USA Today resists FBI subpoena seeking IP addresses of readers of a story | Hacker News Reader

USA Today resists FBI subpoena seeking IP addresses of readers of a story

washingtonpost.com

234 pointspanarky69 comments

It's interesting, the article discusses that the request is for a relatively short period of time (35 minutes) - however for a popular website that could still be thousands of viewers.

It suggests that there's something they're specifically looking to match against - but if that was the case, I would think that specific IP addresses could be provided in the request - e.g. Did any one of these 10 IP addresses view the article in the time period. Much more specific and likely easier to justify.

I'd rampantly speculate that perhaps that time matches to the link being posted in a pedophilia related forum (with the forum behind TOR) - and the FBI would like to get a list of who might have followed it there.

Or perhaps they know for a fact someone read the article using Tor or a VPN, and want to go after the server next. Still seems pretty far out there.

I agree with your speculation, this looks like a timing attack regarding a Tor or VPN server.

That said, while catching pedos is a good thing, their methods are still concerning for regular law abiding citizens. The road to hell is paved with good intentions…

>while catching pedos is a good thing

Catching them? Pedophilia isn't illegal.

A lot of people use “pedophilia” to mean “sexual abuse of children” and “pedophile” or “pedo” to mean “sexual abuser of children”. (E.g., RMS’s infamous defense of “consensual pedophilia” which, merits of the intended sentiment to the side, isn’t even a coherent thing to defend or oppose except under the misuse of “pedophilia” to refer to an act and not an inclination.)

>A lot of people use...

I know and they are wrong. Words have meaning and it is difficult to communicate effectively if people use words incorrectly.

> with the forum behind TOR

TOR users clicking on a news link will take him to the news site through the TOR network. Thus rendering his IP useless.

Not if you also have ISP records. Look up “timing attack.”

Entirely likely, though possibly there are potentially flaws that could allow people to identify it through other means.

I've never used TOR so I didn't realise that this would apply (and it makes perfect sense it would work that way).

It may be that whoever requested the data knows as little about it as I do (or more likely, they know a lot more about what they want and my speculation is completely wrong).

Tor is vulnerable to statistical analysis with which if you time it perfectly you can link exit nodes with specific user. [1] The fact that FBI is asking for those specific 35 minutes suggests that they are onto something like this.

[1] https://blog.torproject.org/one-cell-enough-break-tors-anony...

TOR is clunky and slow, it’s not outside the realm of possibility that someone would visit a dodgy forum over TOR, and use their regular browser for other web browsing.

Some sites can be difficult to even access over TOR, especially ones that are very JavaScript heavy or sit behind something like Cloudflare.

> Did any one of these 10 IP addresses view the article in the time period. Much more specific and likely easier to justify.

It is, but it also leaks information. Now people know you're looking at those IP addresses. If you were going to leak that, a major news outlet is probably not the place you want it to leak to.

You might be right and it might be an easy cover for a fishing expedition, but it doesn't seem inherently malicious on its face.

They could hash them if that really was the problem.

That's only 4 billion hashes to search the entire IPv4 address space. I don't think the entire search space is big enough for that really to provide much privacy while still being functional. Whatever you put in the way, that's somewhere in the neighbourhood of cracking a 6 character lowercase+number password.

How about adding a salt? Check your records and if sha256([salt] + ipaddress]) matches this hash, let us know. Where salt is a long random string.

You could still enumerate every option in practically no time.

Oh yes, you are right. Obviously, do not hire me for any kind of information security. Lol.

But this is a rare case where you can use a derivation-extension function like PBKDF2 to make the hashing take practically any amount of time you want. You could probably make each run take a full minute on USA Today's hardware and still have your results in a reasonable amount of time.

Maybe a technique like « give us the IPs that start with xxxxx » be a compromise between the two?

That is not a compromise, it's giving away information about people who read an article.

Subpoenas leak IP addresses all the time. It's not a big deal if the org being subpoenaed isn't a suspect.

