Judge Upholds FBI Keyboard Sniffing

mshiltonj writes: "Wired is reporting that keyboard sniffing can be used to catch "mobsters." I feel safer already. You can read the ruling. Here's a snippet: "This case presents an interesting issue of first impression dealing with the ever-present tension between individual privacy and liberty rights and law enforcement's use of new and advanced technology to vigorously investigate criminal activity. It appears that no district court in the country has addressed a similar issue. Of course, the matter takes on added importance in light of recent events and potential national security implications." Translation: Don't deny us this tool or you'll be blamed for us not catching terrorists." See also an Infoworld article. We have several previous stories on the Scarfo case.

Comments

Am I missing something?

[coltrane99]

As long as law enforcement has to get a warrant, I don't really have a problem with this..

Re:Am I missing something?

[cmowire]

Yes, you are missing something...

This ruling means that they don't need to get a warant to sniff, just a court order.

So it's not rampant abuse of the system, but the privacy people see it as the thin end of a wedge.

Re:Am I missing something?

[SlashRaid]

I believe these action would also make it easier to obtain a warrant. No probable cause just a need to. I'll search for that, I know it's here some where.

Re:Am I missing something?

[Kamel Jockey]

This ruling means that they don't need to get a warant to sniff, just a court order.

I believe the two are synonymous. You have to go to a judge to get a warrent to perform any kind of search or seizure. I don't believe that this lowers the legal standard.

Re:Am I missing something?

[agentZ]

Please read the article.

Previously, the FBI had to get a wiretap order, under Title III, which has to be signed by the Attorney General or the Deputy. In this case, the FBI was able to gather their evidence using only a search warrant, which any judge can issue.

The FBI's argument was that because the device only intercepted intra-computer communication (i.e. from the keyboard to the CPU) and not computer to computer communications, those communications are not protected by the Wiretap statute (18 USC 2518).

Re:Am I missing something?

[coltrane99]

I read it, it wasn't very clear on the legal difference between warrant and wiretap order. Thanks for the clarification.

Re:Am I missing something?

[Chris Burke]

The FBI's argument was that because the device only intercepted intra-computer communication (i.e. from the keyboard to the CPU) and not computer to computer communications, those communications are not protected by the Wiretap statute (18 USC 2518 [cornell.edu]).

Which is kinda like saying they can put a bug directly in your phone, because then it's only recording what's going from your mouth to the microphone, not phone to phone, and thus not a wiretap.

Granted, in a computer not all keystrokes are going to be transfered over the network, but how can you, the observing FBI agent, know which are which until you look at all of them? I can't see how you could possibly avoid looking at information (like a typed email) that should be require a wiretap order.

But then again, I'm too jaded and cynical to work up much anger when the FBI makes a grab for a little more power. One day my children will wake up and find themselves in a police state where you are born free until an officer of the law says otherwise, and no one will be able to understand how it happened because they won't notice that it has.

Re:Am I missing something?

[agentZ]

Granted, in a computer not all keystrokes are going to be transfered over the network, but how can you, the observing FBI agent, know which are which until you look at all of them? I can't see how you could possibly avoid looking at information (like a typed email) that should be require a wiretap order.

The FBI's tool took very careful steps to not record anything when the user was on-line. It checked whether the modem was in use, Internet Explorer was running, and a few other details. (That information comes from the EPIC web site, sorry I don't have a better link.)

I agree that you could argue that the user was typing an e-mail in Notepad that was going to become a communication, but the typing in Notepad is not, in an of itself, a communication. The actual e-mail leaving the system is a communication only.

Re:Am I missing something?

[dragons_flight]

While I don't know if their program works this way, it is possibly to write key loggers in such a way that they only capture keystrokes that are intended for a specific program. For instance, if I knew the details of the PGP program being used, I could record input only when it was the active window.

Re:Am I missing something?

[coltrane99]

While I agree that the FBI's argument is weak in that respect, it looks to me like the decision is fairly narrow in scope, though IANAL.

If you look in the ruling, you will find this at the beginning:

"The Court shall briefly recite the facts and procedural history of the case. Acting pursuant to federal search warrants, the F.B.I. on January 15, 1999, entered Scarfo and Paolercio's business office, Merchant Services of Essex County, to search for evidence of an illegal gambling and loansharking operation. During their search of Merchant Services, the F.B.I. came across a personal computer and attempted to access its various files. They were unable to gain entry to an encrypted file named "Factors." Suspecting the "Factors" file contained evidence of an illegal gambling and loansharking operation, the F.B.I. returned to the location and, pursuant to two search warrants, installed what is known as a "Key Logger System" ("KLS") on the computer "

Now, it looks from this as if the police asked for the right to install a sniffer to get the password for a specific encrypted file sitting on the filesystem they had gained access to in pursuing a legitimate search warrant.

I would say this is more closely analogous to getting the key to a locked file cabinet than to monitoring communications. As such, I would agree, the wiretap statute shouldn't apply.

Re:Am I missing something?

[Chris Burke]

I'm not convinced. An e-mail that is sent over the net is a communication, even if there is a delay between typing and sending. I mean, there is -anyway-. There's a period of time where the e-mail is sitting in memory, and until you hit "send" it isn't being communicated. Kinda like while the microphone is converting your voice to a digital signal, the phone is converting not communicating, so it should be okay to grab the audio at that point, right?

I'd say that, by definition, an e-mail is a communication whether or not it has been sent yet. Being e-mail implies the intent to communicate it, otherwise it's just a document. Given that, and the fact that they couldn't distinquish an email from anything else, I'd say a wiretap order should still be necessary.

Re:Am I missing something?

[Chris Burke]

Now, it looks from this as if the police asked for the right to install a sniffer to get the password for a specific encrypted file sitting on the filesystem they had gained access to in pursuing a legitimate search warrant.

I would say this is more closely analogous to getting the key to a locked file cabinet than to monitoring communications. As such, I would agree, the wiretap statute shouldn't apply.

It is like getting the key to a locked file cabinet, but to do so they tapped the guy's phone and waited for him to divulge where he hid the key. Wouldn't you need a wiretap order to do that?

The problem here is that, again, they can't tell if he's typing an email or his password until they see the keystrokes, but they record it anyway. If he was using that computer for e-mail, then there's really no way they couldn't have gotten those emails as well as the password.

Inevitably, they are recording communications, and as such I feel they should need a wiretap order. I can't see any fault with this principle.

Re:Am I missing something?

[agentZ]

Whatever you type on your computer is a document. In fact, this comment that I am typing to Slashdot right now is just a document on my computer (in RAM, on disk, whatever), until I click the "Submit" button and transmit data to Slashdot. The bits that go across the wire from me to Slashdot are a communication, and that communication is protected. Any prepatory work done before or afterwards is not protected under the law under 18 USC 2518.

Re:Am I missing something?

[Chris Burke]

It's not a software key logger, it's a hardware one. It's in the keyboard, and thus has no way to know which app has focus.

Not that I'd trust the FBI to kindly not capture keystrokes when I'm typing in Eudora, thanks. They -can- be capturing communication after installing this device, so they should have to get judicial approval to do so.

Re:Am I missing something?

[agentZ]

You won't find anything. They still need probable cause.

Re:Am I missing something?

[monkeydo]

If I am talking on the phone ordering a hit the FBI would need a wiretap order to intercept the phone call. I do not believe the FBI needs a wiretap order to bug a room, and therefore if I stood in the room practicing what I was going to say before I made the call they could record it.

From a strict legal perspective the fact that the keyboard logger *could* record communications that the warrent didn't cover isn't really a reason no to use the device. If the device did record any such communication, the communication and anything resulting from it's interception would not be admissable as evidence.

Re:Am I missing something?

[Anonymous Coward]

Its vegetarian.

Re:Am I missing something?

[Chris Burke]

Could they be bugging the room while you are on the phone without a wiretap order? That seems like a pretty obvious way to get around needing a court order.

From a strict legal perspective, the issue has already been solved, by the judge, barring any issues that come up in appeals. What I'm saying is that I for me, the principle I believe in is that the -could- is what matters, not the promise not to.

Plus, it's a lot tougher to have to prove in court that certain bits of evidence are inadmissible because they were obtained from communications vs non-communications captured from the keyboard rather than just saying you can't capture without a wiretap in the first place.

Re:Am I missing something?

[Chris Burke]

They key word (sorry) was /just/ a document. Obviously anything on the computer is a document of one form or another... But some documents are also communications. Communication means not only the act of communicating but the thing communicated. A letter is a "communication" even when not in the hands of a postal carrier, and so is an e-mail in a window. Defining it to only be a communication while being communicated is very limited, and not the usage in any other walk of life.

Whether this is what the law says or not really doesn't matter to whether or not it's true.

Re:Am I missing something?

[bob_jenkins]

The FBI's argument was that because the device only intercepted intra-computer communication (i.e. from the keyboard to the CPU) and not computer to computer communications, those communications are not protected by the Wiretap statute (18 USC 2518 [cornell.edu]).

Ah, so reading someone's diary is less of a privacy invasion than listening in on their telephone calls? I'm surprised that anyone would make that argument, much less be persuaded by it.

Re:Am I missing something?

[MyNameIsFred]

You're missing the point -- you need a wiretap to listen to the phone conversations, whereas you need a search warrent to read a diary. The FBI was NOT arguing that it was less of an invasion of privacy, they were arguing that a particular law was not applicable.

I'm reminded of a court case a few years ago. A man was videotaping his sexual escapades without the knowledge of the women involved. To their embarassment, he showed the tapes to his friends. There wasn't a law that specifically addressed his actions. So he was prosecuted for illegal wiretapping, AFTER the courts ruled that sexual intercourse is a form of communication.

Re:Am I missing something?

[innocent_white_lamb]

Ah, so reading someone's diary is less of a privacy invasion than listening in on their telephone calls?

Indeed. This short article was just posted at http://www.canoe.ca/CNEWSWeirdNews0201/04_diary-cp .html

Diary entry detailing car theft is woman's undoing

STRATFORD, Ont. (CP) -- A woman has learned that recording your crimes in a diary isn't a good idea.

The 37-year-old's entry into her diary detailing plans to steal a vehicle backfired when police who came to her apartment saw the open book.

"Guess I'll get ready to see what kind of car I can grab today," police quoted the entry as saying. "Hopefully one with lots of gas and extra cash for gas."

While investigating a report of a vehicle break-in on Monday, police followed fresh footprints in the snow to the woman's apartment, said Insp. John Hagarty.

