Slashdot Mirror
FBI Does A Cracker-Jack Job
kade writes: "MSNBC has an article on a story about the FBI hacking the machines of a bunch of Russian crackers in an attempt to get evidence on them due to the the inability or unwillingness of the Russian goverment to assist them in fighting cybercrime." Another reader pointed to coverage on CNN as well.
When do I get my speedboat?
Well, the issue is WHERE they broke the law. They broke Russian law, but that is out of their jurisdiction, so that action is ONLY viewable as illegal under either 1) international treaties, or 2) Russian law.
The only thing that could bite them is international treaty. What they need to do is lure those FBI agents over to Russia so they can be prosecuted for their little hacking gig.
Inconceivable!
Assuming that it gets to trial you can assume that the Defense lawyers will argue that the FBI did need a warent to do this. I imagine a court will decide one way or the other.
One of my favorite bits of USSC writing is the Justice Brandeis desent on the wiretapping case from the 20's when the FBI said that they did not need a warrent to tap a phone. (Brandeis and Homes said that they did but were in the Minority)
In all probability the evidence will be challenged in court.
IANAL!
Erlang Developer and podcaster
They don't need a warrant because the United States Constitution does not protect non-US citizens acting outside the US.
But in theory it should contrain the FBI, I would think. Has this type of thing ever been tested in a court? I don't really know. If something similar has never come up before the judge will have to decide what the law is. This is why we have judges and courts after all.
Erlang Developer and podcaster
Are these Russian Crackers related to the Saltine Crackers, or are they more like Graham Crackers?
But then Animal Crackers are my favorite.
Unfortunately, "the law" is an intangible. It is only made tangible by enforcement. Enforcement only comes when everyone involved in enforcing the law uses ethics. If no one enforces international law on the FBI, then they have jurisdiction anywhere they choose, because "the law" no longer exists. Now, even though I don't think that it's cool that it is this way, who do you think is actually going to enforce law on the the FBI? The KGB? The NSA? NATO? NAFTA? NAMBLA? Nope. None of them. So the FBI will probably continue doing this to its heart's (or lack thereof) content.
Instant Karma's gonna get you...
You may know something about Chechnya. I wouldn't know.
However, what ever crimes have been committed in Chechnya by chechens has nothing to do with what has happened in this case.
Here there were criminals stealing monies and resources from US citizens. The US ask for help from the Russian government, who did not even respond.
The FBI did not invite the criminals to comit any crime. They ask them to show there expertise as in a job interview. Why? So, that the FBI could sniff the ids and passwords. This is not entrapment, which you imply.
The only thing questionable the FBI did was tell the criminals that they were interviewing for a job.
The rights extended to non-US citizen by the US far exceed those extended by many other countries including Russia.
I personally feel these two got just what they deserve. They will have plenty of opportunity to defend themself in court.
I have one last observation. Either, you have a very small vocabulary or are not very well educated. The prolific use of vulgar words to make a completely idiotic argument does not lend anything to your credibility.
Troy
OK, lets make a more accurate analogy. A Mexican resident stands on Mexican soil and shoot a US citizen on US soil. In what country have laws been broken? Now, the US government ask the Mexican government for assistance and is ignored. The FBI lures the murder in to the US. Ask the murder to demonstrate his skills. He calls a friend to send his rifle. When the rifle arrives, the murder is arrested with the evidence taken into custody. This is a closer analogy. I for one and not sure the FBI needed a search warrent to view the data they had down loaded. Police do not need a search warrent to control and take evidence at the scene of a crime. They need it to collect evidence at a suspected location of criminal activity. Constitutional law does not provide for protection of non-US citizen. There is not international treaty that prevents the US from acting in its own defence. Troy
Constitutional law does not apply to non-US citizen
I love that metaphor. I'm going to steal it sometime.
I would say that the Russian mob would have better offers to them (drugs, sex, and more alcohol than they usually have)
:)
Very common technique. Surely you have head of the "award winners" police scams. Where those with outstanding warrants are sent prize vouchers and they get to come to a certain location to claim them. One such event had television coverage where the "winners" were interviewed. They were taken 10 at a time into another room to be given their prizes.
Those prizes consisted of handcuffs and getting read some rights before leaving out the back for jail time.
I'd like to know how "getting them to sit down at a computer running a sniffer" counts as "hacking into their computers".
Part of a trial is establishing a chain of evidence. How on earth can you ever prove that an electronic train of evidence has not been tampered with.
.."
Prosec: "As you can see in the log files
Defens: "Objection: the material security of the log files has not been proven. The prosecution has to prove it that the log files are a true recording of what happened. That the log files and logging process was a completely secure and tamper proof system."
Prosec: "The log files show that no one accessed the system."
Defens: "Objection: Log files are just that, they can be edited. Was the console secure? Was the net access secure?"
Prosec: "When we examined the system."
Defens: "Objection: Prove that the system was not tampered with or completely ghosted by a backup system between the time of the events in question and the time the material was secured."
However, we're going to piss off a lot of countries if we continue to assert that the FBI can do whatever it wants outside of the US.
The War on Hackers has turned up a notch.
Veteran, Bermuda Triangle Expeditionary Force, 1992-1951
Could this fake company name be a purposeful mishmash of the words "indict" and "convict"? Who said that the suits don't have sense of humor?
If tits were wings it'd be flying around.
If I clearly understand this:
he takes the risk of venerating those same "terrorists" he so despises
then I'm not overreacting. There is nothing to venerate on those animals. And note: a large part of these "freedom fighters" are no ethnical chechens. It is just scum gathered from all ex-USSR, mainly from Caucasus, and which found a hot seat in Chechnya at the beginning of the 90's. On what concerns Chechens themselves then I know some of them, who are great people and have nothing in common with these swines that are even unable to read the Al-Khoran.
You know this method reminds me how "chechen" groups sometimes lured people. I know it because I had a few acknowledgements being lured this way before the 1st Chechen War (1994-1996).
In Russia this is consider as the same as kidnapping. I think the FBI has done it because not even the average citizen will understand this. So you US Government Fuckers how better you are than those terrorist groups in Chechnya? How can you talk about human rights if you act the same way as bandits, terrorists and outlaws? Have these guys commited a crime? Maybe. Anyway it is a economic felony which barely touch people's physical well-being. But now their crime is pointless because you committed a bigger crime, you kidnapped people against their will in a foreign sovereign country. You lured people, invited to commit a crime and got them incarcerated. The typical move of "chechen" terrorists and mobs.
You disrespect local laws and rules and you what us to hear you? Go Fuck! Next time the US Government will talk about Human Rights in Russia they can pick the paper and stuck it in their ass. The sound will be more hearable than their voice.
Ok, so they brought them to the U.S., told them to log into their computers in Russia, sniffed the passwords, and then used the sniffed passwords to log into the Russian machines. This is hacking? Social engineering, maybe...
If this happened than FBI can happily know that it violated article 272, part 2 of chapter 28 of the Criminal Code of the Russian Federation. The article claims setences starting from 500 minimal salaries (about US$4000) and up to 5 years of detention. Note that this considers only the fact of illegally accessing a computer.
On what concerns the arguments about local police doing nothing against criminal hackers then I can state this is pure BS. In fact in every major Russian city there is now a special department called 'Direction "R"' that fights computer crimes. Maybe the guys are not as effective as FBI "bright minds". But still is amazing to see how FBI treats their colleagues.
More interesting is that Chelyabinsk is one of the later military centers in Russia. So I believe that if police is sleeping there (Direction R is a police force) than the ex-KGB is surely not sleeping. And I believe that even the most corrupt FSB general would not leave these guys in the fresh air. People are now fucking sensitive to such things after a few major break-ups in Moscow and other cities.
So I can take only one conclusion from FBI's actions: bravado.
What's next? SEALs landing in some Mokrovka village to catch a small group of teenagers playing a cracked Xbox?
Excuse me people, but correct if I'm wrong. For several years I heard that "all are equal in front of the law" and, with exception of intelligence agencies, everyone else was bound to follow the law by the book. And, for years, I heard that in the US this was a sacred rule. So sacred that you made tons of serials and films about it...
Now, it seems that law enforcement has more rights to overcome the law?
Give the russian extortionists the electric chair and reprimand the FBI Agents for violating Russian law and possibly violating American law. Allow the agents to pay their fines out of the confiscated funds, the balance of which are to be used to fund further anti-cracking/extortion campaigns ...
...
Seriously, I wonder if Russians realize that their government's unwillingness or inability to persue these sorts of criminals makes them look to the rest of the world like a haven of corruption and crime. As appearances go: Chechnya is to Russia as Russia to the rest of the world
The Future of Human Evolution: Autonomy
On what concerns the arguments about local police doing nothing against criminal hackers then I can state this is pure BS. In fact in every major Russian city there is now a special department called 'Direction "R"' that fights computer crimes. Maybe the guys are not as effective as FBI "bright minds". But still is amazing to see how FBI treats their colleagues.
... somehow I doubt it, as ex-KGB would never have been stupid enough to fall into the FBI's hands. I say this not to insult Russia but to point out a grim reality ... this sort of thing happens in the United States more than we like to admit, it is certainly plausible that it could happen in Russia as well.