>I'd rampantly speculate that perhaps that time matches to the link being posted in a pedophilia related forum (with the forum behind TOR) - and the FBI would like to get a list of who might have followed it there.

now cue in all those stories of how people have been getting in trouble only because their ISP was using the same IP to NAT a crowd of customers.

Talk about a chilling effect, i.e., do not read the news because law enforcement can subpoena the list of what you read. Lawyers recommend never sharing anything with law enforcement because it can be used against you. So the news articles you read can now be used against you? The FBI seems to think so. This is exactly the reason there are laws prohibiting law enforcement from ask libraries for lists of what patrons read. Someone at the FBI is way out of bounds.

> Talk about a chilling effect, i.e., do not read the news because law enforcement can subpoena the list of what you read. Lawyers recommend never sharing anything with law enforcement because it can be used against you. So the news articles you read can now be used against you? The FBI seems to think so. This is exactly the reason there are laws prohibiting law enforcement from ask libraries for lists of what patrons read.

I don't understand. What's the reason there are laws prohibiting law enforcement from ask libraries for lists of what patrons read ?

These issues go way back to the dawn of books...

If I legitimatly read books about communism, it doent make me a communist!

But yet I could be persecuted for following a genuine intellectual path!

True... But it makes you suspicious...

The fact someone got out a bunch of chemistry textbooks doesn't mean they should be investigated for bomb making...?

and the parent post is the evidence #1 for why, Your Honor, law enforcement shouldn't be allowed to ask libraries for lists of what patrons read.

"In a legal context, a chilling effect is the inhibition or discouragement of the legitimate exercise of natural and legal rights by the threat of legal sanction."

https://en.wikipedia.org/wiki/Chilling_effect

If the cops are scrutinizing what you read, you might be discouraged from reading what you want to read.

Oh, that I get. I thought the reason was explained in the comment (“This is exactly the reason why”). It was implied, not explicitly stated. Thanks.

That’s a common pattern and turn of phrase that i never noticed until now.

You say “this is the reason ..” or “this is an example of why ...” but you are inviting the listener to see the reason.

It’s persuasive because the reader/listener actually fills it in themselves rather than you saying it.

To be fair this doesn't sound like a fishing expedition - they're looking for readers in a 35 minute period. Presumably they have a crime suspect or suspects who may have viewed it in that time. Ideally they would be able to narrow it down to specific IP addresses, but perhaps this is not possible.

if they can produce a warrant for this data, there's no reason why the site cannot comply. But to get the warrant must require a judge to grant it, and it must be lawful.

Lawful is an interesting term. Patriot Act was voted in and is the law of the land. It allows for NSLs and other rather controversial if not unconstitutional practices.

Warrant is not a must. This is not a movie. You would be surprised how many companies give you what you want just by calling as LEO.

> Patriot Act was voted in and was the law of the land.

You may think you are pointing out a grammar error, but I stand by the sentence as written. Nothing has changed since then.

It was voted. It is the law of the land.

A lot has changed, and a lot hasn't.

https://en.m.wikipedia.org/wiki/Patriot_Act

> as of December 2020, the Patriot Act remains expired

But various portions were reauthorized under other laws.

I will admit I did miss that delopment.

Weird question.. was 314a(b) one of those reauthorized pieces? I would assume so, but I am curious.

That is every downloader of a publication accessed potentially internationally within a 35 minute period.

That is not by any definition strictly/narrowly tailored, and if they are being deliberately vague about it to obscure ways and means that is even more alarming. If they are looking for someone in particular they should be asking for the highest time resolution possible to minimize the Constitutional blast crater w/regards the 4th Amendment.

Nevermind we're getting into surveillance via third party metadata via Third Party Doctrine again.

This case seems different. Because of the tech involved, I’d wager (speculatively) cops didn’t care about the content of the article. What mattered is the technical detail like the IP which has nothing to do with intellectual interest in the particular content.

> “The FBI’s subpoena asks for private information about the readers of our journalism. We have asked the court to quash the subpoena to protect the important relationship and trust between USA TODAY’s readers and our journalists.”

Yet it looks like usatoday.com article pages continuously leak this same information, and more, to at least a dozen commercial third parties.

