FBI takes down over 400 .onion sites
fbi.gov
fbi.gov
The Fourth Amendment says "nor shall any person [...] be deprived of life, liberty, or property, without due process of law". I don't see any process of law here. The FBI is law enforcement, not judicial.
If you read through the criminal complaint filed against Silk Road 2.0 / Benthall, they establish pretty sufficient probable cause for a search and seizure.
Arrest warrants for the individuals involved is a separate process.
Selling drugs is illegal. Hence running a website to sell drugs is also illegal. Of course the government is going to shut down the website or any other sites where there is clear evidence of criminal behaviour. The criminal case against Blake et al over whether they ran the site is a separate issue.
The FBI clearly would have sought a warrant from the judiciary as they would in any other case. I really don't understand where you're coming from here. There is nothing unusual at all about how all of this has gone down.
Are police officers or FBI agents who are being shot at prohibited from shooting back at their attacker, because that would deprive life without due process of law?
Can suspects not be arrested until a court case has exhausted all its appeals, because that would deprive liberty without due process of law?
The FBI (presumably) had a warrant here, after gathering evidence, and the cooperation of various other agencies including a few district attorneys. The US (hopefully) is a land in which the process of acquiring a warrant before actually seizing anything or arresting anyone is so commonplace that it isn't even mentioned. There was a process of law, it involved the courts, you didn't see it because it didn't need to be mentioned, and it didn't involve the completion of a criminal case.
(There are separate safeguards, against police officers killing people without reason, arrests happening without a warrant, or liberty or property being deprived for unreasonably long while a court case is artificially stalled. Some of those safeguards are not as effective as a free people would hope. But I don't think that's what you were referencing, and I don't think you can make a case that any of those happened here.)
That is not true any more. There was a discussion [1] two months ago about the changes in the law regarding property seizure post 9/11. They call it "asset forfeiture".
Thank you for putting forward a reasonable hypothesis amid the FUD.
That being said, I doubt he was a developer for 399 other sites, thats quite a few. I think a "watering hole" style attack is likely here, but I think there must be a part of the story that hasn't been revealed; perhaps there was a federation of .onion marketplaces that Benthall was a part of.
But it's still a pretty high number. I would not completely rule out some sort of trick or analysis being employed by global law enforcement to identify the ISP or datacenter being used to host hidden services. It may just be a matter of them plotting the volume of Tor traffic around the world and narrowing it down from there; it's likely not that difficult to distinguish Tor traffic from a popular hidden service and Tor traffic from a relay, exit node, or client.
Note the bottom of the FBI's press release:
>The law enforcement authorities of Bulgaria, Czech Republic, Finland, France, Germany, Hungary, Ireland, Latvia, Lithuania, Luxembourg, Netherlands, Romania, Spain, Sweden, Switzerland, and the United Kingdom, whose actions have been coordinated through Eurojust and Europol’s EC3, provided substantial assistance.
That's a lot of countries. Many unscrupulous hosting providers are located in those countries. It's possible that the FBI narrowed their search down to individual foreign ISPs, then had foreign law enforcement work with ISPs, NOCs, and hosting companies to place selective taps and narrow things down even further, centered purely around analysis of Tor traffic volume.
Or they may have found a general purpose vulnerability. Or perhaps a combination of the two.
These tweets by a (not currently arrested) popular hidden service operator are also very interesting:
https://twitter.com/loldoxbin/status/530764492326838272
https://twitter.com/loldoxbin/status/530766985794420736
https://twitter.com/loldoxbin/status/530768176007884800
https://twitter.com/loldoxbin/status/530768358355251200
https://twitter.com/loldoxbin/status/530891182612955136
Tor is not dead, but anyone running an illicit hidden service should probably be concerned, at least until further details are released or discovered. It's entirely possible that they took down all of these services purely through typical cybercrime investigative techniques, but I think it's unwise to rule out something a bit more powerful this early on.
I guess we'll have to watch this story very carefully.
I'm also "in" the security industry (I'm applying to my first jobs, but that is my chosen career path), and I do not believe Tor is sufficient to protect one's identity; but it irks me when people dismiss it outright because it has flaws.
The flaws are serious and should be better known, but nothing will ever excuse you from maintaining proper OPSEC and employing defense in depth.
