FBI Dismisses Child Porn Prosecution After Refusing To Hand Over Details On Its Hacking Tool

from the extreme-tactics,-voluntary-dismissals dept

The FBI has decided to let one of its Playpen defendants walk rather than turn over information on its Network Investigative Technique. The NIT, deployed all over the world on the back of a single warrant obtained in Virginia, unmasked Tor users by dropping code on Playpen visitors' computers that sent back IP addresses and other information about the user's computer.

The warrant itself has been ruled invalid by a number of judges presiding over Playpen prosecutions, although not all of them have determined that the evidence obtained by the NIT should be suppressed. The FBI not only sent malware to site visitors, but it also ran (and possibly improved) the child porn website for two weeks while pursuing its investigation.

Michaud's lawyer asked the court to force the FBI to hand over information on the NIT. The FBI countered, saying it wouldn't turn over the information even if ordered to do so. Judge Bryan, after an in camera session with the agency, agreed with the government that there was a law enforcement need to keep the details of the tool secret. But he also made it clear the government couldn't have both its secrecy and its evidence. He ordered all evidence suppressed.

With all evidence deriving from the forced exposure of Michaud's IP address, there was nothing left for the government to work with. It could have voluntarily turned over information to Michaud's defense lawyer for examination, but has chosen instead [PDF] to let Michaud go free. (h/t Andrew Crocker)

On June 23, 2016, the United States Attorney’s Office for the Western District of Washington filed a protective Notice of Appeal to preserve the right of the United States to pursue an interlocutory appeal of the order of the district court granting the defense motion to compel and finding, as a remedy for the refusal to comply that the evidence of the Network Investigative Technique (NIT), the search warrant issued on the basis of that evidence and the fruits of that search should all be suppressed.

Upon further review within the Department of Justice or the Court’s order and the record in the case, the United States has concluded that this appeal should not be pursued. It is for that reason that the United States now respectfully requests that this appeal be dismissed.

The FBI is developing quite the reputation for dropping prosecutions in the face of challenges of its secret tools and techniques. The NDAs it hands out to every law enforcement agency seeking to purchase Stingrays not only tells them to obscure the device's use, but to let suspects walk if it seems some of this info might make its way into the courtroom.

What's more problematic here is the FBI/DOJ's two-faced stance on these issues. The FBI argues in court (often obtaining the court's agreement) that these questionable tactics (deploying malware, warrants that ignore jurisdictional limits, running child porn sites rather than shutting them down, etc.) are justified because the people it's going after (child porn viewers/distributors) are that terrible. But then it turns around and lets the very bottom of its basket of criminal suspect deplorables go free rather than hand over information to the defense. It does this even though the defense, the judge, and the DOJ would do all they could to protect as much of the NIT information as possible, including sealing documents and redacting those that are published.

Fortunately, the judge presiding over this case wasn't going to let the FBI have 100% secrecy and 100% of the derived evidence. And that has resulted in a voluntary dismissal of someone the government clearly felt was enough of a criminal menace that its extreme tactics were justified.

Filed Under: child porn, doj, evidence, fbi, hacking, jay michaud, nit, playpen

Judge Says The FBI Can Keep Its Hacking Tool Secret, But Not The Evidence Obtained With It

from the hope-the-feds-enjoy-their-victory-over-transparency dept

Judge Robert Bryan -- having set his own house against itself by declaring the FBI could keep its NIT info secret while simultaneously declaring the defendant in the child porn case had every right to see it -- has managed to find a way out of his self-induced conundrum. And it's going to make the FBI very sad. (h/t Ars Technica)

For the reasons stated orally on the record, evidence of the N.I.T., the search warrant issued based on the N.I.T., and the fruits of that warrant should be excluded and should not be offered in evidence at trial.

Well, not quite.

Michaud hasn't had the case against him dismissed, but the government will now have to rely on evidence it didn't gain access to by using its illegal search. And there can't be much of that, considering the FBI had no idea who Michaud was or where he resided until after the malware-that-isn't-malware had stripped away Tor's protections and revealed his IP address.

The FBI really can't blame anyone but itself for this outcome. Judge Bryan may have agreed that the FBI had good reason to keep its technique secret, but there was nothing preventing the FBI from voluntarily turning over details on its hacking tool to Michaud. But it chose not to, despite his lawyer's assurance it would maintain as much of the FBI's secrecy as possible while still defending his client.

Judge Bryan found the FBI's ex parte arguments persuasive and declared the agency could keep the info out of Michaud's hands. But doing so meant the judicial playing field was no longer level, as he acknowledged in his written ruling. Fortunately, the court has decided it's not going to allow the government to have its secrecy cake and eat it, too. If it wants to deploy exploits with minimal judicial oversight, then it has to realize it can't successfully counter suppression requests with vows of silence.

