The underlying crime was wire fraud, and it happened to be about acquiring IP addresses. He wasn’t prosecuted because he got too many, but for how he got them.
In this day and age if you're committing fraud it's pretty hard for it not to be wire fraud given how everything is transmitted digitally. And penalties for wire fraud are extremely steep (up 20 years for each charge), and it automatically makes it a federal crime. So just don't...
https://www.youtube.com/watch?v=N5S74kKimFs
Jake (Andy Samberg) and Charles (Joe Lo Truglio) form an unlikely alliance with Jack Danger (Ed Helms), a nerdy lead investigator at the United States Postal Inspection Service, as they embark on a mission to crack the case to bring down a drug dealer.
https://en.m.wikipedia.org/wiki/United_States_Postal_Inspect...
But in all fairness, the distinctions are all pretty arbitrary, I'm sure people were laughing as much when the navy spun off their weather stuff and when the army spun off their flying stuff as they do now with the air force spinning off the space stuff.
It's a psychological thing as far as I have been told. As in, the smaller the "amount" or "area" of power you give someone to enforce / defend the fiercer they will do so.
I saw this live once. A tiny office building's front entrance security guard. Had a sign in/out list for visitors. He was o the stereotypical leaned back in his chair, far away from the heightened desk type guy. Our visitor wanted to sign out. He knew the procedure from other days. The list sat behind the counter but in plain view. Our guest thought nothing of it so as he mentioned he'd leave and just sign out he grabbed the list from behind the counter. You should have seen how fast the security guy got up from his chair and started shouting at the guy what the... he was thinking just grabbing that list! He pulled the list back out of our visitors hands and then we heard a littany of other stuff. Until he finally let him actually sign out
I guess one can make use of this in some cases :)
I've read of someone who worked at a bank who was told that after getting a counterfeit, looked them up in the phone book, and they dealt with it promptly.
[0]: https://about.usps.com/postal-bulletin/2019/pb22524/html/cov...
IANAL but to get 20 years they'd have to commit a massive fraud that ended in some serious damage like costing victims million of dollars with some other mitigating circumstances.
You mean aggravating circumstances.
[1] https://en.wikipedia.org/wiki/United_States_Federal_Sentenci...
The Belgian guy I was in with got raided by the police. His hard disks had been hidden behind a brick wall with only the cables visible. They didn't find the hard disks so he got away with it, and I never got arrested or charged.
Good times.
Anecdotal, second-hand story I remembered being told by a former colleague with some significant time working in the Postal service: state or city police pulled over a contracted semi truck carrying mail from one station to the other on suspicion of running un-taxed cigarette shipments from a reservation manufacturer. Because the semi was contracted by the postal service, they had the requisite security: tags, seals and the magical panic button in the cab of the tractor. The driver pushed the button when the state/city police broke the seal and started rummaging through parcels which summoned the inspectors, guns drawn to the scene. Apparently the Postal Inspectors arrested the -police- at that scene on breaking and entering mail facilities.
Some of the details pertaining to why the shipment was actually legal and the police didn't have cause/jurisdiction yadda yadda yadda I don't remember, but still a good story even if the telling of it by my former colleague was more engaging than I can recount.
As the story goes, one of the scientists there copped a warrant high grade enough for the Federal Marshals to come by and make an arrest. They were stopped at one of the gates into a more secure area, asked their business, and told that security would send out the person in question. The Marshals balked at this and demanded to be let in to make the arrest, lest the fugitive make good an escape somehow. After security asked for their requisite clearance, which the Marshals could not provide, it continued to escalate. Fingering their pistol butts, the Marshals insisted they were on lawful business and must be let in, while the guards with rifles replied that by all means the Marshals might make their entry but as armed intruders into a secure laboratory they would promptly get shot.
The pissing match took long enough that the fugitive was finally marched up to the gate and taken into custody before it could escalate further, at this point I believe the Marshals were on the phone with their higher ups trying to plead their case to be let in.
My coworker went to the local police, who wouldn’t do anything, but then his lawyer advised him to go to the postal inspector (he had mailed the check to the contractor.)
The contractor ended up getting five years in federal prison for mail fraud.
In terms of civil disputes between citizens from different member countries - well, we don't have any phone/internet/post police.
