Password-cracking theory against Assange unravels at extradition trial
dissenter.substack.com
dissenter.substack.com
This is so broken, and add extraditions to a long list of habeas corpus negating tools governments in the West now amass.
The problem is that the courts regularly ignore due process because there isn't any incentive for them to uphold the letter of the law. The side with the more expensive team of lawyers regularly wins.
If you could bet on court decisions, you would see the odds heavily in favor of the more moneyed party.
There should be a monetary incentive that encourages people who can read the law to evaluate past court decisions, and that punishes legal bodies (maybe even in a criminal court) that ignore due process.
https://cdn.netzpolitik.org/wp-upload/2019/04/2017-12-21_Vir...
There are two assumptions they use to infer the identity of NF:
1- The belief of two persons that the person who they were talking with was probably Assange.
2- That only one single person was using that jabber account.
The only thing I can personally infer from the information they presented is that NF was (very likely) a member of Wikileaks at that time.
What am I missing?
"Take a word for it" has been taken to a whole new level in the 21st century...
To me the fact that they wrote "other persons known" indicates that they are not sure if there were other members present.
It seems I wasn't clear before but this is exactly what I intended to imply: If they cannot attest that JA was the only member present at that conference then that line of argument is insufficient to make the claim they are making.
It's actually pretty aggravating reading trial documents when nobody present knows what they're talking about, it might as well be a Star Trek script, this is why it's so nice when the trial judge or at least some of the lawyers know what they're talking about (e.g. the Horizon scandal in the UK) but we can't have nice things most of the time.
Here's what the transcript says Manning provided:
80c11049faebf441d524fb3c4cd5351c
That's 16 bytes = 128 bits = one Windows password hash.
So straight away it's completely reasonable that this is in fact a Windows password hash, and in the absence of evidence of how Manning obtained that value it's only speculation that this is actually encrypted somehow (e.g. because it is from an encrypted offline SAM). And yet Assange's defence apparently has hours of such speculation on tap, for whatever they suppose that's worth.
What Assange talks about doing is using Rainbow tables. This would be applicable regardless of which type of Windows hash it is (or Assange thought it was) but crucially if the password is strong then you only get a result if this 128-bit value is an LM Hash. The risible LM Hash turns the first seven characters into one 64-bit value using DES, the next seven into another 64-bit value (DES again). It doesn't work on long passwords, if you have a long password then you can't have an LM hash. This of course is one reason somehow who tried to obtain both hashes would only get one...
The NT Hash is MD4(password). If the password is "qwerty" or "manning" that's not difficult to find, and Rainbow Tables that will be fairly reliable for simple passwords with NT Hash are readily available and would have been years ago too.
But if the password is sixteen random characters then MD4(password) might as well be Argon2id(password) for all the good that'll do you. It's just too many combinations.
So, for all we may ever know that 128-bit value is in fact a legitimate NT Hash of a good password.
The government want a way to charge assange with something, that they don’t then have to also charge all the national newspapers with who helped him - because that would then be a much more blatant attack on press freedom.
They want to charge him as some form of hacker instead of what it’s really about - that they don’t like what he did as a journalist.
"For my friends everything, for my enemies the law" [1]
https://www.jonathan-cook.net/blog/2020-09-22/guardian-silen...
Is this what Assange is accused of doing?
1. Receiving a password hash from Manning
2. Telling Manning he'll try to crack it
3. Following up asking for more info about it (related usernames or something)
4. Never actually cracking it and no further action
Does anyone have any more specifics on what Assange actually did here to break the law? The indictment is pretty vague on this and it seems to be the central issue.
[1] https://www.justice.gov/opa/press-release/file/1289641/downl... (page 9)
Assange and Manning agreed to try to gain unauthorized access to some U.S. government computer system.
Unauthorized computer access is a federal crime, see 18 U.S.C. section 1030.
The federal conspiracy charged (18 U.S.C section 371 in this case) also requires that one of the conspirators take an 'overt act' to further conspiracy. This is to stop idle talk about crimes being prosecuted as conspiracies.
In this case, Manning actually provided Assange with the hashed password. That's the overt act.
But, fundamentally, the conspiracy is the agreement to commit a crime.
Let's say Manning had the files at some point and encrypted them on his own machine with some password which would NOT give access to any U.S. government computer system? Then it wouldn't be a conspiracy to gain access to a U.S. government computer system, would it?
