[HN Gopher] Justice Department withdraws FBI subpoena for USA To...
___________________________________________________________________
Justice Department withdraws FBI subpoena for USA Today records
ID'ing readers
Author : prostoalex
Score : 336 points
Date : 2021-06-05 21:37 UTC (1 days ago)
(HTM) web link (www.usatoday.com)
(TXT) w3m dump (www.usatoday.com)
| PragmaticPulp wrote:
| I'm glad they withdrew this. That said, it does appear that the
| subpoena was more selective than I initially thought, given the
| headlines. From the other USA Today article:
|
| > The subpoena, issued in April, demands the production of
| records containing IP addresses and other identifying information
| "for computers and other electronic devices" that accessed the
| story during a 35-minute time frame starting at 8:03 p.m. on the
| day of the shooting.
|
| A 35-minute window could still produce a large number of readers,
| but I assume they had some other information that would have
| immediately narrowed it down or otherwise confirmed their
| suspicions.
| slumdev wrote:
| This is almost certainly a case of attempted parallel
| construction.
|
| Indulge my hypothetical:
|
| 1. A newspaper article is posted at 1PM.
|
| 2. A suspicious comment that contains nonpublic, incriminating
| information is posted on a message board at 1:15PM. That comment
| links to the USA Today article. The message board is outside of
| FBI jurisdiction.
|
| 3. The Feds already know the identity of the commenter through an
| illegal and/or unconstitutional means of data gathering. (Think
| of all the secret taps built into AT&T's networks, their Stingray
| devices, all of the unpublished vulnerabilities exploited every
| day by TLAs, etc.)
|
| 4. If the Feds can get the identities of everyone who read the
| article during the window immediately before and after that
| comment's submission, they may be able to use other information
| to narrow that list down to one or two suspects and use that to
| sway a judge to issue a search warrant. Because they already know
| who they're looking for, I wouldn't expect this "narrowing down"
| process to be particularly even-handed.
| xvector wrote:
| I wish services didn't store IPs at all.
|
| If abuse is an issue, why not hash the IP with a nonce?
| codetrotter wrote:
| IPv4 space is small so they will subpoena the nonce and find
| what the original IP was
| kadoban wrote:
| For ipv4 is there a difference between storing IPs and storing
| their hash with a nonce? You can calculate the hash of every IP
| address in reasonable time, so it's reversible.
|
| Only benefit I can think of is you can forget the nonce and now
| the data is securely useless, if the nonce was secure, but that
| doesn't seem that useful really.
| xvector wrote:
| I think if we use a difficult enough hash function it should
| be okay? With 4 billion IPv4 addresses it would take 120+
| years to iterate through all of them. You could probably
| rotate the nonce periodically, making it effectively
| worthless to pre-compute any table. But this gets complicated
| fast.
| kadoban wrote:
| You could try to do a more difficult hash or something
| (bcrypt maybe?) but I don't know if it's a very good idea.
| I think you'd spike your latency, open yourself to DoS
| attacks or only minorly inconvenience anyone reversing the
| hashes, or some combination of those.
| xxs wrote:
| >(bcrypt maybe?) but I don't know if it's a very good
| idea
|
| b/scrypt and all other password grade hashes are slow on
| purpose but they are slow per each use. Imagine the
| processing takes 0.1s (which is on the low side of
| hardness) per each request - you just killed all your
| servers w/o any designated DoS. If you abandon the nonce
| and use the same salt multiple times (so the computation
| is amortized), it'd take a replicated cache of IP->hash
| and even then it still doesn't accomplish much...
| rpadovani wrote:
| Why 120 years? It is easily parallelized, and with any
| cloud provider you can launch hundreds of thousands of
| computing unit in seconds. I'd say, as a private citizen, I
| can create a rainbow table of the IPv4 space in half a day,
| more or less?
| somethingwitty1 wrote:
| Except you are still storing the nonce/salt (not sure which
| you are proposing)...which means you _can_ reverse it, so
| the data is subpoenable. It doesn 't really buy anyone
| anything, in this scenario. It could help if the logs were
| stolen, but that isn't what is being discussed here.
| [deleted]
| gizmo686 wrote:
| There are only 2^32 possible IP addresses. You can brute-force
| that on a personal laptop.
| xvector wrote:
| If you use a hard hash function you cannot brute force that
| on a laptop - not even a tenth of that. You can, however,
| spin up compute instances to brute force it in a few days if
| you have $50k lying around.
| zeroimpl wrote:
| What are the odds that a website will run a computationally
| hard hash function on every single HTTP request just so it
| can log something less sensitive than an IP address?
| josefx wrote:
| The website could cache the hash for an hour or two.
| xxs wrote:
| >force that on a laptop
|
| They said: "personal computer", which could easily have 2x
| GPUs and 16+ cores. Heck, laptops nowadays can have a
| pretty good discrete GPU.
|
| Using password grade hash with a =nonce= is absolutely no
| way to be accomplished per each request. The nonce would
| have to be the same for multiple uses - hence NOT a
| 'nonce'. The sharing of the said non-nonce would require a
| form a replicated Map (or IP-sticky processing with a local
| map). It's rather convoluted solution for absolutely no
| benefit as it's still not hard to brute force.
|
| Storing it in such a way - slow hash + salt yields no
| benefits for debugging either, so I wonder why would you do
| so? Password hashes are useful for proving a match with an
| unknown plain text (while making it expensive to brute
| force) - so what would be the exact purpose of having non-
| nonce+IP?
| vgaldikas wrote:
| There's even less 'usable' ones, when you exclude private
| ranges etc...
| olliej wrote:
| And if you further restrict to US service provider ranges
| uses wrote:
| Hm, I'm confused, usually the whole point of storing an IP is
| in case the visitor uses the platform to do something illegal,
| like a death threat. Without the original IP law enforcement
| can't subpoena the ISP, etc. But also as someone else said, if
| you use a nonce, and I think you mean salt, then it can be
| cracked nearly instantaneously anyways due to the small space
| of IPv4 (~4 billion).
