Playpen: The Story of the FBI’s Unprecedented and Illegal Hacking Operation
eff.org
eff.org
First, they showed that the police here, got from some US organizations, access to some kind of realtime NSA style spying tools, they showed on tv that their software show realtime torrent data transfer worldwide, with pips popping up on a map in the entire planet!
Then, they decided to show one person, and showed on tv some kind of hidden teamviewer, they showed someone screen, realtime.
All of this already made me cringe, what kind of mass spying is US exporting?
Then the tv showed 3 people caught, showed their names, location, jobs, even filmed one guy house and his family inside...
1. One guy was an old man that wants help and avoid kids.
2. Another is a 32 year old unemployed that never his parents apartment, and never invite anyone, doesn't have friends or romantic partners.
3. Guy is 28 year old IT worker, no friends or girlfriend. used his work Internet because he couldn't afford broadband at home.
None of the 3 are in jail, they were only officially charged, and they don't have a trial date yet.
Then the tv points out that 70% of pedophiles in jail actually raped a child, and implied that those 3 maybe lied about never abused kids.
So, illegal spying, and guilty until proven otherwise? How these 3 will walk on the street now? All of them lived in smaller towns, and the tv station was the most popular tv station of the country.
Were they monitoring a single torrent file? Multiple? An entire tracker? Most BT traffic in the world?
Trackers will happily disclose the list of peers who are downloading, so it's not hard to monitor a list of torrents. That's how BT works. A lot of anti-piracy companies do it. Unless they were monitoring a massive amount of torrent traffic, I don't see why an intelligence agency has to be involved.
I understand they got a warrant for the server, but theydidnt get warrants for each user like they should have, so unless I am missing something, it's blatantly unconstitutional.
This is where some beltway establishment stenographers would say "but it was thousands, warrants would take too long!" Well tough fucking shit, you still have to get a warrant for each IP.
Unless there is some legal precedent someone wants to cite to me, which I have yet to see.
Mark my words, cp and terrorism and cyberterrorism (read: major bank hacks) are the things going to be used to increase the surveillance of the internet. If we dont stand up for the rights even of horrible people, its a slippery slope that will, not might bite us in the ass later.
First they came for the people who clicked on url shortners, etc.
Shit hell, I wouldnt be surprised if the FBI used this fishnet to spearphish people that had nothing to do with the site so they became targets.
eg: Send that pesky dissident an email with a link to this so that they pop on the autocomprimise tool and voila, dissident surveillance engine disguised as good guy cp catching program.
On a side note, I did some pretty extensive forensics training to be able to testify about stuff like this, and you would be utterly amazed at how many of the other "forensics specialists" were utterly incompetent. (for example, not knowing any other fs than ntfs...)
I haven't really made up my mind about the legalities of this case, it's quite tricky. I think the FBI should definitely have to disclose the NIT (both the exploit and the payload) to the defense, but I'm not sure about the warrant (Rule 41 issues aside).
Going to be used, future tense? Welcome to 2002... This has been the status quo for a long time now.
The state is following the age-old tactic for expanding their power and authority: go after people others won't speak up for in fear of being labeled one of them. It's exactly what the Martin Niemöller quote is about.
While I do not condone the behavior of these people or otherwise support their crime, kudos to EFF for being willing to stand up to the state on this. As we have learned, any liberty sacrificed to "law enforcement" agencies or sociopolitical elites will almost never be reverted. You'd think we would have learned that with the Patriot Act and "terrorism".
Probably doesn't help that you feel the need to mention this even when talking about the nature of the tactic used.
Not that it's a very nice thing to do, it's just self-interest.
You Game?
What if the FBI received a tip that Gmail users are hosting child pornography? Would they be allowed to infect Gmail users' computers?
If the entire purpose of gmail was to facilitate illegal sharing of cp, then yes.
(I gather that they also had discussion forums of some sort, but that the FBI only used the malware against people who visited the specific pages for child porn. So yes, it was targeted.)