Just when I'm about to give up on slashdot as a source of never ending, mindless drivel I find a gem like this, buried beneath the countless posts posturing and belaboring the obvious. I for one had no idea that Russian law enforcement was this involved in tracking down computer criminals (as my other rather provocative post in this thread demonstrates). This is the sort of thing we here in the west hear nothing about, and it colors our perceptions of Russia inappropriately as a result.
More interesting is that Chelyabinsk is one of the later military centers in Russia. So I believe that if police is sleeping there (Direction R is a police force) than the ex-KGB is surely not sleeping.
Unless, of course, it is ex-KGB freelancers that are engaged in these activities, with friends and contacts within the existing law enforcement structure running cover for them. I have no idea if that is the case for these two individuals
So I can take only one conclusion from FBI's actions: bravado.
That is almost certainly the case. It is also a political game -- they can trot out successes like this one come budget time and probably get more funding as a result.
What's next? SEALs landing in some Mokrovka village to catch a small group of teenagers playing a cracked Xbox?
No, but if you are native American, speaking out against the government in Washington, watch out!
The Future of Human Evolution: Autonomy
Many of us are persecuted under US law, but only lawbreakers are Prosecuted under US law.
7 November 2006: The day Americans realized corruption and incompetence weren't addressing 11 September 2001
So sorry, I forgot that all-important "alleged" before lawbreakers. Can't you let me flame people's spelling in peace?
7 November 2006: The day Americans realized corruption and incompetence weren't addressing 11 September 2001
So how does someone being in a foreign country give our spooks the right to invade their privacy? So suppose some Russian spooks think I'm doing something that breaks their laws.. maybe not even our laws.. just theirs.. and so decide to hack into my machines and spy on me or destroy my files.. is that supposed to be okay?
I for one think our country should keep it's police in our country and think that other countries should do the same. If that other country doesn't give our country permission that is even more of a reason not to do it. It sounds like these FBI agents are nothing more than criminals.
Isn't the CIA supposed to handle international stuff? Or in this case possibly the NSA?
At what price learning? At what cost wisdom? The price is a man's peace of mind, and the cost is his life.
If it was your machine that Alexi cracked. Then tried to export us for $4,500 (?!?) then ran "rm -rf /" on our machine when we refused to give him money. This happened in December 1999, it was Alexi, we had his address, picture, but could not do a thing. He was even bragging to us that we could not bust him because he was in Russia and the Russian authorities would not act -- which was true.
I am personally glad he's in the slammer. And I'm sure all you bleeding hearts would be too if it was you that spent 72 hours without sleep trying to recover from his activities. My only complaint is that it took 3 years to do it.
Seriously though, what do we do about Internet users in countries with no low enforcement -- should we just cut Russia off from the Internet entirely? I think that would be worse than running sting operations like this one. If anyone has better ideas, post them! And "secure your machine" isn't the answer, no matter how secure the thing is, there will always be an exploit tomorrow that will root it.
Good point. The Russian government should really make an international incident out of this, since it is deception of their citizens with intent to take property held in Russia. There's no way the U.S. would allow another nation's government to do this to to a U.S. citizen. Unfortunately, Russian law enforcement is probably happy enough to be rid of these guys without having to go to the trouble of catching them that they won't do a thing.
And people complained about the U.S. being the world's policeman before? Just you wait....
Your right to not believe: Americans United for Separation of Church and
Hang on there - just because the Russian government isn't able to do something in their own country (and may not even want to, since they didn't invite the FBI to come in and arrest these guys) and the FBI does have the means and the opportunity to do so, doesn't give the FBI the right to do so. That's what being a sovereign nation means - you can maintain your territorial integrity even when it annoys other countries. If other countries violate your territory, you make an incident out of it as a matter of course.
In reality, if you don't defend your territory enough, you end up not being sovereign any more, because there's no world organization that enforces nations' rights against each other. But that's another story.
If another country approached the U.S. for the extradition of a criminal, and the U.S. didn't recognize the crime (say, distributing soft-core pornography to Muslim countries, or sending Nazi memorabilia to France (the horror)) and so didn't hand the U.S. citizen over, and then a foreign power lured said citizen out of the country, entrapped them to get their password, and then used said password to steal information out of U.S. territory, you can bet the U.S. government would have a cow. If they didn't, then it would be open season on U.S. citizens the world over.
Your right to not believe: Americans United for Separation of Church and
Perhaps more interesting was how they lured them into this country with the promise of a job (and toilet paper, bread, etc.), and nabbed them when they got here... Brilliant!
Jethro
Quidquid latine dictum sit, altum viditur.
They have come for your uncool niece?
The constitutional restrictions against unreasonable S&S don't apply to the rooskies.
They very definitely *do* apply to the FBI, manifestly an arm of the US Govt. and so subject to limits on what they can do.
Or, more simply, the constitution doesn't restrict people (see amend. 10), it restricts the US Govt.
That is, after all, it's purpose.
"...they may harpoon us, but they ain't gonna pick us up on no radar screen!"
The Russians were part of "The Expert Group of Protection Against Hackers." (Are gangsters "The Expert Group of Protection Against Bricks Being Thrown Through Your Storefront Window Panes"?) No doubt about it, if these really are the guys the FBI says they are, they needed to be shut down.
/.'er done the same thing, to shut down the same Black Hats, it would have been just plain old "hacking" (cracking), and would have been bad. Or that's the idea. Let me get back to you on this one....
Let's see: The theory is, "reverse hacking" is good, because it's done by law enforcement; but had a
Defendent "Gorshkov's attorney, Kenneth Kanev, said it was illegal for the FBI to obtain Gorshkov's username and password and use them to access potentially incriminating data from computers halfway around the world without a search warrant." Interesting point. Does this mean the FBI guys are in trouble? Does it mean the evidence is inadmissable? Are these questions independent?
U.S. Attorney "Schroeder says Gorshkov was using someone else's computer and had no reasonable expectation of privacy." If the Russians broke into third party computers, the FBI broke into them, too? (If the evidence is all from the FBI computer the Russians hacked into, and perhaps through, then it's a clean bust, IMHO.)
"They and associates who remain in Russia are believed to have made tens of thousands of probes and intrusions into computer systems, usually through a vulnerable version of Microsoft Windows NT." Is anyone suprised?-)
Stupid job ads, weird spam, occasional insight at
Nobody seems to understand it because you make no sense. Consitution (US or non-US) applies on the territory of the country, and applies to all people on it. Also, I presume, Invicta arrange for the proper work visas for these guys, so they came to the US very much lawfully.
In my opinion they should have had the CIA put bullets into the heads of these individuals to avoid any 'international incidents'.
Steve's Computer Service, Hobbs, NM
Obvious case in point: Manuel Noriega, still sitting in US Federal Prison...
What is reverse hacking? Ugly solutions to non-existent problems? White hat...black hat...grey hat...whatever illegal shit the FBI does in the name of law and order...it's just hacking.
-B
"FBI uses reverse hacking to catch Russians" -- CNN.com
Oh yeah, reverse hacking... that's kinda like when someone punches you in the stomach and then you use reverse punching to get back at 'em.
Let's take a look at an executive summary of the etymology of this term: it's cropped up in a couple of mailing lists and yet it seems to have no useful meaning. A mere 35 hits on Google for 'reverse hacking', but it seems to have a different meaning each time it was used, from "corporate cyber-vigilantism" to "hacking your own computer." Although, it's used exclusively on reputable mailing lists like 'The Hacker Bulletin Board' and 'Windows Security Advice'.
"Reverse hacking" was referenced as early as 1987 by 1 person in the phreaking community to describe "services putting a carrier tone in thier recordings to fool your friendly hacking program into thinking that the code was valid". If that doesn't prove that this term adds no value to the English language, I'm not sure what would.
Anyhow, it's amusing that I suspected that this term was only used by a moron at CNN, and after 5 minutes of investigation, I determined that it was only used by morons around the world.
...Oh wait, you Americans do that too.
You think the FBI will answer yes? And if the FBI answers no, the Russians are justified in trying to do it themselves?
Quick, someone get a honeypot up in the .ru domain. Then we can all see exactly how the FBI hacks.
the use of the "sniffer" software violated his client's right to privacy
BWHAAHAAHA! Right to privacy! That's a good one guys!
"The cop just sat there and watched as I walked into the bank. You can't just sit there and watch criminal who are minding their own business. That's invading their privacy!"
Idiots. The courts have upheld that if a police officer believes there is sufficient probability to support that evidence may be destroyed, they may take steps to protect that evidence. Like they can stop drug dealers from flushing during a raid.
These jerks are BUSTED, plain an simple. Good going FBI with the human engineering!!
Aah, change is good. -- Rafiki
Yeah, but it ain't easy. -- Simba
if those guys were smart, and were running OpenBSD with encrypted partition/swap space on their laptop, used their laptop and authenticated across with 3DES when trying to demonstrate their skills, we wouldn't be hearing about this.
------ Curiosity killed the cat. {satisfaction brought it back | it didn't die ignorant | lack of it is killing mankind
That's what they get for using the same login/password combo more thatn once!
