FBI denied permission to spy on hacker through his webcam

[nsane.forums]

Feds provide "little or no explanation of how Target Computer will be found."

Sorry FBI, you can't randomly hijack someone's webcam.

A federal magistrate judge has denied (PDF) a request from the FBI to install sophisticated surveillance software to track someone suspected of attempting to conduct a “sizeable wire transfer from [John Doe’s] local bank [in Texas] to a foreign bank account.”

Back in March 2013, the FBI asked the judge to grant a month-long “Rule 41 search and seizure warrant” of a suspect’s computer “at premises unknown” as a way to find out more about this possible violations of “federal bank fraud, identity theft and computer security laws.”

In an unusually-public order published this week, Judge Stephen Smith slapped down the FBI on the grounds that the warrant request was overbroad and too invasive. In it, he gives a unique insight as to the government’s capabilities for sophisticated digital surveillance on potential targets. According to the judge’s description of the spyware, it sounds very similar to the RAT software that many miscreants use to spy on other Internet users without their knowledge. (Ars editor Nate Anderson detailed the practice last month.)

According to the 13-page order, the FBI wanted to “surreptitiously install data extraction software on the Target Computer. Once installed, the software has the capacity to search the computer’s hard drive, random access memory, and other storage media; to activate the computer’s built-in camera; to generate latitude and longitude coordinates for the computer’s location; and to transit the extracted data to FBI agents within the district.”

Neither an FBI spokesperson, nor Craig M. Feazel—who represents the FBI in this case and is an assistant United States Attorney—responded to Ars’ request for comment. Many civil libertarians, though, have raised serious questions as to what the government is up to.

“Hacking should be something that is the last resort, not the first option,” Chris Soghoian, principal technologist at the ACLU's Speech Privacy and Technology Project, told Ars. “No one knows anything about [how the FBI’s software works]. We know from a [Freedom of Information Act request] that there was a [Computer and Internet Protocol Address Verifier software], but this seems to be much more sophisticated. This sounds like the kind of [spyware] stuff that Gamma or Finfisher is selling. As a general rule, we don’t think law enforcement should be in the hacking business. It’s sexy, but it’s terrifying.”

Soghoian also recalled that Germany’s own (and similar) “federal trojan” program has been revealed to have notable security flaws by the famed hacker group, the Chaos Computer Club.

"Little or no explanation"

According to the judge’s order (PDF), the FBI has no idea where the suspect actually is, but noted that the “IP address of the computer accessing Doe’s account resolves to a foreign country.”

While IP addresses can certainly be easily spoofed, assuming the suspect actually is outside the United States, that raises significant questions as to the appropriate use of such a warrant. The judge agreed, noting that the “government’s application does not satisfy any [existing territorial limits].”

Further, the judge cited the government’s failure to meet the Fourth Amendment’s requirement of “place to be searched, and the persons or things to be seized.”

The Government’s application contains little or no explanation of how the Target Computer will be found. Presumably, the Government would contact the Target Computer via the counterfeit e-mail address, on the assumption that only the actual culprits would have access to that e-mail account. Even if this assumption proved correct, it would not necessarily mean that the government has made contact with the end-point Target Computer at which the culprits are sitting. It is not unusual for those engaged in illegal computer activity to “spoof” Internet Protocol addresses as a way of disguising their actual online presence; in such a case the Government’s search might be routed through one or more “innocent” computers on its way to the Target Computer. The Government’s application offers nothing but indirect and conclusory assurance that its search technique will avoid infecting innocent computers or devices.

The judge also berated the government for its failure to explain how precisely it would target the suspect’s computer, the suspect, and no one else.

What if the Target Computer is located in a public library, an Internet café, or a workplace accessible to others? What if the computer is used by family or friends uninvolved in the illegal scheme? What if the counterfeit e-mail address is used for legitimate reasons by others unconnected to the criminal conspiracy? What if the e-mail address is accessed by more than one computer, or by a cell phone and other digital devices? There may well be sufficient answers to these questions, but the Government’s application does not supply them.

Yeah, that Judge Smith

What’s also notable about this case, according to legal experts, is that it was issued by a Texas federal judge notorious for his outspoken views on making government surveillance more transparent. As we reported last year, Judge Smith estimated that tens of thousands of secret surveillance orders are issued by his fellow judges each year.

“This is the first time I've seen a public denial; the government has been very secretive about this surveillance tool and there hasn't been much litigation about it that I'm aware of,” Hanni Fakhoury, an attorney with the Electronic Frontier Foundation, told Ars. “I'm not surprised it came from Judge Smith. He's very outspoken on surveillance issues. His order finding cell site records protected by the Fourth Amendment is on appeal to the 5th Circuit (EFF argued the case). And he's issued orders denying requests for tower dump and a stingray before too.”

View: Original Article

[irefay]

Its good to know that the US has at least one judge left who rules according to the law.

[ishmoo21]

Its good to know that the US has at least one judge left who rules according to the law.