Yes, very clear. Skim the indictment a bit, it goes into some detail re: their communication.
Cracking a hashed password isn't obviously part of a crime. Using it may be.
If you're suggesting that the overt act has to itself be criminal: that's wrong.
Conspiring with sources to obtain secret information is what investigative journalists do. Doing so illegally is sometimes clearly bad (like the UK Daily Mail hacking celebrity phones), and sometimes clearly good (Manning and Snowden).
Journalists are never normally prosecuted for breaking the Official Secrets Act (and equivalents in other countries). This case is the first time that's happened. It sets a precedent for other cases against journalists in the future as the US and UK governments get more authoritarian and less open.
The initial indictment against Assange was an attempt to draw some kind of line between him and "proper" journalists. The new indictment (which had to be created because, as the prosecution admitted, the first one would have failed) makes no such distinction.
This is bad for society. Assange is a bit of a twat, but this needs to stop because the ramifications are enormous.
One of the counts of the indictment is not about cajoling a source, or receiving secret documents: it's about actively engaging in an attempt to gain unauthorized access to a U.S. Government computer system.
Isn't there an ethical line, at some point, in terms of the length a journalist can go to get the story? The UK scandal (News of the World; I think; not Daily Mail) you mentioned resulted in journalists going to prison for similar crimes.
I think we're in a really peculiar place if distinctions like this turn on whether it's the right or wrong kind of public interest.
So what is the legal definition of 'journalist' ...
... and what kinds of things are they allowed to hack? Because there are surely some things that are not in the public interest. So where is that line drawn?
It seems like a lot of shades of grey there, it's hard to fathom what's a crime and what's not if it's not clear.
A journalist is "someone who does journalism". Traditionally that meant publishing stories in a newspaper, radio or television company, and it was fairly clear-cut who was a journalist and who wasn't. Nowadays not so much - the main question being "is a blogger a journalist?".
Assange was supplying information to, and co-operating with, major media organisations. I think any definition of journalism would have to include the activities of Wikileaks, and therefore Assange is a journalist.
Where the line is drawn is also a good question. Government would like it drawn at the lines laid out in the pertinent secrecy laws. But clearly if just classifying something as "Secret" would then put it out of reach of journalists and make unauthorised knowledge of it a criminal offence, then that's not serving society. All sorts of political misbehaviour would be classified.
And yeah, there are lots of shades of grey. Lots of things we have to decide as a society:
Are governments allowed to keep things secret?
Who should decide what is kept secret?
If someone discovers that a government agent is doing something illegal, but the activity (or agent) is covered by secrecy laws, how do they make sure that the activity is prevented and/or punished?
> Manning never provided the two files necessary to “reconstruct the decryption key” for the password hash, Eller testified. “At the time, it would not have been possible to crack an encrypted password hash, such as the one Manning obtained.”
If you have a gun, and we agree that I will shoot someone with it, but it turns out (unbeknownst to either of us) that the gun has in fact been permanently deactivated ... that's still conspiracy to commit murder.
[1] https://www.theglobeandmail.com/news/british-columbia/judge-...
While such a comparison might rub you (and me, for that matter) the wrong way, it's the "legal" interpretation that holds in a US Article III court[0].
[0] https://en.wikipedia.org/wiki/Federal_tribunals_in_the_Unite...
If the officer asks, “hey, do you wanna bomb that building?” it’s entrapment. If you ask “would you help me bomb that building?” and the officer sells you what you think is a bomb, it’s not. Of course, the officer isn’t necessarily wearing a wire or anything, and it’s possible to phrase things carefully to suggest something without literally making the suggestion, so it comes down to the officer’s testimony (“I never suggested that he commit a crime” and maybe “I did suggest that somebody ought to pay for that behavior”) versus the accused’s.
Entrapment would be more like "We're going to bomb that building, and if you don't join us, I'm going to kill you... Hah! Just kidding, you're under arrest!"
"Government agents do not entrap defendants simply by offering them an opportunity to commit a crime. Judges expect people to resist any ordinary temptation to violate the law. An entrapment defense arises when government agents resort to repugnant behavior such as the use of threats, harassment, fraud, or even flattery to induce defendants to commit crimes."
https://www.nolo.com/legal-encyclopedia/entrapment-basics-33...
