Hacker News Reader

Comment by mjn | Hacker News Reader

I think this is the relevant court record: https://www.justice.gov/opa/press-release/file/1386631/downl...

The mechanism seems to be a search warrant. The FBI applied for a warrant to "search" all compromised Exchange servers in the United States, and to "seize" the illicit malware on those servers by executing a specified series of commands.

A few excerpts from the above link:

"FBI personnel now seek authorization to search the compromised Microsoft Exchange Servers and uninstall the web shells on those servers". (6th page of the PDF)

"This warrant authorizes the United States to seize and copy from Microsoft Exchange Servers located in the United States the web shells identified in Attachment A, and to delete the web shells from those servers." (11th page)

View on HN

Here's the authorities they cite

> a magistrate judge ... has authority to issue a warrant to use remote access to search electronic storage media and to seize or copy electronically stored information located within or outside that district if ... the media are protected computers that have been damaged without authorization and are located in five or more districts.

> A warrant may be issued for any of the following:

(1) evidence of a crime;

(2) contraband, fruits of crime, or other items illegally possessed;

(3) property designed for use, intended for use, or used in committing a crime; or

(4) a person to be arrested or a person who is unlawfully restrained.

https://www.law.cornell.edu/rules/frcrmp/rule_41

Interesting, I had missed that. The language allowing remote searches when computers "have been damaged without authorization and are located in five or more districts" seems to be recent, added by Congress in a 2016 amendment: https://www.justice.gov/archives/opa/blog/rule-41-changes-en...

Interesting. Fyi I found those quotes by looking up the citations in the application.

Usually warrants have to be pretty specific. This one is, as to the thing that they are searching for. But it isn't, not as to the places to search. Anyways, I doubt the warrant will be challenged, so it works. It's quite the innovation. I... like it, provided they really do only uninstall the malware and close the vulnerability.

It's very specific about the places to search. They are listed in appendix A -- every server that has a web shell installed is enumerated by the URL of the shell.

Ah, got it. Thanks!

Inb4 in a couple years we find out they did just a bit more than expected

The first time they innovate like this, they'll be very careful to do it in a way that seems beyond reproach, probably only uninstall the malware and close the vuln etc.

Once it gets established as a legal thing, they'll keep pushing it...

Is this setting any new precedent for a warrant allowing removal of a file from a server, or is it already common practice when shutting down illicit servers?

can they also copy anything suspicious in "plain view", like whatever is brought by a simple search on the hacked Exchange? That is one huge dragnet. Of course any good citizen wouldn't mind when a law enforcement would come take a look around after the crooks have already broken into the place.

Edit: to the iudqnolq's reply below - warrant doesn't have to explicitly permit it. My understanding [IANAL] is that, at least in the physical world, whatever gets in "plain view" of the officer during any authorized law enforcement activity also becomes a fair game. I.e. they were called for the noise and upon entering see a kilo of heroin laying on the table - the heroin comes into play even though they didn't have a search warrant for it. So i'd expect that the same principle would be applicable in the virtual world too.

No, the warrent does not permit that.

Warrants don't specifically allow for the "plain view exception", do they. Another sibling comment provided a good answer though.

> can they also copy anything suspicious in "plain view", like whatever is brought by a simple search on the hacked Exchange?

If it isn’t passively visible, it is not, by definition, in plain view. If they have to do a search, however simple, beyond what is explicitly authorized in the warrant, to find the information or to find whatever would give them probable cause to believe it is contraband or evidence of crime, they can neither seize it nor get a search/seizure warrant based on their observation of it under the plain view doctrine.

No. "This warrant authorizes the use of remote access techniques to search the electronic storage media identified in Attachment A and to seize and copy from the electronic storage media identified in Attachment A the web shells, used by actors to communicate with and distribute files to victim computers to infect them with malware, as evidence and/or instrumentalities of the computer fraud and conspiracy in violation of Title 18, United States Code, Sections 1030(a)(2) (theft from a protected computer), 1030(a)(5)(A) (damage to a protected computer) and 371 (conspiracy). This authorization includes the use of remote access techniques to access the web shells and issue commands through the web shells to the software running on the electronic storage media to delete the web shells themselves.

This warrant does not authorize the seizure of any tangible property. Except as provided above, this warrant does not authorize the seizure or copying of any content from the electronic storage media identified in Attachment A or the alteration of the functionality of the electronic storage media identified in Attachment A."

https://www.justice.gov/opa/press-release/file/1386631/downl...

Yeah. I don't like the idea that law around search warrants can be used to authorize the government to do things like this. That's not what a search warrant is for. I think the judge was wrong to authorize it, but I don't count on judges to resist law enforcement requests.

If this sort of thing is a good idea, there should really be legislation about it specifically.

Why?

Warrants are issued if there is an evidence of a crime. The existence of these shells is the evidence.

Reply on news.ycombinator.com