DOJ Still Demanding Identity Of Twitter Users Because Someone They Shouldn't Have Arrested Tweeted A Smiley Emoji

from the this-case-remains-fucked-up dept

Last month, I had two blog posts about a particularly insane lawsuit being pushed by the Justice Department against a computer security researcher, Justin Shafer. As we explained, the arrest and prosecution of Shafer appeared to be the result of a truly ridiculous vendetta against Shafer by the FBI because Shafer got angry over a previous (and totally misguided) decision to raid his home, after he properly disclosed security problems involving some dental practice software. It seems clear that Shafer never should have been arrested (and never should have had the FBI raid his house three times over just a few months). Of course, what first brought the case to my attention was an even more ridiculous part of the story, in which the DOJ had sent a subpoena to Twitter demanding basically all info on five Twitter users -- even though two of them don't hide their identity -- because Shafer tweeted a smiley emoji at them.

That story is even more insane than it sounds, but I'm not going to repeat the details here -- I'll just repeat: the case involved the DOJ demanding the identity (and more) of five Twitter users because someone else (who they're railroading over bogus charges) sent a smiley emoji to them on Twitter where they were discussing a different lawsuit altogether.

We now have two updates on that story: (1) Shafer is appealing the fact that he's still in jail, months later and (2) the DOJ has refused to withdraw the emoji subpoena. Yes. You read that right. The DOJ is doubling down, demanding the identity (and more) of Twitter users because someone they never should have arrested, sent a smiley emoji to them. We can cover that second point first because there's not much more to say beyond "What the fuck is wrong with the DOJ?" As you may recall, the five Twitter users whose info was sought by the subpoena included @dawg8u ("Mike Honcho"), @abtnatural ("Virgil"), @Popehat (Ken White), @associatesmind (Keith Lee) and @PogoWasRight (Dissent Doe). Ken White and Keith Lee are both known (and each has blogged about the situation). The rest are at least partially pseudonymous. Dissent Doe, for one, has strong reasons for retaining anonymity, given her focus on data breaches and privacy issues. She revealed the DOJ's stunning decision to keep going over the weekend, noting that she now needs to fight the subpoena in court.

Dissent Doe explained to me later that her lawyers have tried, repeatedly, to contact the DOJ about this ridiculous subpoena, and the DOJ has ignored all attempts to communicate. Twitter has told her that any motion to quash the subpoena needs to be filed this week. She also notes, appropriately, that she's "really really ticked off" about all of this. We all should be.

And, just to be clear, there is no way the subpoena is even remotely Constitutional. Not even armchair lawyers could possibly think so. Over and over again, courts have said that anonymity is protected under the First Amendment, and you need to have very strong reasons to pierce the anonymity. The key case here is McIntyre v. Ohio Elections Commission, but plenty of others have weighed in since then. As we pointed out, the recent Awtry v. Glassdoor case nicely summarizes the history of cases protecting anonymity under the First Amendment:

The Supreme Court has recognized that “an author’s decision to remain anonymous, like other decisions concerning omissions or additions to the content of a publication, is an aspect of the freedom of speech protected by the First Amendment.” McIntyre v. Ohio Elections Comm’n, 514 U.S. 334, 342 (1995). Indeed, “[t]he right to speak anonymously was of fundamental importance to the establishment of our Constitution.” Doe v. 2TheMart.com Inc., 140 F. Supp. 2d 1088, 1092 (W.D. Wash. 2001) (citing McIntyre, 514 U.S. at 341-42). In particular, “Justice Black . . . reminded us that even the arguments favoring the ratification of the Constitution advanced in the Federalist Papers were published under fictitious names.” McIntyre, 514 U.S. at 342 (citing Talley v. California, 362 U.S. 60, 64 (1960)). So too were the responses of the anti-federalists, which were published by authors who used such fictitious names as “Centinel,” “Brutus” and “The Federal Farmer.” In re Anonymous Online Speakers, 661 F.3d 1168, 1172-73 (9th Cir. 2011).

Further, it is well-established that anonymous speech on the Internet, like other types of anonymous speech, enjoys First Amendment protection. In re Anonymous Online Speakers, 661 F.3d 1168, 1173 (9th Cir. 2011)(“online speech stands on the same footing as other speech—there is `no basis for qualifying the level of First Amendment scrutiny that should be applied’ to online speech”) (quoting Reno v. Am. Civil Liberties Union, 521 U.S. 844, 870 (1997)). As the Ninth Circuit has explained, “the ability to speak anonymously on the Internet promotes the robust exchange of ideas and allows individuals to express themselves freely without `fear of economic or official retaliation . . . [or] concern about social ostracism.'” Id.(quoting McIntyre, 514 U.S. at 341-42).

