Texas Grand Jury Indicts Netflix For 'Lewd Exhibition' Of Children In Its Movie 'Cuties'

from the child-beauty-pageants-expected-to-remain-unaffected dept

It seems impossible that 2020 could get any stupider. But here we are, watching in bemusement as a showboating prosecutor talks a grand jury in a tiny Texas county into indicting an online streaming service for… let's check the record… "promotion of lewd visual material depicting child."

Here's "liberty loving conservative" (and state rep) Matt Schaefer's tweet, which contains a snapshot of the indictment.

Here's what the tweet says above the indictment photo:

Netflix, Inc. indicted by grand jury in Tyler Co., Tx for promoting material in Cuties film which depicts lewd exhibition of pubic area of a clothed or partially clothed child who was younger than 18 yrs of age which appeals to the prurient interest in sex

Go ahead and jump to the replies if you enjoy watching a bunch of people who don't understand the First Amendment or state law cheer on this showy act of futility.

The indictment [PDF] states that Netflix broke the law by distributing the film "Cuties" via its streaming service. Jurisdiction is presumably proper because even Tyler County residents can subscribe to the service. If you're not familiar with "Cuties," it's a coming-of-age film dealing with a Sengalese preteen who begins to emulate the sexualization of other females while growing up as a Muslim in Paris, France. It won awards at the Sundance Film Festival and flew under the radar until Netflix began its promotion of the film, which centered on the more questionable depictions of underage girls engaging in hyper-sexualized behavior.

All hell broke loose for a few weeks last month. Calls to boycott Netflix filled social media services and a number of US politicians decided this was the thing they should be spending their time on as thousands died from COVID, businesses closed forever and unemployment remained high.

Here's just some of the legislative-level furor that followed Netflix's release of the film.

Senator Bob Hall (R-Canton) swore to file a bill that would outlaw pedophilia in the state constitution, Texas Attorney General Ken Paxton joined two other state attorney generals in a letter asking Netflix to remove the film, and U.S. Senator Ted Cruz (R-TX) asked U.S. Attorney General William Barr to investigate the company for “the filming of minors engaging in sexually explicit conduct.” State Rep. James White (R-Tyler) likewise wrote Paxton asking for an investigation into the film.

Now that we're all caught up, let's look at the indictment and see if we can find the fatal flaw:

"Knowingly promote[d] visual material which depicts the lewd exhibition of the genitals or pubic area of a clothed or partially clothed child who was younger than 18 years of age at the time the visual material was created, which appeals to the prurient interest in sex, and has no serious literary, artistic, political, or scientific value…"

Anyone can get an indictment. This much is known about grand juries. But securing a conviction is going to be a hell of a lot more difficult. The prosecutor is going to have to convince a judge (and possibly a jury) that a film that won awards at an international film festival contains no "serious literary or artistic value." That's even harder to argue under the Miller test erected by the Supreme Court, which says the work as a whole has to be considered in terms of artistic merits, not just the cringier parts that prompted backlash all over the internet. That should be enough to nullify the criminal case Tyler County DA Lucas Babin is bringing against Netflix.

There's some pandering going on here, but it originates in the prosecutor's office. This will score points with the kind of people willing to award points for performative wastes of public funds. No one else will be affected. "Cuties" will enjoy another few days of internet infamy, along with its US distributor. But no one's going to jail because Netflix distributed this movie, no matter how much one prosecutor wants it to happen.

Filed Under: cuties, documentary, indictment, moral panic, texas
Companies: netflix

New Indictment Tries To Tie Julian Assange To A Hacking He Had Nothing To Do With

from the several-versions-of-truth-and-this-one-is-the-DOJ's dept

The government is still trying to get Julian Assange out of the UK so it can ring him up on a variety of charges related to obtaining and publishing a large number of sensitive documents. Most of the charges are still related to the documents obtained from Chelsea Manning. The DOJ wants to use the oft-abused CFAA to put Assange behind bars because he supposedly helped Manning hack a CIA database.

Another indictment [PDF] has been issued by the DOJ, making this its third attempt to throw the book at Assange. If the DOJ can prove Assange contributed to hacking attempts, it may end up with a case worth pursuing. But much of what the indictments deal with is normal journalism behavior: the cultivation of sources and the encouragement of sources to locate/leak newsworthy documents. The blurry line the DOJ is walking on is the same line the previous administration seemed to feel wasn't worth crossing, no matter how much harm/embarrassment Assange had caused with the release of sensitive documents.

The latest indictment expands the government's espionage theories. The government's second superseding indictment deals with Assange's alleged "unlawful overt acts:" the hacking attempts supposedly made targeting Defense Department computers, possibly with the aid of Chelsea Manning and other Wikileaks associates.

Much of this expanded narrative seems to rely on the input of FBI informants, including Sigurdur Thordarson, who was convicted twice for sex with minors after he began working for the FBI in 2011. Sketchy contributors aside, there are some major omissions in the government's narrative.

First, as Dell Cameron points out for Gizmodo, the indictment casually ignores the government's contribution to cyber attacks on American businesses located overseas, as well as some foreign government targets. But there is a significant omission in the new indictment. And the purpose of this crucial admission appears to be an attempt to link Assange to a data breach he never participated in.

