Hacker News Reader

Comment by dmix | Hacker News Reader

> because he connected to it from an Internet address that he’d previously used to access a social media account registered in his name.

Is the implication here that the US gov has broad access to accounts IDs->IP address which access social media accounts? Or can the FBI/three letter agencies can go to Twitter/FB/etc (or some NSA db) and ask which accounts logged in via x IP address? Or, less conspiratorial, the investigators had some leads on x group of accounts -> got warrants for account IP addresses -> confirmed hypothesis.

View on HN

The US government requires that all ISPs install wiretapping devices as a precondition for doing business.

Failure to install and maintain wiretapping devices incurs a penalty of $130,000 per day, with a maximum of $1,325,000 per violation (unlimited violations).

Assume every ISP is compromised and that every government agency can see everything.

https://en.wikipedia.org/wiki/Communications_Assistance_for_...

Due to HTTPS, an ISP will not see which social media account someone is logging in unless it's somehow leaked in unencrypted form (unlikely).

They don't need to leak it. ISPs, web hosts, social media companies, etc. give up the information willingly, and the feds take care of all the correlation work as needed.

Remember "SSL added and removed here :^)"?

https://archive.is/W3PDG

"SSL added and removed here :^)" was over a decade ago now? HTTPS and encryption since became commonplace.

Not to mention, there's really no reason for the feds to try and break/work around HTTPS in this case when they have more than enough to subpoena the provider and they'll happily surrender the logs.

>"SSL added and removed here :^)" was over a decade ago now?

Yes, and surveillance has become even more entrenched since then.

>HTTPS and encryption since became commonplace.

HTTPS only protects the information in transit. It can't protect you from a backdoored load balancer or other endpoint, which is what that infamous slide was about.

The NSA wasn't breaking encryption, but rather compromising the devices that were communicating via HTTPS with you. The little padlock icon in your browser says nothing about the trustworthiness of the server on the other end. It's like talking on a secure line with someone who is actually a spy.

I think you are looking too closely. They were being investigated for instagram extortion. They had an IP. Therefore subpoena instagram for that IP. Not exactly rocket science

That's probably most likely

Fbi asks twitter, Facebook etc who used this ip address. They will probably tell them. If they don't, it gets a subpoena, and then they get the accounts. It's regular everyday police work. No secret spy programs required.

This. For the feds they're called 2703d orders to request for information. It's a pretty common thing.

It definitely implies one of these, and at face value, they're both terrible. A single IP being used somewhere makes sense to go to the ISP and ask "hey who was this IP assigned to at this time?".

It does not make sense that the police should be able to get a warrant for data from every single website in the western world based only on a single IP. But Snowden already proved that PRISM is a thing.

Also why stop at Facebook/Twitter/Discord? Should police also get warrants for AshleyMadison.com, Tryst.link, UnitedNuclear.com, DonateToPoliticalParty.org, INeedAnAbortion.org, etc etc? "Hey did anyone with this IP perform a transaction on your site and can you give us their name?"

> It does not make sense that the police should be able to get a warrant for data from every single website in the western world based only on a single IP.

Why not?

The police can go around every single business in town, and ask if a man matching some particular description patronized it.

This isn't a fishing expedition, this is the police asking for particular information about a particular person, who they are investigating for a particular crime. This is... Normal police work.

They can go around to every business in town and ask, they can’t get a warrant though.

It's quite likely that the police came to Facebook et al with warrants.

Yes and some people think the issuance of those presumed warrants are inappropriate. However, it’s been proven that the government doesn’t necessarily need warrants as they’ve had unlimited access to the firehouse of data directly through the PRISM program.

Prism was a web portal for serving warrants and NSLs, but if we repeat the original misreporting enough times, I guess it'll stick.

If what you're saying is true, these guys will walk because they'll challenge the lack of warrant in court. I have strong doubts that they are going to be walking anytime soon.

Well, I don’t think they’ll walk if there’s no warrant because the third party doctrine allows Facebook to share whatever they want to with the police. A warrant would actually be “worse” … if it’s based solely on a single one-time IP.

I don't see where you're getting "conspiratorial". It's no doubt just that, y'know, warrants shall issue upon probable cause. If you give information about yourself to someone else, and the cops reasonably suspect you of a crime and can convince a court to that effect, then they can get the info. There's absolutely no new or weird law enforcement powers needed.

I said less conspiratorial in context of the third option because the other two were obviously much more sketchy options? Obviously if the investigators had a lead on particular social media usernames they could get warrants for them.

Unless you mean you think it's "normal" for police to ask Google/Twitter/etc for data dumps of every single account that ever connected from x IP address?

> Unless you mean you think it's "normal" for police to ask Google/Twitter/etc for data dumps of every account that ever connected from x IP address?

I don't see where "data dumps of every account" is substantiated anywhere, you're introducing that as a prior. They no doubt had a suspect[1], got something incriminating, took it to a judge and that was enough to get Meta or whoever to cough up the logs. If you're genuinely curious just wait for the court case and follow it. The defense will be presented with all the warrants and will challenge things if they don't look legal.

[1] No doubt because someone got sloppy with opsec and posted something from the wrong account. It's always something like that. Crime is actually really hard to do anonymously.

> They no doubt had a suspect[1], got something incriminating, took it to a judge and that was enough to get Meta or whoever to cough up the logs.

So literally what I said in my original comment:

>> Or, less conspiratorial, the investigators had some leads on x group of accounts -> got warrants for account IP addresses -> confirmed hypothesis.

Didn't Snowden give us some insight into how these things happen? What would lead us to believe they do not currently happen?

I wouldn't be surprised, but parallel construction is also likely in these cases. E.g. they have some god-mode global network analytics to link most VPNs to real IPs, and simply make up some alternative plausible but bs story about how they tracked them.

> parallel construction is also likely in these cases

Source? Why is this likely?

I kind of thought even the second option here was pretty much a given these days.. Is it even more conspiratorial than the third?

It sounds like "Parellel construction".

These investigations take a ton of time and involve lots of subpoenas.

Doesn't have to be a govt conspiracy, facebook will sell you IDs->IP address. It's literally their business model, answering the question "Who bought stuff where, or when do people want to buy stuff?". "where" and "when" can be derived from a time-series of IPs, for example to know if you observed something on your phone over wifi (implying you live with others, so network-based ads would be most effective) or cellular (implying you're alone rn + targeted ads are better).

Reply on news.ycombinator.com