The woman answered the door in her pyjamas and asked the officers if she could have time to get dressed, said Hagarty.

While the officers waited for the woman to change, they noticed an open diary on the kitchen table.
In an entry written shortly before the officers arrived, the woman stated: "Well so much for that idea. I got caught getting out of a woman's truck, she freaked."

The woman was arrested and the diary was confiscated as evidence.

Police have not released her name or the specific charges she faces.

Re:Am I missing something?

[Weaselmancer]

Finally an excuse to use my old Amiga!

The amiga keyboard uses a 6502 processor to communicate to the main cpu - a 68000.

That's computer-to-computer communication, and therefore protected by the Wiretap statute. Right? ;^)

Re:Am I missing something?

[Tackhead]

> I'm reminded of a court case a few years ago. A man was videotaping his sexual escapades without the knowledge of the women involved. To their embarassment, he showed the tapes to his friends. There wasn't a law that specifically addressed his actions. So he was prosecuted for illegal wiretapping, AFTER the courts ruled that sexual intercourse is a form of communication.

Well, at least that means "Fuck you, spammer" is protected by the First Amendment... ;-)

Re:Am I missing something?

[Anonymous Coward]

Not so. The KLS logged keystrokes only when all serial ports(modems) were inactive.

Re:Am I missing something?

[agentZ]

Ah, the key difference.

Active communications (e.g. e-mail in transit) are protected by 18 USC 2518. Stored communications that you're talking about, such as e-mails you've received, chat logs, and the like, are protected under 18 USC 2703. The rules regarding these protections, also sometimes called the Electronic Communications Privacy Act (ECPA) are rather complicated and depend greatly on the type of information, how old it is, and where it's being stored.

The differences active and stored communications can be summed up this way: To intercept an active communication, the government must show probable cause that the interception will yield evidence of a crime. If a federal judge agrees, he will grant a wiretap order, or authority. To obtain stored communications (e.g. connection logs, billing records, stored e-mail, etc.), the government must present probable cause to a judge, who can grant either a search warrant or a court order (also called a 2703 order). The type of records being obtained determines whether a court order or search warrant is issued.

Re:Am I missing something?

[agentZ]

Actually, it's a joke. I'm not a vegetarian, so I deliberately misspelled it.

Re:Am I missing something?

[agentZ]

Could they be bugging the room while you are on the phone without a wiretap order? That seems like a pretty obvious way to get around needing a court order.

Yes, they can pick up phone conversations while bugging the room. But! In order to get the authority to monitor the room, the government has to show probable cause that monitoring the communications in the room will give evidence of a crime. They can't say, "We'll be able to listen to the guy on the phone," becuase the judge will bitch slap them and say, "ask for a wiretap!" They have to show that people will be in the room talking and they they're trying to monitor that.

If such a legal monitor happens to pick up other audio information not origingally intended, but that is evidence, it is admissible. The same way that if any member of law enforcement is in a legal position and observes evidence of a crime, it's admissible. (Example: Guy calls the cops to say his TV was stolen. While the cops are in the guys house with him writing out a report, they notice a ten pound bag of crack on the table.)

(BTW, this is first really intelligible discussion I've been able to have on /. regarding these kinds of things. Thank you!)

Re:Am I missing something?

[xonker]

The problem here is that, again, they can't tell if he's typing an email or his password until they see the keystrokes, but they record it anyway.

But the email, if incriminating, might not be allowed in court while documents that were decrypted after gleaning the password would be. I think that's a key difference.

If the FBI had a judge's permission to search a filing cabinet, they wouldn't need trickery to get the key -- they'd be able to have a specialist simply pick the lock. When a document is encrypted using PGP, that's a bit more difficult.

While I'm all about protecting privacy, I'm also against completely handicapping law enforcement. Yes, there are some abuses, but let's face facts they're the good guys sometimes too. Defense attorneys get to use just about any means possible to keep evidence out -- evidence against some pretty evil people, mind you -- while LE is continually being handicapped further and further.

If this guy gets off, guess who the bad guys will be? The defense lawyer? Nah, they're "just doing their job." Scarfo? Nope, he just played the game. It'll be the FBI and the prosecutors who couldn't get charges to stick.

Re:Am I missing something?

[uberdave]

Hmmm. My communication is through an ethernet card, not a modem. My serial port is going to be fairly active because every movement of my mouse sends a stream of data.

This piece of hardware is the equivalent of mounting a video camera in the room, and should only be installed under the same guidelines.

Re:Am I missing something?

[Anonymous Coward]

It checked for whether the modem was in use

Maybe someone said this already and I missed it, or maybe no one said it yet and I'm cynical,
but how do we know that the key logger stopped logging when the modem was on? The judge
saw the proof? Does the judge grok source code? This is the point of the alleged
mobster's lawyers. Without the feds coughing up the source code and demonstrating beyond reasonable
doubt that it's the same code that was used, there's no proof that the alleged
mobster's Constitutional rights were not violated. It's an alleged mobster today
but it could be anyone of us tomorrow. Why trust the FBI to tell us they didn't break
the law? Aren't they denying just like the person they accused? Why trust a judge who
doesn't understanding technology any more than I understand law? (*ahem*)

Re:Am I missing something?

[Anonymous Coward]

>Whether this is what the law says or not really doesn't matter to whether or not it's true.

"Law" and "True" are perpendicular axes. The sumbitches are looking to stomp your ass with their jackboots, and you're scratching "true|false" in the sand. Big mistake. Hint: the guy with the spear wins.

The gentleman who lost a free and fair election to a dead man is getting even by stomping on your civil liberties. Won't make _that_ mistake twice, no sirree Dub.

Re:Am I missing something?

[gtg625a]

I would have to agree... but then again this is venturing into vary hazy territory. Seems to me that the question is very philisophic. Is a draft of an e-mail an e-mail even if you never send it, but you wrote it with the intention of sending it? Is piece of mail that sits in your out box but never leaves considered mail? The court system is going to have to be very careful with subjects like this if they do not want to over step their bounds.

been said before and will be said again

[booyah]

Those who are willing to sacrafice long term Freedom in exchange for the short term feeling of security will always ruin it for everyone.

Time to start using the movements of my eyes to signal changes on my computer

blink, blink, left, wink, blink, right, blink, squint

-Booyah

Re:been said before and will be said again

[Anonymous Coward]

Those who are willing to sacrifice long term grammar and spelling in exchange for sppedy post production will always give others headaches.

Re:been said before and will be said again

[Proteus Child]

Time to start using the movements of my eyes to signal changes on my computer

What is a variant of the copyrighted media protection technology was used to protect the keystrokes themselves to get around such a hardware device?

What if someone hacked a microprocessor into their keyboard just before the cable which would encryt the data leaving the keyboard before it hit the link, and placed a decrypting processor just behind the keyboard jack on their system, before the motherboard? Anything placed in between the keyboard and the computer, then (like a hardware-based keylogger) would recieve only encrypted information, meaning that either the keyboard itself or the case would have to be compromised to install such a device.

A keyboard could be sealed with epoxy or superglue. A computer's casing could be secured with a sizable padlock (in many cases.. hardware locks are nice things to have). Failing that, case intrusion switches (like some Dell workstations have, I know ours do where I work) or some sort of low-tech intrusion sensor (along the lines of the classic hair in the doorjamb) could be used to detect such an intrusion.

A major problem with recording the encrypted keystrokes is that there's now a very large amount of ciphertext which could then be analysed. And if the keys are always the same (there's no shift, probably not even a salt value of some sort, and transmitting it from the encryptor to the decryptor would require the cable, which is tapped in this scenario... chicken and egg problem).

Also, if someone were to go to these lengths to protect their keystrokes, the black ops team would probably notice these measures and try to disable them, at worst disabling the box entirely, at best removing said countermeasures quietly (if it can be sealed, it can be unsealed quietly given the proper tools/solvents and enough time). Such lengths would also be highly suspicious to said black ops team (paranoia cuts both ways), which could lead to other monitoring techniques being employed.

All in all, it's an interesting challenge to work on; in a sense it would be an arms race, in which the watchers have to become more crafty to get around the watchee's defensive tactics.

One thing I wonder about is whether or not someone being monitored notices the presence of the hardware device on their system.... a new adapter on a keyboard cable would not be difficult to notice at all, and it could then be removed and placed in a creative place (like in a library or a computer store.. I wonder how much They would like to read variations of All Your Stored Keystrokes...)

I think I just made it onto another 'watch this guy' list.....

Re:been said before and will be said again

[Hatechall]

I think most people here are trying to attach themselves to popular catch phrases and not see the real point.
You cannot walk around yelling "freedom at any cost!", because freedom is just part of the balance that makes our society what it is.
You obviously cannot give everyone all the freedoms in the world just because our culture tells us that freedom is all important. It has a place in society, like justice, restraint and safety.
If you truely believed that you cannot sacrifice ANY freedoms for safety; freedom to own tanks, freedom to spray bullets at Dubaya, freedom to fart in other peoples food, I think it would ROCK! But thats not the point. Society would end as we know it.
As for sayings, recognise this one?
A person's individual freedom to swing his arm extends only so far as the next person's nose.
It is for all of us as a collective society to determine where the next persons nose is.
So, even as importand as freedoms are (and BTW, I disagree with the Judges decision, too much freedoms are at risk, but thats IMHO), we can not go ballying around (HA! I just said ballying!) claiming that freedoms are the end all in everything.
There can always be too much of something, no matter how good it is.

Re:been said before and will be said again

[ichimunki]

I think it would be easier to secure the room than the computer hardware if we're going to be this paranoid. The keylogger only works because it is sneaky. If they can't get into the room without alerting you to the fact that someone got into the room, then you have defeated the sneaky part and will know better than to type your password before doing a security audit.

Re:been said before and will be said again

[innocent_white_lamb]

If you're "up to something" then you get a laptop and store the laptop in a secure safe when it's not in your immediate possession.

That should take care of things nicely, I would think.

Re:been said before and will be said again

[Anonymous Coward]

Very well stated. There seems to be a rather large contingent within the /. community that want to test the concept of freedom to the theoretical limits. When this sort of "hacking-away-at-it" types of testing occurs against a computer program, a buffer-overflow condition potentially results, and once identified, can be addressed and corrected. When this sort of "testing" occurs within society, oftentimes someone dies, and as a result, doesn't get another chance at "...life, liberty, and the pursuit of happiness" There is no addressing and correcting it, at least not for the people who've died. They're dead, and are probably gonna stay dead, even after the bugs get worked out.

