Cock.li e-mail server seized by German authorities, admin announces | Hacker News Reader

Cock.li e-mail server seized by German authorities, admin announces

arstechnica.com

82 pointsaaronem62 comments

Interesting that they only took one of the disks. a) a more aggressive forensic approach would avoid the server to be shut down if at all possible (getting data in RAM or on encrypted partitions) and b) it is very restrained in comparison to other seizures.

I'd say that if they believed he were actively complicit or would do something to hinder the investigation, they would have been more aggressive, possibly went after machines in his home as well. Of course, if I'm right with this assumption, why didn't they contact him, but went directly for the server via the hoster. (I'm actually not sure how the law works with regards to seizing data vs seizing the (probably provider-owned) media it is on)

Also, I guess the "just take one of the RAIDed disks" in this way is only possible if you run a server provided by a known hosting provider, were it isn't the first seizure for both police and provider. The provider knows how the servers are set up, law enforcement trusts that the provider just wants to get everything done as quickly as possible.

"I'd say that if they believed he were actively complicit or would do something to hinder the investigation, they would have been more aggressive, possibly went after machines in his home as well."

My thoughts exactly. His reputation of cooperation might have helped him out here. Nice of them to leave enough stuff to keep the service online. Many small-time operators hit by FBI over here aren't so lucky. They'll take down a whole colo worth of clients sometimes.

http://pastebin.com/raw/YuU6931t

"We have a confiscation order for the disks of your server, but we were allowed to leave one of them installed, due to the fact that you have a Raid1 setup."

Discussion on 8ch.net: https://8ch.net/tech/res/473045.html

> I have no idea why this is happening."

I'm very sure he does. It's been explained thoroughly.

Care to share with the rest of the class?

What? You mean you didn't read the article?

> Cock.li was reportedly used last week to send a bogus bomb threat e-mail from "madbomber@cock.li"

Of course they are going to take records (and from the files of how very unlike-the-US-can-the-germans-be) leaving the system running and intact. If you didn't read the US news about the trouble it caused, go back to skimming headlines.

How, exactly, did German authorities come to decide that California has jurisdiction in Germany? Was this pursuant to MLAT?

Presumably, threatening to kill people is a crime in Germany, so the German police had the authority to open an independent investigation.

Are you saying that one should be allowed to threaten to kill people in one country from another, and not be held accountable?

Are you saying that asking how something works is the same as saying the same thing happening is horribly wrong?

Don't pretend you don't know that "How, exactly did X happen" doesn't indicate that you disapprove of X.

No, he definitely was not saying that.

That seemed to be the implication.

OP specifically asked if it was pursuant to an MLAT obligation. That alone makes it clear they were asking in earnest.

And yet OP also asked how California had jurisdiction in Germany, which implies that the question was more of a passive-aggressive disapproval. Even if it was MLAT, California still wouldn't have jurisdiction in Germany. OP seems to be implying "fuck off California, you have no jurisdiction in Germany".

The whole thing seems to be more about shared moral responsibility rather than MLAT, which is what s73v3r was getting it.

Really? Cause that sounds exactly like what he was saying.

cock.li. The proud owner of nigge.rs, horsefucker.org and goat.si.

RIP in peace

The "anonymous mail service with offensive names" could be made a standard indicator of a country's freedom of speech status.

Actually, that'd be a good research project: setup and host such a service in as many countries as possible, wait as they get shutdown (+6 points)/subpoenaed (+3)/ddosed (+1) and make a map.

Not responsive or relevant to this situation, in two very important ways: first, this isn't just any email service, a threat which cost millions of dollars was made from this service. Second, and more crucially, the service was NOT shut down.

I'll just answer by emphasizing two words in the comment you replied to.

    a threat which cost millions of dollars was made from this service.

...anonymous mail service...

    the service was NOT shut down.

...wait as they get shutdown (+6 points)/subpoenaed (+3)/ddosed (+1) ...

> a threat which cost millions of dollars

It was the reaction to the threat which cost millions of dollars. We should be careful to distinguish between the costs of terrorism and the costs of our reaction to it.

You might think differently if you were responsible for those children. Do you want to take the risk that it might be a real threat? How do you tell the difference between a real threat and one that isn't real? I'm guessing the people at the school district thought the small risk wasn't worth it, and decided to close the schools. Who would want to be labelled as the person who didn't close the schools if someone ended up getting killed? Even if the threat seems implausible, it must be a very difficult decision to make. There have been many bomb threats recently, probably mostly implausible, but for every one of them the airline acts as if it might be a real threat.

You might not, too. The LA district shut down. The NY district, which also received a threat, did not. Why? And why the difference in response?