A section of the indictment titled “Sabu, Hammond, and ASSANGE” begins on the date December 25, 2011, and refers to an attack on servers belonging to a private firm identified only as “Intelligence Consulting Company.” This is obviously Stratfor, the Austin-based private intelligence company whose millions of pilfered emails comprise the WikiLeaks drop known as the Global Intelligence Files.

DOJ omits several crucial details about the Stratfor hack in its attempts to name Assange as a conspirator in a breach that happened without his knowledge. Most notably, prosecutors exclude that the actual breach of Stratfor’s security, in late 2011, occurred 83 days prior to the events they describe, unknownst by anyone DOJ identifies as part of the conspiracy, including Assange.

Assange and Wikileaks may have helped distribute the documents obtained in the breach and there does appear to be evidence Assange provided the hackers with some tools for searching the stash of five million emails, but there's nothing in the indictment that ties Assange to the underlying hacking. The only thing in the indictment is stuff the DOJ is generously calling "evidence."

At best, these are copies of exchanges taken from chat rooms in which a user claims to be Assange, which is not likely to hold up in court.

To be sure, indictments are often a pile of helpful omissions designed to speedily initiate prosecutions. But the more the government adds to its accusations, the more glaring its omissions become. This case was already problematic -- willing to walk right up to the First Amendment and dare it to do something about it. Now it's become more farcical, with the government accusing someone of doing something it appears clear they didn't do and bolstering it with half-truths about the FBI's own involvement in malicious hacking efforts.

Filed Under: cfaa, doj, extradition, hacking, indictment, julian assange, leaks
Companies: stratfor, wikileaks

DOJ Moving Ahead With Its Attempt To Prosecute Julian Assange; Subpoenas Chelsea Manning

from the all-the-bad-precedent-it-can-get dept

The DOJ is still moving ahead with its plan to attack free speech protections. More than eight years in the making, the attempted prosecution of Julian Assange for publishing leaked documents forges ahead slowly, threatening every journalist in its path.

Wikileaks isn't the only entity to publish leaked documents or shield their source. Multiple US press entities have done the same thing over the years. It seems the DOJ feels it's ok to go after Assange and Wikileaks because it's not a US newspaper. But once you set foot on a slope this slippery, it's pretty tough to regain your footing -- especially when the Executive Branch has housed people hellbent on eliminating leakers and whistleblowers for most of the last 20 years.

It appears the government wants Chelsea Manning to testify about her relationship with Wikileaks and Julian Assange. The demand Manning received may be deliberately vague, but it's pretty easy to connect the dots, as Charlie Savage does for the New York Times.

The subpoena does not say what prosecutors intend to ask her about. But it was issued in the Eastern District of Virginia and comes after prosecutors inadvertently disclosed in November that Julian Assange, the founder of WikiLeaks, has been charged under seal in that district.

Ms. Manning, who provided a copy of the subpoena to The New York Times, said that her legal team would file a motion on Friday to quash it, arguing that it would violate her constitutional rights to force her to appear. She declined to say whether she would cooperate if that failed.

It would seem like Manning already cooperated when she was being prosecuted. During that hearing, she took full responsibility for her actions and stated Wikileaks/Assange did not direct her actions. But if the DOJ can't get Manning to talk, it apparently has other options.

A former WikiLeaks volunteer who was also personal friends with Manning was subpoenaed last May. But unlike Manning, he did not fight the subpoena. He accepted an immunity deal offered by prosecutors.

It’s the second person in Assange’s broader orbit publicly known to have cooperated with prosecutors in their nearly decade-long pursuit of WikiLeaks.

The former volunteer is David House. House has been subpoenaed twice, according to The Daily Beast's Kevin Poulsen. House was uncooperative with the first, but far more accommodating the second time around, after being granted immunity for testifying.

House spoke briefly with prosecutors and then testified for about 90 minutes in front of the grand jury, he said. “They wanted to know about my meetings with Assange, they wanted to know broadly about what we talked about,” he recalled. Prosecutors seemed particularly interested in the potential for collateral damage in some of Assange’s leaks.

If the DOJ is really going to re-litigate the harms of Manning's leaks, it might want to refresh its memory about the damage they did. A classified Defense Department report said the leaked docs did no serious damage to personnel or American interests. This reiterated findings by the US military dating all the way back to 2013 which said the same thing: no Americans were harmed or killed as a result of the leaks. Unfortunately, the reality we're faced with is this: the DOJ is threatening First Amendment protections over some hurt feelings and embarrassment.

Filed Under: chelsea manning, david house, doj, indictment, journalism, julian assange, leaks, subpoenas
Companies: wikileaks

DOJ Stacks Charges On MalwareTech, Including Stuff Put Out Of Reach By The Statute Of Limitations

from the 'lying-to-feds'-bingo-card-complete dept

The government's case against Marcus Hutchins, aka MalwareTech, isn't getting any stronger. After detaining him at a Las Vegas airport following some post-conference partying, the FBI decided to hit the guy who inadvertently shut down WannaCry with charges for allegedly creating the Kronos malware. In essence, the case is about criminalizing security research, and the government's indictment decided to hang Hutchins out to dry while allowing the people who actually sold the malware to remain unarrested and unindicted.

The charges were weak and the government appeared to know it. Deployment of malware to cause damage and wreak havoc is one thing, but creating malware -- something lots of security researchers do -- isn't a criminal activity in and of itself. Thrown into the mix were wiretap charges based on the very thin premise that the malware was used to intercept communications.

