The FBI took -- and mysteriously returned -- their server(redtape.msnbc.msn.com)
redtape.msnbc.msn.com
The FBI took -- and mysteriously returned -- their server
http://redtape.msnbc.msn.com/_news/2012/05/11/11647813-the-fbi-took-and-mysteriously-returned-their-server-heres-their-story#.T6zg38SqLMQ.twitter
53 comments
A smaller issue in this story but still important; what kind of data center gets a search warrant and server pulled, and doesn't immediately notify their client? Are they legally prohibited from doing so? Then they let the FBI put the possibly compromised server back on the network? WTF?
Seems to be SOP from all of the data center horror stories that I've heard.. site/apps go offline, datacenter or domain registrar gives you no useful information of any kind, truth later found out via third party or lawyer work.
> Are they legally prohibited from doing so?
Yes. They can be charged with obstruction of justice or interfering with an investigation.
Yes. They can be charged with obstruction of justice or interfering with an investigation.
Still doesn't make much sense. The client is going to figure it out. Also, a search warrant doesn't give the Feds the ability to put it back. Maybe with a national security letter for the purpose of putting spyware on it? But even then the server owner is going to notice that their server went missing for a couple days. "Must have gone for a long walk. Glad it's back," is not how I would approach it.
Right. The data center owner had no obligation to allow the FBI to return the server. [IANAL] This was a convenient choice on their part. Is there any reason why this human rights organization can or should not post a torrent of the server's disk images so that knowledgeable folks can determine what the FBI might have done to the machine?
> Still doesn't make much sense.
On the contrary, it makes perfect sense. It gives the FBI or any law enforcement agency sufficient leeway to do as they please, which is always the intent of such laws.
> The client is going to figure it out.
The only thing the client knows is that their server isn't working. Not that they are about to be raped by the feds.
On the contrary, it makes perfect sense. It gives the FBI or any law enforcement agency sufficient leeway to do as they please, which is always the intent of such laws.
> The client is going to figure it out.
The only thing the client knows is that their server isn't working. Not that they are about to be raped by the feds.
1) Their actions don't make sense. The law is what it is.
2) In this case the Feds had already paid them a visit. If they are trying to run a covert surveillance operation they really suck at it. Even without the FBI visit I am still going to figure out what the hell happened to my server.
Worst wire tap job ever? Helpful FBI agents with experience in network operations want to make up for needlessly inconveniencing someone? Some other three letter agency tells them, "we were using that, could you put it back?" ?
2) In this case the Feds had already paid them a visit. If they are trying to run a covert surveillance operation they really suck at it. Even without the FBI visit I am still going to figure out what the hell happened to my server.
Worst wire tap job ever? Helpful FBI agents with experience in network operations want to make up for needlessly inconveniencing someone? Some other three letter agency tells them, "we were using that, could you put it back?" ?
Seems like a proper time for civil disobedience.
I depends on the type of warrant, but there are warrants that require silence under threat of prosecution.
I'm a student at the University of Pittsburgh. From that point of view, this seems like a perfectly fine action to take. The FBI agents may have disrupted service to a few hundred users, but these threats were affecting thousands of people.
I don't know if these anonymous email threats were unprecedented or not, but they certainly present a huge challenge to law enforcement. What would have happened if the people responsible didn't just stop?
Of course, you could subscribe to the view of the conspiracy theorists among us who feel that the FBI did actually catch the people responsible and are now employing them. :P
I don't know if these anonymous email threats were unprecedented or not, but they certainly present a huge challenge to law enforcement. What would have happened if the people responsible didn't just stop?
Of course, you could subscribe to the view of the conspiracy theorists among us who feel that the FBI did actually catch the people responsible and are now employing them. :P
Up-vote because many people feel this way, so it's important to discuss. But I strongly disagree.
From that point of view, this seems like a perfectly fine action to take.
There's certainly an argument to be made in support of your statement. If we were to work in a purely utilitarian manner, there would be little room for argument.
But the design of the structure of civil rights we have in America doesn't work that way. We recognize that people have certain inherent, inalienable right. Even if stripping someone's rights would save tremendous tragedy, our philosophical underpinnings prevent it.
We don't condone torture (unless you're the current President or his predecessor), even when we might be able to extract information that could save many.
We could save many thousand people who are sick, and destined to die, waiting in vain for organ transplants. Just pick somebody's name out of a hat, and divide up his organs -- a liver, a heart, a couple of kidneys. For each life we took, we could save four or more others (not to mention improving others with cornea transplants, etc.). But despite the fact that utilitarian balance says that the net benefit to society would be positive, our system will not even contemplate such an action.
