sailingaway
04-28-2013, 11:49 PM
A federal magistrate judge has denied (PDF) a request from the FBI to install sophisticated surveillance software to track someone suspected of attempting to conduct a “sizeable wire transfer from [John Doe’s] local bank [in Texas] to a foreign bank account.”
Back in March 2013, the FBI asked the judge to grant a month-long “Rule 41 search and seizure warrant” of a suspect’s computer “at premises unknown” as a way to find out more about these possible violations of “federal bank fraud, identity theft and computer security laws.”
In an unusually public order published this week, Judge Stephen Smith slapped down the FBI on the grounds that the warrant request was overbroad and too invasive. In it, he gives a unique insight as to the government’s capabilities for sophisticated digital surveillance on potential targets. According to the judge’s description of the spyware, it sounds very similar to the RAT software that many miscreants use to spy on other Internet users without their knowledge. (Ars editor Nate Anderson detailed the practice last month.)
According to the 13-page order, the FBI wanted to “surreptitiously install data extraction software on the Target Computer. Once installed, the software has the capacity to search the computer’s hard drive, random access memory, and other storage media; to activate the computer’s built-in camera; to generate latitude and longitude coordinates for the computer’s location; and to transmit the extracted data to FBI agents within the district.”
Neither an FBI spokesperson, nor Craig M. Feazel—who represents the FBI in this case and is an assistant United States Attorney—responded to Ars’ request for comment. Many civil libertarians, though, have raised serious questions as to what the government is up to.
“Hacking should be something that is the last resort, not the first option,” Chris Soghoian, principal technologist at the ACLU's Speech Privacy and Technology Project, told Ars. “No one knows anything about [how the FBI’s software works]. We know from a [Freedom of Information Act request] that there was a [Computer and Internet Protocol Address Verifier software], but this seems to be much more sophisticated. This sounds like the kind of [spyware] stuff that Gamma is selling. As a general rule, we don’t think law enforcement should be in the hacking business. It’s sexy, but it’s terrifying.”
Soghoian also recalled that Germany’s own (and similar) “federal trojan” program has been revealed to have notable security flaws by the famed hacker group, the Chaos Computer Club.
"Little or no explanation"
According to the judge’s order (PDF), the FBI has no idea where the suspect actually is, but noted that the “IP address of the computer accessing Doe’s account resolves to a foreign country.”
While IP addresses can certainly be easily spoofed, assuming the suspect actually is outside the United States, that raises significant questions as to the appropriate use of such a warrant. The judge agreed, noting that the “government’s application does not satisfy any [existing territorial limits].”
Further, the judge cited the government’s failure to meet the Fourth Amendment’s requirement of “place to be searched, and the persons or things to be seized.”
...
The judge also berated the government for its failure to explain how precisely it would target the suspect’s computer, the suspect, and no one else.
What if the Target Computer is located in a public library, an Internet café, or a workplace accessible to others? What if the computer is used by family or friends uninvolved in the illegal scheme? What if the counterfeit e-mail address is used for legitimate reasons by others unconnected to the criminal conspiracy? What if the e-mail address is accessed by more than one computer, or by a cell phone and other digital devices? There may well be sufficient answers to these questions, but the Government’s application does not supply them.
Yeah, that Judge Smith
What’s also notable about this case, according to legal experts, is that it was issued by a Texas federal judge notorious for his outspoken views on making government surveillance more transparent. As we reported last year, Judge Smith estimated that tens of thousands of secret surveillance orders are issued by his fellow judges each year.
more: http://www.nbcnews.com/id/44105072/ns/us_news-crime_and_courts/t/pennsylvania-judge-gets-years-kids-cash-case/#.UX4C7aK87To
Back in March 2013, the FBI asked the judge to grant a month-long “Rule 41 search and seizure warrant” of a suspect’s computer “at premises unknown” as a way to find out more about these possible violations of “federal bank fraud, identity theft and computer security laws.”
In an unusually public order published this week, Judge Stephen Smith slapped down the FBI on the grounds that the warrant request was overbroad and too invasive. In it, he gives a unique insight as to the government’s capabilities for sophisticated digital surveillance on potential targets. According to the judge’s description of the spyware, it sounds very similar to the RAT software that many miscreants use to spy on other Internet users without their knowledge. (Ars editor Nate Anderson detailed the practice last month.)
According to the 13-page order, the FBI wanted to “surreptitiously install data extraction software on the Target Computer. Once installed, the software has the capacity to search the computer’s hard drive, random access memory, and other storage media; to activate the computer’s built-in camera; to generate latitude and longitude coordinates for the computer’s location; and to transmit the extracted data to FBI agents within the district.”
Neither an FBI spokesperson, nor Craig M. Feazel—who represents the FBI in this case and is an assistant United States Attorney—responded to Ars’ request for comment. Many civil libertarians, though, have raised serious questions as to what the government is up to.
“Hacking should be something that is the last resort, not the first option,” Chris Soghoian, principal technologist at the ACLU's Speech Privacy and Technology Project, told Ars. “No one knows anything about [how the FBI’s software works]. We know from a [Freedom of Information Act request] that there was a [Computer and Internet Protocol Address Verifier software], but this seems to be much more sophisticated. This sounds like the kind of [spyware] stuff that Gamma is selling. As a general rule, we don’t think law enforcement should be in the hacking business. It’s sexy, but it’s terrifying.”
Soghoian also recalled that Germany’s own (and similar) “federal trojan” program has been revealed to have notable security flaws by the famed hacker group, the Chaos Computer Club.
"Little or no explanation"
According to the judge’s order (PDF), the FBI has no idea where the suspect actually is, but noted that the “IP address of the computer accessing Doe’s account resolves to a foreign country.”
While IP addresses can certainly be easily spoofed, assuming the suspect actually is outside the United States, that raises significant questions as to the appropriate use of such a warrant. The judge agreed, noting that the “government’s application does not satisfy any [existing territorial limits].”
Further, the judge cited the government’s failure to meet the Fourth Amendment’s requirement of “place to be searched, and the persons or things to be seized.”
...
The judge also berated the government for its failure to explain how precisely it would target the suspect’s computer, the suspect, and no one else.
What if the Target Computer is located in a public library, an Internet café, or a workplace accessible to others? What if the computer is used by family or friends uninvolved in the illegal scheme? What if the counterfeit e-mail address is used for legitimate reasons by others unconnected to the criminal conspiracy? What if the e-mail address is accessed by more than one computer, or by a cell phone and other digital devices? There may well be sufficient answers to these questions, but the Government’s application does not supply them.
Yeah, that Judge Smith
What’s also notable about this case, according to legal experts, is that it was issued by a Texas federal judge notorious for his outspoken views on making government surveillance more transparent. As we reported last year, Judge Smith estimated that tens of thousands of secret surveillance orders are issued by his fellow judges each year.
more: http://www.nbcnews.com/id/44105072/ns/us_news-crime_and_courts/t/pennsylvania-judge-gets-years-kids-cash-case/#.UX4C7aK87To