Not only do I have absolutely no idea how to get from here to there, I also assume the degree of simplification I desire — to the point that normal people know what's going on most of the time — is the legal equivalent of saying "Twitter doesn't need 6000 employees because Mark Zuckerberg wrote Facebook by himself in college" in a software engineering context, and wrong for much the same reasons.
And, oh boy, do we have many laws.
It is by design, to oppress the people.
I very much agree. And I live in the US.
77k fine for a net worth of $10-14 million from his businesses, and a 5 years sentence at a minimum security prison (with the likelihood of parole much earlier) is not a bad retirement plan.
Idk where the “postal inspectors are bad ass” meme comes from online, but from my sample size they’re just as useless as any other government org.
For some reason, the internet thinks they are a group of James Bond secret agents. In my experience dealing with them, they are TSA level, totally indifferent schlubby federal workers waiting for their pension to vest.
That to me is the definition of victimless.
I lost imaginary income that never would have actually existed doesn’t make you a victim.
This was your original comment.
The opposite is true here: a person received addresses at low costs reserved for people who don't have any addressing of their own, and then sold the addresses for millions of dollars to companies who already have a lot of addresses and would be ineligible for this.
They pretended to be dozens of new companies to do this. They filed false affidavits where they swore facts that were untrue.
Meanwhile companies actually eligible for ARIN's initial block policy had to wait indefinitely because this scalper had snatched up all the inventory. Were they not harmed?
Fraud basically means lying to someone to steal from them. Wire fraud means doing that using electronic communications.
Of course there can be bogus charges and you should vote to acquit on those, but wire fraud seems squarely in the set of things that should be illegal if we have laws at all.
While counterfeit stuff are sold by sellers in the marketplace that Amazon provides, that is not equivalent to Amazon being the one selling the stuff.
Substance over form.
I'm sorry, but as far as I'm concerned, Amazon is selling the item.
2. There is so much counterfeit stuff on Amazon that they should know about it, and should be held responsible since they do nothing about it. "Should have known" is sufficient for guilt in a court of law, when the thing is blatantly obvious.
The actual criminal activity (fradulent affidavits, forged signatures) started in 2017.
Then we encountered these spammers were willing to forge BGP LOA stating that they could announce certain, defunct and unused blocks on BGP.
I left there in a hurry, but it seems like they got away with it for a while. It would've been pretty catastrophic if their upstream ISPs decided to cut them off because they were announcing blocks they should not have been.
Today RPKI means that machines can in effect authenticate the LOA, the same way your web server is able to prove it's itchyouch.example (or whatever) to a web browser, the real owners of 203.0.113.0/24 can prove to a machine they're the real deal and you aren't. Unfortunately there are still transit providers who don't do that, or have it set just to bring the discrepancy to the attention of a human.
This is likely true for much of the legacy space in the US, since ARIN requires you sign their registry agreement and actually pay fees to enable RPKI. It's not grandfathered.
How about creating an email address using a pseudonym?
Or does it have to involve money? If someone uses a fake name to order a sex toy delivered (out of embarrassment) is that wire fraud?
My understanding is that using an alias to commit a fraud is an aggravating factor, like it means you went out of your way to deliberately hide your crime. It'd be awfully hard to convince a court that you made an honest mistake if you lied about your identity during the process.
So if you are doing things purely for anonymity it's OK, but if you are registering many email addresses to overcome email service's per account free storage limit, or if you order sex toy delivery for new identity to get a first buyer's discount multiple times, then as I understand that could be a wire fraud.
The other crime was looking like a douche canoe for his profile pic - https://krebsonsecurity.com/wp-content/uploads/2019/08/amirg...
Have had to pull one out of the pump at the bottom. Best part is your clothes are trapped inside with a half load of water. Or you can chance it and hope it can drain a bit at a time over a dozen drain attempts with burning it out.
I suspect another small article of clothing led to a clog in the line (apartment building). Nothing like a whole washing machine load of water back flowing onto your floor.
Fancier machines have an access hole to open up the pump. Annoying models have 3 screws flush with the ground that are nearly impossible to remove without an “airbag” door entry tool. A couple $9 ones from aliexpress can lift my machine and the dryer on top.
Edit: maybe there wasn't actually spyware and it just injected extra banner ads in your browsing. I never looked into installing it myself.