Go not unto/. for advice, for you will be told both yea and nay (but have nothing to do with the question)
they have come for your uncool niece
use LaTeX? want an online reference manager that
-- john
close your eyes, it cant happen here.
use LaTeX? want an online reference manager that
-- john
About the "search warrent problem": People are saying that, because the FBI cracked the computers in Russia and downloaded the data, but didn't view it until they got a warrent, this sets a precedent to say that breaking into computers is legal, just not reading their contents. What this actually says is:
1) FBI doesn't need a warrent to break into computers in another country - we are not a hegemony, our Constitution doesn't apply to Russia.
2) They had the suspects in the US. They downloaded the data (copied it) into the US. Suddenly the data and its owners are in the US - now they need a search warrent to view it, as both are in the US.
Just my two cents.
...but it's being eaten...by some...Linux or something...
I thought international work was the jurisdiction of the CIA.
I doubt any evidence gained from a search with no warrent, regardless of the computer being in Russia or not, would NOT pass Constitutional muster. If it did, we need to extend the US constitution.
And just which court do you think you would go to to get such a search warrant? AFAIK, courts are only allowed to grant warrants where they have jurisdiction.
Certainly it has been proven in court that foreign nationals on foreign soil are not granted US protections. There are numerous examples of people being kidnapped (albeit usually by bounty hunters) to face US justice.
The natural result of forcing US protections on non-US citizens on foreign soil is that the US would have the right to prosecute foreign nationals who have violated American laws without harming American interests. This sort of extra-territoriality would not be thought of highly.
In this case, the FBI did the right thing. They obtained the files from Russia which had no protection (and to which they had no means of obtaining a warrant). When they files were available on US, they obtained the search warrant. I'm no great fan of the US justice system, but it seems they were following the rules. I'll be really suprised if the courts bounce this one.
Indeed. We typically have spy planes trolling up and down China's coast, and since we are The Light of the World [tm], we are entitled to do that, especially against Devil of the Day [tm]. Imagine China (aka "Devil of the Day[tm]") trolling spy planes up and down California's coast, and them selling missiles to Cuba. The Righteous Indignation! The horror! The shock!
--
Slashdot: Failed Car Analogies. Amateur Lawyering. Anecdote Battles.
Hope all you rebels like northern North Dakota, or the hot wind-scoured plains of West Texas, because that's where the reeducation camps will be set up.
"He loved Big Brother". The chilling last line of _1984_.
--
Slashdot: Failed Car Analogies. Amateur Lawyering. Anecdote Battles.
Last I heard, the spy plane landed on a Chinese military base. Help me here, is that part of International Waters?
--
Slashdot: Failed Car Analogies. Amateur Lawyering. Anecdote Battles.
They are not there (civil liberty) by any stretch of delusion, but they just may get there.
Thanks for supplying the examples for me.
--
Slashdot: Failed Car Analogies. Amateur Lawyering. Anecdote Battles.
I don't recall mentioning Taiwan anywhere. Is Taiwan an independent country? Have the US recognized it as such?
What is interesting to me is the direction China and the US are taking. Deng Xiaoping said, "To get rich is glorious" which sounds like a paeon to the free market, which is the direction they are going--towards liberty. Even now, they are problably not much more economically regulated than the US are (no Americans with Disablities Acts, no EPA, FDA, etc, etc, etc). They are not there (civil liberty) by any stretch of delusion, but they just may get there. The US, OTOH, are moving toward a ponderous socialist worker's paradise...
Why are US Civil "Liberties" always accompanied by Government regulations, which always seem to remove Liberty?
--
Slashdot: Failed Car Analogies. Amateur Lawyering. Anecdote Battles.
"The agents downloaded the data, but did not view it until they obtained a search warrant from a U.S. federal court, he said."
Am I the only one completely amazed by this statement. Here, these agents plainly admit to *copying* data which may not be legal to have or view. Um, how is this different from copying some piece of music or literature you may or may not be allowed to use, without listening to or reading it? This seems like it could set (or shatter) a big precedent. Imagine that, *copying* digital data may not necessarily be equivalent to "stealing" it. Amazing.
It's 10 PM. Do you know if you're un-American?
A situation similar to this could easily be considered an act of war- particularly if the hackers or script-kiddies were targeting .gov sites as opposed to corps [who, given the technology and $ at their disposal, are asking for it if they leave their systems open].
Technically, if the compromised hardware, software, company, what have you is physically *inside* united states boundaries, then the attacker could be persecuted under US law, yes? Conversly, if some 1337 d00d in Jersey hacked a Russian site and pissed them off, he should likewise be subject to the same considerations.
Yeah, it's the internet, no physical boundaries and all that. Root my server and the only thing seperating you from a fractured skull is the distance factor- something governments don't have to worry about. Crackers do this kind of shit because they know they're not going to get caught- a few serious, well-founded PROVEN criminal cases may serve as a deterrent, or at least get the issue out in the open.
please dont forget that the united stats of america is the nation of freedom.
ofcourse all us citizens should be allowed to do whatever they want.
hackers treating national security should be prosecuted though..
How about a Soviet <a href="http://www.ngb.dtic.mil/gallery/heritage_co<nobr>l<wbr></wbr></nobr> lection/amsky.htm"> Bear Bomber </a> flying down the coast of Florida instead? It used to happen all the time, when they could afford the fuel. Please, also, note the distinction between an EP-3 spy plane and a Tu-95 bomber.
That's not what I got...
.com, .net, and .org domains can now be registered
.COM, .NET, .ORG, .EDU domains and
Whois Server Version 1.3
Domain names in the
with many different competing registrars. Go to http://www.internic.net
for detailed information.
Domain Name: INVITA.COM
Registrar: NETWORK SOLUTIONS, INC.
Whois Server: whois.networksolutions.com
Referral URL: http://www.networksolutions.com
Name Server: NS.UNI2.NET
Name Server: NS2.UNI2.NET
Updated Date: 09-feb-2001
>>> Last update of whois database: Mon, 23 Apr 2001 07:35:40 EDT
The Registry database contains ONLY
Registrars.
Crackerjack was a UK kids TV pantomime/game show.
It was introduced whit: "It's friday, it`s 5 to 5, it's CRACKERJACK !"
The prizes were pretty crap - you could win a cabbage, or a crackerjack pencil. Later I guess they must have gotten a budget and you could win a crackerjack pen.
One of the things the show had, was that anytime any of the hosts said the word "crackerjack" the audience would yell out "crackerjack" really loudly.
It was a very strange show.
Heres a short clip
The Russians should have been using SSH for there remote communications.. At least that way it would have taken the FBI longer to figure out what they were actually doing and how they were doing it.
On a side note, the issue about the NT exploit. If it is a big firm that is running NT as an actual webserver, they deserved to be slapped. The major problem with NT and it's updates is that for most of them you have to reboot for the changes to take place. That just doesn't go well when you trying to provide a 24/7 service. I meen have you ever seen how long it takes a server with 5+ UWSCSI Drives and 1 1/2 gigs of ram to boot? Almost like 10 minutes, and most of that is just waiting for the SCSI controller to find all the bloody drives. Anyways, enough bableing.. I'm ranted for the day..
Ed.
Ed.
To Be or not to Be.. It's all the same at the end.
Did they consider any of the ramifications? Entrapment was the first word that popped into my head. Am I missing something? What's the loophole?
-Iorek
That's the dissenting opinion that McVeigh quoted at his sentencing hearing. Pretty harshly written for a Supreme Court Justice.
I thought it was the 3Ff B33 3y3!@#$
The US Constitution does apply, the fed's proved it when 'The agents downloaded the data, but did not view it until they obtained a search warrant from a U.S. federal court, he said.' It's due process that applies to all accused persons that are being tried in the US.
The fact that the agents waited until AFTER they downloaded the evidence will probally mean that is it thown out of court, but this is another issue...
Once again, someone proves that NT's only security is that it is likely to crash while your cracking it.
Someone you trust is one of us.
"The Russian hackers drew the ire of the FBI when hundreds of emails were sent to agents. Translated, all of the messages read 'All Your Base Are Belong To Us'."
Those wacky Russians.
If they did not have a warrant to search and seize the data. The evidence will still be thrown out of court and they FBI will have no joy.
"Help me Obi-/.-Kenobi,your my only hope!" -$
I dunno... the idiocy of some people amazes me sometimes.
FBI: HELLO. I AM FROM A NOTABLE AMERICAN SECURITY COMPANY. I WOULD LIKE YOU TO WORK FOR US. HERE IS AN OS INSTALLATION WITH SOME GLORIOUSLY GAPING HOLES. ARE YOU BADD ENOUGH TO COMPROMISE IT? BECAUSE OTHERWISE IT'S BACK TO KASHA AND VODKA, VADIM.
h4x0r: Done!
FBI: HA HA. SUCKER. YOU'RE BUSTED.
This isn't witty, this isn't elegant, this is pretty much textbook entrapment. Not that I'm saying they're innocent, but jesus christ. Supplying the means (the computer) and motive (a job on the line) and it's not entrapment?
Easy does it!
This comment has been submitted already, 276865 hours , 59 minutes ago. No need to try again.
Playing Devil's Advocate...
I'm a white-hat sysadmin. I know the tools, I know the holes, I keep my risk as low as possible and my ear to the underground so I know what's happening.