But for some reason if you tried pretending to be a terrorist, you'd still be a criminal
> But for some reason if you tried pretending to be a terrorist, you'd still be a criminal
That depends. The informant/infiltrator needs to "play along" till some extend. However, they should also not stimulate other people to commit crimes. It is a careful balance.
So for example, if Alice asks Bob to make a bomb, and Bob complies (with a fake bomb), then how exactly did Bob (who works for the FBI) create a terrorist? They didn't. They caught one by pretending being one. Apart from the ability to safely catch Alice red-handed, Bob can also testify the intend of Alice. 2 in 1.
Would you rather see it was Charlie who made the bomb, but then a real one? Of course not. Sometimes, this infiltration method is one of the few or the only viable way to catch a terrorist or criminal. It is not without risk though; it is high risk, high reward. Not the first option to be chosen; you want low risk, high reward options first.
EDIT: in hindsight it would've been better to use different names, ie. Mallory. I leave the above as-is.
Let's say that you've been given a key for a locker at Grand Central Station and told there's a gun inside. We agree that I'll use the gun to shoot someone. You give me the key and I go to collect the gun. In fact, the locker is empty.
The gun doesn't even exist and yet there's still a conspiracy to commit murder.
There'd inevitably be argument over whether it met the required standard, which differs by jurisdiction. e.g. did it advance the conspiracy substantially? did it take the conspiracy past the point of no return?
Well arguably that didn't happen.
> There'd inevitably be argument over whether it met the required standard, which differs by jurisdiction. e.g. did it advance the conspiracy substantially? did it take the conspiracy past the point of no return?
I'd say that going to a place where you would get equipment is not something that substantially advances the conspiracy, even if there was a gun! It's actually getting the equipment that might do so, depending on what the equipment is. And if you're still collecting necessary equipment, or especially doing a prerequisite to collecting equipment, you're nowhere near the point of no return.
If Manning and Assange think that a recipe for fruit salad is a hash of a root password for some U.S. Government computer and then attempt to identify a collision for it, with the goal of allowing Manning unauthorized access: that's still conspiracy.
It's up to the prosecution to prove that J.A. == "Nathaniel Frank" (and yes, whistleblowers have a long history of leaking to multiple players in case one or more of them are in bed with the oppressor).
It's up to the prosecution to prove that "Nathanial Frank" couldn't have believed he was simply helping Manning regain access to whatever non-governmental stuff Manning has legitimate access to, and hence Manning has the right to grant others permission to crack his own hash...
The law states you are innocent until proven guilty, the law effectively states "Nathaniel Frank" was thinking about having permission for cracking the hash to the fruit salad recipe... until proven otherwise, and the burden of proof lies with the prosecutor, not the defense
Edit: I originally mispoke and had this backwards, but it doesn't actually affect the point.
No. At least in the US, it's the prosecution's responsibility to prove beyond a reasonable doubt that someone is guilty.
The defense needn't prove anything. Although, it's often a good idea to find some evidence that exonerates the defendant.
Here's a little primer[0] for you.
[0] https://www.americanbar.org/groups/public_education/resource...
Huh? How would a prosecutor get to try (and attempt to prove) a case if they don't bring the case to the court in the first place?
Perhaps I'm missing something here?
"If I'm God, and we agree that I will kill everyone with my God powers, but it turns out (unbeknownst to either of us) that I'm not God, that's still conspiracy to commit murder."
Promising impossibility is not a conspiracy.
https://www.reddit.com/r/legaladviceofftopic/comments/6le3hy...
https://www.sandiegoreader.com/news/2004/dec/09/attempted-vo...
Refer to, e.g. United States vs. Thomas: https://www.lexisnexis.com/community/casebrief/p/casebrief-u... ... which is an actual appeal court decision.
The defendants were at a bar. A drunken woman collapsed. The defendants put her in their car, took her home, and had sex with her while they believed she was unconscious.
In fact, the woman had died at the bar, and they had been having sex with a corpse. They could not be convicted of rape, but they could be convicted of attempted rape because they believed the woman was alive at the time.
Being factually mistaken about the possibility of a crime is not a defense to a charge of attempt, conspiracy etc.
But a journalist, should have the right to ask people to come forward if they have information with a public interest, even if it is classified. If someone comes forward, they may break the law, but not the journalist.
Further more, Assange is not a US citizen, and is there for under no obligation to be loyal to or protect US interests or secrets. He cant by definition be treasonous again any country besides his own.
