New Charges in Huge C.I.A. Breach Known as Vault 7
nytimes.com
nytimes.com
Very interesting! It almost seems like the pornography charges against him was a way to punish him but without prosecuting him for the actual leakage. Perhaps the government wanted to still point the fingers at someone else or avoid embarrassment?
Take the likelihood that a leaky contractor coincidently is a pedophile. One who works in security yet encrypts stuff with the same cellphone password everywhere.
Balance that with the possibility that a motivated state actor could plant such files on a pc or alter logs on a server they are monitoring.
Coincidentally also, it is very much sufficient for a jury to convict yet the accusation is ambiguous/obvious enough to deter other would be leakers.
I have no idea whether this is a good way to do things but it's a pretty widespread set of coincidences that would also happen to have a particular effect.
Not using a weak password is like security 101 first 5 minutes of the first class type of knowledge.
Im sure im not the only one buying this story.
P.S. The description does seem to describe a password manager: "Specifically, the Cellphone Examination identified various passwords that had been input by the user of the Cellphone to, for example, access the phone, applications on the phone, and/or certain websites."
We have wi-fi routers being used to passively see through walls, with enough fidelity to read lips and record finger movement.
Put someone under a microscope long enough, and every single password they use will reveal itself. Whether locked behind a manager app (sooner or later you'll snag the master password for it) or directly entered.
That’s terrifying. I had no idea that was possible despite it being published years ago and trying to keep track of technology like that: https://ieeexplore.ieee.org/document/7384744/
1. Schulte agreed as a condition of his pretrial house arrest not to own, possess, or use a computer or any other form of internet access. Surveillance showed internet connections from his house, accessing his personal email as well as the TOR network.
His attorneys argue that these connections were Schulte’s cousin (who lives with him) checking his email (and TOR?) on his behalf, which after all the Court never said he couldn’t do.
2. At his bail hearing, the prosecutor mentioned a photograph (apparently recovered from Schulte’s phone) showing an unconscious person (apparently Schulte’s roommate) being sexually assaulted (apparently in their shared bathroom). The identity of the assailant having not being established, this wasn’t taken into consideration at pretrial. But...
Since that hearing, the cops in Virginia followed up and have a reasonable suspicion that the person seen in a photograph on Schulte’s phone, sexually assaulting Schulte’s unconscious roommate, in Schulte’s house, might indeed be Schulte himself. So it sounds like he’s facing sexual assault charges in Virginia, as soon as his federal child-porn-cum-treason prosecution gets sorted out.
So... well, even if these additional allegations don’t change your perspective on his character, they proooooobably cut against any presumption of doubt based on dude’s mastery of opsec.
Sorry, when did they "turn out to be a setup?"
This matter of fact phrasing implies evidence beyond a shadow of a doubt exists which should be commonly known, so if you could cite that, it would be appreciated.
https://www-m.cnn.com/2017/05/19/europe/julian-assange-swede...
“Arrested on suspicion” (and “skipping bail”) being separate to that.
There are two women. One posted on Twitter the next day boasting about the awesome night she'd had with Assange. She later deleted the post but others had recorded it already. The other woman sent lots of text messages saying she wasn't raped and only reported Assange because she wanted him to take an std test, that the police had blown it up and seemed to want to get him.
http://mobile.abc.net.au/news/2016-12-07/julian-assange-goes...
Moreover the women only filed these charges after they met each other and realised they'd both slept with him.
Look, I don't know why you're being so skeptical about this. False reports of rape are extremely common. Most credible studies I've seen peg it at 50% or higher. You should never take such an accusation at face value before a case has been won and in this case we don't even need a trial - the women both created documentary evidence they were lying and one even attempted to destroy it.
The burden of proof is on the commenter posting the claims.
The article linked in the parent merely is a description of Assange's own statement, his side of the story, which certainly has no more credibility than the alleged victim and the legal authority. For example, regarding Assange's claims about text messages, the article makes a point of saying, "The ABC has not seen the text messages."
> the women both created documentary evidence they were lying and one even attempted to destroy it.