First, I'm quite happy that this activity does not appear to be the result of wide scale infrastructure sabotage.
And I am quite happy that the FBI is doing its job to combat crime that is facilitated using (abusing) the technologies that are bastions for free speech, privacy and whistleblowing.
Of course the flipside is that this means that there are capabilities in place to disrupt anonymizing technologies - the technologies make investigation more expensive but ultimately are merely an inconvenience to the powers that be. So when it comes down to it, anonymizing services and Tor can't be trusted to secure you if you have something to say where your life is in danger.
The FBI (/others) wants the court system to replace technology as the gatekeeper to investigation. The court system, however, is brittle. It takes time, it fails, and it responds to external pressure - there are repeated studies that show that the length of time persons in US court systems are convicted to serve is highly correlated with how long it has been since the precising judge has eaten his last meal. There are also extralegal rights that law enforcement are given by legislature and evolving interpretations of what both these legal and extralegal rights entail.
But law enforcement also is justified from their perspective. They don't want there to be criminals that get away with crimes simply because criminals load up some software that obfuscate their identities, locations and accounts. If you look at this published list there are criminal organizations that you and I as taxpayers do want taken down. (I recognize that the sale and consumption of drugs is a greyer area of morality as drug use is sometimes victimless).
I think that for the most part law enforcement is capable of taking down these services and organizations other ways - ordering assault rifles and monitoring the drops - and that this provides opportunities for the government to enforce the law without sabotaging communications infrastructure. Taking down some .onion addresses doesn't do too much besides annoy the services for a time anyway unless the services operationally are not capable of standing up a new address and communicating with customers anonymously.
All in all it's a blurry line but I feel safer with places that are anonymous and secure than I do by trusting a court system and legal process that can only see, process, and be accountable for so much.
I've been skeptical of Tor et-al from day one. I didn't have provable reasons why, but the court has always served as the gatekeeper to investigation, and the Tors of the world seemed like the sort of hubris we techies are so prone to- "Age-old social justice problems man has struggled with for thousands of years can be trivially fixed with my technology!"
It is my opinion that we (techies) overestimate ourselves. Tor is useful, but it would have to be perfect (which no technology can be) to protect you from the flawed judicial system. Which is why I think we are destined for heartbreak, and the longer we forestall that realization the worse off we will be, for we will ignore the judicial system and allow it to become ever more broken.
As a sidenote I find it bitter satire; people who cannot accept the will of others seeking tools to forcefully impose their own morality on the world instead
What everyone is forgetting is this:
The FBI, NSA, CIA etc all have techies. And since they would be extremely well paid it is logical to assume that they are very good at what they do. So anything that we can do they can do only (a) arguably better and (b) with the constraint of having to comply with the law.
By this do you mean those that can't accept the will of others comprise the judicial system or those not prepared to submit to it and pursuing alternate avenues? Your comment works either way, but if you're talking about those attempting to place themselves outside the judicial system that's less them imposing their own morality on the world and simply not allowing the world to impose its morality on them.
If all technology provides more power to everyone, but unevenly to where more is added at the top than the bottom, then the only thing that is left to defend against power inequality are court systems and forms of mass unrest. I distrust the completeness of the former (we've seen them go bad) and rather dislike the latter.
The pendulum could of course swing too far the other direction into anarchy. This, too, leaves my mouth bitter.
Ultimately I think technologies like Tor aren't so bad. Certainly it is nothing compared to nuclear weapons or personal firearms. Information and communication, while they can aid criminal behavior, are not criminal in themselves. Like has always been the case - long before it was possible to monitor and store information and communication for later introspection - criminal acts are acts in the physical world and they can be investigated there.
https://www.schneier.com/news/archives/2014/04/bruce_schneie...
January 30 to July 4, 2014 someone set up 115 tor nodes on fdcservers.net (total cost maybe ~$200k?), which was 6.4% of entry guard capacity. Clients talk to 3 guard nodes for an average of 45 days each, which means they probably picked a guard ~12 times during this period. Each guard-picking attempt had a ~6.4% chance of landing one of these bad guards, or a 55% chance across all attempts.
"We know the attack looked for users who fetched hidden service descriptors... The attack probably also tried to learn who published hidden service descriptors, which would allow the attackers to learn the location of that hidden service."