Tiger Team Extraordinaire, Inc. approaches me with a job offer, pending me proving my ability to penetrate a border system they've set up. Giddy as a schoolgirl, I bust on through their ineptly-armored system and leave a little love note in the root, then get out.
Two days later, the FBI comes knocking on my door and drags me in, charging me with defacing some random webserver I've never heard of.
Mostly, I'm questioning the paucity of this bust and am hard-pressed to explain away how they managed to prove anything with it.
Easy does it!
This comment has been submitted already, 276865 hours , 59 minutes ago. No need to try again.
There is a reason illegal means to capture criminals is considered so dangerous in the USA.
You're confusing issues here. You might want to read the article again and note that the information was only searched once it was on US soil and only after a search warrant was obtained. In that sense it was perfectly legal. Now whether or not they had the right to bug the computer is a totally separate issue, where there might be room for discussion.
This is a manual virus. Copy it to your sig and help me spread!
Scully: 411 UR B453 4R3 B310NG 2 U5!
At which point hopefully the smoking man comes in and shoots them both in the back of the head.
I'm trying to teach myself to set people on fire with my mind... Is it hot in here?
So now they're known as the FB1?
========
Stephen C. VanDahm
I think I'll go check my f/w logs...
"Remember, any tool can be the right tool." -- Red Green
I just LOVE this line...
Pardon me for being clueless... but if you don't have jurisdiction there... then you have NO legal right to do that, meaning you BROKE THE LAW. Just because it's another country doesn't whitewash it!
But of course, when the FBI agents would arrive in Russia, they should be arrested and charged for illegal computer cracking.
Really, on what international legal grounds does U.S. police force commit crimes in another nation? On what moral grounds can they convict the suspected russians for cracking U.S. computers, if they themselves commit equvalent crime in Russia, and expect to get away with it?
I don't respect the Russia's international behaviour much, and they probably have more than enough internal problems, but they really should react to this kind of things. If the FBI agents are not procecuted in U.S. for their tactics, and the actions are not at least apologized, it means that U.S. government officially supports FBI committing crimes in Russia.
It's 100% different thing to work in ''co-operation'' with local police by asking a permission. Without permission, it is simply an international offence. U.S. seems to have given up the last bit of their respect for other nations sovereignity and moral rights. Well, nothing really new in that.
Well it isn't a precedent just yet. The court hasn't ruled, it's just this assistant US Attorney Schroeder guy who says it's ok.
Whats interesting here...
:)
Ok... You could argue that what happened (the cracking) was on russian machines owned by a russion, and the FBI has no jurisdiction there, so no warrent.
They may have thus broken Russian law, but until they go to russia (or russia petitions for extradition (assuming there is a treaty allowing it)) there is no problem.
SO.,.. what the FBI is saying is, what happens on a server in another country, happens in that country according to that countries law
I would be happy to see that argument set a precident in court. Pleased as punch I would be.
So what _I_ as a US citizen put up on a web page hosted in another countru, should be governed by THAT countries law...not US law. I am down with that.
-Steve
"I opened my eyes, and everything went dark again"
That wasn't in the article.
Still though, collecting passwords is one thing, sure. However, USING a password that you have collected to gain unauthorized access to a box is still unauthorized access.... fundamentally no different than exploiting a software bug to get in.
Its still a form of cracking
-Steve
"I opened my eyes, and everything went dark again"
I for one am glad to see the FBI going after real criminals for a change.
So what happens when this is reversed?
Say, for example, John Doe sells some Nazi merchandise on a website which French users can view. Then John travels to France, where he's arrested for a crime which isn't a crime in the country he "commited" it.
Opens the door to a lot of international mistrust.
If these computers were over-seas then the FBi probably over-stepped their authority ina bad way.
The FBI is absolutely forbidden from engaging in foreign survailance. This is the role of the CIA.
I suspect this is just the beginning of how the net is going to break down all our preconceptions of geography and force major changes in the structure of our scoiety,
=\=\=\=\=\=\=\=\=\=\=\=\=\=\=\=\=\=\=\=\
So, please enlighten the rest of us. I for one am interested.
I'm the big fish in the big pond bitch.
Wow, if I had mod points I'd mod you up for that response... not only a description... but clips too.
I'm the big fish in the big pond bitch.
But it seems to me that what the FBI did is a dangerous precedent, using "enforcement" to solve these problems because:
There is no "enforcement" solution. You can enforce all day long and it still won't solve theproblem. We need to get back to the original methods of solving these technical problems. However, one thing the FBI could do, for example, is demand (encourage) Microsoft turn off java and javascript in their shipping products by default. Why don't they encourage greater security from all software producers? These would be positive attempts at solving the problem. The customer is protected by proper architecture.
Perhaps the FBI isn't in the business of "encouragement," but I just don't see how law enforcement in the physical world translates to the digital, especially when computer security, especially with Microsoft, is low and our government has bent over backwards to discourage strong encryption.
No wonder the agents in The Matrix were able to track down Neo so damn fast! I always wondered about that myself.
Trolls make great pets. Adopt one today!
Invita Koekkener is an old player on the Danish market for kichen furniture. The addresses and names mentioned above seem legitimate enough for a Danish company. www.invita.com seems to talk about their stuff.
In Murphy We Turst
There is one major difference here though, and that is that the US government hacked the computers IN RUSSIA. They were clearly not authorized to access them, even after they'd stolen their passwords. You don't need to make analogies to see this point, just switch the parties. The police in country X hacks an individuals computer in the US, and gains information which shows the individual is a criminal. They then prosecute the individual in country X.
The thing is, these individuals are no different than an ordinary Russian citizen. The FBI clearly has no right to hack an ordinary Russian citizen's computer. It doesn't matter what the FBI thinks. What they implicitly did here was issue a search warrant in Russia, without getting any kind of confirmation from the Russian police. If that is ok, then any law enforcement agency in the world could hack any private computer in the US, but I'm sure you would not accept that. How would that be different?
"He also maintains that no search warrant was needed because the FBI lacks jurisdiction in Russia."
So just remove the FBI's jurisdiction in the US and suddenly they no longer need warrants? Huh?
Peace,
Amit
ICQ 77863057
[o]_O
He, he, you need several times the number of admins per computer for a NT network than for an Unix one, so they should be cheap and their strong point should be the patience to wait during many and often computer reboots.
He also maintains that no search warrant was needed because the FBI lacks jurisdiction in Russia.
By this logic, all the government has to do is setup a law enforcment agency which has no jursidiction in the US and they can gather evidence on its own citizens without regard to the constitution.
Jesus died for sombodies sins, but not mine.
"Our products just aren't engineered for security,"
-Brian Valentine,VP in charge of MS Windows Development
I like this bit: "He also maintains that no search warrant was needed because the FBI lacks jurisdiction in Russia. " Apparently the FBI believes their lack of jurisdiction in Russia allows them to ignore rules they are normally subject to. Does this mean the police dept in the neighboring town is allowed to break into my house and search around because they lack jurisdiction?
---
"What is that sound its making?"
---
"What is that sound its making?"
"It thinks it has a virus, but its actually just linux."
Interesting. The FBI breaks into a remote computer and uses the evidence found on them to arrest them.
Nice trick, guys!
Now, all the defence attorneys need to do is say: "Our clients are the victims here. Their computers were compromised/trojaned without their knowledge. Look, the FBI showed how easy it is to do. What prevented criminals from having done it as well? NOTHING!"
Really, now. In this day and age of one-click trojans (ie: SubSeven), it is far too easy to compromise computers and use them as staging areas for further criminal activity. To make a criminal case watertight, you need:
1) Wiretaps
2) Wiretaps
3) Wiretaps
4) Seizing the hardware invovled doesn't hurt, either.
Remember, the FBI has to prove they are guilty. Kinda hard to do without physical evidence or electronic evidence, don't you think? Reasonable doubt, y'know.
Food for thought....
You only violate US law if you break into a computer within the United States. Violating foreign law is okay, as long as you're reasonably safe from extradition.
Even better is that the protections for `civil liberties' only apply within the United States (or with respect to American citizens and permanent residents).
Morale of the story: the FBI gets away with it.
The article says the crackers used an exploit in NT where the patch was availible for TWO YEARS on Microsoft's web site. If you run an e-commerce company and don't use readily availible patches, you DESERVE to get cracked by one of these retards.
The people that run the site should also be ARRESTED for putting their customers personal information in jeopardy. Incompetence is no excuse. What are the admins getting paid to do? Most cracks come from the sheer laziness and cluelessness on the part of the network admins.
Crackers don't use brand-new, not yet on bug-traq exploits, they are a bunch of kids using cracks ages old where the patches to fix it are readily availible. Keep your system up to date, or don't bother putting it on the internet, cause you will and do deserve to get cracked.
Never did I say that the actual crackers who broke in should not be prosecuted. I said the people responsible for the negligence in allowing the security breach should be held responsible.
If I buy CD's from CDNow, I am entrusting them with my personal information. They are the trusted keepers of my credit card number. If, by negligence, someone is able to steal my credit card number, they should be held legally responsible. Of course if a hacker breaks in using a previously unknown bug they cannot be held responsible. However, in cases like this, where a fix was availible for two years, they company SHOULD be held responsible if my personal information is compromised.