Those examples are extreme, but they illustrate the point that we don't take actions that injure innocent people (and remember, everyone is innocent until proven guilty) even when they can save many others.
From that point of view, this seems like a perfectly fine action to take.
There's certainly an argument to be made in support of your statement. If we were to work in a purely utilitarian manner, there would be little room for argument.
But the design of the structure of civil rights we have in America doesn't work that way. We recognize that people have certain inherent, inalienable right. Even if stripping someone's rights would save tremendous tragedy, our philosophical underpinnings prevent it.
We don't condone torture (unless you're the current President or his predecessor), even when we might be able to extract information that could save many.
We could save many thousand people who are sick, and destined to die, waiting in vain for organ transplants. Just pick somebody's name out of a hat, and divide up his organs -- a liver, a heart, a couple of kidneys. For each life we took, we could save four or more others (not to mention improving others with cornea transplants, etc.). But despite the fact that utilitarian balance says that the net benefit to society would be positive, our system will not even contemplate such an action.
Those examples are extreme, but they illustrate the point that we don't take actions that injure innocent people (and remember, everyone is innocent until proven guilty) even when they can save many others.
I think that you've taken this too far. We can't make blanket statements about peoples rights and expect them to be applicable in every situation.
In this case, a legal authority made the decision to interrupt a service for a small period of time in order to investigate a terrorist act that was disrupting the lives of thousands of people daily. If this was, say, a service that was providing medical assistance to elderly people, I don't think the same decision would have been made.
In this case, a legal authority made the decision to interrupt a service for a small period of time in order to investigate a terrorist act that was disrupting the lives of thousands of people daily. If this was, say, a service that was providing medical assistance to elderly people, I don't think the same decision would have been made.
We can't make blanket statements about peoples rights and expect them to be applicable in every situation.
yes you can. that's exactly what a right is. a right is the right to do something even when it seems wrong. you don't need a right to do what seems right.
my favourite quote, ever:
At first blush it may be thought surprising that one should have a right to do that which one ought not. Is it not better to confine rights to that which it is right or at least permissible to do? But to say this is to misunderstand the nature of rights. One needs no right to be entitled to do the right thing. That it is right gives one all the title one needs. But one needs a right to be entitled to do that which one should not. It is an essential element of rights to action that they entitle one to do that which one should not. To say this is not, of course, to say that the purpose or justification of rights of action is to increase wrongdoing. Their purpose is to develop and protect the autonomy of the agent. They entitle him to choose for himself rightly or wrongly. But they cannot do that unless they entitle him to choose wrongly. - Joseph Raz, The Authority of Law (p 266)
rights are very special things - they are used to protect a few essential freedoms that are so important they should be protected whatever else.
rights - real rights - are very powerful things. they're the last defense against tyranny. the absolute last thing you want is some dictator saying "well, times are hard, so you can't have free speech right now". that is why rights are absolute.
yes you can. that's exactly what a right is. a right is the right to do something even when it seems wrong. you don't need a right to do what seems right.
my favourite quote, ever:
At first blush it may be thought surprising that one should have a right to do that which one ought not. Is it not better to confine rights to that which it is right or at least permissible to do? But to say this is to misunderstand the nature of rights. One needs no right to be entitled to do the right thing. That it is right gives one all the title one needs. But one needs a right to be entitled to do that which one should not. It is an essential element of rights to action that they entitle one to do that which one should not. To say this is not, of course, to say that the purpose or justification of rights of action is to increase wrongdoing. Their purpose is to develop and protect the autonomy of the agent. They entitle him to choose for himself rightly or wrongly. But they cannot do that unless they entitle him to choose wrongly. - Joseph Raz, The Authority of Law (p 266)
rights are very special things - they are used to protect a few essential freedoms that are so important they should be protected whatever else.
rights - real rights - are very powerful things. they're the last defense against tyranny. the absolute last thing you want is some dictator saying "well, times are hard, so you can't have free speech right now". that is why rights are absolute.
You're right that legal precedent doesn't take rights absolutely. For example, there's the "clear and present danger" test for speech rights.
However, weighing against such a determination is what the OP explained: any competent mail anonymizer is going to be a dead end in the investigation, so the chances of a payoff is small. I'd be curious to see the actual warrant, to see what the judge approved them to look for.
And on the other side of the coin, I expect that the rights of those using the anonymizer (as opposed to those of the company offering the service) were not weighed, because the FBI never inquired as to who would be affected (at least as far as I know).
Those users of the anonymizer are not directly injured, but are collateral damage. However, the same is true of you: you're neither the threat-maker nor the target of the threats, you're just inconvenienced by the actions that the victim was forced to make.
