Comment by wuliwong | Hacker News Reader

Comment by wuliwong | Hacker News Reader

Parent Full thread

I am not familiar with this case and was wondering what the FBI did to discover visitor IPs. My first thought was that it was done using javascript and they just nabbed anyone who didn't disable JS. But the article says "visited PlayPen and downloaded images from the site." This quote was used in describing how unlikeable the accused will be to the public and may not have been meant to be taken literally. So, I'm still assuming that it was javascript and not some weird thing attached to an image file.

--separate thought--

I actually haven't thought much about the legality of the Feds running JS on a visitor's computer. I never had any issues with it, even being a complete psycho-libertarian in the extreme. I understand the wording of this particular ruling is distasteful but ignoring that does running JS on a visitor's computer need a warrant?

I'm still pondering it but it seems similar to the Feds busting a store that was a front for selling drugs and then tracking everyone that went in that store.*

The analogy isn't perfect because in the computer case they are actually planting a "bug" in private property (assuming our personal computers are still considered private). Whereas in the drug case the Feds could simply follow these people to their homes and then they know their address.

The analogy can be made better if the Feds put a tracking device inside the drugs that the visitors to the "drug store" purchased. These people then are carrying the tracker into their own home, unbeknownst to them. Similarly the web surfers accessing the compromised site are downloading a tracking script onto their computer without realizing.

My intuition tells me that we want the Feds to need to get a warrant to deliver JS to visitors of a child porn site but not to get a warrant for each individual visitor.

I would be quite interested to hear people's thoughts.

* The use of this fictional scenario does in no way imply my support of the U.S. government's policies on the legality of drugs nor imply recognition of said government's ability to determine this for individuals. :-p

You agree with the judge in all aspects save the not requiring a warrant in the first place-- which i think is the only strange there here at all. The judge ruled exactly as you think. The defendant argued that the warrant lacked jurisdiction, being based in VA and he lived in FL. The rules of warrants allow for implanting of tracking devices in the jurisdiction and its ok if they are then taken out of the jurisdiction. the judge argued that you take a digital trip to Virginia's servers, download the porn, and then head back to florida with the contraband. This met the interpretation of the warrant issuing guidelines so it was a valid warrant under the rules. Further, the warrant specified who and what was to be collected: IP address, mac address and a few others. The IP address was actually provided by the client "voluntarily" when the rest of the payload came back. But the stretch--and just incorrect part, to me, at least-- is that the judge opines that a warrant was not necessary in the first part because the internet is known to be treacherous so everyone knows you can be hacked. He gives a big list of hacks, half of which were government actions, and then points out you can't have a reasonable expectation of privacy, and therefore its not an unreasonable search and seizure.

Indeed, I am in total opposition to the overarching spirit of the article where my personal computer is not my private property because I connect it to the internet.

It is funny to me to have to think about the physical location of a server that I am accessing being important. Like my fate depending on whether I was routed to a server in Georgia vs. Kentucky, something I absolutely do not think about whilst navigating the internet.

IIRC, in this case the FBI served up a "diagnostic" executable to users. Since they're using Tor browser, in general, simply enabling Javascript won't do anything to de-anonymize the user (unless the Feds had a TBB 0-day or something of the like). This executable obviously called out to FBI-controlled servers and provided a real IP.

Basically, the only people they ended up busting were people who for some reason decided it was a good idea to download and run an executable being served by their favorite CP site on the "darknet".

It seems almost unbelievable but I guess once enough people are offered an executable file, someone will eventually download and run it.

There is kind of a reasonable expectation for sites to run JS on your computer, if you don't use NoScript. I'm more inclined to believe they installed an actual rootkit, though. There are vulnerabilities in image libraries all the time, and people who are just technically proficient enough to download the Tor Browser can be tricked into downloading .exe files.

Yes, I think your first sentence captures what I was intuitively feeling.

Reply on news.ycombinator.com