Hutchins' defense team pushed back, forcing the government to actually show its work. A discovery request intended to show Hutchins was drunk and tired when he was "interviewed" by the FBI was rebuffed by the government. It also appears -- using the FBI's own testimony and recordings -- that Hutchins was never properly Mirandized.

Between them, the agents described how they flew out to Vegas the night before the arrest. Surveilling agents tracked Hutchins as he went to the airport and got through TSA then sat down at a first class lounge. As soon as Hutchins ordered a drink that turned out to be Coke but that the agents worried might be booze, Chartier, wearing business casual civvies, and two CBP agents wearing official jackets pulled Hutchins away from the lounge, placed him under arrest and cuffed him in a stairwell inside the secure area, and walked him to a CBP interview room, where Chartier and Butcher Mirandized him, then interrogated him for 90 to 100 minutes.

Even in telling that story, Chartier and Butcher’s stories conflicted in ways that are significant for determining when Hutchins was Mirandized. He said it took “seconds” to get into the stairwell and then to the interview room. She noted that the “Airport is rather large. Would have taken awhile.” to walk from place to place (it was 36 minutes between the time Hutchins cleared TSA, walked to the lounge, ordered a Coke, and the time Chartier first approached Hutchins). There seems to be a discrepancy on how many CBP agents were where when (that is, whether one or two accompanied Chartier and Hutchins all the way to to the interrogation room). Those discrepancies remained in spite of the fact that, as Butcher admitted, they had spoken, “Generally, about the interview, and Miranda, and making sure that we were on, that our facts were the same.”

Chartier described that the CBP recording equipment in the room “wasn’t functional that day,” which is why they relied on Butcher pressing a record button herself, which she didn’t do until (she said) Chartier started asking “substantive” questions, but after the Miranda warning.

With all of this going on, and the government's charges relying on some very generous interpretations of the CFAA and wiretap laws, the feds appear unable to close this case successfully. Prosecutors were unable to get Hutchins to agree to a plea deal with their first try, so they're going to take another crack at it. A superseding indictment [PDF] has been entered by the government and, as Marcy Wheeler explains, it's even worse than the extremely shaky one it's replacing.

[T]he government, which refuses to cut its losses on its own prosecutorial misjudgments, just doubled down with a 10-count superseding indictment. Effectively, the superseding creates new counts, first of all, by charging Hutchins for stuff that 1) is outside a five year statute of limitations and 2) he did when he was a minor (that is, stuff that shouldn’t be legally charged at all), and then adding a wire fraud conspiracy and false statements charge to try to bypass all the defects in the original indictment.

The government has added another piece of malware to its indictment -- UPAS Kit -- and is attempting to tie it to Hutchins. Even if it's able to do this, it likely won't help the government secure a conviction for two reasons. First, if the date is accurate, it means Hutchins was still a minor when this alleged crime took place. Second, the government has only five years to prosecute and the July 2012 date stated in the indictment means the statute of limitations has tolled.

There's far more to it than that. Wheeler's post detailing everything wrong with the superseding indictment is a masterpiece deconstruction of government desperation. The indictment wants jurors to believe simply writing about malware is a criminal act, even when the post cited actually details how to thwart malware. And it now includes an old DOJ favorite: making false statements to the FBI.

This last one might cause more problems for the FBI than it will solve. This will rely on statements made during the interrogation of Hutchins -- one that's already been marred by conflicting testimony by FBI agents.

First of all, as I’ve noted, one agent Hutchins allegedly lied to had repeatedly tweaked his Miranda form, without noting that she did that well after he signed the form. The other one appears to have claimed on the stand that he explained to Hutchins what he had been charged with, when the transcript of Hutchins’ interrogation shows the very same agent admitting he hadn’t explained that until an hour later.

So the government is planning on putting one or two FBI agents who have both made inaccurate statements — arguably even lied — to try to put Hutchins in a cage for lying. And they’re claiming that they were “conducting an investigation related to Kronos,” which is 1) what they didn’t tell Hutchins until over an hour after his interview started and 2) what they had already charged him for by the time of the interview.

The best case scenario, as Wheeler explains, in the government tying the 2012 (past the statute of limitations) criminal act to some "marketing" of the malware in 2014, allowing it to salvage all these charges.

In other words, they’re accusing Hutchins of wiretapping and CFAA crimes because someone else posted a YouTube.

And if it can tie anything to this YouTube video, it can nail down venue because YouTube is a US company. (Hutchins is a UK resident.)

What it may also be is another attempt to get Hutchins to cave to a plea deal. This indictment adds more charges, which could mean additional jail time and fines if he's convicted. But that's a huge if. What the government has shown so far doesn't even meet the lowest standards of competency. It's a garbage prosecution made worse by the FBI's apparent decision to let the two people who actually marketed and sold malware walk away from this -- either because the agency can't locate them or (at least in "Randy's" case) has already agreed to drop charges in exchange for testimony.

Filed Under: doj, fbi, indictment, malware, marcus hutchins, statute of limitations

DOJ Russia Indictment Again Highlights Why Internet Companies Can't Just Wave A Magic Wand To Make Bad Stuff Go Away

from the troll-troll-troll-troll dept

As you've certainly heard by now, earlier today the Justice Department announced that it had indicted thirteen Russian individuals and three Russian organizations for various crimes related to trying to influence the US election. You should read the full indictment if you haven't already. Not surprisingly it focuses on the infamous Internet Research Agency (IRA), which was the giant Russian online trolling operation that we've discussed going back to 2015.