| njharman wrote:
| IP is not a person identifier. They should not be allowed as
| evidence in criminal cases.
| gizmo686 wrote:
| There is more to investigating then gathering admissible
| evividence.
|
| For example, if you are talking with Alice and she says
| that she heard from Bob chat Charlie was in the office at a
| weird hour on the day in question investigators have gains
| nothing that they can admit as evidence [0]. However, there
| is nothing that anyone (defense or a third party) can do
| challenge this portion of the investigation other then keep
| it out of evidence, and the investigators are free to
| follow up with either Bob or Charlie to get something that
| would be admissible.
| ed25519FUUU wrote:
| Wouldn't be relevant for a news website.
| LatteLazy wrote:
| I wouldn't be so sure, lots of papers have comment sections
| and they're pretty rammed with death threats on any social
| issue sadly...
| ed25519FUUU wrote:
| Oh jeeze with comments enabled anything goes.
| aneutron wrote:
| Sometimes there's a forensic purpose. For example, you want to
| know which servers exfiltrated your data and to which IP.
|
| Or for audit purposes (e.g. you might need to prove to some
| regulator no outside access was made, which is stupid but ...)
| 8note wrote:
| There's some structure to the IP that can be somewhat useful
| for tracking identity.
|
| Its imperfect, but you'd expect definitely good folks to look a
| certain way
| nullc wrote:
| There are only 2^32 IPv4 addresses, if you know the nonce you
| just try them all... no privacy provided.
|
| If you don't know the nonce, you can't match against other
| users-- so not useful for abuse.
|
| But I'm skeptical re: abuse uses. For commenters, sure-- you
| may need to store IPs to combat abuse. But for readers? At most
| you would need sampled data or in-memory counters (e.g. to
| catch high volume bots).
|
| Unfortunately, there really isn't any penalty for failing to
| minimize private data collection.
| xwolfi wrote:
| The best model would be to display publicly commenters IPs,
| never store readers', store error logs (like people
| bruteforcing a password).
|
| You d have a triple virtuous effect: people would stop being
| such insuferable asses once they understand basically their
| name is on the comment, readers would be completely safe
| because why not and abusers would be logged still.
|
| It's even probably what most websites do: it news to me to
| keep the IP of every visitor, I'd have pruned them.
| techbio wrote:
| Any examples? I like the transparency and self-filtering.
| What is/isn't this approach suitable for? Anonymous is a
| very common pen-name.
| taneq wrote:
| And then my modem reconnects and I get a new IP that used
| to belong to some insufferable asshole, and suddenly I'm
| blocked / blackholed / shadowbanned everywhere and some
| vigilante is flood pinging me.
| Scoundreller wrote:
| Maybe in the 56k days, but my DOCSIS ISP rarely re-
| assigns IPs.
| nexuist wrote:
| Bingo. IRC tried the strategy of banning users by IP and
| half the time you'd end up k-lining entire countries
| because their ISPs were too cheap to buy more endpoints.
| hyperbovine wrote:
| But of course, the real reason is that those ips are worth
| analytics $$$.
| cout wrote:
| It's also useful forensic data if your site is ever hacked.
| xvector wrote:
| If you use a difficult hash function that takes ~1 seconds to
| calculate then it would take over 120 years to iterate
| through the IPv4 address space. At the very least, this could
| cut down on dragnet surveillance
| nullc wrote:
| But then a single user clicking on links quickly would
| bring your webserver to its knees. So much for using those
| addresses to combat abuse... :)
|
| Plus the FBI could probably narrow their search to a few
| hundred thousand addresses (relevant ISPs, no
| unroutable/multicast/etc), then only use the list to
| confirm.
|
| Finally, if it takes 120 years on one core, it'll take 1.4
| months on 1000 cores. I'm willing to be the FBI has access
| to more computing power than I do. ~100 CPU years isn't a
| particularly daunting amount of computing work, even for
| fairly low stakes research.
|
| That search would also decode all addresses in the logs,
| not just one targeted one...
| gizmo686 wrote:
| This requires that you add ~1 second of latency to every
| request that requires you to hash the IP. Even if we assume
| relatively aggressive caching, this is still incredibly
| unacceptable from a user experience perspective.
|
| Assuming you do that, you are looking at about 1193046
| hours to hash the entire address space. More specifically,
| you are looking at 1193046 CPU hours.
|
| You can rent a 96 vCPU c5.24xlarge instance from AWS for a
| rate of $4.08/hour; or $0.0425/CPU-Hour. Assuming this
| offers the same per-cpu hashrate as the general purpose
| web-server, you are looking at a cost of $50,704 to
| construct a rainbow table. That is no where near a
| prohibitive sum of money.
|
| You can probably reduce the cost by shopping around for
| compute or using bare metal. You could see significant cost
| reductions by using hashing optimized ASICs.
|
| Combine this with the fact that no website is going to
| spend 1000ms just computing the hash for every request
| (even if you allow for caching). And the fact that they can
| probably narrow down the address space they are interested
| in considerably if they wanted to save money.
|
| 2^32 is just too small of an asymmetry between legitimate
| use and an attack to be a viable defense.
| xvector wrote:
| From a user experience perspective, you can perform the
| computation asynchronously. There are also hash
| algorithms resistant to ASIC.
|
| But yeah, everything else you said makes sense.
| gizmo686 wrote:
| And now you have a ~1000ms latency between when some
| events happen, and when you can log them. Even assuming
| all such events get logged, you will be left with a
| jumbled mess of out-of-order events.
| tremon wrote:
| Why does your logging system rely on the order of entry
| insertion and not on the entry timestamp?
| 542458 wrote:
| Yes, but then I'm burning a second of compute time every
| time I want to log something.