I, for one, do not believe it was the intent of the founding fathers to construct a Constitution as shield for criminals, miscreants, and other delinquents to hide behind while inflicting harm on other citizens. Somehow, over the years, it seems the ACLU has twisted it into exactly that, and I find that insulting. The Constitution was designed to protect the law-abiding citizens from a tyrannical government. Over the last 220 or so years, its done a pretty damn good job.

Security of the citizens is a fairly important function of the government of any society. I believe the Constitution refers to this as ensuring the domestic tranquility.

I'm glad to see...

[mrroot]

I'm glad to see the courts upholding our rights to have unusual fetishes such as sniffing other people's keyboards.

If I remember correctly, J Edgar Hoover was the FBI's original keyboard sniffer.

Re:I'm glad to see...

[yatest5]

Nah, Hoover liked to suck keyboards.

B'dum tschhhhh

how do we protect ourselves?

[Sebastopol]

so we know they can now break in and install a device as well as slip in a trojan.

what solutions are there? as for software, i've seen one site about free-ware antivirus, but it was linux only (like linux needs av software!). it would be nice if there was open-source AV for windows. any pointers?

as for hardware, other than having intimate knowledge of your own hardware (always checking your keyboard cable connection and keeping your chassis open for inspection), i can only think of sealed, tamper proof computer chassis.

Re:how do we protect ourselves?

[SlashRaid]

Here's a pointer, Switch OS's

Sorry Sebastopol, I had to say it. Some one is going to.

Re:how do we protect ourselves?

[agentZ]

How is using a particular OS going to protect you against a physical device that sniffs key strokes? (i.e. something between the keyboard cable and the CPU.) They're commerically available now.

Re:how do we protect ourselves?

[Anonymous Coward]

Yeah, Linux will surely protect you from a keyboard tap. What a brilliant solution!!

Re:how do we protect ourselves?

[cscx]

what solutions are there? as for software, i've seen one site about free-ware antivirus, but it was linux only (like linux needs av software!). it would be nice if there was open-source AV for windows. any pointers?

Quit being a cheap ass, and go buy McAfee Viruscan for $29.99 at WalMart. You must be one of those guys with like a killer box and all, but you have to sit on an upside down cardboard box and eat ramen noodles.

Re:how do we protect ourselves?

[SlashRaid]

Never said it would. Just trying to humor myself at the expense of another post with flame to Microsoft.

Re:how do we protect ourselves?

[SlashRaid]

Flamebait, shame on me, myself, and..... U.

Re:how do we protect ourselves?

[Sebastopol]

Quit being a cheap ass, and go buy McAfee Viruscan for $29.99 at WalMart. You must be one of those guys with like a killer box and all, but you have to sit on an upside down cardboard box and eat ramen noodles.

Let me clarify: there has been quite a bit of press about NAV and McAfee supporting the FBI backdoor, that is: letting the fed's virus slip by undetected. The reason why I asked about freeware should be obvious at this point.

Now back to my oh so tasty Ramen... ;-)

Re:how do we protect ourselves?

[Anonymous Coward]

That isn't flamebait. This is flamebait:

Linux is, at best, a toy operating system. At worst it is the kind of subversive force in America that Stalin only dreamed of creating.

There are "cells" reporting to unknown leaders that only go by names like "L33t_Kernal_Hax0r" that cannot be located - after all, "living in my momma's basement cause I have no real world skills to speak of" is not a true street address.

There is the Marxist concept of "give what you can, take what you need." Only, none of these people can give anything, excepting the few heroes of the revolution that have their own roach filled apartments and must give blow jobs in parks monthly to meet their rent. Yet, they all feel the need to take, take, take. MP3s? "We must have them! It is about freedom for the artists!!" Software? "We must have it for free! It will be good then!!" Movies? "Yes, we must have them for free!!!" Of course, the dirty secret all of these "give it to me free!!!" people are trying to hide is that they have no resources to actually acquire anything legitimate, due to their pathetic skill set and the fact that society has no use for them.

Society, in fact, had no use for them even during their formative years. That's why their lunch money was stolen. Darwin's law was trying to assert itself, but overprotectively indulgent parenting prevented such a thing from happening.

Re:how do we protect ourselves?

[cscx]

Why should you be worried about Magic Lantern? Are you a terrorist?

Re:how do we protect ourselves?

[cetan]

I think the FBI should keylog trolls like you.

Re:how do we protect ourselves?

[Sebastopol]

Why should you be worried about Magic Lantern? Are you a terrorist?

In cause great terror in the eyes of small minded right-wingers, but in the popular sense: no, I am not a terrorist.

Remember that on a whim Ashcroft made most people on /. terrorists overnight.

Re:how do we protect ourselves?

[Anonymous Coward]

Remember that on a whim Ashcroft made most people on /. terrorists overnight.

How? You'll also have to explain the "on a whim". The government has reams of data on how to fight terrorism. Reports and analyses galore... a "whim" is what you're on when you decide to try pineapple on your pizza or shave your head.

Re:how do we protect ourselves?

[dasunt]

Have a program that puts the keyboard on the screen when you type in your letters, with the keys arranged randomly. By using either the mouse or the keyboard then, you can "type" in your password immune to the keylogger. (Although, they still have password length - so remember, long, secure passwords, people).

Now we've caused the need for video loggers. :) Well, at least the memory required for video logging is a lot greater then the memory required for keyboard logging.

Re:how do we protect ourselves?

[Pinball Wizard]

Zdnet, of all places, actually just put out an article covering how to protect yourself against hardware keystroke loggers.

The author, David Coursey, has been hit and miss with his articles, but when he gets it right, he's pretty good.

Re:how do we protect ourselves?

[Anonymous Coward]

I think it should be the other way around as the sniffer is in software. We should have a blackbox sitting between keyboard/mouse and the computer encrypt the keystrokes. This data stream gets redirected and only decrypted at the application you are using.

Re:how do we protect ourselves?

[Jace of Fuse!]

Quit being a cheap ass, and go buy McAfee Viruscan for $29.99 at WalMart.

Why?

I don't mind commercial software, and I would pay much more than $30 for a good antivirus program, but the fact is, McAfee is bloated and ethically challenged, kind of like the operating sytems it runs on.

Norton isn't much better.

An Antivirus program should be small. It should take up little memory and only be as big as is needed to do the work. It's functions should be non-obtrusive and every function should be optional. It should not have compulsory splash screens or animations, or sounds, or any other "glitz" to make it look more like a multimedia extravaganza than a utility.

I used to recommend Innoculate IT Personal until it went commercial, and even still I recommend it for those willing to pay.

Now I recommend AVG, from http://www.grisoft.com It's fairly small, it's free for personal home use, and it's effective.

As for the FBI Spyware crap -- I don't know if AVG reports it or not, but at least if it doesn't, it's not like you PAID money only to be betrayed, which is something I can't say about McAfee.

Re:how do we protect ourselves?

[cscx]

I disagree. I don't want to start a flame war about AV programs, but McAfee has its good points. It's not as 'bloated' as you think. However, Norton sold out. I used to be a die-hard Norton user. Then they started to add all that 'glitz' you mention. Not necessarily so bad, but it did get more bloated; I liked v. 4.0 myself. However, then they basically crucified themselves when they demanded a yearly subscription fee to use their updates. Does that scream 'sell-out'? Well, I screamed 'fuck you' and went to McAfee. Underneath the window they call a 'menu' (yes, that's what it's called, I'm not sure what you define as 'bloat') is still trusty old VShield, in its original form. The update tool just downloads the SuperDAT exe, and bam, you can upgrade. I've set it up on a network before, and it's a breeze to update through a batch file in the login scripts. Oh well, to each his own.

Re:how do we protect ourselves?

[sholton]

Why should you be worried about Magic Lantern? Are you a terrorist?

No. I am not a terrorist.

<HYPOTHETICAL MODE=ON>
I'm a candidate for public office. I'm God fearing and I love my country. I'm honest (yes, really) and my political views are exactly in line with yours. You would surely vote for me.

However, the party currently in office is corrupt (the result an electorial mistake in the last election); it's no secret, everyone knows it and acknowledges it. A majority would surely vote the corrupt incumbents out. But the incumbents have no intention of allowing themselves to be voted out of power.

The problem here is that every time I contact my supporters to discuss election strategy or try to point out a weakness in the incumbent party platform, the opposition seems to know about it instantly, and takes immediate steps to counter the strategy or have the weaknesses covered up.

Consequently, the "honest" party has been unable to mount an organized attempt to retake political power in this arena.
%lt;/HYPOTHETICAL MODE=ON%gt;

It's a deadlock situation, like screwing up your LILO install, and not being able to fix it because you can't boot.

I realize your comment was meant to be flip and funny, but there's real danger here. There are some political philosophies which define any activity which doesn't promote their power as "terrorist". A democracy must be able to defend itself against such an incursion. We've done a good job of selecting those checks and balances, but it's not a foregone conclusion.

Re:how do we protect ourselves?

[Anonymous Coward]

Your program can also require a random number of garbage keystrokes scattered in the real ones (prefix, in-the-middle, suffix). Thus not even the length is intercepted.

Important point

[wiredog]

armed with a court order

I don't see anything wrong with the police searching, or spying on, someone if they first get a warrant.

Re:Important point

[FFFish]

Are the police allowed to break into your home and plant "bugs"? Are they allowed to sneak in, read your snail mail, without your permission or knowledge? Can they pop the lock on your car trunk, riffle through its contents, all without you knowing?

If they're already granted rights like this, then I suppose the keyboard bug isn't much different.

Re:Important point

[gorilla]

It would be ok if the judges are actually limiting the warrents they approve. Unfortunatly it's seeming like judges are just rubberstamping anything put in front of them. If the reason for the search is 'an informer told me', then it should be rejected.

Re:Important point

[Erasmus Darwin]

"I don't see anything wrong with the police searching, or spying on, someone if they first get a warrant."

That's all nice and good, but just to clarify, you quoted text about the FBI being armed with a "court order" as opposed to a "search warrant". It's my understanding that a search warrant has a higher standard of justification that must be met before a judge may issue it.

Re:Important point

[Anonymous Coward]

on about line 15, or so, the ruling says"Acting pursuant to federal search warrants" - they had search warrants, not court orders.