Again, any credible evidence? Surely this story would be in the NY Times and other major publications.
> False reports of rape are extremely common. Most credible studies I've seen peg it at 50% or higher.
I don't agree and I've never heard of such a study. We also are not talking about 'reports' by alleged victims, but an indictment by legal authorities after they examined the evidence. Again, perhaps the parent can provide some the evidence they say they've seen supporting this extraordinary claim about rape accusations, because false claims on the Internet are certainly even more common.
The burden of the person who wants to learn rather than argue is to do research for themselves. I don't care whether you believe me or not - I mean, why would I?
It's the new "tax evasion."
https://www.scribd.com/document/379346745/Joshua-Adam-Schult...
He apparently saved IRC logs of their entire quest to obtain child porn....?
Using his name as a handle?
Impossible? No, but do you really think this is not questionable at all?
"No your honour, we lost the evidence since then."
You don't think they can't fake a VM?
It shouldn't be beyond the realm of believeability to this bad actors created these charges in retaliation.
Your rights go out the door, and your digital life probed endlessly.
It's not impossible, but it was pretty convincing to me.
Why are you convinced the presence of a VM in this is significant?
I mean, think about it: if you were the defendant, all you'd have to do is have someone examine it and find inode activity when you had a clear alibi that the government didn't know about (which would be easy, given we're talking 8 years here, he'd just have to find when he was on a date or out to dinner or something, the government isn't going to know his entire life history for 8 years), and you'd be well on your way to creating enough doubt with a jury.
Now, it's possible the government is lying, but if they're not, it strains credulity to think that they'd go to the effort, cost, and risk to fake that VM in such elaborate detail. If they wanted to ruin his life, there are hundreds of easier ways to do it than such an elaborate fraud.
What you are now saying is that it's implausible that the CIA would be able to fake logs (and that's what we're talking about with inode data) on a VM for some reason. It would absolutely not be as simple as "have someone examine it and find inode activity when you had a clear alibi" because it is very likely the guy was actually using a VM legitimately. All the CIA has to do is establish that he was in possession of child pornography. Hell, they don't even need to prove it beyond a reasonable doubt if A) the jury, defense, prosecution and / or judge is not tech savvy to understand some of these concepts, and B) if their goal is to trash this guy's life and have it be a warning to other leakers. You don't even need a conviction for that.
It does not strain credulity at all to think that the CIA would go to the effort to fake a small set of data on a VM. The "elaborate detail" is not any more elaborate than in any other instance -- it would be trivially easy to forge. If they wanted to ruin his life, this is a perfect, practical way for them to do it.
The fact that they would forge this data on a VM makes it seem even more plausible to people who don't even understand what VMs are, or how one might fabricate logs like that. It's apparently working on you right now, and you're savvy enough to know about the existence of inode data. You're apparently ready to condemn this guy despite the ludicrous amount of circumstantial evidence that maybe this guy is being set up by an organization literally dedicated to covert operations of this nature, who have even go so far as to detail exactly how they would undertake this exact kind of operation.
There are plenty of ways that happens even accidentally though, a prosecutor would be able to knock out that claim easily.
You've never seen a Linux machine write entries to the system log with the wrong timestamp? It happens all the time on machines with no RTC (Raspberry Pi) or a dead battery.
Pages 3-6 detail the VM. Basically, they found a VM on his computer that was encrypted, with an encrypted file in it, that they unlocked with a password they found on his phone. In the encrypted (truecrypt) file, they found a large amount of what was unmistakenly CP. When they examined the file system, their claim is that there was evidence of a history of using that VM and moving those files around, etc., so it's not like they just appeared one day. Partial files that weren't deleted yet, caches, inode meta data, that sort of thing.
I mean, it's possible to fake, but it would be incredibly easy to fuck that up, and incredibly risky to get caught doing that. If they really wanted to make his life hell, there are easier, less risky, and even legal ways to do it without going to the effort to fabricate 8 years of computer usage that would withstand expert cross examination.