|
| Also, by removing unlikely candidates (IPs owned by
| irrelevant entities or that are not US based) you could get
| the search range much much smaller, and with the FBIs
| budget you could probably compute it all in a few days even
| with a 1-second hash time.
| [deleted]
| b9a2cab5 wrote:
| 1 second on a CPU can easily be 100x faster on a GPU, then
| distributed over 1000's of GPUs. For reference argon2 was
| supposed to be an ASIC-resistant, GPU-resistant memory-hard
| hashing algorithm, but a K20X from 2013 is 5x faster than a
| CPU [1] and GPUs have only gotten faster since then
| compared to CPUs.
|
| [1]: https://github.com/WebDollar/argon2-gpu
| spacemeetstab wrote:
| An example of using IPs to combat abuse is Wordfence. It's a
| WordPress plugin which blocks traffic from known abusive IPs.
| A quick glimpse at the "live traffic" for one of my websites
| reveals several IPs within the last hour that have attempted
| to access the site which were blocked.
|
| A site I was repairing after a hack fortunately had server
| logs which included IP data. That IP allowed me to identify
| the specific exploit used.
|
| So, there are definitely uses for IP data in security terms.
| GeneralMayhem wrote:
| Anti-spam/anti-abuse operations often look a lot like tracking.
| There's no point in knowing a single request's IP, or a single
| user's; to spot the patterns, you have to be able to join it
| with others.
| morpheos137 wrote:
| I am confused how reading a news story in a certain window of
| time could serve as evidence or probable cause or reasonable
| suspicion of anything. Seems utterly bizarre.
| justanotherjoe wrote:
| It makes sense that the person would be scouring the news for
| an incident that involves himself. Isn't that in Sherlock
| Holmes - The Study in Scarlet? Sherlock used false advertising
| in a newspaper of a missing ring found near the crime scene.
| The person who claimed to have the ring is the culprit. This
| also happens in Death Note, another work of fiction, where L,
| the detective, uses news media to narrow down the possible
| suspects.
| kangaroozach wrote:
| Probably narrows down the list of suspects to a few thousand
| from a much higher number.
| jacquesm wrote:
| That's called a dragnet. Suspects are not found by this
| method, innocents are found, it all hinges on the assumption
| that the guilty party will be present, which in fact may not
| be the case. Good policework identifies the suspect first,
| then finds corroborating evidence.
| dalbasal wrote:
| >> how reading a news story in a certain window of time could
| serve as evidence or probable cause or reasonable suspicion of
| anything.
|
| So... I have no idea how they thought it would apply in this
| case, or what investigators had in mind.
|
| That said, very broadly and in theory, in today's world almost
| any data point can be predictive of almost any behaviour. This
| is the premise of ad-tech. Less amorphously, you could probably
| construct a theory. People reading the story within a certain
| window of time, within a certain geographical area... etc.
|
| Evidence, probable cause & reasonable suspicion as legal terms,
| that's a different matter.
| sidlls wrote:
| > almost any data point can be predictive of almost any
| behaviour.
|
| This isn't really true, though, even in theory. In practice
| it's much worse, as we aren't very good at using even large
| collections of data points in most cases to predict behavior.
| We can in some very few, narrow contexts occasionally do
| better (sometimes much better) than a random guess once in
| while.
| dalbasal wrote:
| I didn't mean it quite literally, and specified that I'm
| not suggesting that police had something like this in mind.
| My uneducated guess is that police were after something
| specific relating to other information that they already
| had. That's generally how police investigations work.
|
| That said, the one relatively broad concept where "we"
| consistently do better than random guesses is ad-tech,
| which is where the bulk of private efforts to this effect
| are concentrated currently. The premise here is quite
| literally "every data point is predictive of behaviour,"
| behaviour being stuff related to the goals of advertisers.
|
| It's not a huge leap to suggest that fb & adwords' system
| can be used to predict crime, insurance claims, HR-related
| stuff etc.
| A4ET8a8uTh0 wrote:
| We may not be good at this, but the collective wisdom at
| most corporations states that a best predictor of what
| someone will do, is what they have done in the past. My
| point is that it is being used and inferences are drawn
| regardless.
| boomboomsubban wrote:
| My guess is that they have some related suspect who they claim
| saw the story and nuked their drives. It doesn't seem like
| strong evidence though.
| arp242 wrote:
| My guess is that they have some sort of photo, screenshot, or
| video that happens to show that a suspect had this page open on
| a computer or mobile phone, and that they can reliably date the
| time of this photo or video.
|
| Depending on details, it may not be an unreasonable request.
| The question is more one of trust: do we trust the FBI that
| it's a reasonable request?
|
| This is why all the stuff like the activities the Snowden leaks
| demonstrated or Trump's idiotic harassment of the press through
| the DOJ are so harmful far beyond the direct harm they did:
| they justifiable and seriously erode trust, and then there _is_
| a serious case like this and "trust us" no longer carries any
| value. A sad state of affairs where everyone loses.
| soraminazuki wrote:
| > Depending on details, it may not be an unreasonable
| request.
|
| No. Under no circumstances is it acceptable for governments
| to ID readers of a news article. Such an act is a direct
| attack on the freedom of speech, freedom of thought, and
| freedom of the press. IMO it very clearly crosses a line on
| what law enforcement can and cannot do in a democratic
| society.
|
| Note that law enforcement has (over)broad powers for
| investigation at their disposal already, and they were able
| to find the suspect "through other means." There was no
| justification whatsoever for the subpoena.
| georgeplusplus wrote:
| It seems no different to me than subpoenaing say, a private
| clubs membership records.
|
| The danger comes when law enforcement uses the evidence
| they gather from one case, to target someone who hasn't
| committed a crime. Which clearly hasn't been shown to be
| done here.
| ClumsyPilot wrote:
| By the time is is shown to be done you have already lost
| your freedoms.