While many are trying to position the indictment as a "significant" bit of news, I have to admit to being a bit underwhelmed. It really does not reveal much that wasn't already widely known. It's been widely reported that the Russians had interest in disrupting our democracy and sowing discord, including setting up and pushing competing rallies from different political sides, and generally stoking fires of distrust and anger in America. And... the indictment seems to repeat much of that which has already been reported. Furthermore, this indictment actually reminds me quite a bit of a similar indictment four years ago aginst various Chinese officials for "hacking" crimes against the US. As we noted then, indicting the Chinese -- who the US would never be able to arrest anyway -- just seemed to be a publicity stunt, that had the potential to come back to haunt the US. It kinda feels the same here.

What is interesting to me, however, is that the indictment also demonstrates why all the hand-wringing against Facebook, Twitter and Google seems kind of misplaced. For months we've been seeing big articles and Congressional hearings questioning why the platforms allowed the Russians to use their services as propaganda tools -- even getting the companies to recently send out (useless, confusing) announcements to people about whether or not they saw or reposted Russian troll propaganda. But what the indictment makes pretty clear, is that the Russians made it nearly impossible for an internet service to ferret them out. The money used was spread out among many different banks and laundered through various means to make it more difficult to trace back. And it details just how far the trolls went to appear to be Americans, including traveling to the US, posing as Americans online to talk to actual US activists and push them in certain directions. And, of course, confusing the internet platforms into thinking they were Americans:

ORGANIZATION employees, referred to as "specialists," were tasked to create social media accounts that appeared to be operated by U.S. persons. The Specialists were divided into day-shift and night-shift hours and instructed to make posts in accordance with the appropriate U.S. time zone. The ORGANIZATION also circulated lists of U.S. holidays so that specialists could develop and post appropriate account activity. Specialists were instructed to write about topics germane to the United States such as U.S. foreign policy and U.S. economic issues. Specialists were directed to create "political intensity through supporting radical groups, users dissatisfied with [the] social and economic situation and oppositional social movements."

Defendants and their co-conspirators also created thematic group pages on social media sites, particularly on the social media platforms Facebook and Instagram. ORGANIZATION- controlled pages addressed a range of issues, including: immigration (with group names including "Secured Borders"); the Black Lives Matter movement (with group names including "Blacktivist"); religion (with group names including "United Muslims of America" and "Army of Jesus"); and certain geographic regions within the United States (with group names including "South United" and "Heart of Texas"). By 2016, the size of many groups had grown to hundreds of thousands of online followers.

Most of those groups (if not all?) had previously been revealed by the platforms or by news reports. But the extent to which the Russians went to cover their trails is more revealing.

To hide their Russian identities and ORGANIZATION affiliation, Defendants and their co- conspirators--particularly POLOZOV and the IT department--purchased space on computer servers located inside the United States in order to set up virtual private networks Defendants and their co-conspirators connected from Russia to the U.S.-based infrastructure by way of these VPNs and conducted activity inside the United States? including accessing online social media accounts, opening new accounts, and communicating with real U.S. persons--while masking the Russian origin and control of the activity.

Defendants and their co-conspirators also registered and controlled hundreds of web-based email accounts hosted by U.S. email providers under false names so as to appear to be U.S. persons and groups. From these accounts, Defendants and their co-conspirators registered or linked to online social media accounts in order to monitor them; posed as U.S. persons when requesting assistance from real U.S. persons; contacted media outlets in order to promote activities inside the United States; and conducted other operations, such as those set forth below.

Use of Stolen U.S. Identities

In or around 2016, Defendants and their co-conspirators also used, possessed, and transferred, without lawful authority, the social security numbers and dates of birth of real U.S. persons without those persons' knowledge or consent. Using these means of identification, Defendants and their co-conspirators opened accounts at PayPal, a digital payment service provider; created false means of identification, including fake driver's licenses; and posted on social media accounts using the identities of these U.S. victims. Defendants and their co-conspirators also obtained, and attempted to obtain, false identification documents to use as proof of identity in connection with maintaining accounts and purchasing advertisements on social media sites.

This was not just some run-of-the-mill "pretend to be Americans," this was a hugely involved process to make it very difficult to determine that they were not Americans.

I've seen some people online claiming that this shows why the platforms have to take more responsibility for who is using their platform:

But my read on it is exactly the opposite. It shows just how ridiculous such a demand is. Would any of us be using these various services if we were all forced to go through a detailed background check just to use a social media platform? That seems excessive and silly. Part of the reason why these platforms are so useful and powerful in the first place is that they're available for nearly everyone to use with little hurdles in the way. That obviously has negative consequences -- in the form of trolling and scams and malicious behavior -- but there's also a ton of really good stuff that has come out of it.

We should be pretty cautious before we throw away all of the value of these platforms just because some people used them for nefarious purposes. People are always going to be able to hide their true intentions from the various platforms -- and the response to that shouldn't be "put more blame on the platforms" -- it should be a recognition of why it's so silly to blame the tools and services for the actions of the users.

Yes, we should be concerned about foreign attempts to influence our elections (while noting that the US, itself, has a long history of doing the same damn thing in other countries -- so this is a bit of blowback). But blaming the technology platforms the Russians used seems to be totally missing the point of what happened -- and risks making the internet much worse for everyone else.

