBI sent malware via a link intended to look like a Seattle Times/AP story. https://t.co/Se9f0NXGd1 at pages 61-62. — Christopher Soghoian (@csoghoian) October 27, 2014

In 2007, FBI sent malware via a link intended to look like a Seattle Times/AP story. https://www.eff.org/document/fbicipav-08pdf … at pages 61-62.

The documents date back to 2008 and were obtained by the EFF in 2011. What Soghoian caught fills in the blanks in this story from 2007.

FBI agents trying to track the source of e-mailed bomb threats against a Washington high school last month sent the suspect a secret surveillance program designed to surreptitiously monitor him and report back to a government server, according to an FBI affidavit obtained by Wired News...

The software was sent to the owner of an anonymous MySpace profile linked to bomb threats against Timberline High School near Seattle. The code led the FBI to 15-year-old Josh Glazebrook, a student at the school, who on Monday pleaded guilty to making bomb threats, identity theft and felony harassment.

The court documents didn't detail how the FBI managed to install the weaponized payload on Glazebook's computer. The emails obtained by the EFF, however, expose the electronic paper trail.

The CIPAV (Computer and Internet Protocol Address Verifier) made its way to Glazebrook's system via a Myspace message sent by the FBI… which was impersonating the Seattle Times.



Is this really what we want our investigative agencies to be doing in the name of public safety? Soghoian says no.

"The ends don't justify the means. I'm not saying that the FBI shouldn't be investigating people who threaten to bomb schools. But impersonating the media is a really dangerous line to cross."

The Seattle Times isn't too happy, either. Editor Kathy Best says the paper is now "seeking answers" from the FBI. Best's full statement on behalf of the Times is short, but deeply critical of the agency's actions.

We, like you, just learned of this and are seeking answers ourselves from the FBI and the U.S. Attorney’s office.

But we are outraged that the FBI misappropriated the name of The Seattle Times to secretly install spyware on the computer of a crime suspect. Not only does that cross the line, it erases it.

Our reputation—and our ability to do our job as a government watchdog—is based on trust. And nothing is more fundamental to that trust than our independence from law enforcement, from government, from corporations and from all other special interests. The FBI’s actions, taken without our knowledge, traded on our reputation and put it at peril.

The FBI has already responded (somewhat) to Best's statement, deploying the usual deferrals to public safety and agency investigatory procedures.

“Every effort we made in this investigation had the goal of preventing a tragic event like what happened at Marysville and Seattle Pacific University. We identified a specific subject of an investigation and used a technique that we deemed would be effective in preventing a possible act of violence in a school setting. Use of that type of technique happens in very rare circumstances and only when there is sufficient reason to believe it could be successful in resolving a threat. We were fortunate that information provided by the public gave us the opportunity to step in to a potentially dangerous situation before it was too late.”

TL; DR: The public should be counting its blessings rather than examining our questionable methods.

Taken at face value, Special Agent Frank Montoya Jr. is basically saying that the FBI will abuse its power (and the reputations of others) whenever it determines such methods to be necessary to achieve its goals. Not really a comforting idea at all, and one that basically confirms Soghoian's suspicions: the ends will be used to justify the means, no matter how potentially damaging the means are.

Filed Under: bomb threat, fbi, impersonation, investigations, journmalism, malware

Misheard Will Smith Lyrics Results In Arrest Of Student And District-Wide Lockdown

from the i'd-say-everyone's-familiar-with-this-song,-but... dept

So, it's come to this: the heightened paranoia surrounding all things kid- and school-related, post-Newtown (but also post- other school shootings as well) has managed to turn nearly everything into a potential menace. It's one thing to be cautious and alert for warning signs or veiled threats. It's quite another to turn a recorded rendition of the "Fresh Prince of Bel-Air" theme into a police matter.

Here's how this bit of insanity went down, as delivered by Gideon of A Public Defender. (You may remember Gideon as the Twitterer whose curiosity about a certain unenforceable statement kicked off the Teri Buhl fiasco.):

First, from the increasingly stupid United States of America, a story of how a teen’s life got flip-turned upside down. You see, he was just on the playground where he spent most of his days, minding his own business. You know, chilling out, maxing, relaxing all cool and sometimes with this friends he liked to be shooting some b-ball outside of the school.