First Amendment protection of anonymous speech “is not unlimited, however, and the degree of scrutiny varies depending on the circumstances and the type of speech at issue.” Id. Political speech is considered to be “core” speech and is afforded the highest level of First Amendment protection. McIntyre, 514 U.S. at 346. Online messages such as the ones at issue here are also entitled to some level of First Amendment protection, even if the hurdle for overcoming that protection is less stringent than it is for political speech. See In re Anonymous Online Speakers, 661 F.3d 1168 at 1177; see also Highfields Capital Mgmt., L.P. v. Doe, 385 F. Supp. 2d 969 (N.D. Cal. 2005) (finding that identity of individual who anonymously posted derogatory comments about a company on an online message board was protected from disclosure under the First Amendment); Art of Living Foundation v. Does 1-10, No. 10-cv-5022 LHK, 2011 WL 5444622, at *5 (N.D. Cal. Nov. 9, 2011) (finding the standard articulated in Highfields applied to anonymously posted online commentary criticizing the plaintiff’s organization).

Given that tons of people are pointing this out publicly, what possible reason could the DOJ have for continuing to push Twitter to cough up this info other than to just be assholes?

As for the second update: Shafer has appealed the decision of a magistrate just revoking his pretrial release. The filing, by lawyers Tor Ekeland and Frederic Jennings, is... quite a read (and even cites my articles). It certainly doesn't hold back:

The government accuses Justin Mark Shafer of putting an FBI agent and his wife in substantial emotional distress and publishing restricted information about that FBI agent with the intent to incite violence against him. But nowhere in the record, or in the discovery in this case, is there any true threat of violence against anyone. There is no explicit language articulating any kind of threat. The “restricted” information in question was a prior home address for the FBI agent, publicly available on the internet. This entire case is built on innuendo and speculation that withstands neither constitutional nor statutory scrutiny. It is a chilling example of federal law enforcement overreach, and has serious ramifications for constitutional free speech and due process in relation to the internet and computer law. If the government’s accusations in this case are a crime, then millions of social media using Americans are subject to the prosecutorial whim of the Department of Justice.

The factual bases of the government’s bare bones indictment are a handful of public tweets; a Facebook friend request and message sent to a public Facebook account; the following of a public Twitter account;1 and two emails to an FBI Agent – one with a 😊 emoji and another inquiring about the status of a report of a patient privacy violation. The Defendant made no attempt to mask his identity, and the FBI never contacted the Defendant to express any concern or to ask him to stop his communications. Instead they arrested him. And any claim that he engaged in a sustained course of conduct with a continuity of purpose to cyberstalk or threaten are ludicrous when compared to facts embodied in the case law regarding these statutes.

These accusations led to a pretrial release order so broad it functioned as a prior restraint on Mr. Shafer’s constitutional right to speak about the accusations made against him. When he sought to do so – through a post on his work-related blog – the magistrate judge revoked release, broadly interpreting the release condition terms and finding a violation of those conditions.

An innocent man—who the government has not charged, and cannot charge, with any violent crime, nor with any history of violent crime— is now in jail on the basis of protected speech.

I recommend people read the entire document, as it goes into great detail (even beyond my original posts) about the vindictive nature of the FBI's vendetta against Shafer -- not for doing anything wrong, mind you -- but for being upset that the FBI raided his house and took all his electronics twice for completely bogus reasons. And it's not just Shafer, but Shafers three kids who are now traumatized over the mutliple FBI raids, in which agents pointed weapons at the children, or denied their parents the ability to get the children out of their rooms for extended periods of time.

The children now suffer currently from trauma and substantial emotional distress as a result of the repeated armed FBI raids. The Shafers’ three-year old is now unable to sleep alone in her room. Their (now) six-year old is struggling and withdrawn in school, where he previously excelled. Their ten-year old is now afraid to be near open shades, for fear of being surveilled.... Their father has not come home since April 18, 2017, because he is in jail awaiting trial.