Filed Under: doj, impersonation, indictment, influence, intermediary liability, propaganda, russia, russian trolls
Companies: internet research agency

Sheriff, Deputies Indicted After Subjecting Entire High School To Invasive Pat Downs

from the bulk-violations dept

Earlier this year, the Worth County (GA) Sheriff's Department enraged an entire nation by subjecting the entire student body of a local high school to invasive pat downs. The reason for these searches? Sheriff Jeff Hobby believed drugs would be found on campus.

Invasive searches of students at Worth County High School in Sylvester are being investigated by the Atlanta-based Southern Center for Human Rights.

The Southern Center said Tuesday that hundreds of students at the South Georgia high school were subjected to a search conducted without a warrant. Some of the searches were “highly intrusive” and involved officers touching students’ genitals and breasts.

The Southern Center is raising questions about the legality of the search.

“The Sheriff’s search of Worth County High School students went far beyond what the law permits,” said SCHR attorney Crystal Redd. “The Sheriff had no authority to subject the entire student population to physical searches of their persons, and certainly none to search students in such an aggressive and inappropriate manner.”

The sheriff brought in drug-sniffing dogs and had his deputies frisk every single attending student. The sheriff claimed the searches were legal. And not just legal, but "necessary." The end result of the multiple invasions of personal privacy? Zero drugs, zero arrests.

No drugs were found in a search of Worth County High School Friday.

Perhaps Sheriff Hobby should have taken the results of a search performed a month earlier as indicative of future results.

The Sylvester Police Department did a search on March 17, and found no drugs.

Despite two negative search results, Sheriff Hobby still expressed a desire to search the school again.

When asked about that previous search that came up dry, Hobby said he didn't think that search was thorough, so he decided to do his own.

He said he believes there are drugs at the high school and the middle school, but also said that he will not do another search, due to response from community.

According to school policies, students may be searched if there's reasonable suspicion the student is in possession of an illegal item. The same rules apply to law enforcement, but they were ignored here. Sheriff Hobby claimed he could search any student he wanted to (in this case, all of them) simply because he was accompanied by a school administrator.

Hobby was wrong and is now facing some serious legal problems. First off, Hobby has been sued by several of the students frisked by his officers.

A federal civil rights lawsuit filed last week against a south Georgia sheriff offers new details of the bizarre school-wide search of hundreds of students where deputies allegedly touched girls’ breasts, vaginal areas and groped boys in their groins.

One of the nine Worth County High School students who filed the lawsuit, identified as K.P., told the AJC that the April 14 search was “very, very scary.” She said the incident was stuck in her memory and it colored the rest of her senior year.

The lawsuit also details how much time the Sheriff's Department wasted violating rights and failing to discover contraband.

[T]he sheriff and his deputies locked the high school down for more than four hours and conducted body searches of close to 800 students present in school that day...

This lawsuit is a problem for Sheriff Hobby, especially as it will be much more difficult for the sheriff and his deputies to avail themselves of immunity. Indictments have that sort of effect on immunity claims. [via Greg Doucette]

A south Georgia grand jury indicted Worth County Sheriff Jeff Hobby on Tuesday for sexual battery, false imprisonment and violation of oath of office after he ordered a school-wide search of hundreds of high school students. Deputies allegedly touched girls vaginas and breasts and groped boys in their groin area during the search at the Worth County High School April 14.

Two of Hobby’s deputies were also indicted Tuesday in connection with the case.

Somewhat ironically, the indicted sheriff's attorney is bemoaning the same grand jury system law enforcement loves when it's indicting civilians.

Under Georgia law, a police officer or sheriff accused of a crime related to their official duties can appear before a grand jury to give a statement. Private citizens facing criminal charges do not get this privilege. But the sheriff and his deputies chose not to invoke that privilege. All stayed out of the grand jury room. That’s at least in part due to a new law that curbed some of the unique privileges officers previously had to sway grand jurors.

Under a new law that took effect last year, officers would have been subject to cross examination and wouldn’t have been able to rebut statements made by prosecutors during that cross-examination.

“It’s not a balanced proceeding,” said Norman Crowe Jr., the sheriff’s attorney.

Well, of course it isn't. That's been obvious for years. But no one on the prosecutorial side has anything bad to say about it until they end up as grist for the grand jury mill.

Apparently, Sheriff Hobby is going to claim he's innocent because he didn't personally pat down any of the students. That may save him from the sexual battery charge, but it's not going to help him much with the other two: violation of oath of office and false imprisonment. Without the sheriff giving the orders, it's unlikely his deputies would have locked down a school and patted down 800 students.

Hobby's statements made in defense of the search -- all made pre-lawsuit and pre-indictment -- aren't going to help much either. He feels he's completely justified in performing en masse suspicionless searches of US citizens. They may have limited rights as minors and school attendees, but their rights do not vanish entirely once they walk on campus.

The whole debacle was an ugly abuse of Hobby's power. Preventing future abuses depends greatly on the judicial system's ability to hold the sheriff accountable for his actions. With Hobby in charge, the Worth County Sheriff's Department is unqualified to police itself. Whether or not he's convicted, he should be removed from office. His post-search comments show he's willing to violate rights of hundreds of people simultaneously to find contraband he swears exists, but has yet to actually discover.