|
| Media, news and journalists and their sources have
| special protections and consideration that random private
| club does not.
| ctdonath wrote:
| Equally bad. Freedom of association is also an enumerated
| right. Without demonstrable cause, none of the
| government's business. Yes, I've been protected from such
| harassment thanks to that right.
| morpheos137 wrote:
| Still even if they had such a screen shot I don't get how
| reading a news article about a sex offender would be
| incrimnating even if you were a sex offender yourself.
|
| That said...https://www.cbsnews.com/news/luka-magnotta-
| wanted-for-canada...
| salawat wrote:
| It's a CSAM case. They're probably trying to prove he's the
| primary user.
| arp242 wrote:
| > Still even if they had such a screen shot I don't get how
| reading a news article about a sex offender would be
| incrimnating even if you were a sex offender yourself.
|
| What? Absolutely no one said or even implied any such
| thing.
|
| Photos of in child sex abuse cases are routinely
| scrutinized in great detail to reveal clues about the
| location, time, and anything else that might lead to the
| individuals in the case.
|
| Interpol has an entire website dedicated to help identify
| objects in pictures[1], asking members of the public to
| help identify everyday things like T-shirts. Actually, one
| of the top results pictures right now is "do you recognise
| this newspaper?"
|
| No one is suggesting that "wearing this t-shirt" or "having
| this newspaper" is incriminating in and of itself. Finding
| these people from vague online pictures where they intend
| to remain anonymous is tricky business, and sometimes with
| a bunch of these clues combined with some other information
| they can identify offenders and/or victims.
|
| _Of course_ there are trade-offs involved in all of this,
| and it 's important we have robust public conversations
| discussing those; as I mentioned in my previous comment,
| the lack of trust here is a big issue. But much of this
| entire thread is ... disappointing. I wish people would
| keep cooler heads (as well as, you know, actually read the
| article before commenting).
|
| [1]: https://www.europol.europa.eu/stopchildabuse
| tzs wrote:
| It sounds like what they were trying to do was identify
| someone.
|
| It is quite common to know something about the recent
| behavior of someone that has some connection to a crime but
| not know who they are.
|
| You might not know who robbed the bank, say, but you know
| their getaway car was a red Corvette with a license number
| that ended in 6. Or you might know that a recently killed
| body was disemboweled with a Kobalt brand model
| #TRS-5CF-K34714 trenching spade (it was left at the scene)
| and your forensics people were able to determine that it
| had not been used before this so was probably recently
| purchased.
|
| In the first case, you are going to ask your state's motor
| vehicle department for a list of all registered red
| Corvettes in the area of the robbery. In the second case
| you are going to see if any Lowe's in the area (Kobalt is
| their house brand) can tell you who recently bought a
| #TRS-5CF-K34714 trenching spade.
|
| You aren't asking because owning a red corvette is
| incriminating, or because owning a #TRS-5CF-K34714
| trenching spade is incriminating [1]. You are asking
| because whoever did the crime is probably either in the set
| of red corvette owners for the robbery or the set of
| #TRS-5CF-K34714 trenching spade owners for the
| disemboweling, or someone in those sets is connected to
| whoever did the crime. Even if the connection is innocent
| talking to them can be useful--the red Corvette may have
| been a ride share, for example, and the driver had no idea
| he was serving as getaway driver, but he still may be able
| to provide details about the robber that will help find
| him.
|
| Here it sounds like they determined that there was someone
| connected to the shooter and they wanted to find that
| person but did not know their identity, but did find out
| somehow that it was likely they had read that article
| within a 35 minute window on a particular day (I have no
| idea how they would have found that out).
|
| [1] I own one. It's great!
| graderjs wrote:
| I think maybe they have a phone, with the story in the browser
| history, and they want to link it to a wifi point.
| mcbutterbunz wrote:
| That seems plausible but I would think that there could be a
| lot of other sites the person visited that would be easier to
| track down. Maybe that's what they did and the reason they're
| dropping this subpoena.
| graderjs wrote:
| That's what I think, yeah -- they cross-referenced the
| information anotherway (from another technical source or
| like you say, another site maybe) and withdrew.
| Izkata wrote:
| Article:
|
| > was withdrawn after investigators found the person
| through other means
| laurent92 wrote:
| This is just a charitable guess. A guess with equal
| probability to anything.
|
| Another guess is they want a precedent to subponea Fox News
| readers and classify people by political opinion. Albeit
| less charitable, it has equal probability.
| strken wrote:
| It's also possible they've got a video or picture with the
| story open on a screen in the background.
| beermonster wrote:
| I'd imagine it's part of the process of attribution for
| something. If you know they accessed the news site during a
| time frame it may help with attribution or possibly placing
| them in a certain location at a certain time - both of which
| might be important and both of which you may know via some out
| of band method.
|
| It could also be used to de-anonymise someone if they made an
| OpSec mistake e.g. accessing the news site outside of Tor or a
| VPN and you happen to know (via some out of band method) that
| they did this and so could use it to get their actual-IP.
|
| It wouldn't be a straight forward "if you accessed a news page
| you are guilty of something".
| sitkack wrote:
| Copy-paste deanonimization attacks are thing and have exposed
| people in this exact manner.
|
| Having only one connection going over Tor is a big risk that
| forces the user to constantly recalculate the information
| horizon. Easy mistake to make.
| dredmorbius wrote:
| In an age where newspapers were bought at news stands for cash,
| identity of the reader was entirely anonymous.
|
| In an age where printed periodicals were delivered by
| subscription, the subscriber information was available (and yes,
| often tracked by local and federal law enforcement), but not the
| specifics of what articles were read.
|
| Today, with Web-based document delivery and Javascript
| instrumentation, the specifics of who reads what articles, time
| on page, sections read, interactions, shares, and more, are
| available not just to the publishere but advertisers, any
| entities hacking into or accessing their systems, app developers,
| and more.