I'm aware of that, and I don't know the answer. All I'm saying is that it was not necessarily unreasonable.

Why a difference in response? A few days earlier, less than 100 miles from the LA school district, 14 people were killed by ISIS-inspired terrorists who also had a garage full of pipebombs. What administrator in their right mind wouldn't be extra cautious with specific threats?

At a security conference a couple of years ago in Melbourne, a speaker said that for entertainment, he used to set up a Tor exit node and time how long it took to get the not-legally-enforceable ceast-and-desist letter from the authorities. Apparently he had it right down to a couple of hours.

Seeing as he's yet to be accused of anything except being a community-minded sysadmin with a low sense of humor, I'm not sure a mere lack of taste excuses the extremely unsympathetic media attention that's been focused on the operator of this service in the last few days.

I use the provided mail service (@tfwno.gf) explicitly due to how transparent he is. Same reason why I used and donated to pomf.se before its closure (different person).

If the only people who care about users and practice active disclosure of subpoenas are people with low-brow humor, so be it, I'll continue to support them.

Also a quick note there is a bit of misinformation floating around. He doesn't own many of the domains, he just runs the mailservers for them.

Nobody is accusing him of anything other than hosting some poor joke domains. However, his domain was the one that the emails threatening several school districts came from. And while I'm sure they don't think he's the culprit, his server would still have some evidence on it.

Have you seen CBS's [1] and the Daily Mail's [2] hit pieces on him? Of the latter such flagrant nonsense is to be expected, but one generally doesn't expect to see CBS descend to the same level.

[1] http://losangeles.cbslocal.com/2015/12/18/cbs-news-maine-nat... [2] http://www.dailymail.co.uk/news/article-3367044/Maine-colleg...

That wasn't from CBS, it was from a local TV station, which is quite different.

It says "CBS News" at the front of the headline. If they aren't inclined to make the distinction, I don't see why they deserve the benefit of the doubt from me.

That's crediting this story as a source:

http://www.cbsnews.com/news/police-given-email-account-infor...

If the same article were published on Abc.com, putting a credit in the headline would be similarly useful, and it would obviously be ridiculous to say that CBS was then responsible for the content of the article under the headline (in this case, it seems that CBS Radio is responsible for the content though)

And? KCBS isn't an affiliate; it's owned and operated by the network. The difference in domain name is purely cosmetic; if CBS corporate weren't OK with the content of the story, the story would no longer be online, if indeed it had ever been published at all.

The difference between the entities is largely cosmetic, but it simply isn't accurate to say that "CBS News" is responsible for the content of the article that you linked. As I pointed out, CBS Radio is, so as you say, that points to "CBS corporate" still being responsible, but it's more fair to the people working at CBS News to not mis-attribute the story (I used the abc.com example to try to make it clearer that conflating a source mentioned in the headline with the attribution is a mistake).

edit (which I see you only said CBS, I got lost in the depth of the thread.)

I've pretty much assumed all large news corps are the same. Pointless to even read them anymore - finding reliable news is getting harder.

Point of order: gratuitous use of the word "nigger" is not a joke. Jokes are funny, or at least attempt to be funny. This doesn't qualify. This is something other than a joke.

It doesn't qualify because you said so, really?

This is something else than a joke, because?

Speculation and assertion is not an argument.

If a statement is a joke is not defined whether someone finds it is funny or not, but by its intention. We don't all laught at the same jokes do we? In this case, we don't know the intention behind it, or at least our two comments didn't reveal it.

(It is so sad to see preconditioned impulsive disagreement, just because certain words are discussed from a neutral perspective)

"nigger" is never neutral (except when it comes from the mouth of black rappers but that is the exception to the rule).

Words were not "discussed", here, in any way, let alone a supposedly "neutral perspective". Pay attention to detail. It counts.

He doesn't seem to be serious, but I don't think one could really call the domain a "joke". It's using a word who's sole connotation is as a racial slur.

And i don't see why there shouldn't be impulsive disagreement, considering how terrible the word is.

Most people find it funny to offend people they don't like, just deal with it.

There's a whole chunk of black comedy and hip hop that didn't get that memo. Seems to me like it's one of those things where it's funny or not depending on the audience's personal beliefs. Along with speakers skin color. Which means there's probably nothing concrete to your statement past normal biases and judgments of human groups.

Nope. Hip hop is not relevant here. You are not paying attention to the context. I actually have no problem with rappers and hip hip artists using the word in question.