Maybe, but how hard would it be to convince a tech-illiterate jury of that? Is there a lawyer on earth that could explain the minutiae of metadata on virtual machines to one? And if they get caught, they go "oops!" and pay out a few million dollars as a sorry, at best.
Of course, nothing says they wouldn't be cooperating in this.
ps. How would one know enough about the scene to motivate such skepticism?
https://dd80b675424c132b90b3-e48385e382d2e5d17821a5e1d8e4c86...
To me, it would be like being in a warez channel full of people saying, “I want pirated material.” That at least I have experience with, and someone saying “Where the copyright violations at?” Rather than “any good ftp’s and xdcc’s?” Would raises red flags.
Oh really, and did you ask how it is that IRC logs from 2009 just happened to be sitting in someone's back pocket?
It is actually quite obvious from the conversation that "STURM" is a CI or other operative who is trying to entrap "JOSH".
If this guy was breaking the law back in 2009 why did the CIA hire him exactly?
Maybe we should be investigating how law enforcement and intel agencies use child exploitation and child pornography to entrap people, and how many of the people involved in those ops have "inclinations" that trend in that direction.
Then we might find some real criminals.
Meanwhile all of these leakers having some sort of cp charge is a significant enough to look deeper into what is going on.
Really.
Does that sound like something anyone would ever expect to return fruitful results enabling criminal activity? Does anyone imagine this being the sort of thing a person operating an encrypted server would do either deliberately or inadvertently? And what would it even mean, to have that in Google search logs?
Here on HN, to most of us, figure it means less than nothing. On some level, it might actually harm the authenticity of the prosecution's technical credibility.
I'd imagine the goal of the prosecutors though, is to select the most technically inept grandmas, to pack the jury with.
Reminds me of: https://www.youtube.com/watch?v=SYkbqzWVHZI
Those charges were Swedish.
The fact that they found child porn on his computer is the scariest part. Almost any technical person could frame almost anyone else with CP possession. It's just a matter of putting some files on a computer and/or faking some logs, browser history, etc.
It would be incredibly trivial for the CIA to put CP on his computer and then use that as a method of getting him into custody. A rogue agent could do it without anyone else knowing.
The frightening aspect of CP possession is that there's basically no one willing to even hear out a person charged with the crime. It's the perfect thing to frame someone with precisely because it's so revolting and hard to disprove.
CP possession laws should be changed to put much more onus on the state. It possibly should not even be a felony to merely posses simply because of how hard it is to prove beyond a reasonable doubt. Production of CP is clearly the main problem and far easier to be confident in prosecuting.
Combine this with the very specific ad targeting that is possible to pull of(like the guy that managed to make FB to show his ad to his roommate) and you get an easy and remote way to frame people
There are also extensive file system logs indicating a history of use. That was faked too?
And the IRC logs, those are fake?
Come on man.
Extensive file system logs are also easy to generate. They could also be legitimate access logs but the VM itself was compromised by the CIA.
IRC logs are literally a text file. It would be extremely easy to fake those as well.
Do you really think the CIA is incapable of doing something like this? Hell, if I were able to obtain the password used to encrypt the VM (easily within the realm of possibility with CIA resources) I could do each one of these things myself.
The CIA has many extremely clear motivations to set this up, and they absolutely have the means to do so. They have also in the past been caught doing far, far worse. In addition the Vault 7 leaks contain instructions for doing exactly what many suspect here -- planting something like CP covertly in order to frame someone.
Come on, man.
There was a case, I do not remember in what country where a guy was accused of child pornography because of his IP address and later was found that someone in police made a typo and they had the wrong IP.
Maybe the traffic logs are not enough to put you in jail but the accusation itself could destroy you and your family.
I realize these claims != guilt, rather that a lot of these comments are arguing how easy it would be to get caught up in existing laws. That's not what's claimed here; if true this guy is a collector.
If this is a setup, it's beautifully orchestrated.
I was afraid to open the comments here. Very happy I was wrong.
You're going to need resources too, if you want access without leaving a trace, TBH I can't see how you can do it remotely (ie at a distance) without cracking the targets upstream ISP. Otherwise their logs of incoming connections from whatever anonymous relays you've used are going to implicate an external attacker, which would tend to corroborate the targets innocence.