I understand your point and I accept your observation that "mass surveillance" may not be the right definition of what happened in the Playpen case.
However, I invite you to consider the following: once (and if) there is a legal precedent where law enforcement agencies are allowed to hack the users of a given website, that legal precedent will be relevant in future cases, related to other websites that are not Playpen. Today it's Playpen, tomorrow it might be a community of activists. By then, I think you will agree with me, it will be much easier to consider that proper mass surveillance. And if you were one of those activists mentioned in my example above, good luck building your defence on the fact that "this provision can't be applied to me, because it was intended for child pornography websites".
This type of process has already happened in recent history, e.g. with "security" laws that were passed after 9/11. Those laws, in several ways, limit everyone's liberties, not just those of terrorists[1][2].
Of course those provisions seemed like a damn good idea soon after 9/11. Now, not so much. Erosion of freedom, just like natural erosion, has a way of progressing very slowly but steadily.
It's like a all-access pass to unlimited trampling of privacy.
This article was posted here 17 days ago by minamisan.
Yeah, why don't they just run a porn site full time? Is the limited duration an admission that they shouldn't use that method? Why not continue if it's so effective?
If so, is this illegal, and if not, why?
To those mad about the FBI overstepping privacy rights on shaky grounds: how could you possibly need more evidence than proof of visits to a website that distributes child pornography?
Are you saying that "think of the children" is a valid argument in the face of an existential threat to democracy?
The Federal Court has found the fourth amendment does not protect a home computer[1].
One might disagree with that, but claiming the FBI is "bypassing the very constitutional protections that each of its agents is sworn to protect" seems quite emotive given that an actual court found the exact opposite.
[1] https://www.eff.org/deeplinks/2016/06/federal-court-fourth-a...
Say this was not on TOR but the regular internet. Say I masked the URL of this child porn website with a popular URL shortening service and posted that link here saying "read this!" You click this link and are surprised and quickly close the page.
You visited a child porn site!
But now imagine in that ONE visit the FBI exploited an undisclosed vulnerability in your browser. Now they spy on your malware infected machine.
Would you be happy? I'm not saying this happened but it's possible when you allow this sort of activity to happen in your country.
But that isn't what happened here. Or even close to it.
A better analogy here is something like the FBI staking out an illegal dog fighting ring (which isn't exactly easy to get into in the first place) and then tracking the cars of people who visited it.
Maybe they should have to get a warrant, maybe not - I think there are valid arguments on both sides of that.
But let's not pretend these people didn't know exactly what they were doing. These aren't innocent people tricked into it.
You're probably right that these people weren't tricked at any point. But setting a precedent that it's ok for government agencies to inject malware and attack citizen computers seems like a very slippery slope.
Boobytraps, land mines, etc. are often banned because they attack people without discretion. Injecting malware into someone's machine just because they stumble upon an URL (be it .com, .onion, .xxx or .whatever) sounds criminal to me regardless of who is running the show.
I can't imagine what a warrant for this scenario would look like given it was on TOR? Who would it be issued for?
But the same argument holds true for general possession laws. Take some illegal images, plant it on someone's computer, phone in an anonymous tip, boom jail time for an innocent person. It's the whole problem with possession of anything being a crime. Same with drugs. Just accessing something is an even scarier thought.
This reads to me like: there's this bad area in town where drug dealers are known to congregate. Does that make every person who hangs around there, or even passes by, a drug dealer by association?
Furthermore, the FBI achieved their goal at the end of the day. Just because evidence is obtained illegally doesn't mean that people who distribute CP are just off the hook. Sure, that's abuse of power. But it's absolutely ridiculous for any sane person to argue that these people should walk free because the FBI overstepped its bounds.
I'm pretty sure his argument was that the site could have had other purposes.
>But it's absolutely ridiculous for any sane person to argue that these people should walk free because the FBI overstepped its bounds.
That's actually how the legal system does (and should) work. Look up "fruit of the poisonous tree"
But in this case it didn't. Not a single case coming out of it has claimed that it was some kind of mistake, or inadvertent visit or they were there to do something else.