However, weighing against such a determination is what the OP explained: any competent mail anonymizer is going to be a dead end in the investigation, so the chances of a payoff is small. I'd be curious to see the actual warrant, to see what the judge approved them to look for.
And on the other side of the coin, I expect that the rights of those using the anonymizer (as opposed to those of the company offering the service) were not weighed, because the FBI never inquired as to who would be affected (at least as far as I know).
Those users of the anonymizer are not directly injured, but are collateral damage. However, the same is true of you: you're neither the threat-maker nor the target of the threats, you're just inconvenienced by the actions that the victim was forced to make.
I agree... In one case you're talking about killing someone and taking their organs to give to others and in the other we're talking about disrupting someones email usage to prevent bomb detonation. Can we see the difference here? I still don't see any reason that I would not give up my private information on a server in order to protect our country and thousands of lives... looking up some counter arguments though. I can't think of any good ones off the top of my head.
>> I still don't see any reason that I would not give up my private information on a server in order to protect our country and thousands of lives.
In the case of the service disrupted, that private information on the server could be what's protecting other lives in a country where basic rights are being disputed in blood.
In the case of the service disrupted, that private information on the server could be what's protecting other lives in a country where basic rights are being disputed in blood.
Right, but who is to say that the FBI would release that information into the wrong hands? If that is the case then it sounds like the problem is with the way confidential information is handled by our intelligence agencies.
I'm not talking about the actual content, just that they had made the service unavailable to people that might direly need them. If you're fighting for democratic rights in a country with severely restricted freedoms, it might not be a matter of just checking back for the service to be up, probably you'd have limited windows to of oportunity operate. You may just have missed the chance to warn a fellow activist in time to save his life, or your own.
I pretty much agree, they talked about "innocent peoples privacy" but if they are truly innocent then it shouldn't matter if the FBI sees their information. If my data were on that server and I was doing nothing wrong I really don't think I would mind handing it over to the FBI to help find even the smallest threat to our country.
Right to privacy is fundamental in the United States. People should never have to respond to the argument that if they are truly innocent they won't mind some breach.
But, was anyone's personal data really on that server? If it's an anonymous emailing service I would think that just the service was disrupted.
Could be. I'm curious to hear why my comment was down voted though, regardless of whether there was information on the server or not. It seems a lot of people are always screaming "privacy!" and when I mention I'm willing to give up some privacy to protect the safety of other people and our country others do not agree with me. What is it you think will happen if the FBI gets a hold of your data on a server? This of course is just my opinion and I respect everyone else's opinion but I would like to hear a counter argument.
Gathering, pre-processing, entering, and storing information costs time and money.
Having more data about more people increases the risks of false positives ("Innocent Bob is a terrorist!") and false negatives ("Terrorist Ann is innocent!"); and raises the risks of faulty data being gathered, processed and entered.
So, having data about innocent people just increases costs and decreases quality.
Having more data about more people increases the risks of false positives ("Innocent Bob is a terrorist!") and false negatives ("Terrorist Ann is innocent!"); and raises the risks of faulty data being gathered, processed and entered.
So, having data about innocent people just increases costs and decreases quality.
You're getting downvoted because you've just rephrased the "if you've nothing to hide, you've nothing to fear" argument. Here, have a counterargument: http://papers.ssrn.com/sol3/papers.cfm?abstract_id=998565...;
Thanks. I'll look it over.
If that were my server, I'd pull the data needed and burn the hardware. Never use it again.
NFW.
I'd build a new machine from scratch, at a different datacenter, using pristine code and data from backups.
Once a machine has been in an adversary's possession, not even the data is safe.
That said, the FBI probably just imaged the drives. They're not as clueful/devious as many think they are.
I'd build a new machine from scratch, at a different datacenter, using pristine code and data from backups.
Once a machine has been in an adversary's possession, not even the data is safe.
That said, the FBI probably just imaged the drives. They're not as clueful/devious as many think they are.
>> "That said, the FBI probably just imaged the drives. They're not as clueful/devious as many think they are."
I would agree, but it also doesn't seem like some kind of act of charity that they plugged the thing in and tried to reconnect it and made sure it was apparently working before they left.
I would agree, but it also doesn't seem like some kind of act of charity that they plugged the thing in and tried to reconnect it and made sure it was apparently working before they left.
They do hire clueful contractors once in a while.
Correct. But the guys were probably Special Agents and were from the data forensics group that are recruited into the DoJ specifically for their IT skills.
It's also possible that there was a Special Agent + Contractor team working.
BTW, they are probably not very happy that video evidence of their activities was captured and published. Don't look for them to make that mistake again.
It's also possible that there was a Special Agent + Contractor team working.