|
| And, yes, law enforcement, whether under warrant, subpoena, or
| ... other methods.
| sgt wrote:
| I still read my "primary" newspaper like an old newspaper, in a
| sense.
|
| Yes, I read it on my iPad through an app, but it simply renders
| a PDF of the actual physical newspaper and its layout.
|
| So there's no way to fit dynamic ads, JavaScript nuggets, etc.
| They can't really determine what article I read.
|
| I think that should really be the norm for electronic
| newspapers. How is it in other parts of the world?
| blablabla123 wrote:
| > In an age where newspapers were bought at news stands for
| cash, identity of the reader was entirely anonymous.
|
| Still, everybody on the street could see what we read while
| carrying the paper home. That can easily be dozens or hundreds
| of people. In some sense the periodic subscription via snail
| mail is in some sense the most private form. Sure, in the Web
| everything is tracked but in the average case literally nobody
| is aware of what we read. The worst case scenario can be quite
| bad though...
| simfoo wrote:
| Actually this track-ability is what is keeping me from
| subscribing to news websites. I'd easily pay a few bucks to
| them for the privilege, but I don't want to log-in or identify
| myself every time I read an article.
| chrisrogers wrote:
| Yeah for this you would need to sign up using a one-use
| mailbox, pay by mailing in a cashier's check, atop hiding
| your traffic. Possible with the NY Times, at least.
| Scoundreller wrote:
| Why a cashier's check? Shouldn't you send in $1 coins
| (after baking them) and pray that they arrive?
| 1f60c wrote:
| What do you mean by "baking"? Google is unhelpfully
| showing me results about crypto currencies and how to
| literally bake coins into a cake.
| Scoundreller wrote:
| Heating them in the oven to clean off any identifying
| residue.
| spinax wrote:
| I would use an acetone soak.
| shkkmo wrote:
| I highly doubt baking them will do that.
| lixtra wrote:
| Same here. They could send out a daily e-paper though (and
| some do!).
| dredmorbius wrote:
| Absolutely this, yes.
| gentleman11 wrote:
| Ads technica disables tracking if you are a paying subscriber
| last I checked
| jacquesm wrote:
| It's quite likely that if you do not use an add blocker and
| disable all social media tags on those pages using a js
| blocker that what you read is already coupled to your profile
| in some database.
| user3939382 wrote:
| The "other methods" is the curious facet of this story to me.
| With stuff like this [1] [2] I wonder if the FBI really "needs"
| USA Today to comply to get this information or rather, this is
| part of a long-term strategy to get legal precedent on their
| side. The same dynamics were in play with the San Bernardino
| shooting, where they made a big deal out of getting data they
| didn't seem to actually need.
|
| 1 https://en.wikipedia.org/wiki/Utah_Data_Center
|
| 2 https://en.wikipedia.org/wiki/Room_641A
| toomanybeersies wrote:
| I this case, I think it's a genuine mea culpa from the FBI,
| without explicitly admitting they were wrong.
|
| The subpoena, and USA Today's response [1] paints a picture
| of an incompetent and/or inexperienced FBI agent, who is
| unaware of existing Justice department guidelines
| specifically prohibiting her from serving such a subpoena.
|
| Reading between the lines, citing "other methods" is the
| FBI's way of quietly withdrawing a subpoena that should never
| have been served.
|
| [1] https://storage.courtlistener.com/recap/gov.uscourts.dcd.
| 231...
| shkkmo wrote:
| I think describing this as a "mea culpa" when the FBI has
| refused to admit any wrong doing or mistake and also has
| issued nothing like an apology, is not reasonable.
|
| > "The subpoena is being withdrawn because intervening
| investigative developments have rendered it unnecessary,"
| an FBI spokesperson said.
|
| I think this is nothing like a "mea culpa", but instead has
| absolutely everything to do with managing the establishment
| of precedents to work in the favor of the FBI whenever
| possible.
| dredmorbius wrote:
| I hadn't considered the precedent angle. That's an
| interesting one.
|
| I was thinking along the lines that evidence already exists
| that would provide much the same value as the access logs
| might, but the access logs would either provide cover for
| introducing that evidence, or provide the value without
| disclosing other surveillance methods.
|
| Either of those prospects is troubling.
| CapitalistCartr wrote:
| Parallel construction.
|
| https://en.m.wikipedia.org/wiki/Parallel_construction
| qualudeheart wrote:
| You can get around that if you search for link urls in archive
| sites.
|
| Someone usually will have archived the article there.
|
| If you feel a bit more ambitious you could make a bot that runs
| on a vps somewhere and automatically scrapes news articles.
| TooCleverByHalf wrote:
| Sure. But that's not the point.
| dredmorbius wrote:
| Tor seems to work reasonably well, except that many
| mainstream media sites block, throttle, or CAPTCHA it.
| nuker wrote:
| VPN plus incognito (private) browser window is easier than
| tor and roughly same protection level. That is for general
| use, not for hardcore anonymity.
| xxs wrote:
| Those youtube ads sure helped the VPN popularity. There
| is absolutely no reason to believe VPNs are even remotely
| secure.
| dredmorbius wrote:
| History's shown that for numerous VPN providers that's
| _not_ the case.
|
| Chief value of (public/general) VPNs seems to be 1)
| accessing region-zoned content or 2) protection against
| local-segment interception.
|
| The benefit of 2) is balanced against the fairly strong
| probability that the VPN provider itself is heavily
| surveilled or actively aiding in monitoring activities.
| qualudeheart wrote:
| With some vpn providers you can look them up in court
| records to see if there are any mentions of them keeping
| logs.
| pabs3 wrote:
| Combine Tor Browser with the archive.org/archive.is sites?
| dredmorbius wrote:
| Internet Archive / Wayback Machine works.
|
| Archive.is runs Tor through a Cloudfront captcha which
| fails consistently in my experience.