Amen

[Cypher3927]

Oh I'm sure they'll do it anyway. ;)

[dMog]

why is it that law breakers get all the breaks before during a and after they commit crimes..it is not like they wanted to go after an innocent person just to see if he was breaking the law...he WAS or was very highly involved in a crime..yes protect the rights of the average joe..law abiding citizens...and protect with a vigilant passion.... but i think all bets should be off when you are a proven criminal...and yes i agree i do not wish to be living in a police state either...but there must be some common ground here that does not allow a criminal freedom to do as they please...do you really wanttot murderers and rapists and voilent criminals get off on legal loopholes and technicalities...it happens a lot right now

[bigcid10]

why is it that law breakers get all the breaks before during a and after they commit crimes..it is not like they wanted to go after an innocent person just to see if he was breaking the law...he WAS or was very highly involved in a crime..yes protect the rights of the average joe..law abiding citizens...and protect with a vigilant passion.... but i think all bets should be off when you are a proven criminal...and yes i agree i do not wish to be living in a police state either...but there must be some common ground here that does not allow a criminal freedom to do as they please...do you really wanttot murderers and rapists and voilent criminals get off on legal loopholes and technicalities...it happens a lot right now

At the end of the day,the feds just wanted to take his money,because that's what they do

[ande]

Maybe FBI still need permission, Cocaine Import Agency don't.

Oh I'm sure they'll do it anyway. ;)

Bend the law to enforce the law.

[RadioActive]

Its good to know that the US has at least one judge left who rules according to the law.

Not for long. They'll probably remove him one way or another soon :s

[GPSBaltic]

The FBI is working. Please clean your keyboard!

[Whoopenstein]

The only thing they're prevented from doing is using the obtained evidence against you in a court of law. They can still use it to obtain other evidence to nail your ass. Remember back in the Windows 95 days when some guy was reverse-engineering Windows and found reference to "NSA key"?

[DKT27]

Remember back in the Windows 95 days when some guy was reverse-engineering Windows and found reference to "NSA key"?

Honestly, there have been so many stories about spyware surrounding Windows 95, I'm not sure what to believe in.

[Whoopenstein]

Remember back in the Window s 95 days when some guy was reverse-engineering Windows and found reference to "NSA key"?

Honestly, there have been so many stories about spyware surrounding Windows 95, I'm not sure what to believe in.

Well, I can tell you when I first heard this, I went to one of the popular news sites at the time to read about it. I was using one of the early firewall programs called "Jammer" and that thing went off like a firecracker. Someone from that site was trying to get into my computer. I had to power my system down. Was it the NSA? Who knows?

[dMog]

or was it just some 12 year old trying to see what he could get away with.... or even some criminal enterprise trying to see what they could get away with... why would the NSA target some poor average joe when they actually have serious threats to look into..ambrocious for instance :D

[Whoopenstein]

or was it just some 12 year old trying to see what he could get away with.... or even some criminal enterprise trying to see what they could get away with... why would the NSA target some poor average joe when they actually have serious threats to look into..ambrocious for instance :D

You'd be surprised at what gov'm'nts waste their time on. I had Jammer installed on my computer for over a month (about in 1996) with no hits. It only went off when I showed interest in "NSA key". What 12 yr old would have the tool to sniff the ip address of anyone who visits a particular web site? Criminal hackers were almost unheard of at the time. Fortunately, since I started to wear my special aluminum helmet, the attacks have stopped. :P

[dMog]

i got one of those helmets too...and tinfoil wallpaper i find works very well too..win95.At first,I had no firewall and just antivirus installed .. after a while my computer was sooooo full of spyware and Trojans..it took forever to boot and sometimes would not shut down not to mention my browser never going to the web sites i wanted it to go to...was not just the nsa..it was every tom dick and harry trying to take over every box in the world

[Whoopenstein]

I'll have to try the aluminum wallpaper trick. The horizontal blinds aren't working as well as they used to.

And to stay on topic, you could always put a piece of tape over the webcam or disconnect it - and the microphone.

[dMog]

you mean to say that actually doing something like that can protect you better than tinfoil? no wonder i like coming to this site

edit..the cat looks soo pleased with that helmet on :D

[nIGHT]

Have you seen real people wearing those aluminum helmets in real life?

I haven't seen and didn't know anyone in my country believing on those things.

Not that I despise them, I respect the fact that they are entitled to whatever they want to believe.

But curious on what first comes in your mind when you saw one wearing a tin foil in his head.

Is it...

WTF! What's going on?

or

Is halloween already?

or

Where's the parade?

Just curious hehe! :lol:

[dMog]

i actually know a person that used to think cosmic rays were getting into his head...he got help before the tinfoil phase set in...but he is still way more than a tad off center... definitely marched to not only to different drummer but to no instrument or cadence on earth

[Whoopenstein]

I wonder which works better - tin foil or aluminum foil? Actual tin foil might be hard to find. ;)