WAIT. DID HE JUST SAY SHOOT AND SCHOOL IN THE SAME SENTENCE? ARREST HIM! Once you’re done laughing, know that that’s exactly what happened to 19-year old Travis Clawson because a doctor’s office called his voicemail to confirm an appointment, heard the above line, thought he was shooting people outside the school and called cops. Who arrested him first, then spent the 20 seconds it takes to realize it’s the theme song from Fresh Prince of Bel-Air. No word on whether Carlton showed up to dance and everyone laughed at him.

A few things to note:

1. This was the teen's voicemail greeting. It wasn't as if he was calling the school and making threats. It's highly doubtful that criminals (or aspiring criminals) are leaving records of their future exploits as voicemail greetings. Gideon doesn't seem convinced this is a thing.

Also: is this a thing now? People leave notes of their criminal intent as voicemail messages? "Hi, you've reached my cellphone. I'm unavailable right now because I'm robbing that Stop-n-Go on Orchard and Willard. Leave me a message and I'll get back to you when I get out in 5-20 years because I'm stupid enough to leave --- BEEP."

2. The police arrested the student for something that took likely less than a minute to explain. Couldn't this have been handled with a little in-person questioning, rather than escalating the situation immediately by arresting first, questioning second? I understand that the word "b-ball" could possibly be misheard as "people" and the receptionist probably did the right thing by notifying law enforcement, but it still seems as though this could all have been sorted out in a five minute discussion.

3. This isn't noted in Gideon's commentary, but the police had the teen's school (along with the rest of the district) go into lockdown mode while they searched for the Will Smith-quoting "gunman." From there, it gets even more ridiculous:

The call to 911 forced the entire district into lockdown for about 30 minutes and police said they detained the 19-year-old student for three hours while searching his locker, before determining that it was all one big misunderstanding.

Never mind what I said about point 2. I know it's often said that we should "err on the side of caution," but, seriously, three hours to "search a locker?" Obviously, no one bothered asking the teen anything about the message until they ran about 2:50 off the clock.

Officer Mike Natale says, "[The teen] was afraid and embarrassed." No kidding. I would imagine more of the first than the second. Three hours being detained by police while under lockdown and not being given any hint as to what started the whole debacle would make anyone, possibly even an actual criminal, "afraid."

In wxpi.com's story, the police officer states that the teen "had learned from his mistake" (towards the end of the video). Really? What mistake? There are plenty of mistakes in this story, but a teen recording one of the most well-known TV theme songs as an outgoing voicemail message isn't one of them.

Filed Under: arrest, bomb threat, fresh prince, lockdown, lyrics, shooting threat, will smith

Do We Really Want To Criminalize Bad Jokes?

from the careful-what-you-get dept

Back in January, we wrote about the story of a guy in the UK who was arrested and banned from his local airport after making a (bad) joke on Twitter about blowing the place up. His tweet was:

"Robin Hood airport is closed. You've got a week and a bit to get your shit together, otherwise I'm blowing the airport sky high!!"

As we said at the time, it was a really dumb statement, and I have no problem with police checking it out, but once they realized it was just a dumb joke, it seems reasonable to leave the guy alone. However, some more details are now coming to light that make the story even more questionable, and raise some issues that could impact pretty much anyone who makes a bad joke on Twitter, should someone in power want to cause them serious trouble.

Andrew sent over a few more articles about the story, that highlight that the guy wasn't actually charged for making a fake bomb threat. There actually is a law for that... but the authorities didn't charge him with that because they knew that his joke would never actually be seen as a bomb threat. Charging him under that law would require evidence that he intended to make people actually think he was intending to blow the airport up -- but no reasonable person would think that.

Instead, it appears that the police used a little-known part of the UK's Communications Act that outlaws sending a "message that was grossly offensive or of an indecent, obscene or menacing character." Sound broad enough? Yeah. Suddenly, you realize he wasn't charged with making a bomb threat. He was charged with making a bad joke, that someone misinterpreted as being "menacing." The link above to TheLawyer.com goes through all this in great detail, including a pretty scary discussion with the officials who decided which law to charge the guy with, where they basically dance around the issue, even though it's pointed out to them that they're clearly stretching the meaning of that particular law well beyond what it's supposed to cover, while ignoring the actual law concerning bomb threats.

No matter, it appears that the guy has now been officially found guilty and fined £385 plus £600 costs (though, Stephen Fry has offered to pay). The fine isn't huge, but the guy now has a criminal conviction on his record for making a bad joke (not for making a bomb threat). That doesn't seem reasonable no matter how you look at it.

Filed Under: bomb threat, communications, criminal, uk