BTW, they are probably not very happy that video evidence of their activities was captured and published. Don't look for them to make that mistake again.
[deleted]
They are doing something like that, but auditing the machine first to see if they can get any information on why the FBI returned it so quickly.
At least keep it around in a closet somewhere--at some point in the future it might be fun to play with whatever nasties are on it.
"I'd pull the data needed": what if there is a virus?
[deleted]
Here is my question...
If you rent an apartment, even though you don't own the building, you have "rights of tenant in possession". Basically the apartment is "yours" and you have rights. If a search warrant is to be served to search your place, it gets served on YOU, not the owner of the buildng.
If you rent server space, like a rack in a datacenter, that space is "yours". So should the search warrant have been honored?
If you rent an apartment, even though you don't own the building, you have "rights of tenant in possession". Basically the apartment is "yours" and you have rights. If a search warrant is to be served to search your place, it gets served on YOU, not the owner of the buildng.
If you rent server space, like a rack in a datacenter, that space is "yours". So should the search warrant have been honored?
Generally speaking you aren't renting server space, you're renting server equipment i.e. the rack, hardware, power, networking, so I would imagine that would or at least could be the difference.
Good point, it would in fact make a difference.
I read the article, they do say "colocation"; besides which, XO Communications does not rent servers as far as I know. So that seems to point that they were renting the physical space that their servers are in.
Would it make a difference if they were just renting a partial rack, or a full rack that goes all the way down to the floor and is enclosed? I don't know ...
I read the article, they do say "colocation"; besides which, XO Communications does not rent servers as far as I know. So that seems to point that they were renting the physical space that their servers are in.
Would it make a difference if they were just renting a partial rack, or a full rack that goes all the way down to the floor and is enclosed? I don't know ...
Surely even then the rental contract would specify the equipment they rent, not the space - the data centre could move their rack to a different physical location at any time.
I will tell you that unless something is on fire in my rack, no one from Level3 will even touch anything - and even then they would hit the fire suppression button and leave the room. They do not touch anything in a customer rack. (I have two racks in a local facility owned by Level3).
The contract I signed, had a clause that said if they had to move me somewhere else, they would pay all costs of doing so. I don't know how standard a clause this is.
The contract I signed, had a clause that said if they had to move me somewhere else, they would pay all costs of doing so. I don't know how standard a clause this is.
OK I simplified a little, but if there was ever any reason to move a rack and it could be done with zero downtime, the arguments against it are never going to be "but that's my space I rented".
I rent a furnished appartment, and while the company that owns it would never touch it without my permission, the contract is very specific about it being this building, they would never say "mind moving next door?" whereas with a rack in a data centre, not only does the contract not specify exactly where the rack is placed, it makes very little difference about it's exact location.
I rent a furnished appartment, and while the company that owns it would never touch it without my permission, the contract is very specific about it being this building, they would never say "mind moving next door?" whereas with a rack in a data centre, not only does the contract not specify exactly where the rack is placed, it makes very little difference about it's exact location.
What are the US laws in regard to search and seizure of rented storage facilities? This seems like an interesting point on the continuum between an apartment and a data center rack.
IMHO, just avoid the whole question and rent outside the USA.
I've been in a situation where a server was temporarily pulled by feds. They almost certainly just duplicated the drives with legally-sound forensic software.
Im surprised nobody is discussing the reason for the pull. Obviously the FBI has copied all the data on the server and are now using a backdoor in the encryption or brute force cracking to get into the information.
There is no such thing as safe data once the physical server is confiscated, and people shouldnt trust standard encryption algorithms to be safe from backdoors.
Microsoft Windows has had backdoors for a long time I reckon. Some of it are called "bugs" once its discoved and fixed with Windows Updates. Other stuff gets introduced that way as well.
Or they could have port knocking techniques built into the closed source kernel to allow people who know the code to enter the computer without any trace.
There is no such thing as safe data once the physical server is confiscated, and people shouldnt trust standard encryption algorithms to be safe from backdoors.
Microsoft Windows has had backdoors for a long time I reckon. Some of it are called "bugs" once its discoved and fixed with Windows Updates. Other stuff gets introduced that way as well.
Or they could have port knocking techniques built into the closed source kernel to allow people who know the code to enter the computer without any trace.
If you were the FBI, and you had a backdoor already built into the software running on that server, would you really confiscate it and take four days to use it rather than leaving it running and hoping nobody notices you came by to activate it, and/or having it be activated over the network?
I wonder if we've got to the point where it might actually be worth putting a camera into the server case that streams to another site? You really only have to keep under an hour of video.
Scary stuff. The state of privacy in society today is nothing short of scary.