Is the difference that the government was trying to get the information for free?

Advertisers don't raid your house.

> Advertisers don't raid your house.

No, but they can give that data to the FBI who do raid houses.

As the parent post noted, the USA Today home page makes requests to dozens of third-parties--including Amazon, Facebook, Google, Twitter, and something called "summerhamster". I'm sure one of the dozens will take the FBI's call.

Hilariously, the USA Today homepage also hits OneTrust, who has the slogan "Privacy, Security and Data Governance" right in the <title>. What is there to govern if nearly all the major tech players have your access logs?

USA Today is shouting its readers' reading behavior from the mountain top.

OneTrust is very commonly used for the legally required cookie banners for EU readers.

There is no legal requirement to have cookies so there is no legal requirement for any banners

And you don't need consent for cookies that are obviously required for normal site functioning like login etc.

Bang on. For example

A user visits an e-commerce website and decides to purchase a product. They add it to their shopping basket before continuing browsing for more goods they wish to buy. They then finish their shopping by going through the website’s checkout process.

The website uses cookies to ensure that when the user chooses the goods they wish to buy and clicks the ‘add to basket’ or ‘proceed to checkout’ button, the site ‘remembers’ what they chose on a previous page.

In this context, the cookie is ‘strictly necessary’ to provide the service the user requests and so the exemption would apply and no consent would be required

We all cheer for Max Schrems to teach these companies that misconstruing cookie banners as complying with EU regulations is a risky play.

summerhamster is one of a billion of those shitty "adblock detecting!!!" "dont lose money!!!" malicious JS domains.

Probably it would be easier for the FBI if they just started their own advertising/analytics company.

Too easy.

well, not physically I suppose

The difference is disclosing information voluntarily, versus being forced.

Maybe they could have easily gotten the data otherwise,but decided to do the right thing by requesting it through the direct channel and allowing this process to take place through the legal system.

Yup.

I read pedos or terrorists combined with a different than usual request for information as a red flag for "fishing for a precedent".

This seems like a crafted case to set some kind of precedent. The request involves cop killing and child abuse, though it's really hard to see how the requested information is useful as the "suspect" killed himself. My guess would be they're trying to prove a related person saw the incident and wiped their drives or something, but that's some weak evidence. Additionally, the FBI likely could just buy this data.

Also, why is this challenge which featured a gag order not be dealt with in a secret court? Doesn't our knowledge of events already make the USA Today guilty of a crime even if this subpoena doesn't stand?

I’m also wondering how this got public so easily if there was a gag order, but it sounds like the court made it public initially and USA Today just responded to that news.

That's still pretty suspect. The info was important enough that the courts issues a gag order, but the courts then broke it themselves?

That would be quite a wide net and quite the "fishing expedition" and why the FBI has earned itself a bad rep (in addition to things like getting people on unrelated charges like "lying" while they are free to make things up.

https://archive.is/kL7Zm

My mind immediately went to trying to match a screenshot of the article that someone posted.

The USA Today website does a little bit of localization in the navigation bar. If that's visible together with the system clock its probably enough to narrow to a very small set of IPs.

This is insane.

I guess it's a best practice to not disclose real personal details for library cards, store discount programs, and such where it's not absolutely required and where it can be avoided.

I recall hunting stories on this one, because there was an 8chan rumor that one of the FBI agents shot had been "their head kiddie porn investigator" and they'd been working on the Hunter Biden laptop case for over a year in secret.

There appeared to be no correlation at all. The rumor died down fast too.

The perp is already dead.

https://www.bbc.com/news/world-us-canada-55908105

According to the Miami Herald, the suspect was barricaded inside a home for several hours before shooting and killing himself.

And HN still has the view websites should collect and store every morsel of data about every visitor because nothing to hide, nothing to fear.

Quite the opposite. The HN crowd is very privacy-conscientious.

Any post about the gdpr has dozens of googlers saying how awful it is they can’t just capture every bit of data they want from visitors.

Of course, since they directly profit from violating people’s privacy, but Google is not HN.

Reply on news.ycombinator.com