By "wide scale infrastructure sabotage" I was trying to refer to QUANTUMINSERT, TEMPORA and other internet-scale mass read and write capabilities. It doesn't look like the FBI had to use those sorts of technologies to interrupt the .onion addresses - I'm really happy about that. First because it shows that law enforcement can fight cybercrime without those tools and second because if they were used proponents/supporters would have championed them as 'necessary' or 'inevitable'.
As little as 20 years ago, spraying your crops with DDT wasn't illegal. Look how far we've come.
As little as 5 years ago, selling furniture treated with brominated flame retardants wasn't illegal in the EU. Look how far we've come.
We are wrong about chemicals all the time. The regulatory status of chemical X fifty years ago rarely means much.
But before we get rid of the current legislation about drugs, we would need an actual plan for dealing with irresponsible uses of drugs.
If people could take heroin or ice and (a) stop whenever they wanted and (b) still function as society expects then nobody would have an issue with them being legal. But drugs like those effectively rewire the brain and are incredibly destructive. A significant amount of domestic violence, child abuse, family breakdown incidents are directly attributable to drugs. You can't blame society for not wanting drugs like those to be readily accessible.
Regardless, the current legislative frameworks around the world (with few exceptions) are based on fear and a twisted sense of morality rather than actual harm.
I still got clean, because the risk of getting caught and the impact that would have on my future outweighed my addiction. I'm glad I did, and I'm lucky Australia treats it as a medical problem, not a criminal one, when you seek help.
But legalization of heroin, crack, cocaine, meth? That's really a pipe dream. It might happen some day, but that'd be more on the range of 70-100 years if I were to guess, and perhaps a lot longer.
Marijuana is a significant portion of sales on all of the dark markets, but other more addictive narcotics still constitute the majority compared to marijuana.
But the ethical imperative to allow people full control over what substances go into their own bodies seems to be as ignored as ever.
Simple example: I'm not legally allowed to control the levels of testosterone in my own body. That seems absurd.
#MyBodyMyChoice
Many drugs have indirect impacts. Jacking up on testosterone, for example, makes you aggressive and violent.
Many people want the government to look out for them. For example, the regulatory rigor around new medicine.
Many proponents of complete legalization of all substances argue that responsible users have no impact on others. However while this may be true of responsible users, empirical evidence suggests vanishingly few users are responsible, which is the major problem.
You have to weight the infringement on the rights & freedoms of innocent bystanders suffering at the hands of the abusers, against the infringement of rights from outlawing the drug. Somebody must loose; which should it be?
Maybe the rational conclusion is still, "make it legal", but this is the real question. It is not as simple as "my body, my choice".
Most users are responsible, but since they are responsible, they won't impact you, or anyone, and you'll never hear of them
And, I took the most addictive drug to illustrate this.
What is the net negative impact that MDMA users, for instance, have on other people ? Other than being nice to the point of being annoying, but, well, if we talk about this kind of negative impact, what are we waiting to make ethanol illegal ?
This is a good question to ask in some hypothetical world where making it illegal actually stops people from consuming it.
That's clearly not our world, though, so the question is actually of little relevance. Laws punishing consumption have been shown, empirically, to violate the rights and freedoms of both the users and of the innocent bystanders (by preventing users from becoming non-users).
I'm almost positive someone will be absolutely indignant at my temerity for suggesting the above, but it's worth thinking about what real legalization would look like.
http://www.ttb.gov/spirits/faq.shtml
This is different from brewing beer, cider and winemaking, which are quite differently regulated.
One of the primary selling points of legalization was to increase state revenue. This is how the state collects. Personally, I'm not at all bothered by this.
The counter culture won. America is the world's largest welfare state, has the largest entitlement systems, with a total government system larger than the economy of Japan, hyper regulation, high taxation, and has very few remnants of Capitalism.
AFAICT when people came down from whatever it was and actually tried to live their 'new' ways, they pretty much degenerated and fell apart after short times for all sorts of reasons.
Being a corporate drone is not an aspiration. Feeding your family and having a nice place for them to live certainly is though.
These are not noble drug dealers harming nobody.
They are sociopathic assholes selling whatever makes money, even if the ONLY reason for the item is to harm innocent individuals against their will.
But that they aren't is proof positive to me that the government does not operate for the benefit of the people, but for the benefit of itself.