> Just because evidence is obtained illegally doesn't mean that people who distribute CP are just off the hook.
In the U.S. that's exactly what it is supposed to mean. If the FBI, police, or just about anyone oversteps the law it's not admissible in court. There has to be a reasonable suspicion and motive to get a warrant - that could have been as easy as simply getting a warrant to host a Tor node and sniff traffic. They didn't do that.
Now, lets get to what's scary about your argument. What if all the sudden it was illegal to visit Hacker News? Perhaps it was declared that way by your new president Trump. Trump got sick of people "hacking" things, so instead of just blocking all the websites he decided he wanted to simply monitor all the users who visit hacker news, then charge all of them with "hacking". It is a hacking website after all... And, although our justice branch of the government was never consulted, i'm sure you'll find some CNN poll showing 40% of American's should be jailed for life for hacking.
Later on the news, someone in a suit will be saying "it's absolutely ridiculous for any sane person to argue that these people should walk free because the FBI overstepped its bounds."
.... Hence, as a democracy we all try to get along, and that includes respecting each-others privacy as long as there is not a reasonable suspicion we are harming others. It's there to protect democracy, not the pedophiles.
That question is misleading. What people is worried about is "How much power has the FBI to spy on ordinary citizens?". Even the worst authoritarian governments put assassins in prisons, but that doesn't justify their systems.
What we need is a balanced dialog about privacy. Yes, there are good uses to spying. Yes, spying is open to abuse from institutions and individuals for personal gain. Lets work inside the constitutional framework and create laws that empower good uses and limit bad uses instead. That's why we have separation of powers.
Quite frankly, I think that any person with these compulsions should be put to death. People with these compulsions are almost never "cured" of them and they cause unimaginable harm to society. A child who has been sexually abused is pretty much ruined as a person for the rest of his or her life. The rest of that person's life is a long, drawn out torture. And this is assuming that the predator lets the child live. Often they are killed by the predator since the crime is so egregious and there is no turning back.
I really, really do not care if the rights of these people were trampled on. Even if my machine was somehow collaterally infected with this malware, it would not bother me in the least if I knew for sure it was part of this investigation.
These "people" are beyond help. There is no reform if you have these compulsions. That is why, even after they have did their time, they must register as a sex offender and be restricted in where they reside. They should just be destroyed.
You may be expecting far too much of your government. My opinion is that if pedophilia became a mental illness treatable by execution, enemies of the powerful might discover that their hard drives had been filled with outlawed images without their knowledge, rather than just having convenient car wrecks or drug overdoses.
Why just murder someone when you can simultaneously discredit and vilify them?
If you truly believe that such people are too dangerous to live, the logical course of action is for you to go out and murder them yourself. Are you prepared to deal with the consequences of that? Would it be better to just hire a professional to do it on your behalf? Would that become more acceptable if the professional is a state employee?
Sexuality is something you can't re-wire. You don't get to choose your sexual desires and compulsions. You can't "pray the gay away." Some people are asexual and they are attracted to nobody (or thing, if that's what you fancy. No judgements). Similarly, you can't stop a pedophile from being a pedophile. The only difference with pedophiles is that they are wired to cause serious negative Utility, so the negative Utility brought by killing the pedophile will be less than the negative Utility the pedophile brings if they are left alive to continue to commit atrocities.
To say nothing that the level of hatred will only lead to pedophiles thinking through system is being rigged against them and thus be less likely to even try to live a non harmful life. Germany's program which does the opposite of what you want seems to be the far better method for ensuring the least amount of children are abused.
I call bullshit. If you put such a strong statement out there you better back it up. I'd like to supply you with a quote from an actual study:
"The prevalence of recidivating for another sex offense was low (13% or less) while nearly half of sex offenders did recidivate with some type of offense."[0]
[0] https://www.ncjrs.gov/pdffiles1/nij/grants/238060.pdf, pg. 13