| skissane wrote:
| > Archive.is runs Tor through a Cloudfront captcha which
| fails consistently in my experience.
|
| Just tried it now and works for me.
|
| It is an annoying captcha, it had something like five
| steps to complete, but I've seen worse. I'd rather this
| captcha than the one that Roblox uses.
| Scoundreller wrote:
| You only get that far with JavaScript on. At that point,
| tor is like a hot pink tank. In theory safer than
| nothing, but standing out a lot.
| skissane wrote:
| Yes that's true. I had JavaScript on.
|
| I agree that turning on JavaScript with Tor is risky from
| a security viewpoint. It significantly increases the risk
| that your real identity may be unmasked.
| qualudeheart wrote:
| Yeah I like tor because the tor browser has built in
| fingerprinting protection.
|
| Otherwise you could use a privacy hardened firefox version
| along with some kinda proxy.
|
| I would say you could rent your own vps, use a vpn service
| that maintains their own servers, use a decentralized vpn
| (these are a new development) or just use someone else's
| wifi that you don't also use with your ,,real" identity.
|
| Opsec can be hard to maintain but boy is doing so fun.
| hanniabu wrote:
| Haven't heard of decentralized vpn yet, have any
| suggestions to look into?
| qualudeheart wrote:
| Two providers that I know of are Sentinel vpn and
| Mysterium vpn.
|
| They're like tor where anyone can run their own node, but
| unlike tor there is a financial incentive to run them
| because they come with built in payment processing
| solutions via cryptocurrencies.
|
| Some people are skeptical of cryptocurrencies but I
| consider this to be an excellent use case:
|
| Securing coordination between actors that don't
| necessarily trust each other through market incentives.
|
| This would incentivize people to run their own nodes and
| it would be less like tor where most exit nodes are
| allegedly run by intelligence agencies.
| myself248 wrote:
| I'm curious if we'll ever find out what they thought they'd learn
| from this.
| pmorici wrote:
| Maybe they were hoping to get enough information to do browser
| finger printing?
|
| https://coveryourtracks.eff.org/
| mathattack wrote:
| From the article, that's why they withdrew it.
|
| ---
|
| " The subpoena, issued as part of an investigation seeking to
| identify a child sexual exploitation offender, was withdrawn
| after investigators found the person through other means,
| according to a notice the Justice Department sent to USA
| TODAY's attorneys Saturday."
| Scoundreller wrote:
| Sounds like they subpoenaed dozens of websites. While USA
| Today fought it, the rest fell right over without mentioning
| it/fighting it.
|
| I've seen this before where a user got an email from Google
| legal about a subpoena against them, spent $7k successfully
| fighting it, but it didn't matter because several other
| $BigCos didn't even let the user know.
| bottled_poe wrote:
| Right, so it wasn't public outrage around privacy that
| impacted the decision at all.
| resoluteteeth wrote:
| I think you may have replied to the wrong comment.
| tekromancr wrote:
| I don't think they did. That reply tracks
| Dylan16807 wrote:
| To paraphrase: "What did they think they'd learn?"
| "That's why they withdrew it."
|
| I don't understand how that reply works. Can you
| elaborate?
|
| (The best way for me to reconcile those would be to
| interpret it as a snarky "you're realizing it's useless,
| they also realized that, so they withdrew it" but that
| doesn't answer the question of why they made the request
| in the first place. Or I could interpret it as "the quote
| below is why they withdrew it" but that's even further
| from answering the question of why they made the request
| in the first place. Is it supposed to mean "they withdrew
| it _so_ we don 't find out what they'd learn"? It's hard
| to see how withdrawing the request helps very much there.
| Overall, I'm lost.)
| mathattack wrote:
| Not being snarky- the FBI claimed they were looking for a
| pedo and found him elsewhere.
|
| It could be a smoke and mirrors response to get people to
| say "well in that case..." but the article does answer
| the question.
| weaksauce wrote:
| > but that doesn't answer the question of why they made
| the request in the first place
|
| most likely the fbi was monitoring some website somewhere
| and the person of interest posted a link to or talked
| about the article and it was 35 min after the story was
| posted when the guy linked to it.
| b9a2cab5 wrote:
| More likely they acquired the data through other means like
| hacking into a "foreign" server.
| bellyfullofbac wrote:
| Probably easier to subpoena the many many tracking pixel
| providers embedded on the USA Today website...
| codezero wrote:
| It likely means they got this data more easily from a third
| party, like an analytics or ads provider.
| splithalf wrote:
| They need to be penalized. For every high profile incident like
| this, there are many more that never reach public scrutiny. The
| leadership needs to be made accountable.
| mortdeus wrote:
| im just curious how they knew the person of interest read that
| article?
|
| Was he a person of interest in the lead up to the shootout, who
| got away, and they were just grasping at straws to discover a
| list of local area IPs correlated with known addresses he might
| have been hiding out at so they could obtain a search warrant?
|
| If that's the case, then honestly I don't think this is any worse
| than when they force say Google or Facebook to provide such data
| to government.
|
| I don't see why the USA Today should get any special privileges
| over any other tech company just because they are "media".
|
| If we want to have an argument about the Government abusing it's
| power to spy on us in general, that's one thing. But the USA
| Today is literally saying its more important they protect the
| illusion of their readers "privacy" (which we all know they don't
| care about your privacy are willing to sell all your personal
| info to the highest bidder, its in all their TOS) than it is to
| try and help the cops catch a child predator...
|
| I do agree that this does establish a troubling precedent, but i
| kinda thought Snowden already made it blatantly clear that the
| NSA and the CIA is already doing this.
|
| It seems to me that the FBI is basically just trying to play
| catch up, which we should be concerned about because they are
| supposedly the agency put in place to police us. Those other
| agencies are supposedly only supposed to police the world.
|
| (which i never understood why thats supposedly okay. Americans
| are the only people entitled to their privacy?)