To liken to your child care analogy, lets look at a day care center. If the day care center states all workers undergo an extensive background check (much like an e-commerce site guarantees your personal information security), and a convicted child molester ends up working there, they should be held responsible if he molests children at the day care center. The center is TRUSTED with the SAFE care of your child, much like an e-commerce company is TRUSTED with the SAFETY of your credit card number.
If an e-commerce company has admins who spend their time playing mindsweeper and cybering on ICQ while totally ignoring their networks security, they are negligent and should be held responsible for blantant security breaches. There are thousands of "network admins" who don't know their ass from their elbow in network security, who got their MCSE from the back of a newspaper, working at these companies. And it's scary that we entrust our personal information to incompetant people. That's why companies should be held accountable for security breaches.
This is effectively no different from kidnapping the crackers and should be grounds for throwing out the case.
that these Russian hackers are apparently the ones behind the /. story here which was posted in March. That was apparently the first time public knowledge of these attacks had been leaked to the public.
Now note that these two guys were arrested in November, per the MSNBC article.
Whoa.. these hackers were neutralized half a year before there was even public knowledge of their hacks. Kind of weird when you remember that Ars Technica got all hot and bothered about their scoop "The Great Hack Attack", that these sorts of attacks had only been a matter of time; and now we know that when Ars was standing up on the box, the attacks had been stopped.
Someone should submit this to Cryptome.
They'll only have to pay $50 + court costs, $75... but if you get a lawyer to do a class action suit, then you can actually hit them up for the whole $2.7 million with ONE court case.
As evil as class action suits are in the eyes of many, they're great for just that sort of thing. $75 is a thorn in the side, but a class action suit is a huge lamb-feces encrusted iron spike.
Actually, I believe that entrapment only involves getting someone to "commit a crime they would not have commited otherwise", the law enforcement agency need not commit a crime itself.
Don't take life so seriously; it isn't permanent.
I wonder haow the US would react if the Russians tricked some American's to fly to Russia, then prosecuted then for breaking Russian laws, while they were residing in the US. This is as bad as the US putting warrents out on Burmese, Mexican & Columbian drug lords who have never been to the US, so have never been under US juristiction. Whatever happened to the concept of national juristictions.
I'm pretty sure that civilians sniffing e-mail would be considered cyber-terrorism, but the gov't doing it isn't, since they have our best interests in mind, of course (sarcasm). This isn't the first time that law enforcement is doing dubiously ethical things in the name of protecting the people that they would prosecute private civilians for - just try wire tapping or bugging private property. You'll wind up in jail why the FBI is simply "doing their job."
In another way, though, this isn't necessarily a bad thing - if I knew I could trust every FBI member to use the authority in a way to ensure justice, I wouldn't mind knowing that law enforcement could randomly check up on various suspects. There are many powers the government has which they in theory have because they won't abuse them - why else do we allow the government to have a military in peace time? As long as this trust is never abused, these extra powers are generally a good thing - but I get the feeling that trust in the government is getting heavily abused these days. I guess I'm just cynical.
You are in a maze of twisty little relative jumps, all alike.
That explanation nicely ignores the fact that this happened in Russia and would therefore fall under Russian law. Which means that if Russian law allows the FBI to snoop on crackers, the FBI is in the clear, I guess... except I thought that US law said the FBI only had athority inside the US...
I kind of hope this becomes an incident simply because I can't think of any way that this is legal.
You are in a maze of twisty little relative jumps, all alike.
"Schroeder [FBI] says Gorshkov [crook] was using someone else's computer and had no reasonable expectation of privacy. He also maintains that no search warrant was needed because the FBI lacks jurisdiction in Russia."
Does this arguement make sence to anyone else?
--Chris
Or another one-time password scheme. Other posters have suggested SSH, which misses the point.
-- www.globaltics.net
Political discussion for a new world
5 yrs of AOL only internet, on a 486/25 runing Windows 3.0 ... with a flickering monitor.
-- www.globaltics.net
Political discussion for a new world
Pity it wasn't posted at 4:55pm on a Friday.
Note: This will have no relevance to those outside the UK, and even some younger UK readers will have no idea what I'm talking about.
hacked by Krad and Frontpage.
I think you underestimate just how much I just dont care.
We here at the Society for the Conservation and Reinstitution of the Wholesome Snack Cracker-Jack (c) (SCRWSCJ) are appalled that you have used the Cracker-Jack (c) name without its wholesome carmel, nut and corn goodness.
SCRWSCJ insists that all future references to the wholesome Cracker-Jacks (c) are used with utmost respect, referred to with its greatest goodness.
We at SCRWSCJ anticipate that all future references to Cracker-Jack (c) will be used correctly, and to our standards. May the long life of Cracker-Jack (c) and the SCRWSCJ live on long into our children's lives. Remember kids, its carmel-popcorn-nut-crunchy-wholesome-goodness!
Thank you.
Good quote, too many chars. Seriously, the slashdot 120 char limit sucks!
no, jackass, the CORRECT line for this version of "California, Uber Alles" is this:
Come quietly to the camp
Friends don't let friends use multiple inheritance.
Thanks for the news. I missed that one.
~~ What's stopping you?
Actually, that doesn't work well either- Non-US citizens have US rights. The rights claimed by the Bill of Rights aren't just for Americans, only originally asserted by them. Illegal Aliens get due process.
The way I understand it, since it's a US Law Enforcement agency, they're bound to uphold and respect US rights and procedure, whether their targets are US citizens or not.
A host is a host from coast to coast, but no one uses a host that's close
So your POS SCSI controlled takes 10 minutes to enumerate drives, and you are blaming NT? Explain that one to me....
Even if they were cracking
The ivory tower has never had to reach so h
Problem is, that the FBI "reverse hacking" of russian computers is done by an official US government branch
Touché, I was only seeing the other way around. I do think the WWIII thing is a bit of a stretch, but you never do know...
The ivory tower has never had to reach so h
$ whois invita.com
Registrant:
Federal Bureau of Investigation (INVITA-DOM)
935 Pennsylvania Avenue, NW, Room 7972
Washington, DC 20535
US
Domain Name: INVITA.COM
Administrative Contact, Technical Contact, Billing Contact:
Louis J. Freeh (LF10359-IN) louis@fbi.gov
Federal Bureau of Investigation (INVITA-DOM)
935 Pennsylvania Avenue, NW, Room 7972
Washington, DC 20535
USA
2023243000
Record last updated on 06-Apr-2001.
Record expires on 24-Apr-2003.
Record created on 24-Apr-1998.
Database last updated on 24-Apr-2001 02:37:00 EDT.
Domain servers in listed order:
NS1.FBI.GOV 165.87.201.243
NS2.FBI.GOV 165.87.201.244
So the message I get is that breaking into computers is BAD BAD BAD when a couple evil Russians do it to hardworking Americans, but it's okay when the good ol' US government does it right back to 'em.
Maybe I'm just yet another paranoid government-hating Slashdotting Big-Brother-phobe, but why should I believe that law enforcement agencies will only wear white hats when they perform these kinds of actions?
Here's their web site. They are famous for Mastermind, a game that I remember playing back in the seventies and that's still available now!
sulli
RTFJ.
Would the FBI help out Russian officials, if they made a request that was within applicable treaties?
The answer is yes, becuase the FBI has the resources and will to do so. The FBI recieved no help from Russian officials on this, so they have no right to complain
Alcohol, Tobacco and Firearms should be the name of a store, not a government agency.
This could be a huge can of worms. It will be interesting to see if Russia views these searches the same way.
Viv
-----------
Viv
Gmail invites for ip
Quick, take out a patent!
-----------
- - - - - - - - - - -
I am a programmer. I am paid to produce syntax not grammar. Deal with it.
Man, and here I was thinking that all of these port scans were coming from script kiddies.. little did I know that the fbi was trying out their 1337 h4X0ring $k|11z on my pc. Okay.. I admit it.. I suck at l337 speak!
I thought someone said there was going to be free beer!
You've either never been cracked or you are a freakin' genius or your didn't recover right. Just because you find a compromise on day X, it does not mean that it happened on day X... could have been yesterday, last week, a month ago. It takes time to go back and validate all of your data even if you were doing regular backups through that time. You have to find the last trusted backup, not just the last one you happened to make. It can take weeks to properly do forensics and work your way back to a trusted backup set.
No relation to Happy Monkey
A vanilla webserver is a little different than a full-blown e-commerce system with a back-end database to worry about, sure. Presumably you can re-format, re-configure, slap source back on it and be running again in no time.
It's easy, and to some extent valid, to observe that different policies and procedures would prevent or minimize damage after the fact. People should always use a compromise as an excuse to review their procedures. But security is always a compromise on usability, and determining ahead of time exactly where to draw that fine line is an impossible art.
Incidentally, if you don't feel that NT/IIS has adequate security, it seems to me that you've missed your own point--properly installed and configured, that setup can be as secure as anything else on the market. But perhaps you were trying to say that in your case, you couldn't provide the functionality that you wanted with the security you wanted. I guess that would be my point--you've got to make that tradeoff somewhere, and I'm not sure you should castigate these guys for doing so. Nobody likes a whiner, but I think it's reasonable to be pretty pissed off when you get jammed like that.