It's doubtful the FBI will learn from this experience. It did the same thing in 2012 and received nothing but deference from the courts. This time around, courts and lawyers are better educated, thanks to Snowden's leaks and a few hundred FOIA warriors -- all of whom have served to expose the massive, secret expansion of the government's surveillance reach and the near-complete dearth of effective oversight.

The FBI will be pushing hard for the adoption of the proposed Rule 41 changes. If these had been in place, every illegal search it performed using its NIT and the invalid warrant it obtained would have been legal. As it stands now, however, multiple courts have examined the warrant and the hacking tool and found the FBI's actions to be in violation of current statutes. What should have been slam-dunk prosecutions against unsympathetic defendants have instead become multiple participants in an ongoing debacle.

Filed Under: doj, evidence, fbi, jay michaud, malware, nit, playpen, robert bryan, rule 41

Judge Says Defendant Has Right To Examine FBI's Hacking Tool While Stating FBI Has Right To Withhold Details

from the gridlock dept

As we covered recently, the judge presiding over Jay Michaud's case in Washington -- part of the FBI's Playpen child porn sting operation -- recently declared the FBI did not have to turn over information on its hacking tool to the defense. How Judge Robert Bryan arrived at this conclusion wasn't fully explained during his oral order, but it had something to do with the government's secret, judge's-eyes-only presentation that preceded the order.

It also may have had something to do with the government's declaration that it wouldn't be turning over this information to Michaud under any circumstances. Either way, Bryan arrived at the contradictory conclusion that the FBI did not need to turn over this information despite conceding the defense had a right to see this information.

A written ruling has been issued which offers a bit more in the way of explanation while simultaneously failing to deliver Judge Bryan from the conundrum he has created. (via Ars Technica)

The government’s oral arguments on February 17 and May 12, 2016 and its related briefing addressing materiality essentially amount to an ipse dixit argument, without convincing expert support, that 1) giving the defendant full access to the N.I.T. code will not turn up anything helpful to the defense, and 2) a showing of materiality demands facts, not hypotheses, and the defendant has done nothing more than fabricate guesses about what the N.I.T. code could show.

Bryan believes the government is entitled to withhold this information. He also believes the information should be handed over to the defense for a number of reasons.

These arguments bear little fruit. The defendant is not required to accept the government’s assurances that reviewing the N.I.T. code will yield no helpful information. The government asserts that the N.I.T. code will not be helpful to the defense, but that information may well, in the hands of a defense lawyer with a fertile mind, be a treasure trove of exculpatory evidence.

Judge Bryan points out the information still has worth to the defendant even if it doesn't show anything that could result in suppressed evidence. It could also be the details do nothing more than further cement the government's case against Michaud. If so, all the more reason for the defense to have access to it.

Furthermore, even if the defendant’s review of the N.I.T. code ultimately only yields inculpatory evidence,“[e]ven inculpatory evidence may be relevant [because a] defendant who knows that the government has evidence that renders his planned defense useless can alter his trial strategy.

Acknowledging the conundrum is the first step.

The resolution of Defendant’s Third Motion to Compel Discovery places this matter in an unusual position: the defendant has the right to review the full N.I.T. code, but the government does not have to produce it. Thus, we reach the question of sanctions: What should be done about it when, under these facts, the defense has a justifiable need for information in the hands of the government, but the government has a justifiable right not to turn the information over to the defense?

According to motions filed by Michaud, one way out of the mess is the dismissal of the case. Bryan doesn't exactly seem amenable to that outcome -- especially given his belief that the FBI's secrecy is justified -- but with this much paint surrounding his corner, he may be forced to resolve this in favor of the defendant, rather than continue to lock him out of information that could drastically alter its outcome.

Filed Under: catch 22, doj, fbi, hacking, jay michaud, malware, nit, robert bryan

Judge In Child Porn Case Reverses Course, Says FBI Will Not Have To Turn Over Details On Its Hacking Tool

from the no-unending-solitary-confinement-for-special-agents,-apparently dept

Back in February, the judge presiding over the FBI's case against Jay Michaud ordered the agency to turn over information on the hacking tool it used to unmask Tor users who visited a seized child porn site. The FBI further solidified its status as a law unto itself by responding that it would not comply with the court's order, no matter what.

Unfortunately, we won't be seeing any FBI officials tossed into jail cells indefinitely for contempt of court charges. The judge in that case has reversed course, as Motherboard reports.