Filed Under: 4th amendment, drugs, false imprisonment, georgia, high school, indictment, jeff hobby, pat downs, sexual battery, worth county

The Indictment Against Malware Researcher Marcus Hutchines Is Really Weird

from the why-is-that-illegal? dept

So, yesterday, we wrote a quick post about recently-famous malware research Marcus Hutchins (famous for accidentally stopping the WannaCry attack) being detained by the FBI as he left Defcon. An hour or so later, we updated it with the details of the indictment which had been released. That had my quick response, which noted that the "evidence" didn't seem very strong. It just claims (without anything else) that Hutchins wrote the Kronos malware, and most of the indictment and most of the activity focuses on a second defendant (whose name is redacted) who apparently was out selling the malware. I was planning to write up a more thorough look at the indictment and its problems today, but last night, Orin Kerr beat me to it, and he (famed lawyer, law professor and former assistant US attorney) has a bit more expertise in the subject, so let's work off of his analysis.

The crux of the indictment is that Hutchins and the unnamed "co-conspirator" worked together to create and sell malware, leading Kerr to ask the fairly obvious question:

This raises an interesting legal question: Is it a crime to create and sell malware?

After all, as many others pointed out, there are lots of folks out there who build and sell malware of one kind or another -- and, indeed, the US government is often a large purchaser of malware sold by others. Kerr's initial gut reaction was more or less the same as mine: that the actual amount of evidence in the indictment is pretty minimal, though obviously they may have a lot more that just hasn't been shared yet (or they may turn up more).

Do the charges hold up? Just based on a first look at the case, my sense is that the government’s theory of the case is fairly aggressive. It will lead to some significant legal challenges. It’s hard to say, at this point, how those challenges will play out. The indictment is pretty bare bones, and we don’t have all the facts or even what the government thinks are the facts. So while we can’t say that this indictment is clearly an overreach, we can say that the government is pushing the envelope in some ways and may or may not have the facts it needs to make its case. As always, we’ll have to stay tuned.

From there, Kerr digs into each of the charges. The first is "conspiracy." This one struck my layman's mind as somewhat odd. Two people working together does not a conspiracy make. Kerr similarly calls it "odd" and notes that for this charge to work, the government has to argue that selling malware is the same as using malware to damage a computer. And that seems... difficult. Kerr points out that there are two conditions that must be met for this to work:

First, the government must prove that Hutchins and X had an intent to damage a computer. That is, the goal of their conspiracy must have been to impair the availability or integrity of a program or data. Maybe there are facts that support that, but at the very least they don’t appear in the indictment. The indictment makes it seem that the purpose of selling the malware was to, well, sell malware. It’s not obvious that Hutchins and X cared what the buyer did with the malware after so long as they paid. If Hutchins and X didn’t care what the buyer did with the malware, it’s hard to see how they could have a purpose to impair the availability or integrity of a computer.

Second, the government must prove that the agreement was to cause the result of damaging a computer. In an ordinary 1030(a)(5)(A) case, causation is easy. The person sends the malware and the malware damages the machine. Here, though, the government’s theory adds an intermediary: The theory seems to be that Hutchins and X conspired, and the goal of their collective activity was to cause damage, even though the actual act of damaging a computer (if it happened) was to be caused directly by the buyer using the malware rather than by Hutchins and X.

That second point is especially interesting to me. We've seen more and more attempts to charge "intermediaries" with crimes based on actions of third party users of their tools (the Megaupload case being one big example). And that seems like a very dangerous path to go down. One of the reasons why we talk about "intermediary liability protections" on Techdirt so much is that they're so important on a basic "blame the person who actually did the wrong" spectrum. It's not the intermediary, it's the user. Go after the user, even if that's more difficult. Here, the DOJ seems to be going after the intermediary. Because.

The next three charges are all similar, and I didn't quite get them at first, but Kerr explains. They're making use of 18 U.S.C 2512 which Kerr describes as, "a rarely-used law that criminalizes making, selling, or advertising for sale illegal wiretapping devices." Yes, wiretapping devices. Here, Kerr focuses on the question of whether or not a piece of malware software is a "device" under the law, and argues that may be difficult as well.

In Potter v. Havlice, 2008 WL 2556723 (S.D. Ohio 2008), the plaintiff sued the defendant under Section 2512 for making and selling “Activity Monitor,” which was billed as “an ideal spy software package to ensure you have the control you need over your child or spouse activity when they are online.” After rejecting Section 2512 liability because there is no civil cause of action under the statute, the court added an alternative holding that “Activity Monitor is not a device as contemplated by Section 2512.”

Section 2512 makes the manufacture and/or trafficking of “any electronic, mechanical, or other device” illegal. The phrase “electronic, mechanical, or other device” is defined in 18 U.S.C. § 2510(5) to generally mean “any device or apparatus which can be used to intercept a wire, oral, or electronic communication….” Clearly, Activity Monitor alone cannot be used to intercept communications. It must be installed in a device, such as a computer, to be able to do so.

Also, the definition of the word “device” does not encompass software such as Activity Monitor. Merriam Webster Dictionary defines “device” as “a piece of equipment or a mechanism designed to serve a special purpose or perform a special function.” Activity Monitor alone is not a piece of equipmentor a mechanism.