I was making a statement of fact, which is valid no matter how many downvotes I get: this guy just named a domain "nigg.er". That's not a "joke". It doesn't meet any definition of what a joke is. It's using a word to be gratuitously offensive. It doesn't matter what his motivation was; it doesn't rise to the level of a joke. I'm not saying that because I find the word offensive, I'm saying it because simply naming something "nigger" is factually not a joke. I'm not sure what you call it, but I am sure that you don't call it a joke. :)

Glad you clarified your position. So, it boils down to the use of the domain in isolation. There's a type of humor that covers that depending on his intent (& only with that intent). I can't recall the name but it's contrarian, controversial, and a bit trollish. The idea is you pick a taboo word or activity to use in a way that causes no harm. Then, people rally against you over it. Then you laugh at them for their wasting time on it.

Alternatively, a form of this draws attention to how much true evil society tolerates under banner of "acceptable behavior" while they put energy into calling out harmless domain names that should get an eye roll at someone's stupidity at worst. These domain names probably received far more hate from certain people than any carcinogen-filled product or even laws that re-enforce things that hold blacks back. Some get virtually no complaints but taboos almost always do. Ya think? ;)

Note: I don't like the domain name(s) for the record. However, I think it can be a joke or a tool of activism in certain situations. I don't know if contrarian, taboo-oriented humor or calling out people's BS was the goal here.

Note 2: I forgot to add I'm big on the second paragraph's version of this kind of humor. I call out self-righteous pricks all the time with it. Includes use of "the N word" in the positive ways blacks use it. It's just too effective at finding most judgmental & often (not always) hypocritical folks. :)

It's shock humor. Whether you perceive it to be subjectively funny doesn't affect how others see it. You could call it childish, but it's still a joke.

Tor browser. The proud enabler of child porn industry.

I'm pretty sure there's more child porn on P2P networks, Usenet and the just over private internet forums/sites than on TOR.

My point was, just because there exists one (perfectly valid) objection to Tor, it doesn't mean the project as a whole is negative and should be shut down (what the parent seems to be implying about this email provider).

I would bet that maybe not, but a disproportionate number of darknet websites is.

P(darknet | child porn) might be low, as you are suggesting, but P(child porn | darknet) >>> P(child porn | clearweb), in orders of magnitude.

This guy deserves to be in jail. I am DISGUSTED at a human like this roaming free after threatening to hurt millions maybe even BILLIONS of children! Shame on this man!!!

Imagine if this was regular mail.

It's the equivalent of German seizing private mail from EVERYONE that uses the hypothetical Cock Postal Service because one individual used that same service in the US to make a threat.

This is ridiculous. Outright abuse of power and invasion of privacy. Yet another reason to encrypt everything.

It's more like seizing the customer records from Cock Postal Service (presumably operated by James May).

My guess is that the fact this guy ran the operation from his bedroom, and they weren't sure whether he would co-operate or not, was the reason they seized the disk rather than just subpoena him. Presumably if it was hotmail or gmail this wouldn't have happened.

I think it's good that this scumbag cocksucker is going to get his commuppence (I'm talking about the idiot who sent the email, not the guy who runs the cock email service). He's obviously a bit of an idiot to use an email service that says "will report any illegal activity to the relevant authorities" rather than one that is actually properly encrypted (if such a beast even exists at the moment -- they seem to all get DDoSed out of existence by China or similar pretty quickly).

I think it sucks that all ~65,000 other people have their data seized because of him, though.

The fellow running the service ran it on a German hosting service (https://www.hetzner.de), and not his bedroom. Full cooperation was provided by everyone, following in the letter and spirit of the law.

It just really sucks that the German authorities took it upon themselves to take the entire thing.

He managed it from his bedroom.

If I telecommute, I manage hundreds of servers from my bedroom. I don't see the issue here.

I also manage servers from my bedroom. If I set up a cock-based email service from my bedroom, I wouldn't expect to receive the same credibility as the likes of gmail or hotmail.

>My guess is that the fact this guy ran the operation from his bedroom, and they weren't sure whether he would co-operate or not, was the reason they seized the disk rather than just subpoena him. Presumably if it was hotmail or gmail this wouldn't have happened.

Is this somehow supposed to be acceptable? "We weren't sure you would come down to the station and answer some questions, so we arrested you (without charge) and held you for a day."

Isn't it normal for police to seize evidence in cases like this? Your comparison doesn't seem very helpful, as there is a big difference between holding someone at a police station vs seizing evidence.

I admit there is a big difference between someone's property and someone's liberty. However I still don't feel it's justified to potentially invade thousands of other user's privacy in order to gather evidence, especially since they could have subpoenaed him and he has a history of complying with such requests.

It sounds like someone doing an experiment to see if he can get the government to take down a server.

Much more efficient than DDoS attacks.

Simply find a way to make the domain seem suspicious.

Reply on news.ycombinator.com