If he on the other hand, provides material support to someone committing a crime, (like helping to crack a password), then he can be tried as an accomplice. This evidence seems to imply he did not.
What I wonder more about is our own guys: how does manning and Snowden walk out the door with this info anyway? Our search procedures apparently suck.
For the record my assessment of our involvement in Iraq is not kind: we should have escalated to armed intrusion to vet wmds base by base instead of invading wholesale on the reason Iraqi's were evasive. Second torture is unamerican, not reliable, and wholly wrong. Not proud at all of what we did here. Our response before after 9/11 was incompetent.
Actually, here in the US, we don't have licensed journalists. As such anyone may act as one. Government employees (including members of the military) and contractors can be and have been charged and convicted with misuse/dissemination of classified information. What's more, private citizens working in the employ of a foreign government have also been charged and convicted for providing classified information to that foreign government.
However, no US journalist (and remember, anyone can be a journalist) has ever been convicted under the Espionage Act. Ever.
As such, it seems incredibly unlikely that Assange would be convicted under that Espionage Act. I guess we'll just have to see.
I take issue with the title of this posting, as (at least in the UK[0]), an Extradition Hearing is not a trial, nor is it intended to be one.
[0] https://www.gov.uk/guidance/extradition-processes-and-review
Not disagreeing with the rest of your post, just pointing this out because there is no reason to retreat to the common sense position you advocate. The fact that you have to make such a sensible point is a reflection of the deep deceit and dishonesty of the prosecutors who clearly know this and are omitting it in order to try and paint a portrait of conspiracy that is factually wrong and they know it.
Could you please elaborate on why you think that matters to the charge of conspiracy?
> Treason against the United States, shall consist only in levying War against them, or in adhering to their Enemies, giving them Aid and Comfort.
Assange is being accused of conspiring to break into a government computer not treason.
The fact that extradition isn't an equal thing isn't exactly shocking its a function of treaties between the relevant nations and wherein a power imbalance exists between those nations the terms are less likely to be equal and the US is still one of the most powerful nations on Earth.
The US does rarely extradite for example
https://news.bloomberglaw.com/us-law-week/u-s-citizens-extra...
Ivo is getting extradited for attempted extortion which he committed in the Czech Republic and when people commit crimes from the US against international parties they can also be charged with the a crime for those acts supposing they are against the law here.
Punishing acts where victim and criminal are members of different nations is often complicated. Few nations are eager to subject their citizens to foreign laws.
IIUC, at least in the US, a charge of conspiracy requires an overt act by at least one of the conspirators[0]: "If two or more persons conspire either to commit any offense against the United States, or to defraud the United States, or any agency thereof in any manner or for any purpose, and one or more of such persons do any act to effect the object of the conspiracy, each shall be fined under this title or imprisoned not more than five years, or both.
If, however, the offense, the commission of which is the object of the conspiracy, is a misdemeanor only, the punishment for such conspiracy shall not exceed the maximum punishment provided for such misdemeanor."
As such, in the scenario you present, unless those who discuss murder actually do something in furtherance of that discussed goal, it's not conspiracy.
[0] https://www.law.cornell.edu/uscode/text/18/371
N.B.: IANAL
The example mentions a gun, but does not mention that it was procured for the purpose of committing murder. At least in the US, having a gun (there are more guns than people here) by itself isn't very remarkable.
If, however, the gun was procured specifically for that purpose, it could be construed as an overt act.
Alternatively, if someone retrieved the gun from a storage facility (as was suggested by another commenter) for the purposes of committing murder, that would still be an overt act.
ISTR a case where a woman contracted with someone (who turned out to be police acting on a tip from the owner of a website that claimed to put folks in touch with hit men) to kill her husband[0].
Just asking someone to do so wasn't enough. The police had to get the woman to commit an overt act in furtherance of the conspiracy (in that case, paying the undercover cop).
[0] https://www.wxyz.com/news/monroe-county-woman-arrested-for-t...
This is a far cry from conspiracy to commit murder, with our without a functional gun.
Rather, it's a separate charge under the Computer Fraud and Abuse Act[1]. And that matters because the penalties are enormously more severe for the the former than the latter.
>This is a far cry from conspiracy to commit murder, with our without a functional gun.
Conspiracy is defined[2] as: "If two or more persons conspire either to commit any offense against the United States, or to defraud the United States, or any agency thereof in any manner or for any purpose, and one or more of such persons do any act to effect the object of the conspiracy, each shall be fined under this title or imprisoned not more than five years, or both.