Re:Important point

[Anonymous Coward]

On about line 16 the ruling says: "the F.B.I. returned to the location and, pursuant to two search warrants, installed what is known as a "Key Logger System" ("KLS")" - again with the warrants.

Re:Important point

[Happy go Lucky]

It would be ok if the judges are actually limiting the warrents they approve. Unfortunatly it's seeming like judges are just rubberstamping anything put in front of them. If the reason for the search is 'an informer told me', then it should be rejected.

There basically are no search warrants that are based entirely upon the four words 'an informer told me.'

The last time I used a confidential informant to support a search warrant, it took me about twelve pages to write the affidavit in support. It was more like "This person informed me that the house at 12345 Bullshit Lane contained over one pound of methamphetamine, and the laboratory and materials commonly used to manufacture methamphetamine. He stated that he knew this because...."

If a private citizen with no personal involvement is willing to go on the record with the above, that may or may not be a complete affidavit right there. If the private citizen is going on record and his statement contains facts which work against his penal interest, then it's almost certainly enough. Something like "I know the meth is there because I helped to make it."

Unfortunately, I don't seem to get that lucky. In the case I'm talking about, my informant didn't want his name mentioned and I had to take a different tack. What I did was I stated in the affidavit that this informant had provided me with important information in sixteen prior cases, that the information was material and was not common knowledge, and that the information had proven correct on every occasion. I then took about ten of the twelve pages and outlined each of those sixteen cases to establish my informant's credibility to the judge.

Even if a judge issues a warrant on a faulty affidavit, it can be suppressed by the trial judge. If the supporting affidavit doesnt contain probable cause within its "four corners," then it's easily-attacked at trial.

But then, it's always fun to watch a bunch of /. people watch a Law&Order re-run, read some ACLU junk mail, and suddenly know everything about what the cops do or don't do.

Hmmm, now I foresee a bunch of ethnic

[Hairy_Potter]

looking, muscle bound, gold chain wearing, shiny suited tough guys buying laptops at Best Buy.

They had a court approval, but...

[Marx_Mrvelous]

In my mind the real question isn't about the keystroke recorder, but the fact that the govt. let them essentially break-in and secretly install it. Yea yea, he's a "known criminal" in our innocent until proven guilty state, but this mean that they can use the same tactics on *anyone* not just criminals.

It definitely bothers me.

Re:They had a court approval, but...

[agentZ]

The FBI still had to obtain a search warrant. That means they have to go before a judge and show that there is probable cause (i.e. enough information available to convince a reasonable person) to believe that such a search will yield evidence of a crime. The FBI can't just do this willy-nilly. They have to get a judge's approval first.

Re:They had a court approval, but...

[Kamel Jockey]

In my mind the real question isn't about the keystroke recorder, but the fact that the govt. let them essentially break-in and secretly install it.

Interestingly, we (the USA) used the same tactic to steal classified information from the Soviets during the cold war. A (separate) camera was installed inside the Soviet embassy's photocopier which took pictures of every single document which went through the copier. A "service personnel" would then come and remove the film and the USA would immediately have perfect copies of numerous Soviet documents.

But back to the topic, the government would still need a court order to do these things, meaning they would have to convince a judge that an investigation would be imperiled if they did not do these things. My assumption is that this ruling would also extend to the exceptions granted the government to pursue a search without a warrent, as is allowed in "hot pursuits", "honest mistakes by the police", "evidence in plain view", etc.

Re:They had a court approval, but...

[Anonymous Coward]

Yea yea, he's a "known criminal" in our innocent until proven guilty state, but this mean that they can use the same tactics on *anyone* not just criminals.

Yeah, the government's just itching to find out what porn sites you whack off to. Then The Plan will be complete.

Re:They had a court approval, but...

[arkanes]

Of course, it's more or less an open secret that wiretaps are often done without a wiretap order, and the order is either gained after the fact, or just never at all. And with a sympathetic judge (and don't think that the FBI doesn't know which ones to call), you can get a search warrant on vanishingly little evidence. Of course, the evidence from the search may get tossed in trial, but trial evidence isn't neccesarily what they need, either.

Re:They had a court approval, but...

[jeffy124]

slight clarification:

What you describe at the former Soviet Embassy would not require a court order. The Embassy is Soviet land, and is not subject to the laws of the United States. Hence, the US didnt need a court order to plant a camera in a copy machine at an Embassy, just the authorization from officals at the CIA. Now if the "repair man" was caught by Soviet officials -- he would be tried for espionage in Moscow.

The court order the FBI had is only needed when dealing within the US, regardless of the investigatee's nationality.

Re:They had a court approval, but...

[agentZ]

it's more or less an open secret that wiretaps are often done without a wiretap order

Really? If an agent runs an intercept without court authorization, they are personally liable for civil damages for running an illegal wiretap. If you know of this happening, you should contact your local US Attorney's office. For more information, check out 18 USC 2520, which says, in part, "any person whose wire, oral, or electronic communication is intercepted, disclosed, or intentionally used in violation of this chapter may in a civil action recover from the person or entity which engaged in that violation such relief as may be appropriate" and then goes on to spell out civil penalties of "the sum of the actual damages suffered by the plaintiff and any profits made by the violator as a result of the violation; or statutory damages of whichever is the greater of $100 a day for each day of violation or $10,000."

Re:They had a court approval, but...

[Kamel Jockey]

Definitly true, no court order would be required in this case... I just thought it'd be an interesting (although moderately off-topic) story to point out.

Re:They had a court approval, but...

[Anonymous Coward]

If there is probable cause without a wiretap, then they should be able to gather proof of criminal activities without one. This disturbs me greatly.

Re:They had a court approval, but...

[Anonymous Coward]

And the state of Idaho found out that a federal judge was more than willing to absolve FBI sniper Lon Horiuchi in the murder of Randy Weaver's wife at Ruby Ridge when they tried to prosecute him. The federal judge refused to allow Horiuchi to stand trial on the basis that he was acting under direction of the government, regardless of whether the action was legal or not - the same "just doing his job" defense that the Nazis attempted to employ after WWII.

I think you'd find the same kind of government blanket protecting any other agent that was found to have performed an improper wiretap, regardless of what the U.S. Code says.

Re:They had a court approval, but...

[gilroy]

Blockquoth the poster:

Really? If an agent runs an intercept without court authorization, they are personally liable for civil damages for running an illegal wiretap

Does anyone have any stats or stories about law enforcement people being busted under this? I'm not being argumentative -- believe it or not -- but it'd be handy to see if this sort of legal protection is actually effective.

Re:They had a court approval, but...

[arkanes]

I'll try to find some when I'm not nursing a serious migraine, but there were quite a few posted in one of the stories about the USA act.

Linux Support?

[peterdaly]

What are you worried about? I doubt they were cluefull enough to make a Linux version of the sniffer. ;-)

-Pete

Re:Linux Support?

[Anonymous Coward]

I doubt they were cluefull enough to make a Linux version of the sniffer.

That's true, if you happen to run Linux on a computer that doesn't have a keyboard. But if you use a AT/PS2/USB keyboard, you're fucked no matter what OS you use.

Time for encrypted protocol between keyboard and OS.

Re:Linux Support?

[malxau]

Just make sure you do all the things that Linux users are good at - root passwords that are difficult to guess, leave your PCs logged off when not in use, yaddayadda. It would be very difficult to install a software keyboard logger on a secure OS.

i l o v e t h i s c o u n t r y

[undecidable]

i w o u l d n e v e r d o a n y t h i n g b a d a g a i n s t t h i s c o u n t r y. o u r g o v e r n m e n t a l w a y s m a k e s t h e r i g h t d e c i s i o n s.

Re:i l o v e t h i s c o u n t r y

[Anonymous Coward]

Flame bate? Is the sarcasm lost to you?

Keyboard sniffing, anthrax, and the media

[DonkPunch]

One of the more interesting things about the recent anthrax terrorism is the presence of anthrax on the first victim's keyboard.

The unfortunate victim died as a result of inhaled anthrax. Spores were found on both his keyboard and in his nasal lining.

Now, I ask, since most people touch their keyboards with their fingers (rather than their nose), how did the spores get from his nasal passage to his keyboard?

Is it possible the contamination went directly from his nasal passages to the keyboard? Could keyboard sniffing already be a widespread practice amongst people in the press?

It's certainly something to think about.

Re:Keyboard sniffing, anthrax, and the media

[I_redwolf]

Simple, the first victim touched the keyboard and then wiped their nose, this allowed the Anthrax spores to be spread through the nasal cavity. It's really a brilliant way to distribute Anthrax if you have a specific target. How many times a day does one touch a keyboard in his/her work place and how many times does the same person wipe their nose?

For me, I'm always at my keyboard and probably wipe my nose very infrequently and I might even do it without noticing but the Anthrax spores will still be there for a while it's not like they die off in 5 minutes so I eventually will wipe my nose and be infected by Anthrax.

Re:Keyboard sniffing, anthrax, and the media

[Syriloth]

Perhaps even more interesting, if the unfortunate victim was using the keyboard normally, how did the anthrax get from his fingers to his nose?

Oh, wait...

Re:Keyboard sniffing, anthrax, and the media

[SlashRaid]

It's believed by some the letter was opened over the desk at witch the key board sat. The dust filled the area when the letter was opened and the the keyboard collected the dust.

You can get the same great effect with coffee to.

Now how did it get to the Nasal passage?

A: Inhalation during the tme the letter was opened.

B: Strange smell from desk, checking area by sniffing with nose.

C: Type. Insert finger to nose. Examine finger. Repeat as needed.

Re:Keyboard sniffing, anthrax, and the media

[kindbud]

"Wipe" of course, is a euphemism for "pick".

we need separate phone lines

[perdida]

separate wires and trunks and routers and networks, to be free. We need a geographically distributed Intranet that is incapable of connecting to the Internet, where the FBI can snoop using Magic Lantern or any other tool it wants.

The government wants to protect its corridors of free information and commerce instead of its borders, or territory. This redefinition of sovereignty is really a justification for imperialism.

If one accepts that logic, though, the only thing to do is to create a sovereign and inviolate internet, separated by an airwall from the Internet. Info between the two can be carried via disks that are rigorously scanned, if necessary.

I can't wait to see some secret cables being dug and laid by freedom-loving people.

Re:we need separate phone lines

[Have Blue]

If you keep the cables a secret, expect them to be severed almost daily.