As for why Shafer has been in jail all this time? Apparently it's because he wrote a blog post about the case. You can read that blog post here. I wouldn't necessarily say that the blog post was a good idea, because he's clearly venting his anger about the arrest and the treatment by the FBI and Special Agent Nathan Hopp in particular. But it hardly meets the criteria of threatening Hopp or "contacting" him via social media. And yet, since Shafer was barred from either of those things as condition for pretrial release, he was brought back in and has been in jail ever since. That raises a whole new set of First Amendment questions. Shafer is in jail for blogging.

During the period of Mr. Shafer’s pretrial release, he committed no crimes. He used no illegal or prohibited substances. He neither fled nor attempted to flee. He did nothing that posed a threat to the safety of any person or the community. He simply wrote a blog post comprised of constitutionally protected speech criticizing his prosecution. (See Ex. C, April 14, 2017 Blog Post) For this he has been taken away from his wife and children.

Shortly after the blog post was published, Mr. Shafer received a notice of potential violation of his pretrial conditions of release.

On April 18, 2017, a revocation hearing was held before Magistrate Judge Toliver. The government referenced vague concerns regarding flight risk, and claimed that the blog post Mr. Shafer had written was evidence of danger to the community or violation of the no-contact order between Mr. Shafer and SA Hopp. The government argued at the revocation hearing that merely “criticizing” SA Hopp in the “blog site” [sic] was indirect contact. (Tr. 5:8-6:10 (Apr. 18, 2017).) At the close of the revocation hearing, Magistrate Judge Toliver revoked Mr. Shafer’s pretrial release order. He has been detained since.

More specifically, Shafer's lawyers point out:

The original terms of his supervised release violated his free speech rights under the First Amendment. Imprisoning him pre-trial based on his speech is unconstitutional. This current, unconstitutional incarceration before an adjudication by a jury of his peers hampers Mr. Shafer’s ability to put on an effective defense, as he is not free to diligently prepare for his defense with his attorneys due to constant monitoring and harassment in jail. This violates his Fifth Amendment Due Process rights and his Sixth Amendment right to mount an effective defense. Moreover, none of Congress’s narrowly prescribed exceptions to an innocent defendant's presumption of liberty apply here. Mr. Shafer should be released pre-trial under appropriate conditions because his current incarceration violates the Constitution and federal law.

Everything about this case is crazy. We've certainly seen overreach by the DOJ in the past, but this case seems like a pretty blatant example not just of overreach, and not just of the DOJ doing whatever the fuck it wants, but of it doubling down to violate the rights of people just because it doesn't like being called out about it.

Filed Under: anonymity, cfaa, disclosure, dissent doe, doj, fbi, first amendment, identity, justin shafer, keith lee, ken white, nathan hopp, popehat, subpoena, vendetta
Companies: twitter

The DOJ's Bizarre Subpoena Over An Emoji Highlights Its Ridiculous Vendetta Against A Security Researcher

from the lawlessness-under-the-guise-of-law-enforcement dept

Yesterday we broke the crazy story of how the DOJ issued a subpoena to Twitter attempting to identify five Twitter users, not because of anything they had done, but because someone else the DOJ disliked -- a security researcher named Justin Shafer -- had tweeted an emoji at them in response to a discussion about a different case. You can read all the details in that original post, in case you missed it yesterday. There was so much craziness in that story that I didn't even get to cover all of it. Some of those named in the subpoena have posted their thoughts -- including Ken "Popehat" White and Keith Lee. I suggest reading both, as the subpoena directed at each of them was particularly silly, given that both freely make their identities public. The DOJ didn't seem to do even the slightest research into the accounts it was demanding info on, or it would have known just how easy it was to "unmask" White and Lee.

As for the other three Twitter accountholders -- all of them are anonymous. But the DOJ certainly has zero legal basis for unmasking them. As we've discussed repeatedly in the past, anonymous speech is also protected by the First Amendment, and there's a very high bar for law enforcement to get past to unmask anonymous speakers. EFF's Kurt Opsahl pointed to a concise statement on this in a recent ruling in the Awtry v. Glassdoor case, which Lee also reposts in his blog:

The Supreme Court has recognized that “an author’s decision to remain anonymous, like other decisions concerning omissions or additions to the content of a publication, is an aspect of the freedom of speech protected by the First Amendment.” McIntyre v. Ohio Elections Comm’n, 514 U.S. 334, 342 (1995). Indeed, “[t]he right to speak anonymously was of fundamental importance to the establishment of our Constitution.” Doe v. 2TheMart.com Inc., 140 F. Supp. 2d 1088, 1092 (W.D. Wash. 2001) (citing McIntyre, 514 U.S. at 341-42). In particular, “Justice Black . . . reminded us that even the arguments favoring the ratification of the Constitution advanced in the Federalist Papers were published under fictitious names.” McIntyre, 514 U.S. at 342 (citing Talley v. California, 362 U.S. 60, 64 (1960)). So too were the responses of the anti-federalists, which were published by authors who used such fictitious names as “Centinel,” “Brutus” and “The Federal Farmer.” In re Anonymous Online Speakers, 661 F.3d 1168, 1172-73 (9th Cir. 2011).

Further, it is well-established that anonymous speech on the Internet, like other types of anonymous speech, enjoys First Amendment protection. In re Anonymous Online Speakers, 661 F.3d 1168, 1173 (9th Cir. 2011)(“online speech stands on the same footing as other speech—there is `no basis for qualifying the level of First Amendment scrutiny that should be applied’ to online speech”) (quoting Reno v. Am. Civil Liberties Union, 521 U.S. 844, 870 (1997)). As the Ninth Circuit has explained, “the ability to speak anonymously on the Internet promotes the robust exchange of ideas and allows individuals to express themselves freely without `fear of economic or official retaliation . . . [or] concern about social ostracism.'” Id.(quoting McIntyre, 514 U.S. at 341-42).

First Amendment protection of anonymous speech “is not unlimited, however, and the degree of scrutiny varies depending on the circumstances and the type of speech at issue.” Id. Political speech is considered to be “core” speech and is afforded the highest level of First Amendment protection. McIntyre, 514 U.S. at 346. Online messages such as the ones at issue here are also entitled to some level of First Amendment protection, even if the hurdle for overcoming that protection is less stringent than it is for political speech. See In re Anonymous Online Speakers, 661 F.3d 1168 at 1177; see also Highfields Capital Mgmt., L.P. v. Doe, 385 F. Supp. 2d 969 (N.D. Cal. 2005) (finding that identity of individual who anonymously posted derogatory comments about a company on an online message board was protected from disclosure under the First Amendment); Art of Living Foundation v. Does 1-10, No. 10-cv-5022 LHK, 2011 WL 5444622, at *5 (N.D. Cal. Nov. 9, 2011) (finding the standard articulated in Highfields applied to anonymously posted online commentary criticizing the plaintiff’s organization).

That the Assistant US Attoreny, Douglas Gardner, who signed off on the subpoena, either didn't know this or didn't care is hugely troubling and problematic. As Scott Greenfield colorfully summarizes of the federal agents involved in this case, looking at the details, "this situation is so utterly idiotic as to make one wonder how they can get out of bed without hurting themselves."

Of course, for White and Lee, this is mostly amusing. For the other three, it's likely that the DOJ will backdown, though it may cause them something of a headache in the meantime.

But the really crazy story is what's going on with Justin Shafer, the security researcher at the heart of all of this. As we explained yesterday, Shafer had exposed some bad technology practices by various dental software companies -- including fake encryption that resulted in an FTC fine -- and a wide open FTP server revealing private info on customers. The latter resulted in the FBI raiding his home and taking all of his electronics. That, of course, set things off on the crazy course leading to the emoji subpoena, because Shafer got interested in finding out more about FBI Special Agent Nathan Hopp (who Shafer initially thought was Nathan "Hawk"). As mentioned yesterday, I don't agree with Shafer's decisions and actions in trying to track down Hopp, but to argue that it was, in anyway, criminal Cyber Stalking seemed nuts.

Dissent Doe, one of the anonymous users whose info was subpoenaed by the DOJ, and who has worked with Shafer in the past to (ethically) expose breaches has a longer post detailing just how totally fucked up the DOJ's claims are against Shafer. It's even worse that we initially thought. In the criminal complaint we posted yesterday, we didn't even get into the earlier parts, where FBI Special Agent Ronnie Buentello tries to connect Shafer to a fairly well known black hat hacking group that deals in vulnerabilities and illegally accessed information, called The Dark Overlord. The Dark Overlord actually was in the press this week for accessing private info from a plastic surgeon who works with many famous people, and promising to release the info.