No relation to Happy Monkey
I certainly wouldn't argue that most breaches--and I would go so far as to say ALL breaches--are preventable; it's just that it's much easier to see what would have prevented them in retrospect than it is beforehand. Certainly people should follow minimal best practices, at least--I completely agree with you on that point.
;) And if I remember the attrition.org numbers correctly, it's actually cracked less often per share, too.
I guess I just find it disturbing that you seem to hold the victims more responsible for the problem than the attackers. Prudence is one thing, culpability another. To draw a poor analogy, if you're going to walk at night in a bad part of town, you should be prepared for muggers--but that doesn't mean you should just accept being mugged. You should still call the cops, try to find the guys who did it, and take them off the streets. That's not whining, it's civic responsibility. Vengeance is not the point--justice is. There may always be someone else, but that doesn't excuse these guys in particular--they should be pursued and removed from the scene.
Aside; that's an interesting argument against NT/IIS--usually what people say is that it's less secure because there are fewer reported vulnerabilities weekly than other, more open platforms... implying that more open platforms are better reviewed for security. If you really believe that, though, you should take a look at the actual numbers: securityfocus stats Considering the percentage of all webservers that are hosted on NT, it actually has fewer reported vulnerabilities for its market penetration than some Other operating systems (not naming any names here
I don't like how MS handles flaws, either, but it's really just a mirror for corporate America. I've never worked anywhere where the PHBs were more concerned with fixes than features--until after they got hit.
No relation to Happy Monkey
I don't think your view of law and duty is actually all that different from mine. I agree with pretty much everything you've said; I just don't think (returning to the lousy mugger analogy) that it's acceptable to say "Don't walk in certain neighborhoods," instead of trying to address the root problem. Your point that such things are often symptomatic of greater social ills is well-taken--however, it crosses your point of individual responsibility being the only really relevant matter. If the muggee needs to be responsible for watching his or her back in indian country, then the mugger also needs to be responsible for, well, being a mugger. And I don't think that justice is not a deterrent, either. I think it's a great deterrent, where it's actually applied. Deterrence, however, is not easily measured in most contexts, so I can't cite anything for you particularly... it's just an observation of human nature. If you have an expectation that you're going to get caught and punished you're less likely to commit a rational crime. Murder would be an example--it has a very high clearance rate, and it's also the least common violent crime. And I guess, in short, that I don't think that being stupid means its okay to be victimized. I suppose I'm idealistic enough to think that our society should be such that you simply shouldn't have to worry about getting mugged/cracked.
Aside: The point about the stats, though, is that even though NT is higher than everything but the aggregate of all linux distros, it's not as much higher in exploits as it is in market penetration. If NT had 100% market share, they would have 100% of all exploits. In other words, you should see a correlation between how wide-spread an OS is an how many 'sploits are found for it, presuming all other factors are equal. But NT actually has a lower percentage of 'sploits against it than it has market penetration. So, for instance, if you took certain other operating systems and extrapolated them out to having the market share that NT currently does, you would actually see them with more exploits against them than NT has. You could argue that this is a Bad Thing and that more problems found mean more fixed; but I don't think you can argue that NT has more exploits for market share than other operating systems.
I don't have a comment on the nature of the exploits, since I can't seem to find any relevant stats for that. Off the top of my head, I can only think of a few popular IIS/NT exploits that allow full file access or arbitrary code execution.
No relation to Happy Monkey
From the CNN article: Schroeder says Gorshkov was using someone else's computer and had no reasonable expectation of privacy. He also maintains that no search warrant was needed because the FBI lacks jurisdiction in Russia. This must be a new def'n of jurisdiction... if "crime-fighter A" doesn't have jurisdiction in a particular region, that is a free license to do whatever he wishes? Seems like the crime figthers would soon find jurisdiction troublesome and seek to remove the notion. What the feds should have done is get permission from the local Russian authorities and proceed through the channels. Be afriad when fallable human beings become above the law....
"Jesus saves, but everyone else in a 10 foot radius takes full damage from the fireball."
FBI Agents needed for challenging positions at new Siberian Internet company.
Experience with sniffing tools, "reverse hacking" tools, skirting government regulations and using search engines at resume web sites.
Pick up one way tickets at you nearest Russian Embasy.
We are confidant you will stay!
It is not likely to happen, but legitimate. Thus the joke.
They could even be prosecuted in the US unless they could argue the hot persuit clause or something similar
Actually, since at least some of the alleged crimes took place inside the boundries of the US, it's the FBI's job to handle.
I like you, Stuart. You're not like everyone else, here, at Slashdot.
This raises an interesting constitutional issue. Lets say, for example, your are an american business man and often travel to Russia. Now, the FBI thinks your a low life money launderer for the Russian Mob and the only reason you haven't been arrested in Russia is because you pay off the police. They don't have much to prove this. In fact, they can't even get a wire tap for your cell, which is provided by an american company.
So one day, you are in Russia and using a Russian ISP, you check your email. Now the FBI, through perfectly legal means, gets your IP, breaks into your computer, and finds....NOTHING except a LOT of porn with couple images that MAY be girls under 18. You come back to the states, they arrest you under for child porn (when they know its contestable) so they can get warrents to check your house in the vague hope of finding something to prove you are with the russian mob.
At no point did they get a warrent.
Sound far fetched. Maybe. But it does raise an interesting Constitutional issue for American Citizens. If I travel to Russia, the FBI, who has not jurisdiction there, should NEED a warrent to invade my property in Russia. Here it is implied that since Russia is not America, the govt can use means that fly in the face of the Constitution to catch someone.
I doubt any evidence gained from a search with no warrent, regardless of the computer being in Russia or not, would NOT pass Constitutional muster. If it did, we need to extend the US constitution.
Burn Hollywood Burn
WTF? I am just stating the facts. If I can't say 2+2 is 4 I am not free. Sorry to see someone with such an extensive vocab doesn't like the truth being shared.
You expect me to take you seriously?
Spooging, Cum-Wanker, please. BTW no one asked you to participate so you can leave yourself out of being led into the "depths of bullshit". If you did even cursory research you would note that the report on the raid was reported in the Seattle Post intelligencer ntot by Indymedia .
I am curious what do you think about the federal mandate requiring all cell phones to have a GPS?
That piece of info reported by Fox News no less not exactly the paragon of anarchism .
For that matter Mr spooge, maybe we can put a chip in the back of your head Mr. "Spooging Cum Wanker" and force you to clean up your horrible language and learn some manners.
.
Mr Spooge,
Thanks for the lively conversation. I will shut up now.
peace..
Thanks. I know I feel stupid.
The Indymedia center in Seattle was raided by the FBI. Not only that but the federal government has required that all phones have a tracking device by 2005 We should not support a government that hacks into the citizens of other countries computers. It is only matter of time before they do it to us. If they haven't already started. Welcome to the corporate police state.
It's no surprise, really. The FBI doesn't do old-fashioned gumshoe investigations any more. The only tactic used nowadays is deception (lying) to get confessions, and then using those confessions to get evidence against others.
*cough* bullshit *cough*
That was honest of them. I know I couldn't resist sneaking a tiny peek.
I love the smell of Karma in the morning
ut what are they doing against US crackers hacking Chinese computers? Hire them.
As x approaches total apathy I couldn't care less.
As Micrsoft makes their Server OS almost brainless to administer, NT admins come to expect that everything will take care of itself. I've known quite a few NT admins and if the task is any more complicated than clicking the "Install" button, then they're lost. I suppose it's the nature of the beast. As software gets simpler and simpler, the users get dumber and dumber. They expect to be hand fed everything and when things aren't immediately obvious, they're lost. It's a somewhat scary thought to think that as technology progresses, less and less people actually know how it works. I suppose it's a necessary trade off, but it does seem to put a lot of power in the hands of very few individuals.
They don't need a warrant, right? It's not their jurisdiction!
If somebody doesn't have jurisdiction somewhere, it doesn't mean he can do anything. This means he can do nothing.
Did the FBI break US law? It certainly seems that they might have. The whole wash about not having jurisdiction is BS, as the article states the sniffing and login were done in the US...Seattle to be precise.
Now, the sniffer wasn't a problem, I don't think, since the FBI legally owned that computer and are free to install whatever monitoring tools they want (BTW, I don't think it was a sniffer but a key logger). The using of the passwords to log onto an account that was not theirs, however, is a crime. And I believe that if a private US citizen were to hack another computer in another country, that US law would still be applicable. If I kill a Russian citizen visiting the US, am I not guilty of murder in the US? Or am I only guilty in Russia?
So, the FBI broke the law by hacking another computer. This would be OK if they had a search warrant, but, obviously, they didn't get one until after the fact. I wonder if they tried to get one before the operation, and were turned down by a judge who stated that they didn't need one. Barring that, I would say they definitely need a search warrant before downloading the data (including simply viewing the data and gaining access). After all, for the time between downloading the data and having a search warrant for it, that data was effectively stolen merchandise.
And, besides, it's called a search warrant, not a look warrant!
Of couse this was only their argument and not necessarily the law, but it's fairly brash. As was the "expectation of privacy" argument.
I bet they used scripts.