Re:we need separate phone lines

[Anonymous Coward]

Well, try using a mixture of VPNs, wireless connections, fibre strung along fences and of course, Cisco's new Long-Range-Ethernet technology....10Mbps over Cat1, 2 & 3 (regular old POTS lines)!!

Re:we need separate phone lines

[delta407]

Well, there's the IPv6 network -- which is (to some extent) "incapable of connecting to the Internet".

However, as long as there is public access to this "geographically distributed Intranet", the government can and will get access. They have legal authority over the land that your cables use, the frequency ranges that wireless solutions run through, and even the upper atmosphere where you send your satellites.

With that Legal Authority (whether or not it's actually legal according to the laws), the goverment can snoop on this network. They could install monitoring systems on your major backbones. Heck, the people that lay your cables and send up your satellites can do that -- you can trust no one. If you trust no one, it's not a public network; it's a network of one.

Re:we need separate phone lines

[Bonker]

I can't wait to see some secret cables being dug and laid by freedom-loving people.

Contractor: Hey, boss. I hit some sort of electrical cable at two feet.

Foreman: Was it flagged?

Contractor: Uhhh... no. All the flags for telco, electric and cable are over there. *Points*

Foreman: Keep digging.

Seriously, if this sort of thing could even take off, it will be via wireless connections.

Re:we need separate phone lines

[Anonymous Coward]

I am very interested in this plan. I have established my own autonomous nation-state in the woods of Idaho, where I can be free of persecution carried out by governmental and corporate entities. I attempt to use only home-made products (my property is defended by a number of ingenius home-made defense systems), but I must use a satellite modem in order to connect to the Internet. I am a member of a few important groups which communicate only through the web, so Internet connectivity is essential.

However, this requires me to (1) give an address for billing to a corporate entity, possibly allowing me to be detected and/or tracked, and (2) use a product made by those whom I publically condemn. In addition, I am very concerned about a satellite pointing at my home. I've bought the system (using it now), but if I see a single taxman or black helicopter, I'm going to be pissed. I like your thinking though. We need a free net for a free people.

Installation

[syrupMatt]

I'm sure others will notice this, but how exactly does the installation of the sniffer take place? Since there is no warrant, and only a court order, do the authorities have the legal backing to "break and enter" a computer to install the sniffer? Is a computer awarded the same rights as a physical place (i.e. apt, home, etc...)?.

Also, if the sniffer is sent as a trojan'd email or program, could this lead to entrapment defenses based on the enticement used in the delivery method?

Re:Installation

[dperkins]

It is important for law enforcement to have the tools at their disposal to be able to properly investigate crime and gather evidence. The question becomes how much we trust Law Enforcement. I certainly don't trust any branch of the government that isn't overseen by another. For an investigative agency to be able to use some method of surveillance without oversight by the Judiciary is a grave concern given the recent attention brought to FBI corruption, scandals, ineptitude, etc.

Why don't we have our law enforcement and investigative agencies cleaned up before we give them sweeping new powers?

Re:Installation

[syrupMatt]

Why don't we clean up our authorities before we give them broad new powers? Simple answer.

The fact is that perfect authorities who are "untouchable" and never err will never exist in the world due to the fact that they are products of an imperfect society. Do we expect all people everywhere to be never wrong in their judgement of others? Then how can we expect the few that we give power to to be any better than the collective world that they come from?

Of course, this could be seen as the beginnings of an anarchistic rant, but just understand, the key is in oversight and accountability, not constant cleansing of the people we entrust with the application of our rights.

Re:Installation

[RobertGraham]

In the Scarfo case, the FBI entered in a "black-bag" operation (breaking-and-entering the building) and found the encrypted file when they physically accessed the computer. They broke in a second time to install the keylogger. They had valid warrants under current U.S. law in order to do this.

In the Magic Lantern system, they propose either hacking into the machine from the Internet, or more likely, install a transparent proxy at the ISP that attaches a trojan to any .exe the user downloads from the Internet.

Re:Installation

[Elvis Maximus]

1) The court order authorized them to use "intrusive methods" to place the device.

2) As I understand entrapment, the action the defendant has been enticed into has to be (or lead to) what they are being charged for.

Re:Installation

[philologist]

I believe the ``anti-terrorist'' (Patriot Act) legislation proposal that President Bush
is currently supporting will allow more of this kind of activity. Here is
an article on the bill from LA Weekly. It's about a month old, but I don't think much
has changed since then.

System Security

[Wanker]

Sounds like another good reason to make sure your systems are secure if both the white and black hats are trying to break into our systems.

Here are some excellent step-by-step instructions on securing Linux, Solaris, and NT.

Re:System Security

[Anonymous Coward]

Everywhere I look, people keep talking about securing their OS. Don't you people understand that securing your OS does diddly squat to protect against keystroke loggers?

I'm not saying that you shouldn't secure your OS or choice - you should, obviously. However, touting OS security as protection against keystroke sniffers (the point of this article) is completely irrelevant. The keystroke sniffer sits somewhere between your keys and your CPUs keyboard port, whether it be USB, PS/2 or whatever. How the hell do you expect OS security to solve that? Encryption? No, your key will be logged as soon as you type it? Hardcore passwords? No, see encryption.

Re:System Security

[Wanker]

The idea is that if you have a secure OS it's MUCH harder to install the keystroke logger in the first place. The article spoke about the FBI using known holes in browsers, E-mail, etc. to install their logging utilities.

If these holes have been plugged, they'll need physical access which then requires (I hope!) a warrant.

Yes, they can

[wiredog]

If they get a warrant first.

Hardware keystroke sniffer

[Nonesuch]

For example, the KeyGhost is a hardware dongle that records keystrokes. Requires physical access to install.

I've actually seen similar products for sale at $99 in consumer electronics catalogs as a way to catch your kids surfing porn.

While I have not (yet) seen equivalent products for USB on the market, sniffing USB is even easier than PS/2.

Re:Hardware keystroke sniffer

[RadioheadKid]

While I have not (yet) seen equivalent products for USB on the market, sniffing USB is even easier than PS/2.

I'm sorry, I just get annoyed when people say things about which they have no idea. What part of sniffing USB is easier? The hardware would be much more complex. You have to identify which frames belong to the keyboard and not the printer, scanner, mouse etc. if you are using a hub. There's a lot more information to process and if you want to process it later, then you have to store a lot more. I don't see how it's any easier, actually its harder. PS/2 on the other hand is a very simple protocol, very simple hardware can process it.

If you were perhaps talking about the software level, you still have to hook into the keyboard drivers, the USB or PS/2 stuff is abstracted to the keyboard driver, so on that level they are about the same degree of difficulty. And actually, sniffing linux is pretty easy too, I'm sure the FBI could do it, granted they would have to recompile the kernel since the keyboard stuff is usually not a module, but very do-able...

Re:Hardware keystroke sniffer

[Anonymous Coward]

Radiohead is, quite possibly, the worst band ever.

Re:Hardware keystroke sniffer

[Anonymous Coward]

Dumbass. You can tell if a USB device is a Human Interactive Device (HID) and once you know that, you can check if it's a keyboard.

Re:Hardware keystroke sniffer

[RadioheadKid]

No crap, but my point is it takes a lot more hardware (i.e. logic, i.e. gates) to differentiate between, interrupt, isocronous and bulk frames, and furthermore to tell which device it came from, instead just loging PS/2 data, which you know comes from the keyboard...

Thank GOD!

[kitts]

I just know Bin Laden and his evil computer hacking cronies are pissed off about this. Way to go FBI!

Pshaw! Who needs to detect bombs in shoes when we got THIS. Al Quaida, we ownz joo, baby!

I don't see what all the fuss is about

[mr_gerbik]

Who cares is the FBI smells my keyboard? It prolly just smells like sweat and doritos.

What kind of sniffer?

[Halloween Jack]

If it's a bit of hardware that actually goes inside the box, then even things like carrying your boot disk (a la iPod) or keyboard with you wouldn't necessarily keep them from bugging your system. You'd have to pull apart your machine to check, every time you used it, and know what you were looking at.

Of course, if you only used your laptop or portable/"belt-top" wearable systems, and kept it with you constantly, even sleeping with it, then all this might be a moot point.

*ahem* Not that I'm actually thinking about doing something like that, or would have any reason to do so, Mr. G-Man. Heh.

Re:What kind of sniffer?

[CDWert]

I look in mine on a weekly basis , dont you ???
Seriously, Ive had STTTTRRAAAANNNGGGEEE things happen before. I have had my root password no longer work on a development box with NO network capablity, and other strangeness, sites in cache I was out of town on those dates (for real), Actually im in my machine doing something or another on a weekly basis so I look around. For a time (2 years) while working on some projects and this strangness was happening I had my work area monitored by camera after a couple too many odditied for a home dev enviroment and a guy that lives alone and owns his house(no landlord issues)

I do and have done things on my machine that I am certain MANY people would love to get their hands on, nothing Illegal certainly, but all kinds of stuff, govt projects that made their way home as weekend work, you name it. Hell we had a competitor of one company going through our employees trash (no shit) we found this out when we hired one of their developers....

Checksums, visual inspections, swap keyboards and mice periodically. Its all good security, NEVER network in any way a box with secret squirrel quality data. now if all you have on your system is a bunch of Quake levels and porn who gives a crap.

Who was it said "Youre not paranoid if people really are after you" ???

next up to bat

[Anonymous Coward]

un-sniffable keyboards
sniffer detection systems
etc..

Active and passive wiretapping

[2Flower]

The real danger here lies in how wiretapping is shifting from being an activity you need to actively monitor via an external resource, and is becoming a self-contained object you drop into the suspect's house and fetch later. The latter you only need a court order. The former you need a full warrant.

Until a judge figures out that loggers and tappers are basically the same thing with two different methods of planting and unplanting, this ruling will stick, unfortunately. And once voice recorders are small enough to be plantable devices without any active collection needed (or video recorders, or combination video and audio and keystroke and data packet sniffer and so on) then little black boxes can sneak into anyone's home on thin suspicion.

Re:Active and passive wiretapping

[Proteus Child]

... self-contained object you drop into the suspect's house and fetch later.

What happens if the black ops team is caught in the act by the owner of the house/box in question? Try explaining that one.. especially if the suspect calls the local police.

Re:Active and passive wiretapping

[delcielo]

The fact is that this isn't as simple as saying it should be considered a "wiretap" or a "search." What we need is for the law to catch up to technology and say "This is a keyboard sniffer, and you need X to implement it."