In the case of "Josh" other people's links show IRC chats where the other end is confirmed from capture of another perp. Also that his personal phone has the passwords on; that he said the encrypted data was his and that no-one else had access. If the evidence presented is true it seems pretty hard to setup without him being party to the whole thing.
The guy is clearly guilty.
It strains credulity to think that the government planted an encrypted VM with an encrypted file with a password known only to the defendant, faked the entire usage logs, and faked an extensive file system logs to match a pattern of use that would be incredibly difficult to do correctly. It’s just not believable, nor is there any suggestion as to government motive that would risk such an incredible violation of the law if they were caught.
We can play theoretical exercises all day, but the fact is that the evidence as described is incredibly damning.
No consequences. No one pays attention. No fear.
If you know anything about downloading hugely illegal material you will keep your mouth shut because the claims there are completely laughable, but you don't want to admit you've been downloading hugely illegal material that would get you jailed/killed.
To the average person it sounds reasonable because they are an idiot.
To anyone with half a brain even downloading the pdf without doing it through tor, copying it to an air gapped machine, and reading it there is such a huge breach of security you wouldn't be out of prison if you ever did it.
And that you find that more believable than that someone could just happen to be both a security expert and a pedophile?
Do you realize he wasn't caught because of his security lapses? The found the VM because they raided his house for a separate matter. Every indication is that, with the exception of using a password he stored on his phone (which, read the indictment, he clearly realized during the interrogation that he had made a mistake), the government would have never found this VM of his.
He did take the steps you suggest, and it didn't matter, because they raided his house, and he made a single, and easily understandable mistake: he stored the password he used for the VM somewhere where someone could access it digitally. If he had just memorized the password, they would have very likely never broken that encryption.
At this point, we don't know that it will. That's making the argument out to be stronger than it is.
It should also be noted that he did take precautions, many of them, and the VM was only found after they seized his computer for a separate matter. Without that there is no indication they would have ever found it.
So yes, it would seem you have reached a forgone conclusion a while ago and have been working backwards since. For the record I don’t think that you’re a shill, just a sincerely uncritical individual when it comes to the machinations of both criminal justice, and state intelligence apparatuses and their history.
Is that better, mate?
Could he be innocent? Sure. Could the VM be a plant? Sure. Could the government be lying? Sure. And that is why we have a justice system.
But just because something is possible, or you can come up with an explation of why something may exist, doesn't mean it's probable, and doesn't mean it's likely.
And for the record, since you seem to think you know all about me and my government-shilling ways, I was protesting the war at MIT before you were even born, and I actually think this guy is innocent of the leaking charges. I also happen to think he's very likely guilty of the CP charges.
By the way, do actually have any evidence whatsoever that would imply the government planted that VM, other than some theoretical argument? Because for all your bluster about rationality, I don't see you presenting a shred of evidence to suggest that this didn't go down exactly how it was presented in the indictment.
Did you miss me specifically saying that I didn’t buy into the shilling thing? Please don’t claim that I said or implied something I went out of my way to disavow.
I was protesting the war at MIT before you were even born
Holy shit, you know how old I am?
and I actually think this guy is innocent of the leaking charges. I also happen to think he's very likely guilty of the CP charges.
I think the opposite is true, but I’ll tell you what, I’d never reach either conclusion with so little information available and it all coming via one side. A prosecutor looking for an indictment isn’t an unbiased viewpoint, just like a defense attorney speaking on behalf of their client isn’t.
Wikileaks is a news organization, not an anti-secrecy organization who's First Amendment Right to Freedom of the Press has been illegally infringed upon by the US Government.
No, they publish classified documents. What they do is more akin to public espionage than journalism.
I understand people want to lionize Wikileaks and consider Julian Assange to be the modern day equivalent to Woodward and Bernstein, but to consider what they do journalism is to discredit journalism. There's a reason Edward Snowden went to the actual press and not Wikileaks.