In the Buentello's affidavit with the criminal complaint against Shafer, the FBI agent tries to connect Shafer to The Dark Overlord, claiming that the dental database he had discovered available online was also found in The Dark Overlord's possession, and also presenting evidence of communications between Shafer and The Dark Overlord. It's not at all clear what that has to do with with Shafer's alleged "Cyber Harassment" of Nathan Hopp, but it's certainly presented to the grand jury in a way to make Shafer out to be a bad dude:

On June 29, 2016, FBI Atlanta (NDGA) opened a criminal computer intrusion investigation on an individual using the online moniker, "TheDarkOverlord," who claimed to have stolen 655,000 patient medical records and attempted to extort medical facilities he victimized. As part of their case, FBI Atlanta is investigating JUSTIN SHAFER as a co-conspirator of "TheDarkOverlord." Subsequent media reports confirmed "TheDarkOverlord" had posted the records for sales where he was seeking 60 Bitcoins ($39,782.00) for a Farmington, Missouri database of 47,864 records, which was found on JUSTIN SHAFER's computer during a search warrant executed on January 29, 2017; 170 Bitcoins ($112,200.00) for a Central/Midwest database containing 207,572 records; and 300 Bitcoins ($197,940.00) for a Blue Cross/Blue Shield (BC/BS) database containinng 396,458 records. Since his appearance in June 2016, "TheDarkOverlord" has claimed approximately 15 major computer breaches and the sale of one million customer PII records, and engaged in extortion of the victims across the United States, targeting medical providers, financial companies, large U.S corporations, and even a provider of cancer servcies in Indiana. In most cases, "TheDarkOverlord" extorted his victims with verbose, condescending, and abusive language, and taunted victim companies, their employees, and (in at least one case) the children of victim employees. "TheDarkOverlord" has carried out threats to release data when victims declined to pay, and has made implied threats to FBI Agents in Atlanta and New Orleans.

Collaboration between multiple FBI Divisions has subsequently identified significant links (IP addresses, emails, social media ccounts) between "TheDarkOverlord" and JUSTIN SHAFER. On January 29, 2017, FBI Dallas, FBI Atlanta, FBI Saint Louis, FBI New Orleans, and FBI Newark executed a search warrant at JUSTIN SHAFER's residence, located in North Richland Hills, Texas. At time of entry, JUSTIN SHAFER was logged into at least two different workstations in his home office and garage. During the execution of the search warrant, the FBI seized approximately 29 evidence items, including desktops, laptops, hard drives, router, several cell phones, numerous universal serial bus (USB) drives, CD's, and an Xbox game console. A chat session appearing to be with "TheDarkOverlord" was observed on a computer during the execution of the search warrant. In the months following the initial search warrant on May 25, 2016, several online media outlets published articles defending Shafer as a "security researcher" and admonished the FBI for executing a search warrant at his residence. SA Nathan Hopp was present for both search warrants that were executed on May 25, 2016 and on January 29, 2017.

Sounds pretty nefarious, right? Right. Except... as Dissent Doe points out, this leaves out a ridiculous amount of context that suggests that rather than collaborating with "TheDarkOverlord" (or maybe even being TheDarkOverlord as some might read the Buentello's account to suggest, Shafer had a long history of trying to expose TheDarkOverlord -- and, specifically to share the details of what he learned with the FBI.

What the FBI did not tell the court was that Shafer had emailed that very database to the FBI in July, 2016, telling the FBI that TheDarkOverlord gave it to him, unsolicited, duing a chat on Twitter.

So here’s “Exhibit A” for you: the email Justin Shafer sent on July 1, 2016 to this blogger and the Dallas FBI with the database the FBI would later claim supported a suspicion that he was a “co-conspirator:”

On July 1, 2016, Shafer emailed the Dallas FBI a copy of a database TheDarkOverlord had given him via Twitter. On March 31, 2017, the FBI claimed they found it during a raid of his home in January and never mentioned that he had provided it to them voluntarily in July, 2016.

Okay. But how about that supposed "chat session" that Shafer was having with The Dark Overlord when the FBI raided his house?

The affidavit referred to a chat session, but did not indicate whether it was a file copy of an old chat session or a new one in progress at the time of the raid. In fact, Shafer did have a number of private (DM) conversations on Twitter with TheDarkOverlord that Shafer logged. He often reviewed the logs afterwards, looking for additional clues in the material. Shafer generally shared his logs of the chats with this blogger and with others – including the FBI.