The government's motion has been granted, and the FBI does not have to provide the exploit code to the defense as previously ordered. That means that the defense in the case will probably be unable to examine how the evidence against their client was collected in the first place.

It is not totally clear why Judge Robert J. Bryan changed his mind. On Thursday, the government and Bryan held a private meeting, where the government presented its reasons for nondisclosure of the Tor Browser exploit.

The judge apparently believes the defense should still be able to examine the code but apparently can't be bothered with ensuring this will happen.

Despite backtracking somewhat, Bryan still thinks the defense has a reason to see that code, according to audio of the public section of Thursday’s hearing provided by activist Phil Mocek. Of course, whether the FBI decides to then provide it is another matter.

Given the FBI's earlier promise to withhold the details of the NIT despite being ordered to disclose them, I'd say there's about a 0% chance of the FBI voluntarily turning this information over to the defense. Right now, the agency is working overtime just trying to keep the evidence it obtained with its hacking tool from being tossed out of three other courts. It's also facing the prospect that third-party interlopers like Mozilla may still result in it having to release these details to someone outside of its own offices. At this point, hardly anything's going the FBI's way, so it will take whatever it can get, even if it's only temporary relief.

Filed Under: discovery, doj, fbi, hacking, jay michaud, malware, nit, playpen

FBI Says It Will Ignore Court Order If Told To Reveal Its Tor Browser Exploit, Because It Feels It's Above The Law...

from the above-the-law? dept

There are a bunch of different cases going on right now concerning the FBI secretly running a hidden Tor-based child porn site called Playpen for two weeks, and then hacking the users of the site with malware in order to identify them. The courts, so far, have been fine with the FBI's overall actions of running the site, but there are increasing questions about how it hacked the users. In FBI lingo, they used a "network investigative technique" or a NIT to hack into those computers, but the FBI really doesn't want to talk about the details.

In one case, it was revealed that the warrant used by the FBI never mentions either hacking or malware, suggesting that the FBI actively misled the judge. In another one of the cases, a judge has declared the use of the NIT to be illegal searches, mainly based on jurisdictional questions (the warrants were for Virginia, but the individuals were far away from there).

In yet another case, the one involving Jay Michaud -- his lawyers have now told the court that the DOJ has made it clear that despite the court ruling earlier this year that the FBI must reveal the details of the NIT/hacking tool, it will not do so (first revealed by Brad Heath). The redacted filing is in response to a (sealed) motion for reconsideration by the DOJ, but reveals more or less what the DOJ said in that filing: If you can't see that, the relevant portion reads:

The Government has now made plain that the FBI will not comply with the Court's discovery order... [REDACTED]... The Government further acknowledges that "there may be consequences for this refusal." [REDACTED] Pursuant to the law discussed below, the consequences are straightforward: the prosecution must now choose between complying with the Court's discovery order and dismissing the case.....

The dilemma is one entirely of the Government's own making, and nothing in its Motion for Reconsideration or renewed requests for secret proceedings changes the analysis.

The filing goes on to point out how the FBI has similarly been refusing to reveal details of its Stingray mobile phone surveillance tools (something we've discussed here quite a bit), leading to convictions being overturned. As Michaud's lawyers point out, the situation here is basically the same. If the FBI refuses to obey a court order, then the case should be dropped.

As the Maryland court observed, the FBI’s obstruction of disclosure “from special order and/or warrant application through appellate review – prevents the court from exercising its fundamental duties under the constitution.” ... “[I]t is self-evident that the court must understand why and how [a] search was conducted,” and “[t]he analytical framework requires analysis of the functionality of the surveillance device and the range of information potentially revealed by its use.” ... These conclusions mirror the conclusions reached by this Court at the February 17 hearing.

The filing also highlights how important it is to get the details, noting that the FBI has a history of incorrectly raiding homes because it doesn't understand how Tor works:

The Government’s refusal to comply with the discovery order is all the more untenable given the exceptional technical complexities that are involved with the Tor network and the FBI’s use of sophisticated hacking “techniques.” Just a few weeks ago, Seattle police raided the home of two people who use the Tor network, based on an allegation that their IP addresses had been linked to child pornography, when in fact illicit traffic had merely passed through their connection to the network.....

But perhaps even more amusing, the lawyers point out how the DOJ/FBI's claims here run exactly counter to the DOJ/FBI's arguments about Apple's obligation to respond to the DOJ's court order to help unlock encrypted phones: Their complaint is that the DOJ said that Apple could use a secure location to keep the code safe, but rejects such a solution here -- but the comparison could go even deeper. After all, the DOJ kept saying that Apple was acting as if it was above the law in telling the FBI that it would not write special software to help break into a phone. Yet, here, the request is much more straightforward. The FBI doesn't have to write any new code at all... it just has to reveal what it has been told to reveal by a court: the software it used to hack into someone's computer.