So... that's going to make this interesting. Of course, then there's the further question of whether or not the malware itself is really intercepting communications. Either way, this feels like a way to try to twist a law targeting older technology to pretend that it applies to a very different kind of technology. I know this happens semi-frequently, but it always troubles me. You get bad results this way, because the technology that was originally being regulated, and what it's now being used against, are very different, and should be treated differently. But when you try to shove something like malware into laws created to stop wiretapping devices... you end up with bad results, where rulings can be made about something being "bad" without realizing the wider reverberations it may have.

And, finally, there's a CFAA claim, because if there's a criminal case that could be summarized as "behaving badly on a computer" you have to expect an eventual CFAA claim.

This count raises the same challenges as count one. The theory seems to be that that selling a copy of malware is akin to using the malware to damage a computer. But to get there, they need to show that Hutchins and X had the intent to impair the availability or integrity of information on a computer and not just intent to distribute the malware to a paying customer. The government also needs to prove that their act of distributing the malware was the proximate cause of the resulting damage even though a third party’s intentional act of sending the malware was required for that to happen.

Again... this seems quite difficult to actually show, though perhaps there's more evidence that the DOJ hasn't yet revealed.

In the meantime, others are insisting that the DOJ has the wrong guy. A friend and colleague of Hutchins, Kevin Beaumont, insisted that the DOJ is simply wrong, and that Marcus has more or less dedicated his life to fighting malware, not creating it:

On top of that, the BBC spotted the fact that Marcus asked on Twitter if anyone had a sample of Kronos after it first was discovered:

Now, of course, that alone is not evidence of much. After all, if he really had created it, why not tweet something like that to make sure people think he hadn't? But, still, it is worth pointing out, along with multiple other folks saying that they simply don't believe Hutchins would have been behind the malware, let alone the broader legal question of whether or not making and selling malware is even illegal in the first place.

Filed Under: cfaa, conspiracy, doj, indictment, kronos, malware, malwaretech, marcus hutchins, orin kerr, selling malware

Reporter Indicted For Covering Trump Inauguration Protests

from the free-press? dept

Back in January, we noted that six journalists had been arrested while covering protests in Washingto DC on inauguration day. It is troubling enough that this kind of thing has been happening with increasing frequency in the past few years (a bunch of journalists were arrested while covering the Ferguson protests, for example). And as bad (and unconstitutional) as it is to arrest these journalists, usually any charges are soon dropped. However, it appears that at least one of the reporters arrested for covering inauguration protests, Aaron Cantu of the Santa Fe Reporter, has now been indicted with prosecutors accusing him of participating in violence related to the protests:

Aaron Cantú, a staff writer at the Santa Fe Reporter, has been indicted by a federal grand jury on charges that he participated in a riot while working as a journalist during protests in Washington, DC on Inauguration Day.

Cantú faces eight felony counts—including inciting a riot, rioting, conspiracy to riot and five counts of destruction of property. The grand jury handed up the indictment last week.

From the news report, it's not clear they actually have any evidence that Cantu was engaged in any of the destruction. Indeed, it sounds like he was over with other journalists observing the events (and wiping pepper spray from his eyes):

Cantú was not named specifically by prosecutors as the cause of any of the destruction, as some defendants were. Instead, the indictment named him as being present while the damage happened. The arrests have been criticized by the American Civil Liberties Union, other civil rights groups and newspapers as overly broad and lacking hard evidence.

Video from the conservative media group The Rebel shows glimpses of Cantú off to the side of the protests with other journalists, washing what appears to be pepper spray from his eyes. He’s standing next to a conservative journalist as she narrates the scene.

The fact that he isn't named specifically, and that the complaint is just that he was "present" is crazy. Of course he was present. He was doing his job, reporting on protests. Assuming this goes forward, Cantu should have very strong First Amendment defenses, and might consider suing the government for civil liberties violations.

While I'm hardly sympathetic to arguments by law enforcement when they round up large groups of people at protests that it's difficult for them to determine who's really a journalist and who is not, at least you can sort of understand how that might happen -- even if you disapprove. But once the fog of the moment has passed it is absolutely bizarre for prosecutors to push forward with an indictment against someone who is clearly there as press.

Filed Under: aaron cantu, donald trump, first amendment, free press, free speech, inauguration, indictment, protests

Team Prenda Finally Goes To Jail: Hansmeier & Steele Indicted & Arrested

from the shit-gets-real dept

For many, many, many years, we've been covering the saga of Prenda Law -- a legal operation set up to file tons of shakedown copyright infringement lawsuits in an effort to get as many people as possible to just pay up and settle. The scam got deeper and deeper the more you looked, including forged signatures, clear evidence that the main actors behind Prenda -- John Steele and Paul Hansmeier -- were uploading their own works as a honeypot, while pretending to represent clients that they themselves owned through various shell companies -- which they denied owning. It went on and on and on. And on and on and on. Things really went sideways almost four years ago when Judge Otis Wright in California was the first judge to put much of this together, and called all of them to court, where everyone pleaded the fifth (yes, lawyers were pleading the fifth in a case they themselves brought). In response, Judge Wright referrred the case to law enforcement, leading many people to ask over the past four years how it was these guys weren't in jail (and, in fact, they continued to file lawsuits, reprising the same scheme but with ADA shakedowns.

Court after court after court has slammed Prenda, and ordered Hansmeier and Steele (partner 3, Paul Duffy, died in the middle of all of this) to pay up lots of money. Of course, in response to that, there were further accusations of illegally hiding money, bogus trusts, a questionable bankruptcy claim and more. And, yet, they still were not in jail. Oh, and we didn't even mention the various ethics investigations that recently suspended Hansmeier's license.