"When it rains, it pours." --Morton's Salt
The biggest problem with NT isn't necessarily the security holes. It's the idiocy of the admins. The only way to stop this: make it expensive to hire retarded sysadmins. Do this by suing these outfits (not necessarily Microsoft) for gross negligence and lack of due diligence in protecting your credit card information. Yeah, you'll probably only get $50 plus court costs, but that'll be $75 they have to pay. These Russian hackers stole 38,000 numbers from an undisclosed site; That's almost $2.7 million for hiring an incompetent admin!
The US Constitution DOES apply here, though not in the way that I've been hearing people say. You are correct that the United States would not need a search warrant to hack computers from halfway around the world. The US does have every right to do so as you state.
;)
However, when these people are in U.S. territory the rules change. You are guaranteed the rights of any other US citizen when present. These men entered the country legally with passports. They have a right for their communications, keystrokes, etc. to be free from surveillance while here. It's like what happened to the US citizen in Singapore who was vandalizing property while there. He was given due process and equal punishment as dictated by law.
The only exceptions to the rule are under the "critical zone approach" as ruled by the Supreme Court. The Court fully recognizes that the Fourth Amendment does not apply in "critical zones" (often international airports). The FBI may have conducted this search legally if they had only obtained the warrant beforehand (including a provision for obtaining the keylogger data).
And hegemony? For crissakes, its been that way 100% since the Cold War. It doesn't matter whether or not we're enforcing Constitutional law. Instead, if we do *anything* in our self-interest with the military, we're hegemonic. Take the Kuwait oil fields and the Gulf War as an example. And, well, I might be facing the draft in a few years so I'll refrain from complaining about the military.
Registrant:
Invita Koekkener A/S (INVITA-DOM)
Fabriksvej 20
DK-7441 Bording,
DK
Domain Name: INVITA.COM
Administrative Contact, Billing Contact:
Krogsgaard, Johannes (JK10757) invitajk@POST1.TELE.DK
Invita Koekkener A/S
Fabriksvej 20
Bording, 7441
DK
86861677 (FAX) 86861677
Technical Contact:
UNI2 / Henrik Bo Hansen (UNI2-DK) domain@UNI2.DK
UNI2
Gl. Koege Landevej 55
Valby
DENMARK
+45 77 30 10 01
Fax- +45 77 30 10 00
Record last updated on 09-Feb-2001.
Record expires on 12-Oct-2001.
Record created on 11-Oct-1996.
Database last updated on 24-Apr-2001 02:37:00 EDT.
Domain servers in listed order:
NS.UNI2.NET 129.142.7.99
NS2.UNI2.NET 195.82.195.99
I know a lot of people may not see it this way, but I think the US FBI actually played fair on this.
For one, when these Hacker/Crackers from russia started in on US Businesses they had to know they were opening up a can of worms.
Breaking in to a closed computer system is a violation of US, Soviet, and International Law. They must have know this too.
When the FBI did get involved, they requested (several times) that Russia arrest them (for breaking Soviet law) as is the usual custom. Russia declined for thier own reasons.
Reaching an impass of sorts, The FBI found one of thier resumes online through an EMail one of them sent to a US ISP requesting a job, after the guy hacked the ISPs System. (Im sorry but, this has arrest me written all over it.)
The FBI then lured the Hacker/Crackers to the US with a promise of a job from a Security company that DOES NOT EXIST. I looked online for the company, and found no information leading to it. Did they even check it out?
The FBI Arrested them once they set foot on US Soil, and then hacked in to their computers to find evidence. (Which I would guess is also the usual course in an FBI investigation when direct seizure of the hardware is imposible).
I feel I must state that the FBI didn't ever break or violate the Hackers/Crackers Rights, because they don't have any. They aren't US citizens, or nationals, and as such the constitution doesn't apply to them. (Sux, but its true)
The FBI didn't have to Issue a warrent, because US search and siezure laws don't apply to them. (Soviets don't really have any as far as I know)
Thankfully I believe that Miranda (Arrest) Rights still apply to them because you don't have to be a us citizen to benfit from them, you only have to be arrested in the US.
The only thing the FBI might have flubbed is breaking Soviet and International Law for cracking in to the overseas PC's. But that would be for Russia to push, and would have little bearing in this case.
I feel real bad for those two, no matter what they did. They are stuck in the US legal system, and have No Constitutional rights.
Either way I think the FBI played this one fairly, the two hacker/crackers choose the weapons, and the FBI won the duel.
RA7
-
"Consistency is the hobgoblin of small minds" - RWE
There is nothing even vaguely like entrapment going on here. Entrapment is when a law enforcement officer commits a crime in order to encourage a suspect to commit that same crime, and then turns around and arrests the suspect when he does. For instance, if I'm a cop and I take you to the store and I shoplift something and say "go ahead, it's fun!" and then you shoplift something too, you Get Out Of Jail Free (tm) because I entrapped you.
Just tricking someone into revealing information about their guilt is not entrapment; it's simply a worthy and useful police tactic.
"Patriotism is your conviction that this country is superior to all other countries because you were born in it." -- GBS
IANAL, but once they were on US soil, the constitution would apply. Since what I have gathered from the threads so far (I haven't been able to get back into the article to confirm my skim earlier), the hackers came to the US, had their codes sniffed as part of a demo, were arrested and then the hacker's machines were hacked by the FBI.
Since this doesn't appear to be appear to be a national security issue, and the hackers were in custody where they couldn't "damage" or erase their machines, the FBI should have gotten the search warrent before hacking the machines.
Also, since the FBI hack of the Russian machines originated from the US (and particularly since it was knowingly extended into Russia), I think the laws of both nations apply.
did you make that up or did they change it already? $ whois invita.com Registrant: Invita Koekkener A/S (INVITA-DOM) Fabriksvej 20 DK-7441 Bording, DK Domain Name: INVITA.COM Administrative Contact, Billing Contact: Krogsgaard, Johannes (JK10757) invitajk@POST1.TELE.DK Invita Koekkener A/S Fabriksvej 20 DK-7441 Bording, DK Domain Name: INVITA.COM Administrative Contact, Billing Contact: Krogsgaard, Johannes (JK10757) invitajk@POST1.TELE.DK Invita Koekkener A/S Fabriksvej 20 Bording, 7441 DK 86861677 (FAX) 86861677 Technical Contact: UNI2 / Henrik Bo Hansen (UNI2-DK) domain@UNI2.DK UNI2 Gl. Koege Landevej 55 Valby DENMARK +45 77 30 10 01 Fax- +45 77 30 10 00 Record last updated on 09-Feb-2001. Record expires on 12-Oct-2001. Record created on 11-Oct-1996. Database last updated on 24-Apr-2001 02:37:00 EDT. Domain servers in listed order: NS.UNI2.NET 129.142.7.99 NS2.UNI2.NET 195.82.195.99
Won't the FBI now be violating any possible Russian laws then, and knowing the Russians, they'll come up with some elaborate scheme to make us look like a horse's ass.
Since the FBI are indeed hacking those crackers...this is shaping up to be an international incident.
Slashdot Hypocrisy at work?
Um, sorry, but there wasn't any 'hacking' involved here. The FBI sniffed their id's and passwords on a machine they gave to the Russian crackers and used the information to log into their own computers. I never knew that network sniffing was hacking...guess I better watch our networking people more closely!
Tyler
Back in the Good Old Days, one of the "agents" would then have peeled off his false rubber face to reveal that he was, in fact, Mr. Phelps.
Bait-and-switch huh? so if I lure a child into my house with a cookie, and then lock the door behind them, it's not kidnapping? That's ridiculous, the FBI is in the wrong.
If nobody ever re-invented the wheel, we'd all be pushing around flintstones cars, wouldn't we?
Note that my entrapement definition is the Canadian one, btu I think it's the same as with the USA. I'm seeing several challenges to this if the Ruskies have a good lawer.
Cue The Sun...
First of all, they might want to break into Bush's computer, since he is the President now (unless they're looking for Bill & Monica's Webcam Porn stash)
Secondly, there's got to be some other gov't agency that already monitors said computer, and some employee of said agency probably keeps a copy of those files somewhere less secure than the machine itself.
No, I don't think the FBI would help the Russians, but if they wanted to, they'd probably just give them an FTP address, rather than break into the machine all over again.
Nice! Please mod up, pretty please. Oh, how I'd love Russia to ask for the extradition of the FBI goons who've not only admitted to breaking a Russian law, they're actually crowing about it.
If you were blocking sigs, you wouldn't have to read this.
Hey, yeah, you're right! It's so obvious! So it's equally OK for Russian (Chinese, Iraqi, pick your own demonised nation) spooks to hack and crack boxen in the USA because it's convenient for them?
If you were blocking sigs, you wouldn't have to read this.
"...a bunch of Russian crackers" "FBI Does A Cracker..." Hey now!, there's no need to be racist. ;)
-
AIM: dpete455
Yahoo!: dpete455
Jabber: dpete455@jabber.org
http://www.archive.org/details/ThePowerOfNightmares
what a stupid point to make, and how unrelated to the topic.
A: None. The Universe spins the bulb, and the Zen master merely stays out of the way.
no, the people that CRACKED it should be arrested. nice to ignore all issues about personal responsibility...
'oh, since you left your window open to your house, and i stole your childrens' clothes, you should be arrested for child abuse...'
great point, bravo...