| mschuster91 wrote:
| > I don't see why the USA Today should get any special
| privileges over any other tech company just because they are
| "media".
|
| Because freedom of press is (in all democracies) one of the
| highest ranking human rights.
| boomboomsubban wrote:
| >The government's own guidelines require the FBI to pursue
| alternative sources before subpoenaing a newspaper
|
| Or "we could always just buy this data, we requested it for some
| other reason but the media got more pissy than we expected."
|
| The entire thing is just so strange, why was the challenge not
| hidden when the subpoena was?
| malwarebytess wrote:
| They'll just send a NSL instead.
| Scoundreller wrote:
| Don't think that works for pedos. But if we're not allowed to
| see the NSLs, then who knows what they contain.
| wolverine876 wrote:
| Biden has now made it policy to protect journalists from certain
| means of investigation, but that can be reversed easily by the
| next president, by Biden if they want, and because the has no
| legal force, courts won't enforce it and it may be that the
| biggest risk taken by violators is to lose their job.
|
| Why isn't this made into a federal law? What constituency in
| Congress is opposed?
| jb775 wrote:
| > should remind the Biden administration of the importance of an
| independent press.
|
| "Independent Press" a.k.a. leftist propaganda machine owned by a
| handful of super rich elites.
| mrmckizzle wrote:
| I must be missing something here. How does it help an
| investigation by fetching the meta data of those who read an
| article? Anyone could of read the article within that time
| period.
| Turing_Machine wrote:
| > President Joe Biden recently criticized the policy, saying it's
| "simply wrong" to seize journalists' records.
|
| The FBI is part of DOJ, which is an executive branch department
| under Biden's direct authority. If he thinks it's "simply wrong",
| he can just order them not to do it. He's not limited to
| "criticizing" it.
| jrockway wrote:
| I think the article is conflating two points. Biden banned the
| practice of compelling journalists to provide the identity of
| their sources. That is totally unrelated to this subpoena,
| which is attempting to get a list of people that read a certain
| article.
|
| Obviously it's also wrong to seek this information, but it's
| not what Biden was talking about in the quote.
| bowmessage wrote:
| Good point. I'm not sure he's even aware of that option,
| unfortunately.
| hellow0rldz wrote:
| Oh, he is. But it's good PR to make positive statements while
| doing whatever you want.
| Sebguer wrote:
| He literally did ban the practice, though, and the quoted
| line is after the reporting saying he did so?
| hellow0rldz wrote:
| No he did not. He gave a "direction". Which, legally,
| means almost nothing.
|
| > "Going forward, consistent with the President's
| direction, this Department of Justice - in a change to
| its longstanding practice - will not seek compulsory
| legal process in leak investigations to obtain source
| information from members of the news media doing their
| jobs," Anthony Coley, Justice Department spokesman, said
| in a statement.
|
| They are changing a "practice".
|
| One uses laws to prevent practices one does not like, not
| "directions".
| ncallaway wrote:
| > One uses laws to prevent practices one does not like,
| not "directions".
|
| If you want a law to prevent this I'm not sure why you're
| criticizing Biden. He is the President, no the
| Legislature.
|
| If you think there should be a law, then your complaint
| should be for congress.
| hellow0rldz wrote:
| Is there a written order from the President saying this.
| Is it public somewhere? If not, it's just PR.
| colejohnson66 wrote:
| Well, considering the DOJ is under his control, it's not
| a "direction", but a "law" of sorts. Actual laws come
| from Congress, which Biden doesn't control.
| hellow0rldz wrote:
| Same question to you: is there a written order from the
| President saying this? Is it public somewhere? If not,
| it's just PR.
| GavinMcG wrote:
| Are you suggesting he's senile? Stupid? It's not clear why
| you'd think someone with Biden's political experience would
| be unaware that the President is the head of the executive
| branch.
| Supermancho wrote:
| > Are you suggesting he's senile?
|
| Forgetful at the very least. Senile is unnecessarily
| pejorative. He's an old man who doesnt do much more than
| make political speeches in public.
|
| > Biden's political experience
|
| His team's political experience is more important, like
| almost all POTUS before him.
| Sebguer wrote:
| He did:
|
| "Going forward, consistent with the President's direction, this
| Department of Justice - in a change to its longstanding
| practice - will not seek compulsory legal process in leak
| investigations to obtain source information from members of the
| news media doing their jobs," Justice Department spokesman
| Anthon Coley said in a statement Saturday.
| tootie wrote:
| This was not a leak investigation and they weren't after
| sources. The article mentions the completely unrelated change
| in policy regarding some other cases. The only correlation is
| they involve newspapers.
| mr_toad wrote:
| > in leak investigations to obtain source information from
| members of the news media
|
| That means they won't subpoena journalists phone records when
| looking for whistleblowers. It doesn't mean they won't go
| after reader's IP when looking for other suspects.
| sarak12070 wrote:
| Look 20 years younger than your age Naturally
| http://healthwithbeauty.xyz/2021/06/05/how-to-look-20-years-...
|
| creepy animals that exist I am sure you don't know about these
| animals https://www.interestingnews.club/2021/06/creepy-animals-
| that...
|
| Hong Kong parking space sells for $1.3M, sets new world record
| https://www.interestingnews.club/2021/06/hong-kong-parking-s...
| [deleted]
| wydfre wrote:
| Did anybody bother to lookup the article they wanted to get the
| IPs for and get scared out of their minds when they realize what
| the title was?
|
| No, I am wrong, Hacker News is right, I have learned my mistake,
| we need anonymity - from everything. I don't want responsibility
| for my actions - that's why I support the EFF, and I don't care
| about the FSF. We deserve the same anonymity as the upper echelon
| of the government, and who cares about unconditionally
| accelerating the singularity with open-source.
|
| Transparency - only Satan could want such a thing!