In lieu of that, all sides are proposing whatever will result in their victory. It's hard to blame either of them for the positions they've taken.

Re:Active and passive wiretapping

[gilroy]

Blockquoth the poster:

The fact is that this isn't as simple as saying it should be considered a "wiretap" or a "search."

In one sense, it is. Not that a keyboard sniffer is a wiretap, but that it is held to the same standard before being granted. I think it's perfectly legitimate to search for analogies to the procedure in question. In effect, the defense is saying, "This is as worrisome and intrusive as a wiretap, with similar potentials for abuse, and therefore should be restricted in the same way." Since the wiretap law exists, has lots of case law, strikes a workable balance, and is familiar, why not piggyback on it?

Of course the defense is proposing something that will lead to their winning. That doesn't make their argument invalid or their reasoning bad.

Watch for an increase of sales in

[kawlyn]

Smart card readers (for your key), and voice dictation software. A keyboard logger can't work, if you don't user the keyboard.

Re:Watch for an increase of sales in

[CaffeineAddict2001]

Keyboard loggers arn't necessarily software, so they would just need physical access to your machine. I wouldnt be suprised if they have keyloggers that look like the little rubber nubbies on the bottom of keyboards and laptops. As for speech software, they would just use a normal bug in that case. =)

Making the details known to the populace

[adamy]

The US has the concept of the citizen/soldier. Basically, the average citizen is required, when called, to provide for the common defense.

While police are not the military, they are still providing for that common defense. Why should anything be reserved to a government agency, and kep away from the people at alarge? Isn't this a government of the people, by the people, for the people? A lifetime membership oin the public beauraucracy [sorry for my spelling] is a frightening thing.

I'm starting to think the ancient Athenians had it right.
Public service there was should be involuntary, random , and short.

I am a former Military officer, so no need to tell me about military secrets and stuff like that. Far more of our offensive ability comes from our advanced manufacturing power than scientific advances on the US has. I've served my time, and have now returned to the (server) farm.

Re:Making the details known to the populace

[Anonymous Coward]

If you will not cease this seditious talk at once you'll find yourself facing a military tribunal very soon.

At the time of war this kind of talk cannot be allowed.

Re:Making the details known to the populace

[adamy]

What is off topic about commenting on the article.

Remember the part where they said that the details of sniffing devices can't be released?

The 4th Amendment is alive and well

[alen]

contrary to /. belief. It specifically states that law enforcement needs a search warrant before searching your property or person. Now since they didn't have tcp/ip or telephones in those days it's up to the court system to update the meaning of our constitution as times and technology changes. That's how it has always worked. If you're a suspect and a search warrant is issued our law enforcement agencies have been able to search your property for the last few hundred years.

Re:The 4th Amendment is alive and well

[exceed]

The Founding Fathers wrote the Constitution in a broad and general way, for they already knew technologies would become more advanced and things they didn't have then would appear in the future.

Re:The 4th Amendment is alive and well

[Safety Cap]

If you're a suspect and a search warrant is issued our law enforcement agencies have been able to search your property for the last few hundred years.

All suspects are guilty. If they were innocent, they wouldn't be suspects now, would they? -- Troops

Re:The 4th Amendment is alive and well

[Snover]

Isn't your computer your property?

Scary, but honestly...

[FatSean]

Do any of you actually do anything that would merit the FBI spying on you?

Re:Scary, but honestly...

[Anonymous Coward]

Yes. I've publically voiced concerns for human rights abuses in Uzbehkistan. Yeah, and the assassin in Tashkent is now FBI's friend.

Re:Scary, but honestly...

[alen]

And so. Have you ever conducted any criminal activity or spoken out in favor of a revolution against the United States Government? You think they really care about your concerns?

Re:Scary, but honestly...

[Anonymous Coward]

Umm, well.....lets see. Right now, not really. I DO inhale occasionally (OK, more than occasionally) and do a little personal cultivation - visit lots of offshore websites, work with encryption products, am employed as a telecom engineer (SS7, etc) and do not have a US bank account - cash works just fine, thanks. Oh yes, I also do a little hunting, have some rifles around...a handgun for snake country (loaded w/buckshot).

Yeah, I can envision myself being 'of interest'.

Examine your life. Any quirks, 'habits', choice of reading material, web sites visited, banking habits, lifestyle, hell the part of town you live in can mark you for observation! Stop using this damn line of reasoning "those who have nothing to hide have nothing to fear".....EVERYONE has something they would rather not share with the Feds.

Re:Scary, but honestly...

[alen]

Well lets see, smoking pot is illegal so if law enforcement starts to spy on you where is the problem? You're breaking the law. As far as everything else you'll probably just get labeled into the crazy weirdo category and no one will care.

But who cares about guns? Just follow your state fireamrs laws and you're OK. No one spies on you because you're weird. Only if you're a suspect in criminal activity.

Re:Scary, but honestly...

[Anonymous Coward]

lets see, you smoke pot, deal only in cash, have guns laying around?
I'd suggest opening up your computer, Senor Escobar, before you and your Scarab get back from Colombia.

Re:Scary, but honestly...

[Anonymous Coward]

No, but you would be surprised to see what drifts to the surface when you compare a lot of different databases. And that's when the spotlight suddenly appears on you. The key here is that a lot of surveillance is done by automatic means and notoriously unreliable AI, which can point to people who do nothing wrong.

But that doesn't mean that police shouldn't be allowed to investigate if they've got a search warrant.

This is the same as wiretapping

[Binx Bolling]

Come on. There is absolutely nothing wrong with this. This is exactly how police surveillance should happen. A court order is still required. It is difficult to do on a large scale, at least when a physical key logger is used. It does not require people to use broken encryption. The problem starts when people are forbidden from verifying the integrity of their own computers.

bb

Re:This is the same as wiretapping

[Fastolfe]

My thoughts were the same as yours until I read that there was no wiretap order granted here. Granted, a "similar" court order would still be needed to set this up (I would hope?), but I just wonder if that order is sufficient to justify this sort of surveillance. I think it's sufficiently similar to a wiretap to require the same type of court order... but is it?

Re:This is the same as wiretapping

[Quizme2000]

Now all those real sys admins can start earning some nice kickbacks from shady ISP customers for bug(as in wire tapping not GPF) free browsing and from your local SS/FBI office for ratting out the ones that wouldn't pay you. Its creating organized crime oppertunity not preventing it. Hey at least I would be able to afford housing in CA for once.

Keyboard Sniffing

[Anonymous Coward]

Hmmm, With the amout of hair and gunk that has managed to build up in my keyboard, i'd be afraid to smell it...

What is this, so new for of fettish?

;)

Evidence in Plain View

[Kamel Jockey]

This ruling also will most likely apply the "Evidence in Plain View" rule to the Internet... meaning that if you are caught doing something illegal online (analogous to being stopped for speeding and a cop sees a bag of pot in your passenger seat), that evidence may also be used against you.

But we know no one here does bad things like that!

Re:Evidence in Plain View

[SuiteSisterMary]

But at that point, wouldn't using even the most rudimentary of encryption take it 'out of plain view?'

dudes,

[cosmo7]

they probably won't shut down mobster - they'll just have a long string of court dates and then make them switch to a subscription model.

Proper procedures were followed

[libertynews]

Here's the relavent part of the decision:

"Acting pursuant to federal search warrants, the F.B.I. on January 15, 1999, entered Scarfo and Paolercio's business office, Merchant Services of Essex County, to search for evidence of an illegal gambling and loansharking operation. During their search of Merchant Services, the F.B.I. came across a personal computer and attempted to access its various files. They were unable to gain entry to an encrypted file named ?Factors.?
Suspecting the ?Factors? file contained evidence of an illegal gambling and loansharking operation, the F.B.I. returned to the location and, pursuant to two search warrants, installed what is known as a ?Key Logger System? (?KLS?) on the computer and/or computer keyboard in order to decipher the passphrase to the encrypted file, thereby gaining entry to the file."

Note that the FBI has a warrent for the first entry, and returned with new warrents to install the KLS. I'm as paranoid as the next guy about government intrusion (hence my Libertynews.org website) but the FBI followed the rules here. And as detailed in previous articles they actually bent over backwards to make sure the KLS did not record any of his online keystrokes.

This is the kind of thing that civil libertarians should be applauding, proper use of warrents and use of technology to limit the scope of thier intrusion.

Re:Proper procedures were followed

[arkanes]

Well, I could still see a number of problems. One is that (arguably, and the judge obviously disagrees) they should have gotten a wiretap order, not a search warrant. Second, I would question whether or not the first warrant applied to his computer. Third, how did they decide that a file name "factors" had anything illegal in it? I'll give you 10 to 1 odds that the "probable cause" was simply the fact that it was encrypted.

Re:Proper procedures were followed

[markmoss]

they actually bent over backwards to make sure the KLS did not record any of his online keystrokes.

Wiretap warrants require more probable cause, because they will capture _everything_, not just the particular conversation the cops are after. So, instead of getting a wiretap warrant, they got a warrant to go after the encryption key and configured the KLS to discard keystrokes when the modem was active, therefore it didn't catch any keystrokes that were being _directly_ transmitted.

That's highly Jesuitical reasoning. Quite obviously if Scarpo typed e-mail off-line, then dialed in to send it, the KLS would capture that. Sounds like a wiretap to me. More to the principle of the laws, KLS captures everything typed in whenever the modem is off, not just the item specified in the warrant.

Note that although the FBI insisted and finally convinced the judge that the KLS system was "secret" and so the court and Scarfo's lawyers could only see an edited version of the specs, they did let out how to beat it. Keep that modem running! (Wouldn't an ethernet connection also do this? It's continually active on an external cable, and so under their definition of "wiretapping" KLS would have to stay off.)

To me, it looks like the courts are going nuts over tiny technical details, which they hardly understand, while missing the big picture. The FBI has lied and concealed evidence about Waco, protected one of their agents who turned out to be spying for many years (Hansen), and at least one field office (Boston organized crime task force) has become difficult to distinguish from the mobsters. And it's pretty clear by now that if anyone is ever disciplined for Waco, it will be a letter of reprimand sent to their retirement home, and I have no reason to expect any significant firings over the other misdeeds, let alone agents going to jail. Yet, the judge will take the FBI's word for it that the KLS has to be secret and the sanitized description released is sufficiently accurate.

If I could trust the cops to obey the laws and their procedures, I wouldn't worry much about technicalities...