Of course, there's also the fact that because of the whole Apple/DOJ fight, Senators Dianne Feinstein and Richard Burr started pushing a bill to ban encryption that opens with the following: Somehow, I get the feeling that both Feinstein and Burr will feel differently when it's the FBI/DOJ refusing to comply with court orders, and will claim the government is correct here. I wonder if anyone else in the Senate will now release a companion bill to the Burr/Feinstein bill suggesting that the DOJ itself should start complying with court orders, as it is not "above the law."

Filed Under: court orders, doj, fbi, hacking, jay michaud, malware, nit, tor

The FBI Doesn't Want To Share Details On The Exploit It Deployed While Running A Child Porn Site

from the we'll-let-you-know-what-you-can-'discover' dept

The FBI will not be talking about the Network Investigative Technique (NIT) it used to obtain information about anonymous visitors to the child porn site it seized and ran for two weeks while the NIT did its work. A recently-filed declaration (uploaded by USA Today's Brad Heath and pointed out by the ACLU's Chris Soghoian) by the FBI tells the court the defense will learn nothing from being provided details on the NIT's inner workings, especially since the agency isn't willing to turn these details over to Jay Michaud's lawyers.

As Special Agent Daniel Alfin explains it, the defense's tech expert has misrepresented the NIT's form and function to the court.

I have also reviewed the declaration of Mr. Tsyrklevich, the defense expert, dated January 13, 2016 and noted a number of statements that are inaccurate and/or require clarification. I will address several of these in great detail below but will begin by noting one overarching misconception in that declaration. Specifically, Tsyrklevich attempts to redefine the NIT as something containing multiple components. The NIT, however, consists of a single component -- that is, the computer instructions delivered to the defendant's computer after he logged into Playpen that sent specific information obtained from his computer back to the FBI.

This is hardly surprising, considering the tech expert hasn't had an opportunity to examine the FBI's software. But because the defense is wrong about the NIT, the FBI argues it shouldn't be allowed to figure out how wrong it is -- or figure out what it may have gotten right by examining other evidence.

Tsyrklevich claims that he requires access to the government's "exploit" to determine if the government "executed additional functions outside the scope of the NIT warrant." He is wrong. Discovery of the "exploit" would do nothing to help him determine if the government exceeded the scope of the warrant because it would explain how the NIT was deployed to Michaud's computer, not what it did once deployed.

This is the FBI playing games with words, albeit words perhaps poorly chosen by Michaud's lawyer. The FBI is claiming the only "exploit" was the delivery of the NIT payload, but not the payload itself. Michaud would like access to details on the latter (the payload), but the FBI is claiming the defense expert is only seeking details on the former.

Continuing in that vein, the FBI agent says additional info on the exploit would do nothing to help determine whether the NIT exceeded the scope of the warrant because all the "exploit" did was allow the FBI to access information about Michaud's computer. It's circular reasoning that allows the FBI to skirt questions about the information it pulled from the computers it attached itself to while running the Playpen website.

The FBI's declaration then goes even further, stating that all the information Michaud's lawyer needs can be found in the information the agency has already handed over. The FBI doesn't want to discuss its "server component" (where information exchanged with suspects' computers was stored). Agent Alfin claims the defense can verify the legitimacy of the FBI's claims about data supposedly originating from Michaud's computer by comparing the information already handed to it by the agency with what will presumably be another copy of the same information previously handed to it by the agency.

Specifically, the government has offered to provide a copy of the data stream sent by Michaud's computer to the government as a result of the execution of the NIT. Tsyrklevich can compare the information sent to the government by the NIT to the information provided in discovery to verify that what the government recorded from Michaud's computer is in fact what was sent by Michaud's computer.

And how will Michaud know this new copy of the information isn't just a reprint of the old copy? Well, apparently because the FBI agent says it's totally legit.

I have reviewed that data stream and, as explained below, confirmed that the information sent by Michaud's computer as a result of the NIT matches the information that is stored on the government's servers.

Feel better?

The FBI obviously isn't going to hand over information on its means and methods without a fight, making its NITs just another tech component it won't talk about in court. It has managed to keep discussions of Stingrays out of court for several years and now it's doing everything it can to protect more recently-discovered innovations -- even if it means cutting defendants and judges out of the loop.The FBI could hand these details over to the defense and judges without having to hand them over to the general public (via in camera presentations, sealed submissions or the use of redactions) but it would rather keep even those components of the justice system in the dark.

Filed Under: fbi, jay michaud, nit