So now view “Exhibit B:” an email Shafer sent on July 3, 2016 to an NHS unit in the U.K. to warn them that they had been hacked by TheDarkOverlord. Shafer had been told about the hack in a private conversation with TheDarkOverlord and then tried to contact the NHS so that they could secure their data and warn patients. Shafer also cc:d Dallas FBI on that email, and included part of the chat log between him and TheDarkOverlord:

When Shafer learned that TheDarkOverlord hacked the NHS, he tried to notify the NHS and cc:d the Dallas FBI.
Part of the chat log between Shafer and TheDarkOverlord that was emailed to the Dallas FBI to alert them. The FBI would later suggest that finding chat logs on Shafer’s computers was somehow evidence that he was a co-conspirator.

As Doe points out, Shafer was even continuing to share information on The Dark Overlord with the FBi after the FBI had raided his house. Doe points out, a la Scott Greenfield's observations, that these FBI and DOJ folks don't seem to have the slightest clue what they're doing:

It seems the FBI couldn’t tell a white hat from a black hat. Or perhaps the Dallas FBI failed to share the information he was providing to them with the Atlanta and Missouri regions of the FBI and other regions investigating TheDarkOverlord. Despite TheDarkOverlord’s bizarre attempts to implicate Shafer or tease him, Shafer had always helpfully provided information to the FBI. What co-conspirator does that?

And do note that Shafer offered this help to the Dallas FBI in July, 2016 – even after they had raided him in May, 2016 and upset his children and damaged his property (he claims). He was still being a whitehat. What a shame that the Dallas FBI did not respond to him that way.

Now consider “Exhibit C:” If Shafer was a co-conspirator, why was he running around the internet trying to get TheDarkOverlord patient data dumps removed? Here’s an email from Mega.nz in February, 2017 thanking Shafer for notifying them and saying they suspended TDO’s account. It was not the first time Shafer had contacted them. And once again, Dallas FBI was cc:d.

File-sharing site Mega.nz thanked Shafer for alerting them to a data dump of sensitive information.

So beginning in July, 2016 and thereafter, Dallas FBI received evidence that Shafer provided to try to help them catch TheDarkOverlord. Does any of the evidence above look like someone conspiring with TheDarkOverlord or does it look like someone trying to help law enforcement catch TheDarkOverlord?

As Doe further points out, the FBI has all of this evidence. It chose to selectively present it to a grand jury in a manner that totally misrepresents Shafer's relationship to The Dark Overlord (and to the FBI, for that matter). It really looks as if the somewhat clueless FBI was just so focused on protecting one of its own -- Special Agent Nathan Hopp -- that it appears to have practically framed Shafer to the grand jury to lead to his eventual arrest and indictment.

And, on that note, in April of this year, Shafer was indicted (though, somewhat oddly, in a different district...) for the supposed Cyber Stalking of Hopp. The indictment, somewhat ridiculously, claims that Shafer "with intent to injure, harass, and cause substantial emotional distress" had "used and attempted to use, facilities in interstate and foreign commerce, including electronic mail and internet websites, to engage in a course of conduct that caused and attempted to cause substantial emotional distress to the victims."

Again, I think that Shafer probably went overboard in venting his anger about Hopp and posting some publicly available info about Hopp and his family. He also did reach out to Hopp's wife via Facebook -- which, again, seems dumb. But to argue that his messages were harassing seems like a stretch. The conversation was Shafer asking Hopp's wife to ask Hopp to return the videos of his kids that had been seized in an earlier raid. Again, this is a dumb thing to do, but it seems like a stretch to call it cyber stalking.

Meanwhile, another thing found in the original affidavit was a chat between Shafer and a friend of his, Darrell Pruitt, in which Pruitt responded "What an asshole" following Shafer's sharing some info on Hopp. Pruitt commented on our story, noting that his involvement meant that the FBI showed up at his office:

As a friend of Justin, he shared with me his suspicion of FBI Special Agent Nathan Hopp's (or Hawk's) perceived vendetta as it was happening. I responded, "What an asshole." And that was enough to warrant an unannounced visit to my dental office by two agents, whose questions indicated to me that they really didn't have a clue about the case they were prosecuting. I think they were disappointed that I actually didn't assist Justin in identifying Hopp, that I have nothing to do with TheDarkOverlord, and that no money had been exchanged between Justin and me... Thus went an hour of my life which I'll never regain - Not to mention that my first patient waited in my dental chair for an hour while I was asked pointless questions. I was even warned by one of the agents that "'I don't know' will only go so far." But it is the damn truth.