A: None. The Universe spins the bulb, and the Zen master merely stays out of the way.
the russian gov't should be concerned with it's deteriorating infrastructure and the collapse of it's currency
we're just arresting some known criminals, and were able to do it because they are fundamentally idiots (did you see the simpsons where homer 'won' the boat from the springfield police dept?).
hurray to FBI for protecting american citizens from criminals.
A: None. The Universe spins the bulb, and the Zen master merely stays out of the way.
here's the only problem:
-you're a private citizen
-they're law enforcement officers
oh, wait, that's all the difference in the world. your post made a nice little sound bite, but really fall flat when reality comes into play.
A: None. The Universe spins the bulb, and the Zen master merely stays out of the way.
last i heard, it was hit by an idiot chinese pilot....
A: None. The Universe spins the bulb, and the Zen master merely stays out of the way.
Falung Gong
US citizens (scholar) being jailed without charges
Gov't firing on and killing 2 in a village that refused to pay taxes they couldn't afford (at least we JAIL them here...)
oh... Tianemen square
Tibet
do i really have to give more examples of flagrant human rights abuses by the PRC?
A: None. The Universe spins the bulb, and the Zen master merely stays out of the way.
my bad. however, look at this article from the nytimes (you need username/pass), and you will see a good example of how economically free china has become:
B OXA.html
http://www.nytimes.com/2001/04/22/weekinreview/22
A: None. The Universe spins the bulb, and the Zen master merely stays out of the way.
I live in South Africa and this scares me. What is going to happen if this is allowed to set a precedent? Will the FBI and another American law enforcement agencies start hacking into computers and stealing data instead of trying to obtain search warrants? And what is to stop them hacking into my computer and stealing all my data if they merely suspect I am guilty of a crime? Where does it end?
The power of government must be held in check, unless the government is to be trusted. And that means trusting every money grubbing power hungry politician that seeks out a place in the structure. Now, I am not saying that every person that works for the government is evil, or even that every politician is. I am just saying that those who are most likely to abuse power are the same ones who will most diligently seek it out. Those that seek it out are the most likely to aquire such power. And that means that a signifigant number of the people in power are willing to abuse it. And even if that were not the case, I do not think that we should condone the government committing the electronic equivalent of unlawful search and seizure.
-CrackElf
"Blake is an idealist, Jenna. He cannot afford to think." - Kerr Avon, Star One, Blakes 7
Backup. It should not take 72 hours to recover the data. And, with a daily backup, you should loose at the absolute most 24 hours. Security and data integrity includes regular backups. Every IT department should be ready for data loss and data leakage scenarios. Because even if you catch the cracker, most of the time it is after the damage is done.
"Blake is an idealist, Jenna. He cannot afford to think." - Kerr Avon, Star One, Blakes 7
The point of my post is that a system administrator has to have the proper policies and prepare for the most unfortunate contingencies. It does very little good going after the cracker, because the damage is already done. Yeah, it would be nice, but are you really going to be able to arrest and convict all of the script kiddies out there? One should make their system robust. Both through keeping the physical and virtual security up to date and by enacting policies and procedures that will minimize the damage. Most of the security breaches that i have seen in my carear have not been some new, unheard of exploit, and could have been prevented, or at the very least, greatly minimized by the proper policies and procedures.
-CrackElf
"Blake is an idealist, Jenna. He cannot afford to think." - Kerr Avon, Star One, Blakes 7
It is interesting to see the double-standard with which the U.S. Government operates. I'm sure I would be prosecuted to high heaven if I tried to hack into Bill Clinton's computer to get the skinny on what went on between him and Monica. All your evidence is belong to US!
Well, it's nice to know that the the U.S. government prosecutes those that violate its laws by pretty much violating the same law itself. Lets face it: stating the word "secutity" in a sentence along with the word "internet" is an oxymoron (I know you could twist the words, but you know what I mean). I personally think that anything, ANYTHING should be allowed on the internet. These so-called security products that supposably protect people from 'malicious' hackers are often laughed at by the very people they try to intimidate. I'm not neccessarily siding with the russian hackers here. What they did was wrong and I'm not going to forgive their connivances, however, if the U.S. government is willing to make a provision that it can break its own laws to execute them, then we are heading down a dangerous path. Just look at the recent jailing of the woman who didn't have her seat-belt on. I don't think there's a single sane person anywhere in the world that would validate the handcuffing of a person who commited such a small crime. Now I'm getting off topic a bit, but lets face it, the U.S. clearly stepped over its own line when it reached into the heart of russia to illegally sieze evidence. They stomped all over Russian sovereignty because they were blinded by the prospect of getting a second 'big break' on the war on cybercrime. On a related note, we seem to be gaining an AWFUL lot of notoriety when it comes to our foreign policy / scare tactics: The recent China fiasco, the Peru incident, and this current story come to mind... P.S. Those of you who have gotten the 'eye for an eye' theory spinning around in your heads, I think we first have to PROVE that they did it to say that they are guilty. The way the press is spinning it, they are already as guilty as sin, but under modern law, they are not. Don't forget that or that will be our undoing.
In the end, I never existed.
Neither is the example of the ship firing from international waters, so long as the ship isn't acting under orders from a foreign government.
By your analogy, ANY arrest could be considered "kidnapping."
This is wholly outside the jurisdiction of any US state or federal laws. The only "laws" that do apply are international treaties, and I have yet to hear of any that forbids a nation-state from taking nessecary action to protect itself from outside threat.
If the US were trying to enforce Constitutional law outside its borders, then the Chinese and others are right: We really ARE hegemonic. And I'd hate to be part of the military that tries to enforce those laws on the rest of the world.
But what are they doing against US crackers hacking Chinese computers? ... That's what I thought.
They invited the Russian to use a computer with a keyboard sniffer, and then took all his passwords. They woudn't have needed to CRACK anything.
This seems mostly to have been social engineering, something which the FBI probably has lots of experience in.
Check it out the FBI defaced the hacker's web site.
Now that's just cold.
Two very interesting things in the article:
1) "After Ivanov arrived in Seattle, accompanied by Gorshkov, agents posing as Invita officials asked the men to demonstrate their prowess on a computer outfitted with "sniffer" software to record every keystroke. After arresting the duo, they used account numbers and passwords obtained by the program to gain access to data stored in the computers in Russia, Schroeder said."
Ok, so they brought them to the U.S., told them to log into their computers in Russia, sniffed the passwords, and then used the sniffed passwords to log into the Russian machines. This is hacking? Social engineering, maybe...
2) "The agents downloaded the data, but did not view it until they obtained a search warrant from a U.S. federal court, he said."
Now this is interesting. They don't need a search warrant to break into your computer, only to read what's there. Which means that breaking into a computer isn't search and seizure.
Does this mean that if I break into FBI computers, but don't look at anything, that I haven't hacked them?
Very, very interesting precedent...
It seems that the government has decided that although the constitution of the US holds the rights of an individual to be god given, god only gave those rights to americans. Everyone else is fair game. This truly bothers be! In the past the government got around this by creating a corporation to do the intelligence gathering (CIA, OSS, ETC.) Now they wish to do it them selves? What's next, "Sir your computer was on the internet and as you may not be aware, Computers on the net are open to search. The Founding fathers did not have computers when they wrote the constitution and could not have foreseen them. There for there is no right to be secure in your computer."
Next you know they will outlaw the constitution! OOPS they did that already. The constitution was written on himp paper and as most are aware himp is ILLEGAL in the United states.
That's like the fbi breaking into your house with blind folds on, and taking everything, then looking at your stuff once they got the search warrant (course that would never happen).
It's interesting....people that steal information and attempt to extort money OUTSIDE the US, claim they are protected because American rules don't apply. I guess it works both ways!
did the FBI suspect that they were invovled in this and cracked the computers to get the evidence? if so I would think that the Russian Government would be pist as hell.
:)
The FBI did not have a warent to serch the computers in russia.(as far as I can tell from the article)
I think the russian government sould arrest the FBI agents for Illegal computer activity
I am the Alpha and the Omega-3
if they're not protected by our laws because they are out of the country, how can they be prosecuted by those same laws? Laws are made to protect people (believe it or not), you should have a fair playing field. Their real arguement shouldn't be "well they're out of the country they're not protected by those rights", the truth is they're out of the country and the FBI has no jurisdiction to do what it did, but if they said it that way then they'd look like the villans.
Beware blue cats moving at
You impugn my honor, Sir, as well as the honor of evil_spork.
I have not seen the inside of a college dorm for years, having left the hallowed ivory halls for the greener but far more dull pastures of employment.
I will not demand an apology from a lowly AC, but would consider it apropos (mind you I mean not "man -k", but rather "fitting the circumstance").
A spork who is benevolent.
According to the "media pundits", all hacking is bad (refer to Ziff-Davis, etc. ad nauseum). Hackers are evil and dangerous. Now we have them working in our government, and in law enforcement, no less. Wonder how long it will take them to turn their "reverse hacking" techniques on the unsuspecting public?
The only good news is that I know several of these "in-duh-viduals" and they wouldn't be able to hack their way out of a wet paper bag with a chain saw. How they got lucky (or even if they did) with the Russian Hackers beyond me.
HDGary secures my bank