|
| At least in my sect of Christianity, Satan only hurts bad people
| - it's people themselves that are evil or want to make others
| evil. Bit more theologically consistent.
| giantg2 wrote:
| They're just going to get it from they payment providers like
| Visa, Mastercard, etc. Maybe even ISPs. Just because they gave up
| on one avenue doesn't mean they won't use other methods to get
| what they want.
| throwitaway12 wrote:
| This is a disgusting over reach of power as usual by the American
| TLA's.
|
| Please remember to always use a VPN, Tor, or other similar
| technologies when using the internet to shield your self from
| basic infringements of your privacy like this.
| DaniloDias wrote:
| Julian Assange reminds us that our entire journalism justice
| system is fraudulent. This story is a drip in the ocean of
| journalistic and justice corruption. We are not doing any better
| today than we were yesterday.
| a3n wrote:
| So DoJ is like Google or Facebook: They silently do whatever they
| want until it appears on HN, then they fix it.
| judge2020 wrote:
| All three share the trait of being in the public sphere. Graver
| atrocities are happening across every other industry, they're
| just boring/not newsworthy so nobody really applies scrutiny.
| cschep wrote:
| They also all three share the trait of not caring at all what
| we hacker newsers think :D There just aren't enough of us.
| judge2020 wrote:
| I think the reason we often see FAANG-related issues
| actually resolved when they're posted on HN is that so many
| programmers who work at these FAANGs read HN and can
| escalate real issues internally.
|
| While there probably are thousands of real issues that
| don't make it onto HN and thus never get resolved, there's
| probably multiple millions of people just as desparate that
| are just trying to skirt some rule or are telling half-
| truths to try to get their way and bypass policies.
| nexuist wrote:
| This makes me wonder how a Hacker News-for-politicians
| variant would fare, if political managers at various
| levels in the chain could post under a pseudonym to bring
| high level attention to some broken or un-oiled cog. Not
| necessarily for civilians to find out but for other
| political operatives to learn about and pull whatever
| levers they can pull to resolve issues internally. My
| understanding is that the government (at least the US
| Fed) is very top->down information wise, and e.g. a town
| clerk in Kansas has no available way to interact with INS
| even when they need to for their job.
|
| Let's say one day you stumble upon some nuclear
| centrifuge in the middle of a field. Who do you even call
| and how do you do it in such a way that you don't end up
| on the no-fly list for the rest of your life?
| B1FF_PSUVM wrote:
| https://en.wikipedia.org/wiki/Bureau_of_Sabotage
| tootie wrote:
| The DOJ was trying to catch a child molester. Not sell ads.
| zapdrive wrote:
| The perp was being investigated for possession of child
| pornography. While not a saint, he was not a "child
| molester".
| arp242 wrote:
| The trade in child pornography enables child molestation.
|
| I suppose that if we get very technical you're technically
| correct. Seems like an odd and very pedantic hill to die on
| though.
| gruez wrote:
| Conflict minerals enable regimes that commit war crimes.
| Does buying electronics made from such minerals make you
| a war criminal?
| arp242 wrote:
| This is a silly comparison and this "aha, but what about
| this, huh?!"-style of conversation is not one I'm
| interested in having.
| laurent92 wrote:
| Child pronography is any _depiction_ of someone under 18.
| This includes:
|
| - Drawings, 3D renderings,
|
| - People you don't have the ID of. Remember the joke:
| "Actress ___ turned 18, it is now legal to watch her
| films."
|
| While one of the gravest crimes, accusations of CP made
| by police are wildly different from a human's definition
| of it, and it is also at high risk of being used for
| political reasons, we need to keep that in mind.
| jlokier wrote:
| I wouldn't call false accusations of such a serious crime
| "technical" or "pedantic".
|
| I'd call it "profoundly misleading about a serious
| matter" at best.
| toomanybeersies wrote:
| How does HN play into this at all?
|
| The FBI served USA Today with a subpoena. USA Today's lawyers
| replied to the FBI, stating that the subpoena is "not
| authorized under federal regulations, and object to its
| service" [1]
|
| [1] (page 15)
| https://storage.courtlistener.com/recap/gov.uscourts.dcd.231...
| throw_nbvc1234 wrote:
| In a democratic society, as an entity grows in power, so must
| the level of transparency. Otherwise the will of the people
| cannot be a real check on that power. Whether through standard
| journalism (which seems to be lacking lately) or other means
| this is still true.
|
| Would you personally be (as) worried about mass surveillance if
| you could somehow guarantee that every use of that power would
| be reported on to the public; and that any abuses of power
| would come to light? With the underlying assumption that those
| abuses of power would also have consequences.
| whereis wrote:
| Did they want the readership data for malicious, unjustified
| reasons?
| xwolfi wrote:
| No: they wanted to identify one sex offender, probably because
| they knew he read this article somehow.
|
| They did not care who read the article itself which was benign.
|
| They wanted to create a precedent to make their job easier, not
| realizing maybe people care less abt solving crimes than making
| it forever possible to track who reads what.
| 2OEH8eoCRo0 wrote:
| Probably not
| chrischen wrote:
| They probably just wanted it to make their jobs easier.
| serf wrote:
| That's a brilliant side-step over a morality qualm, without
| ever really answering the question.
| subroutine wrote:
| What do you mean?
| [deleted]
| decremental wrote:
| "They probably just wanted it [...]" is the same as writing
| "No, they probably wanted it [...]."
| tootie wrote:
| It's in the article. It was a criminal investigation. This is
| no different than subpoenaing phone records or financial
| records. They had a very narrow target and a specific objective
| well within their purview and serving the public interest. The
| subpoena was withdrawn because they caught the guy.
| grouphugs wrote:
| the nazis constantly obstruct the future they're imagining with
| their own bullshit, this shits hilarious
___________________________________________________________________
(page generated 2021-06-06 23:03 UTC)