This whole story is crazy and bizarre -- but really raises serious questions about a DOJ and FBI totally out of control.

Filed Under: dissent doe, doj, fbi, justin shafer, keith lee, ken white, nathan hopp, popehat, security research, the dark overlord

DOJ Subpoenas Twitter About Popehat, Dissent Doe And Others Over A Smiley Emoji Tweet

from the our-tax-dollars-at-work dept

So, here's a fun one. Back in May, the Justice Department -- apparently lacking anything better to do with its time -- sent a subpoena to Twitter, demanding a whole bunch of information on a five Twitter users, including a few names that regular Techdirt readers may be familiar with:

If you can't see that, it's a subpoena asking for information on the following five Twitter users: @dawg8u ("Mike Honcho"), @abtnatural ("Virgil"), @Popehat (Ken White), @associatesmind (Keith Lee) and @PogoWasRight (Dissent Doe). I'm pretty sure we've talked about three of those five in previous Techdirt posts. Either way, they're folks who are quite active in legal/privacy issues on Twitter.

And what info does the DOJ want on them? Well, basically everything:

1. Names (including subscriber names, user names, and screen names);
2. Addresses (including mailing addresses, residential addresses, business addresses, and e-mail addresses);
3. Records of session times and durations, and the temporarily assigned network addresses (such as Internet Protocol ("IP") addresses) associated with those sessions;
4. Length of service (including start date) and types of service utilized;
5. Telephone or instrument numbers (including MAC addresses, Electronic Serial Numbers ("ESN"), Mobile Electronic Identity Numbers ("MEIN"), Mobile Equipment Identifier ("MEID"), Mobile Identification Numbers ("MIN"), Subscriber Identity Modules ("SIM"), Mobile Subscriber Integrated Services Digital Network Numbers ("MSISDND"), International Mobile Subscriber Identifier ("IMSI"), or International Mobile Equipment Identities ("IMEI"));
6. Other subscriber numbers or identities, or associated accounts (including the registration Internet Protocol ("IP") address);
7. Means and source of payment for such service (including any credit card or bank account number) and billing records.

That's a fair bit of information. Why the hell would the DOJ want all that? Would you believe it appears to be over a single tweet from someone to each of those five individuals that consists entirely of a smiley face? I wish I was kidding. Here's the tweet and then I'll get into the somewhat convoluted back story. The tweet is up as I write this, but here's a screenshot in case it disappears:

And, just to make it clear, here are all the users "in the conversation" on that tweet (since Twitter now buries at least some of that information):

You'll note that all of the names are the same names as listed in the subpoena above (as a point of clarification, the four users listed below were already in the conversation, so their metadata gets swept along, and then the tweeter, Justin Shafer, is also adding in @PogoWasRight to the conversation).

So, who is Justin Shafer, and what the hell is all of this about? Buckle up, because it'll take a bit of background to get around to this tweet (and, yes, it will still feel very, very, stupid that this subpoena was ever issued). First up: Justin Shafer is a security researcher, who has some history spotting bad encryption. Go back to 2013 and he had spotted a weak not really "encryption" standard put out by Faircom. Once it was called out as weak, vulnerable and not really encryption, Faircom rebranded it from the "Faircom Standard Encryption" to "Data Camouflage" since the reporting by Shafer showed that it wasn't really encryption at all -- but just a weak attempt at obfuscation.

Fast forward to late 2013, when a dentist named Rob Meaglia alerted some of his patients that a computer was stolen from his offices with "medical records and dental insurance information." But, Dr. Meaglia told his patients that the records system they were using, Dentrix, made by a company called Henry Schein, Inc., had all of that data encrypted. Except it appeared that Dentrix was actually using Faircom's "Data Camouflage" and not actual encryption. And, as that link notes, Henry Schein, Inc. had been informed of this problem months earlier, around the time Faircom admitted it wasn't actual encryption.

In May of 2016, the FTC announced a settlement with Henry Schein, Inc. over the claim that it "falsely advertised the level of encryption it provided to protect patient data." Kudos to Justin Shafer.