Re:Proper procedures were followed

[Anonymous Coward]

The question is really weather a search warrant should allow federal agents to hide in your attic for months at a time, to try to overhear your encryption password. I think I will skip on the applause and the Libertynews.org.

Terrorism is the new excuse

[Hobobo]

Jesus... everyone is using terrorism to invade liberties and attack others. They've set up military tribunals, email/keyboard sniffing, hundreds of detnetions, racial profiling under this "terrorism" excuse. Even foreign countries are using it; China's calling Taiwan "terrorist," Russia says the Chechyns are "terrorists." It's absurd and ridiculus.

Re:Terrorism is the new excuse

[TWR]

You're an idiot.

They've set up military tribunals,

These are explicitly for non-US citizens caught abroad, trying to attack the US. US citizens aren't subject to them (they've got constitutional rights). Residents of the US aren't subject to them (the Supreme Court says that non-citizens who are residents of the US have constitutional rights). Stop being an idiot.

email/keyboard sniffing

This case was explicitly about a mafioso, so how is the terrorist excuse working here? Besides, WIRETAPS ARE LEGAL WITH A JUDGE'S PERMISSION. This is just the 21st century version of the wiretap. Stop being an idiot.

, hundreds of detnetions,

And every single detainee is either someone who has violated the law (overstaying their visas, for example) or who is a material witness who is likely to flee. Unless you know better, oh stupid one? This is the exact same thing that liberal icon Bobby Kennedy did when he started taking on the mob; if a reputed mafioso spit on the sidewalk, he would be arrested for violating public spitting laws (which exist to prevent the spread of disease). Was it OK for Bobby Kennedy to do? Did civilization collapse?

racial profiling

Note to moron: you would have to be willfully stupid to not wonder about a muslim booking a one-way ticket on a jumbo jet, taking no baggage. Idiots don't pay attention to patterns just because it's not politically correct. Oh, and the majority of American Blacks are in favor of racial profiling to prevent terror attacks, so you can assuage your white, upper-middle class guilt.

under this "terrorism" excuse.

Excuse? If you think this is a fucking excuse, please tell me where the Twin Towers went. Do you think they're on holiday in Paris?

Russia says the Chechyns are "terrorists."

The Chechens are terrorists. They blew up several apartment buildings in Russia two or three years ago. That's what prompted the renewal of the Chechen war. There had been a cease-fire for about a year until they started blowing up civilians in Russia. Sorry to let actual facts get in the way of your mindless diatribe.

China's calling Taiwan "terrorist,"

China is run by a group of evil people. They've been calling the Taiwanese whatever name seems to strike a nerve in the West. It's like Saddam calling the US/British no-fly zones "terrorist" or "criminal." When the evil ones call you names, you're doing well.

-jon

Re:Terrorism is the new excuse

[Anonymous Coward]

I do not fear Military Tribunals. I am a U.S. citizen and not part of the U.S. military. Why are YOU afraid of U.S. Tribunals?

Also, most lawyers I have heard from laugh and say, "If I were walker, *I* would want a tribunal instead of a jury"

Re:Terrorism is the new excuse

[Hobobo]

I'm not going to waste time responding to your whole spiel, but I picked out the stupidest thing.

" These are explicitly for non-US citizens caught abroad, trying to attack the US. US citizens aren't subject to them (they've got constitutional rights). Residents of the US aren't subject to them (the Supreme Court says that non-citizens who are residents of the US have constitutional rights). Stop being an idiot."

What are you talking about?! American lives are worth more than Afghan lives?! (or for that matter, Somalian, Ethiopian, Pakistani, Iraqi, etc?). Who the F cares if US citizens aren't subject to them. This is a total invasion of the human rights of the Afghanees.

You know these tribunals are exactly what the Soviet Union used during the Cold War. Read up on it. Americans haven't been exposed to this sort of thing, so they're not as sensetive to it.

Re:Terrorism is the new excuse

[TWR]

So many words, so few brains.

Who the F cares if US citizens aren't subject to them. This is a total invasion of the human rights of the Afghanees.

It is no such thing. Let me try to explain this to someone as terminally stupid as yourself. Military tribunals are intended to try prisoners of war, captured overseas. Same as the Nuremberg trials, same as the trial faced by Tojo and other Japanese leaders at the end of WW II.

This is a war. The US is bending over backwards to be nice to captured enemy troops, even though these troops are fighting in violation of the Third Geneva Convention (they target civilians, they don't wear uniforms to mark themselves as combatants, and they don't reveal their chain of command). Under international law, the US is well within its rights to shoot these fuckers with no trial at all.

Human rights, by the way, are a fiction created by western societies. If you don't respect them (as the Taliban and Al Qeida certainly don't), they don't exist. Pissing and moaning that the US isn't respecting rights that the the people captured don't even believe exist is an amazing exercise in self-indulgence.

You know these tribunals are exactly what the Soviet Union used during the Cold War. Read up on it. Americans haven't been exposed to this sort of thing, so they're not as sensetive to it.

Oh don't be absurd. This is nothing like the show trials in the USSR. Please site an example (with references) that show any similarities. You're just another America-hater who would love to cast the US as the Evil Empire, since the country you loved (the USSR) proved to be so completely rotten.

-jon

Re:Terrorism is the new excuse

[Hobobo]

" This is a war. The US is bending over backwards to be nice to captured enemy troops, even though these troops are fighting in violation of the Third Geneva Convention (they target civilians, they don't wear uniforms to mark themselves as combatants, and they don't reveal their chain of command). Under international law, the US is well within its rights to shoot these fuckers with no trial at all."

Stop making things up. These tribunals are 100% secret. You/other civilians have no idea what is going on there.

With on the spot convictions/death penalty, god knows how many innocent people will be sentenced by these kill happy folks.

Re:Terrorism is the new excuse

[TWR]

With on the spot convictions/death penalty, god knows how many innocent people will be sentenced by these kill happy folks.

Are you stupid? According to the US government, no tribunals have occured yet, and the rules for them have not been finalized. And if they have been happening in secret, how do YOU know about them? And how do you know they were innocent people? You must be God.

As for innocent, tell me how many innocent fuckers were in the Taliban and Al Qeida armies.

It must be nice to hate America. You don't need evidence or any such thing to prove your point. Just a feeling that "kill-happy" folks are going to do something. If the US is so evil and kill-happy, why didn't we just nuke Afghanistan?

-jon

Re:Terrorism is the new excuse

[Anonymous Coward]

Out of interest, do these arguments really need to be this personal? Are you an idiot if you disagree with something? Are opinions reflective of stupidity? This is an issue which affects everyone and no doubt everyone has opinions about it - if you want those arguments in the open, please argue on a factual basis - and if you just want to piss each other off, there's always email.

Re:Terrorism is the new excuse

[Hobobo]

"And if they have been happening in secret, how do YOU know about them? " It's not secret they exist... what goes on in the trials is kept secret. Pretty much censorship.

"And how do you know they were innocent people? You must be God." I'm sure you've heard how many innocent people get killed in the US via death penalty, and we have due process and trials take years. Now, imagine a trial where the accused has barely any rights (as Bush said, he'll have more than suspects under the Taliban, which is a pretty laughable comparison -- might as well compare the rights of Jews in to the Nazis). God (me? :) knows how many innocent people will get executed. Of course since it's nice and secret, the public will never know.

"As for innocent, tell me how many innocent fuckers were in the Taliban and Al Qeida armies." Obviously they're not innocent (though it's funny how the US supported the Taliban back in 70's or 80's). However as I said before people who are will be executed.

"It must be nice to hate America." I don't hate America. I love manything about it including the culture and diversity. What I hate is how we go into other countries, total F them up, putting in dictators and whatever who supress the people. There are probably a hundred examples, (Taliban is one).

"You don't need evidence or any such thing to prove your point. Just a feeling that "kill-happy" folks are going to do something. If the US is so evil and kill-happy, why didn't we just nuke Afghanistan?" You know more innocent civilians Afghanees have been killed compared to Sept. 11 (~2990). Here's an excert from an article on the Washington Post (obviously not some crackpot source):

"local residents in Paktia province said that as many as 60 people were killed when U.S. aircraft bombed a convoy carrying tribal elders on their way to Kabul to attend the swearing-in of Afghanistan's interim government"...[further down]..."University of New Hampshire professor Marc Herold, using international media reports, has estimated the total at more than 4,000. "

Yep, the we sure are taking care of those life threatening tribal elders, good things we prevented them from attending the swearing in ceremony of the new government. Jesus... bomb happy fucks.

Well it was nice talking to you. If you haven't already, read A People's History of the US (Zinn).

Re:Terrorism is the new excuse

[TWR]

You love making stuff up, don't you?

1. NO TRIBUNALS HAVE OCCURED. Until you prove otherwise, you're a liar when you claim they have.

2.NO EVIDENCE HAS BEEN PRESENTED OF AN INNOCENT PERSON BEING EXECUTED SINCE THE DEATH PENALTY WAS REINSTATED IN 1976. Now, I don't always agree with how the death penalty is implented in places like Texas. But I have yet to see conclusive evidence that any innocents have been executed recently. This doesn't mean the system doesn't have problems, though. In any event, it has NOTHING to do with whether or not "innocent" Afghans will be executed. If you're captured pointing a gun at US troops, you don't have much of a case.

3. LEARN SOME FUCKING HISTORY. The Taliban was created by Pakistani intelligence (the ISI) in the mid-90's. The US didn't support them in the 70's and 80's; they didn't exist. The US supported the Muhenjidin, the Afghani and Arab guerrilla fighters trying to evict the Soviets from Afghanistan. There are overlap between the groups (Mullah Omar lost an eye fighting the Soviets), but they were not the same group of people and they had different goals.

4. WE HAVE NO IDEA HOW MANY AFGHANI CIVILIANS HAVE BEEN KILLED. We can't even get exact numbers on the number of people killed at the Twin Towers, and we're picking through rubble and doing DNA tests. Do you really think that these reporters (most of whom are anti-American in their slant) are getting accurate numbers? And do you think there would be nearly as many civilian casualties if the Taliban and Al Qeida weren't using civilians as cover? When the US bombed those Red Cross warehouses, it was because the Taliban was using them to hide.

It's time you figure out who the good guys are here, you shithead.

-jon

Re:Terrorism is the new excuse

[Hobobo]

My god you are a dumbass. Just one more thing:

"NO TRIBUNALS HAVE OCCURED"

No, they haven't, but since they're secret, how can you be so sure?