If, however, the offense, the commission of which is the object of the conspiracy, is a misdemeanor only, the punishment for such conspiracy shall not exceed the maximum punishment provided for such misdemeanor."
As such, the example was just that, an example. Would you be less butthurt if the example was conspiracy to steal office supplies from a US Post Office, and the overt act was to bring a hand-cart to the post office in order to cart away said office supplies?
[0] https://en.wikipedia.org/wiki/Espionage_Act_of_1917
[1] https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act
[2] https://www.law.cornell.edu/uscode/text/18/371
Edit: Fixed grammatical error
one side seems to be just pointing out and clarifying the laws and evidence, the side seems to refuse to accept what seems to be a straightforward explanation.
You might disagree with the laws, you might think they are unfair, or think they are applied unequally or selectively, and that is fine. All those things are unarguably true in general.
But by the definition of conspiracy, I don’t get why so many commenters are trying to argue that what assange did does not fit that description.
If your objections were any of the reasons I mentioned earlier, that would make total sense. But rejecting that what he did technically can be described as conspiracy per the definition under United States law? It just makes you look unreasonable.
Is the USA out for assange? Yes, they’ll throw anything they can find at him. And it looks like they found something. Whether that is a good state of affairs is not relevant for the discussion at hand.
they’ve got him with this charge. Denying it won’t help him. Denial of a fact helps no one. Realize you lost the battle and move on so you can win the war or whatever analogy along those lines you want to use.
Classifying this as "conspiracy" violates the first amendment. What he did should be expected behavior of the press, I won't just abandon this encroachment and move on.
Wiki leaks affiliated? Almost certainly.
Assange? No actual evidence. (that I am aware of)
IMHO this is the salient weakness in the case for extradition. The fact that the same exact argument could be used against any wiki leaks affiliated individual at that time makes it a witch hunt instead of a legitimate legal proceeding.
This whole endeavor is a clear and blatant attack on freedom of information. It should be clear to everyone across the globe by now. The American government does not care if it commits war crimes, however it will go to extremes to punish any journalists or whistleblowers who expose these war crimes.
Wrong. Rainbow tables have always worked, even 20 years ago.
The claim is that the hash is from an offline SAM. Windows by that era has an encrypted SAM file, so when it isn't running the raw hashes are actually encrypted with RC4.
In principle 128-bits of RC4-enciphered data is useless. RC4 is not good encryption by 2020 standards (nor indeed in 2010) but it's enough that if the 128-bits is from an encrypted SAM they're useless. But the trouble is that tools to decrypt the SAM certainly did exist in 2010.
Maybe they weren’t called rainbow tables back then, but lookup tables of pre-computed hashes for password cracking existed. I was there. However, I may be off by a year... I cannot recall the exact date I first became aware of them. I am fairly certain it was in the 90s.
Pre-computation is obvious. Hellman comes up with chained pre-computation in the 1980s. Rainbow Tables are further improvement on Hellman's idea.
Let's use LM hash as the example, the core idea in LM hash is you can turn up to 7 characters of password into a 64-bit value. LM hash does this twice (so up to 14 character passwords) but we can divide it into two 64-bit hashes.
In 1975 LM hash hasn't actually been invented, but if you somehow went back and showed people from 1975 how it works they can pre-compute hashes. There are 2^56 possible hashes. So if you've got somewhere to store 2^56 hashes and passwords you can do the work and then reverse any LM hash. Hmm, 2^56 is a lot though. In 1975 nobody can store this data.
By 1995 LM hash does exist, and Hellman has proposed his chaining optimisations. So, you do 2^56 calculations still (this is a bunch of work but it's certainly possible) but they form long chains so now you don't need to store 2^56 answers somewhere. Maybe you store 2^40 answers, you need to do 2^16 calculations for every reverse and you need 2^40 storage and sadly your recall is now poor. Maybe it only works 80% of the time. Storing 2^40 answers in 1995 is expensive, you can't afford to do it, but the government or a rich company can.
By 2005 there are Rainbow Tables. Phillipe's idea massively improved recall. You can have say 99.9% recall, store 2^40 answers and do 2^16 calculations to reverse a hash. Also in 2005, storing 2^40 answers seems reasonable, you can just walk to a store and buy many gigabytes of storage space no problem.