A /16 subnet was routed to our fraternity house, licensed to house up to 22 people. 65,536 (minus broadcast, gateway, and network address) IPv4 addresses for 22 people. My roommate bought 1 GB of RAM (about $4k at the time) and a VMWare student license for his Linux desktop. He cut down Win95 to be able to run in 32 MB of RAM (including his COM scripting bot, Internet Explorer, and the AllAdvantage spyware). I seem to remember him configuring the VMs to run 16-bit color to save memory footprint. He scripted the Win95 boot process to read a CSV file off of NFS, remove the top line, and write the file back. The CSV file contained fake name, fake address, etc. The VM would register itself with AllAdvantage, with my roommate as the referrer, and then randomly click on links in Internet Explorer until hitting the payout limit, and then shut down the VM. A Perl script (remember the late 90s?) on the Linux host would re-launch a clean VM every time an old VM shut down, and keep the CSV populated with fake account details.
30 VMs were browsing 24x7 for ALlAdvantage. My roommate set up a caching proxy on his Linux box, so he didn't hose the house's T1 connection. 10% of the payout (the referral fees) over something like 4-5 months paid for the whole desktop. AllAdvantage never got returned cheques from the fake addresses because they never paid out. I think he ran his system for over a year before AllAdvantage went out of business, for a total of something like $12k in profit.
He ran his own DNS server that hopped randomly all over the /16 to reduce the probability of detection. He's pretty convinced AllAdvantage's fraud people noticed him as an extreme outlier. He suspects they ignored him because the data he was generating for them cost 1/11th as much as most of the other data they were selling to customers.
Edit: a quick search shows the AllAdvantage rate was maybe $0.40/hr. 10% of this was $0.04 x 30 VMs = $1.20/hr 24x7. 8766 hours/year works out to about $10,000 per year. $12k in profit, $4k in RAM, and $1k for the rest of the machine works out to a bit under 2 years of running the system, if the rest of my memory is roughly accurate.
A few years later, our school kept the /16 allocated to us, but only routed the first /24 to the house. I'm sure my roommate wasn't the only one to get up to shenanigans with so many IP addresses.
Edit: He also found some online casinos that didn't explicitly forbid bots and he set up some poker bots that would keep track of its winning percentages against all other players. He set up some monitoring/control software for his feature phone (or was it a PDA?) so he could watch his losses from class and shut it down if necessary.
He kept records of every card seen in every game his bots played. I asked on at least 3 occasions for access to that data, to check for (1) naive shuffling (2) using a linear congruential generator instead of cryptographic quality random numbers and (3) seeding with time instead of a true random seed. He told me at least 3 times that he would give me FTP access to card histories, but never did. A couple years later, a paper came out detailing a code review of the most common online poker software finding (1) naive shuffling (2) using a linear congruential generator (3) seeded using only the time the game started and (4) containing an off-by-one error in the naive shuffle. The off-by-one error might have prevented me from figuring it all out from the poker bot histories, but there's some alternate history where we made millions in online poker, fully within the published rules of the sites. (Unfortunately, the millions would have come entirely from other players, the online casinos not bearing any of the costs of the shoddy coding.)
He mused several times that it would be fun to create a cardboard box with one of those see-through windows for a shipping label... and two subtle slits allowing a continuous roll of various shipping addresses and an advancement mechanism to be hidden within the package. He'd use a battery and/or inertial energy harvesting weight to power a device to change the sipping address every 4 hours. He wanted to send such a package with tracking information and watch it ping-pong around the country until someone realized something was fishy with the package.
He eventually dropped out of school and was living off of his poker bots until (without health insurance) his appendix burst and he was forced to get a day job to pay off his medical debt.
I hope he gets elected to Congress someday (though he's not very political) just to make a great epilogue to a biographical film.
On a side note, I thought a naive shuffle with a well-seeded cryptographic-quality pseudorandom number generator was the most likely finding from his poker bot history archive. I thought the linear congruential generator and seeding with the current time were long shots. I was just hoping that the skewed distribution gave a measurable edge over bots and players that were playing under the assumption of a uniform distribution of cards.
Had I thought there was a reasonable probability of a popular poker site using a LCRNG seeded with the current time, I would have been much more persistent in my requests for the history data.
That and netzero. The wild west of the internet.
The only thing missing from your story was Napster