Even better - Senator Gravel, doing his job, brought them into Congress .. something that was necessary, because the press was compromised and wasn't doing their job.
EDIT: downvoters aren't offering a response, so I'll just hope or assume that they want evidence:
[1] https://foreignpolicy.com/2017/08/17/wikileaks-turned-down-l...
[2] https://www.theguardian.com/news/2016/apr/07/putin-dismisses...
[3] http://www.haaretz.com/us-news/1.771716
[4] http://edition.cnn.com/2017/10/25/politics/cambridge-analyti...
[5] https://sunlightfoundation.com/2016/07/28/on-weaponized-tran...
[6] https://www.theatlantic.com/politics/archive/2017/11/the-sec...
1. The original claim is a lie. There is no evidence of Russian corruption and the claim was made for attention or some other purpose. Remind me, again, how many lies it takes to make someone untrustworthy?
2. The original claim is true, but something or someone prevents information from being released. This is the more insidious reason. It means that the organization will only release "the truth" that jibes with the messages/agenda they want to push, which is propaganda. Regardless of whether or not Russia has a direct influence of the release is unknown, but it becomes propaganda nonetheless.
My personal opinion is that Assange is virtually inseparable from Wikileaks and appears to have a god complex, using the platform as his mouthpiece on his view of the state of things while enjoying the comforts of avoiding consequence.
Except around eight years of imprisonment now. It being a relatively nice imprisonment doesn't change what it is.
[1] https://en.wikipedia.org/wiki/Operation_Mockingbird
[2] https://en.wikipedia.org/wiki/Media_cross-ownership_in_the_U...
None of your links contain any "evidence".
Evidence shouldn't be difficult to explain. Loosely connected assumptions, however, are often difficult to articulate.
The argument you propose is that practically anyone who exposes corruption in western organizations could be Russian government propagandists.
If another news organization received the DNC leaks and chose to not publish them, do you think that would have been ethical?
Is your position that, one cannot be a US citizen and oppose the US government and if you do you're a Russian agent?
Julian Assange has an agenda against certain people/parties, and has demonstrably leaked things that support that, and not leaked things that refute it.
I say that as a detractor of many of the same people and institutions Assange dislikes, so check your assumptions of bias before you throw them, please.
You're right, though, that nothing actually meets that bar. It's a human institution; it's necessarily flawed. That's why you source across biases and ideologies, and correct accordingly.
The thing I'm talking about is instead the deliberate pretense of not being partisan. Fox News calling itself "fair and balanced", or claiming "We report. You decide." are just particularly egregious examples. When you aren't presenting enough of the picture for someone to form an informed opinion, you're peddling propaganda. I know the propagandist can't admit that's what he's doing, so I hold journalism to the standard of integrity of knowing, and owning, its biases.
But it's ultimately a spectrum, and it's on me to gauge where on that spectrum any given source lands. Some things are more propaganda than journalism. Some things are more or less one or the other to different degrees on different topics, at the same time. Sometimes they're at different points on the same topic, on different days, or in different stories.
It's complicated, sure. But, holding as nuanced an appreciation of this mess as I hope I've implied, I hope also that you'll give me the credit of not merely talking out my ass when I say I find Assange to be towards the propagandist pole.
Then your post is content free. If you find nothing to meet your personal standard of being journalism than you finding wikileaks to not be journalists merely means they are the same as the New York Times.
In no way did I claim, or even imply some sort of equivalence between Wikileaks and the NYT. Please don't put words in my mouth which I explicitly disclaim just two paragraphs later.
My point is more that it's impracticable to impossible to share all of our biases, not least because we aren't aware of so many of them. When we've internalized a narrative, it becomes an unconscious bias, and can't very well be meaningfully disclosed.
What GOP documents did Wikileaks receive that they didn’t release?
It really doesn't, though. You don't have to be unbiased to be a journalist, a journalistic entity, or whatever you want to call it.
Fox News, biased as it is, is still news.
EDIT: Yes, of course it's impossible to eliminate bias. To extrapolate from that to accepting overtly biased and selectively published content as journalism is unsupported, at best.