Ken "Popehat" White -- who as a former Assistant US Attorney and current criminal lawyer -- has kept saying that the wheels of justice turn slowly, but they do turn. Back in May, White noted that it appeared that ofifcials were getting mighty close to filing charges against Hansmeier and Steele, based on some evidence he had seen, suggesting the investigation was wrapping up. And the wheels continued to turn... until earlier today when it was revealed that Steele and Hansmeier have both been indicted and arrested in connection with the Prenda scam.

You can read the indictment or Ken White's excellent analysis of it. As White notes, the indictment is incredibly thorough. We've written about a number of indictments in the past in which law enforcement is fairly lax on details. This is not one of those cases. The overview gives a really good summary of everything:

Between 2011 and 2014, defendants Paul R. HANSMEIER and John L. STEELE orchestrated an elaborate scheme to fraudulently obtain millions of dollars in copyright lawsuit settlements by deceiving state and federal courts throughout the country. In order to carry out the scheme, the defendants used sham entities to obtain copyrights to pornographic movies--some of which they filmed themselves--and then uploaded those movies to file-sharing websites in order to lure people to download the movies. To learn the identities of the people caught in the trap they constructed, HANSMEIER and STEELE filed specious copyright infringement lawsuits and fraudulently procured permission from courts to send subpoenas to internet service providers for subscriber information associated with the IP addresses used to download their pornographic movies. After receiving this information, the defendants--through extortionate letters and phone calls--threatened the subscribers with enormous financial penalties and public embarrassment unless the subscribers agreed to pay a settlement, all the while concealing their collusion in the alleged copyright infringement. When courts restricted their ability to sue multiple individuals in the same lawsuit, the defendants shifted tactics. They filed lawsuits falsely alleging that computer systems purportedly belonging to their sham clients had been infiltrated by hackers, and then recruited ruse defendants against whom they brought these illusory "hacking" lawsuits. Finally, when courts became suspicious of the defendants' tactics and motives, the defendants began a long process of lies and deceit designed to conceal the truth and deflect responsibility from themselves. In total, the defendants obtained approximately. $6,000,000 made possible by the fraudulent copyright lawsuits they peddled to courts throughout the country

I believe the $6 million number is new. But everything else in there we've covered in the past. The lawsuit names some people by initials only -- but who are easily identifiable if you've been following the saga. M.L. is likely Mark Lutz the "paralegal" who was involved in many of these cases, and was a figurehead owner of some of the sham corporations. You may remember him from one of the earliest Prenda stories we had, where Lutz "appeared" in court as a "corporate representative" of one of Prenda's "clients" and yet knew nothing at all about the company he was supposed "representing." That story also involved an appearance by John Steele who claimed he was there just observing, but which the judge immediately became suspicious about.

P.H. is likely to be Peter Hansmeier, Paul's brother, whose name has appeared at times in connection with the Prenda scam and had been described as the technology person tracking down who was downloading the files in question. The indictment also mentions P.D. who is obviously Paul Duffy, the official owner of Prenda Law, but who was always sort of the third wheel of the operation before dying just as all the mess was unfolding. A.C. is clearly Alan Cooper, named here as "an acquaintance of Steele," but who was a caretaker for some Steele properties, and whose signature Steele forged on documents pretending to own AF Holdings, one of the bogus shell companies he set up. B.G. is almost certain Brett Gibbs, a California lawyer who filed a bunch of Prenda lawsuits early on, but was one of the first to reveal details once judges started to catch on.

Perhaps the most interesting part of the indictment is it details multiple lies that Team Prenda told under penalty of perjury or under oath to various courts. It's a pretty long and detailed list. It includes filings by Mark Lutz and Brett Gibbs, which the indictment claims were all done, under penalty of perjury, at the direction of Steele and Hansmeier -- so they don't even get off for trying to keep their names off these documents.

Based on all this, they're facing a bunch of charges, for mail fraud, wire fraud, conspiracy to commit money laundering (involving the transactions to hide money from courts) and conspiracy to commit and suborn perjury.

As White rightly reminds us, an indictment is just a bunch of allegations, not yet proven, but having followed Team Prenda and all these actions for many years, the feds seem to have clearly figured out what was going on, and appear to have the evidence to back up many of those claims. Things don't look good for Steele and Hansmeier. According to the Minneapolis Star Tribune, US Attorney Andrew Luger called a press conference to announce all of this and call out the actions of Steele and Hansmeier.

"The defendants in this case are charged with devising a scheme that casts doubt on the integrity of our profession," Luger said in prepared remarks. "The conduct of these defendants was outrageous — they used deceptive lawsuits and unsuspecting judges to extort millions from vulnerable defendants. Our courts are halls of justice where fairness and the rule of law triumph, and my office will use every available resource to stop corrupt lawyers from abusing our system of justice."

Turns out that when you abuse the judicial system to shake people down... people aren't going to be too happy about that. Of course, now we have to wonder if the other giant copyright troll, Malibu Media, may be facing similar issues going forward...

Filed Under: arrested, indictment, john steele, mail fraud, mark lutz, paul hansmeier, perjury, peter hansmeier
Companies: af holdings, guava, ingenuity 13, livewire, prenda, prenda law