#freedom hosting

While investigating a hosting company known for sheltering child porn last year the FBI incidentally seized the entire e-mail database of a popular anonymous webmail service called TorMail.

Now the FBI is tapping that vast trove of e-mail in unrelated investigations.

The bureau’s data windfall, seized from a company called Freedom Hosting, surfaced in court papers last week when prosecutors indicted a Florida man for allegedly selling counterfeit credit cards online. The filings show the FBI built its case in part by executing a search warrant on a Gmail account used by the counterfeiters, where they found that orders for forged cards were being sent to a TorMail e-mail account: “[email protected].”

Acting on that lead in September, the FBI obtained a search warrant for the TorMail account, and then accessed it from the bureau’s own copy of “data and information from the TorMail e-mail server, including the content of TorMail e-mail accounts,” according to the complaint (.pdf) sworn out by U.S. Postal Inspector Eric Malecki.

The FBI acknowledged that last july it secretly took control of Freedom Hosting - the largest provider of ultra-anonymous hosting, days before the servers started serving custom malware designed to identify visitors of the TOR sites.

First off: I really do not want to get into the "moral" or "ethical" debate on this matter and I will not at any point be discussing those issues. You can also just skip to the last paragraph for the tl;dr version.

With that said:

I think the feds seized physical control of these boxes for a while before or at the point when they arrested the operator a la Kim Dotcom. I also believe the Feds pushed out the exploit from that privileged position instead of popping the hosts remotely from the outside.

Breaking out of KVM or XEN is not a particularly easy task, at least not for the FBI anyway. They didn't do it alone, they had outside help from somewhere.

What I would like to point out though, is that the courts have now given, and the Federal Government has taken, the position that it can compromise any machine on the internet, inject it full of malware, and then prosecute individuals that are caught up in this net. All without any direct evidence or probable cause to believe that the individuals were part of, or the machines they operated were used in the commission of, any form of criminal activity. This is further complicated by the obfuscated domain names used in the onion network which raises doubt on user intent, that at the time of compromise or access there was no illicit content being served to the user and by there being numerous legitimate services offered by third parties from this hosting provider - TorMail being one such example.

IANAL, but to me, this particular breach (of the client machines, not the servers) raises serious First, Fourth and Fifth amendment questions. Not least of which is the forceful compelling of the machine and user to "speak" against their will, identify themselves and potentially incriminating themselves. The Fourth Amendment problems with this are pretty obvious in that they have breached hundreds or thousands of machines and installed malware without a specific warrant for each of these geographically diverse locations in which they potentially have little or no jurisdiction.

Many people will blindly excuse away the criminality of The State because of the nature of the illegal content hosted on these servers. It appears that this is indeed the case and that the press are not raising the points that Federal authorities have stepped way beyond the bounds of legality once again. Or that this is now Stuxnet-like militaristic behaviour being conducted domestically against citizens here at home.

Tor, the “network of virtual tunnels that allows people and groups to improve their privacy and security on the Internet”, has recently wrote in a blog post that some of the anonymous servers they use for routing have simply vanished from thier network: “Around midnight on August 4th we were notified by a few people [...]

The post Tor servers are down appeared first on SecurEncrypt - HIPAA/HITECH File Encryption Software.