But, literally days later, the FBI was raiding Justin Shafer's home and taking all of his computers. This was not specifically about the Harry Schein case, but since Shafer had continued to investigate poor data security practices involving dentists, he'd come across an FTP server operated by another dental software company, Patterson Dental, which makes "Eaglesoft," a dental practice management software product. Shafer had discovered an openly available anonymous FTP server with patient data. Shafer did the right thing as a security researcher, and alerted Patterson. However, rather than thanking Shafer for discovering the server they had left with patient data exposed, Patterson Dental argued that Shafer had violated the CFAA in accessing the open anonymous FTP server. Hence the FBI raid.

Not surprisingly, Shafer was none too pleased with the FBI's decision to raid his home and take all of his electronics. In particular, it appears he was especially annoyed with FBI Special Agent Nathan Hopp (who he initially believed was actually Nathan "Hawk.")

Fast forward to March of this year, to an entirely different story: the FBI arresting John Rivello for "assaulting" journalist Kurt Eichenwald with a tweet. If you follow Techdirt related stuff, you probably remember that whole story. Lots of people, including us, posted the criminal complaint that was put together by one Nathan Hopp, a special agent at the FBI.

It appears that the Rivello arrest and subsequent news coverage suddenly alerted Shafer to the fact that "Nathan Hawk" was actually "Nathan Hopp" and Shafer began a bit of an open source "investigation" on Twitter. I wouldn't necessarily call the following tweets "smart," but Shafer, finally aware of the FBI agent who lead the raid on his house, started trying to find any public info on Hopp -- and his family. Now, searching out his family isn't great. But it does appear that he was just looking up publicly available information:

At this point, the FBI decided to start protecting its own. Seeing as the guy whose home the FBI had ridiculously raided a year earlier was now tweeting some info about one of its special agents, the FBI started putting together a new criminal complaint arguing that all of the tweets above amounted to "Cyber Stalking" under 18 USC 2216A. This seems like a huge stretch, because that law requires "intent to kill, injure, harass, intimidate, or place under surveillance...."

Either way, about the time all of this was happening, Ken "Popehat" White had started another Twitter thread about the Rivello arrest, leading Virgil and Keith Lee to respond about the criminal complaint, eventually leading Mike Honcho to note "Nathan Hopp is the least busy FBI agent of all time." It is to that tweet that Shafer replies with his smiley emoji and adds or cc's, Dissent Doe to the conversation:

And that takes us to 10 days later, when a new criminal complaint against Shafer is issued*, arguing that those tweets were criminal Cyber Stalking. And because part of that included his smiley emoji in response to the Popehat thread/Honcho tweet, the DOJ felt it necessary to issue a subpoena demanding basically all info on those 5 Twitter users (including Popehat, a former Assistant US Attorney whose info is pretty easy to find on Google). Perhaps the FBI somehow thinks that Shafer was really behind those other accounts or something -- but anyone with even the slightest level of competence should realize that's unlikely -- and that's got nothing to do with anything here anyway.

* As an aside, look closely at that criminal complaint against Shafer. I have no idea why but it appears that the FBI/DOJ is so clueless that rather than submitting the final complaint, they actually submitted the copy showing the "comments" on the Word doc they were using to prepare the complaint -- which shows two comments that both suggest the FBI is well aware that this complaint is weak sauce and probably doesn't meet the standard under the law... but this story is crazy enough without spending too much time on that.

Twitter is apparently fighting back against this subpoena. And even though it was issued back in May, a few days ago, the company alerted the individuals that the DOJ was demanding info on. Dissent Doe has already stated publicly a plan to move to quash the subpoena as well, and I wouldn't be surprised to see the others named take similar steps.

But, really, take a step back and everything about this situation is crazy. Going after Shafer the first time was crazy. Going after him again for supposed "Cyber Stalking" over a few harmless tweets was clearly just the FBI trying to protect its own from being embarrassed online. Then, to subpoena a ton of info on 5 totally unrelated Twitter users... just because Shafer tweeted a smiley face emoticon at them? What the fuck is the DOJ up to? Doesn't Assistant US Attorney Douglas Gardner, who signed the subpoena, have better things to do with his time, like going after actual criminals, rather than harassing people for tweeting?

Filed Under: cfaa, cyberstalking, dissent doe, doj, douglas gardner, emoji, encryption, fbi, fbi raid, justin shafer, keith lee, ken white, nathan hopp, pogowasright, popehat, subpoena, tweets
Companies: henry schein, patterson dental, twitter