It's the selectivity of reporting that compromises the claim of journalism, not the bias. When you don't report on things that don't support your narrative, you're no longer reporting.
They're among the worst offenders, they're far from alone in playing that game.
That WikiLeaks even had a wiki.
You are the only person in this thread pushing the government narrative and taking their words at face value.
Anyone who has kept track of these persecutions knows that unmentionable facts are thrown in constantly to try and get the defendants to break. Viz, Daniel Ellsberg being called a homosexual.
I agree. But the First Amendment doesn’t protect individuals or companies from any and all prosecution.
In his case, there was never any plant (thank god), but honestly - I've watched this tactic used again and again to destroy reputations. If the State Police feel empowered to use it at will, it's entirely believable for me to believe the _CIA_ would go so far as to plant - especially given the extra-legal authority of impunity they are empowered by.
As you pointed out, that also isn't the case here either. Hat tip for the accurate username though.
So the State Police (NY State for me) did manufacture child pornography allegations. I am glad your experience was different.
I believe that in this case, the CIA planted this evidence.
I love my username, one could even say irrationally so.
That didn't really work out... I wonder if that was the real motivation; it seems a little naive.
Put the info out there, hope it gets traction, hope we who care spread it.
You can't force people to care.
Every country does it.
Targeting Americans for political purposes is illegal. Targeting Americans for National Security reasons is perfectly within National Security Law.
The only person who got in trouble for the domestic surveillance disclosures were the person who blew the whistle. That's because what he did was illegal and what they did wasn't.
However, for the Vault 7 leak, almost no major news organizations cited Russia as a likely culprit for this.
I agree with your sentiment that basically any official information that comes out of the IC is suspect, but in this case, unless you can cite specific examples, I'm pretty sure the IC never publicly blamed Russia.
>no actual evidence was ever provided implicating North Korea - just unsupported allegations.
No actual evidence has been provided implicating Wikileaks received anything from Russia either - just unsupported allegations. If you disagree, I welcome you to link below actual evidence that has been provided. Despite the exhorations of many, claims made by spooks, spies, employees of think tanks and 3-letter agencies is not proof of anything, in any context, ever. Its extremely troubling, and very revealing, that this simple fact is an anathema to so many.
Wikileaks is globally important as a whistleblowing operation. If you go back to the 1990s you can find the US government applauding Wikileaks' publications.
When Wikileaks distributed several large caches of US documents, and would not negotiate with the US Justice Department on disclosure, censorship and propaganda agreements common with most other news providers - this more friendly relationship curdled.
The US became increasingly hostile with Wikileaks, tried to get its operators extradited, even shopped around for internet sock puppets and social media campaigns to damage their reputations.
Wikileaks in turn became distasteful of the US, and happily publishes damaging materials on the United States. These documents also happen to cover many of the details associated with unsavory activity of the world's sole superpower, which makes the reporting rather important.
US media characterizations of Wikileaks as a Russian operation are, and have been, a (successful?) domestic propaganda campaign. The way the IG talks in internal documents (go find them) about Wikileaks is that it is an independent information organization that "punches above its weight" and has geopolitical capabilities as a non-state actor. That's much closer to the truth.
If you read the leaked emails, you will find that SONY had worked with the US Department of State and the CIA to add American propaganda into "The Interview" with a plan to distribute it across the Korean Peninsula. Seth Rogan also did several interviews about CIA and State Department working on the set.
The group attributed for hacking SONY was "DarkSeoul" within "Bureau 121". This group is known for actively retaliating against companies that use propaganda to attack North Korean national security as a form of deterrence.
Additionally, the group posted, along with the SONY leaks, criticisms of what they called "the movie of terrorism" ("The Interview").
Of course, American media turned it all around and pretended that they said something about blowing up movie theaters, and caused a public panic.
Nobody in the IC attributed Vault7 to Russia. Wikileaks themselves suggested that it was a CIA contractor. US media did domestically propagandize the public via IC partnerships to "infer" and "suggest" that it was Russia, but no public statements that I'm aware of were made.