Also, chill dude.

Re:Terrorism is the new excuse

[Hobobo]

And also...

"WE HAVE NO IDEA HOW MANY AFGHANI CIVILIANS HAVE BEEN KILLED"

So do you think if only 1 civilian was killed that would be acceptable? What if one of your relatives or friends were killed by a stray bomb. Or what if a bomb landed in one your street and destroyed your neighborhood (because there was a terrorist living there). Would that be acceptable?

Think before you talk so callously about peoples lives.

Re:Terrorism is the new excuse

[TWR]

I am sure because there is no evidence they have occured.

You are making the extraordinary claim: that unbeknownst to everyone else on the planet, the government is engaging in secret tribunals and executions. Prove it. Or shut the fuck up.

-jon

Re:Terrorism is the new excuse

[TWR]

Stop being a glib idiot.

There is a world of difference between intentionally targeting civilians for mass murder and accidently killing civilians in a war zone because the enemy WHO ATTACKED YOU FIRST is using civilians as human shields. If the Taliban Afghans and Al Qeada Arabs you love so much cared about the Afghani people, why are they using them as cover for bombs? Why not turn themselves in and save the lives of their fellow Muslims, or at least carry the battle away from civilians. But they'd rather let them die. And idiots like you think these bastards are the good guys.

It's amazing how twisted you are.

-jon

Re:Terrorism is the new excuse

[Hobobo]

*cough*Watergate*cough*Iran-Contra*cough*Fidels assasination and many others is Latin America*cough*

Re:Terrorism is the new excuse

[Hobobo]

"There is a world of difference between intentionally targeting civilians for mass murder and accidently killing civilians in a war zone"

If you were hit by a stray bomb and died would you care if it was intentional or accidental? Would you feel better if your found it was supposed to hit a military base?

Re:Terrorism is the new excuse

[TWR]

I didn't know that Fidel Castro was assassinated.

Apparently, you are too stupid to know what proof of something is. Proof is not what someone else did 30 years ago. Proof is what you are doing now.

-jon

Re:Terrorism is the new excuse

[TWR]

If I was hit by a stray bomb, I wouldn't probably feel much of anything; I'd be dead.

And if I found out that a neighbor was a terrorist, and a family member was killed trying get the guy, I'd pitch in and try to find the motherfucking terrorist. See, I don't blame the victim like you do. I blame the source.

-jon

Do they really think...?

[KC7GR]

...that this will be at all effective? Think about this:

First off, how many people are NOT running Lookout Distress or similar Gatesian Bloatware for their E-mail? Those who fall into this category WILL see the 'Magic Lantern' worm as an unexecuted file attachment, one that is likely to be quickly deleted.

Second: How long is it going to take the computing community "At Large" to dissect how ML or any other keyboard logger works, and come up with a very effective countermeasure?

Third: How long will it take seasoned criminals to grab said countermeasure? The ones that are computer-savvy can download and install just as well as any techie.

This whole exercise seems to be little more than useless window dressing to me. It almost looks like a (somewhat desperate) attempt by the FBI to fool the public into thinking they're effectively fighting terrorists when they may not have the slightest hint of a clue.

I don't pretend to have all the answers, but I really don't see what good monitoring Lord only knows how many computer keyboards will do. And how is a typical consumer, who can barely find their system's power switch, going to know if they're being monitored?

Re:Do they really think...?

[bluGill]

Third: How long will it take seasoned criminals to grab said countermeasure? The ones that are computer-savvy can download and install just as well as any techie.

No, smart criminals will not remove this, they will sabatoge it. That is it will still be there, and appear to function correctly, except it will only log legal activity. (ie posts to /., irc sessions, email to mom.) The things that you don't want known won't be loged.

Re:Do they really think...?

[Sloppy]

How long is it going to take the computing community "At Large" to dissect how ML or any other keyboard logger works, and come up with a very effective countermeasure?

(Assuming we're talking about the software loggers...)

At first, I thought FBI probably has a good thing going. It's not like this thing is a virus. Only the suspect's computer will be compromised, so it might take a long time for the security community to get a copy of FBI's malware. And they can't look at it, if they can't get their hands on it.

Except... someone who "practices unsafe computing" enough to be vulnerable to FBI software attacks, is vulnerable to other attacks as well(*). So the next year's Sircam will eventually mass-mail the FBI software out to everyone in some suspected criminal's MS Outlook address book. "Don Corleone, I include this file for your advice..."

(*) That's the whole problem with FBI's attitude that they must have a way to gather evidence this way. If FBI even has the capability (warrant or not) to do this, then computers are vulnerable to criminal attacks as well. A world where the cops require that everyone leave their front door unlocked, is Burglar Paradise.

Key points

[RobertGraham]

The ruling centers around the question whether this was a wiretap of the phone line. The FBI had search warrants to obtain the passwords, but they did not have a wiretap order for his phone (Scarfo used AOL dialup). Thus, if the keystroke monitor was active while he was chatting on IRC, then it would be the equivalent to a phone wiretap of his AOL communications.

In order to combat this, the FBI designed their keylogger to go innactive while the modem was connected. I still have some lingering questions about this. E-mail is asynchronous. With many e-mail services (Eudora, Outlook, and AOL), the underlying software lets you compose e-mail offline and store it to disk, automatically transferring it at a later date. Personally, I compose a lot of my e-mail when my computer is offline -- these days, I spend half my time on airplanes, it is when I get the most e-mail written, I sync when I land at the next destination.

Another worrisome trend is that the hearings were "ex parte in camera" -- meaning in the judges private chambers without the presence of defense attornies. The FBI claims the details must remain a secret for national security reasons. The defense attornies are only provided a sanitized summary of the keylogging features, not the full details. This is worrisome because it prevents the public from understanding the details of what is really going on. As we saw in the Carnivore case, the FBI was free to define its own boundaries. For example, when Carnivore grabs e-mail summaries, I would interpret the court order as allowing capture of only the SMTP "envelope" containing the TO/FROM addresses -- the FBI interprets this as capturing the full e-mail headers. I think this is a gross violation of civil liberties, but there is no way to challenge this. Likewise, the keylogger details may show similar gross violations of civil liberties, but the FBI hides behind its cloak of "national security".

The thing is, there are no important details to keylogging. You can go to http://www.keyghost.com for your own hardware-based keylogger, or you can download numerous keyloggers off the Internet. There are some difficult problems. For example, PGP 6.0 introduced a keyboard driver that intercepts your keystrokes: when you type your password, this driver routes them around Windows. Thus, while it appears that you are typing in a dialog box, this is only an illusion. Standard software keyloggers for Windows will not capture the passwords. (This is why PGP 6 doesn't work well with Win2k -- it doesn't have the power management features, so it prevents Win2k from going into "suspend/hibernate" mode).

Anyway, I'll be posting some more detailed analysis later this month on my personal website. In addition, I'm providing a $10,000 bounty for anybody PC containing an "interesting" keylogger -- maybe one from the mafia doing industrial espionage, maybe one from the FBI, I don't care. I'll be posting the full details to my website (http://www.robertgraham.com).

Re:Key points

[Corporate Drone]

I noticed the description of how the key logger worked, vis-a-vis modem operation, too.

Doesn't this imply that, if you believe their description, one could circumvent the key logger by simply sending bytes out to the modem continuously (AT ... AT ... AT ...)?

Until, of course, the Feds found out, and got a wiretap permit, too, and changed the key logger to work at all times...

Re:Key points

[SuiteSisterMary]

Two modems...one null modem cable...one process at idle+1 priority that sends random letters from one modem to the other.

Re:Key points

[ocie]

Or just make sure you are online when you open the file, or check your computer for dongles before you power it on.

Re:Key points

[tiny69]

The ruling centers around the question whether this was a wiretap of the phone line. The FBI had search warrants to obtain the passwords, but they did not have a wiretap order for his phone (Scarfo used AOL dialup). Thus, if the keystroke monitor was active while he was chatting on IRC, then it would be the equivalent to a phone wiretap of his AOL communications.

In order to combat this, the FBI designed their keylogger to go innactive while the modem was connected.

So what happens to those that have a seperate computer used as a firewall. How would the keylogger on one computer know when the modem on another computer had an active link?

And how many people have moved their computers to allow easy inspection of the back of it for any "additional" hardware?

Re:Key points

[agentZ]

I still have some lingering questions about this. E-mail is asynchronous. With many e-mail services (Eudora, Outlook, and AOL), the underlying software lets you compose e-mail offline and store it to disk, automatically transferring it at a later date. Personally, I compose a lot of my e-mail when my computer is offline -- these days, I spend half my time on airplanes, it is when I get the most e-mail written, I sync when I land at the next destination.

An interesting point, but remember that only the actual communication itself is protected under the wiretap statute, 18 USC 2518. That is, the actual bits you sent as e-mail are protected by this law. Any drafts or other documents you make on your computer are protected as stored communications, which are discussed in 18 USC 2703, also called the Electronic Communications Privacy Act.

Re:Key points

[alexburke]

This is why PGP 6 doesn't work well with Win2k -- it doesn't have the power management features, so it prevents Win2k from going into "suspend/hibernate" mode.

I found that out the hard way, and the buggers made the upgrade to the power-management-friendly version (7.x) a paid upgrade. It did include a bit of new functionality (the ability to create self-decrypting archives), though.

This just in

[cnkeller]

The department of education has been dissolved for failing to teach proper english, after it was leaked by the FBI that hundreds of thousands of US slashdot posters used both syntatic and grammatically incorrect English....

Firewalling outgoing packets...

[rmdyer]

Is there any software that allows you to firewall outgoing packets as well as incomming?

Re:Firewalling outgoing packets...

[WyldOne]

Most firewall can. However; most firewalls don't.

I put in a block on our firewall 'just in case' for a virus that was going round. If someone got it in our network it would block any possible outgoing packets to the suspect site.

If ou know your firewall software well, you can do it. The only problem is knowing where you want to go.

[OT] About your sig

[Zen Mastuh]

I'm definitely getting modded down for this (Moderators: use "Offtopic", please!) off topic post, but frankly I don't get your sig. Do you mean to tell me god has sacks? Does he weigh them out to 7.10 grams?

Re:[OT] About your sig

[Anonymous Coward]

If I remember correctly, "God Moving Over the Face of the Water" is a Moby song. Don't know if that's related to his sig though...

Re:[OT] About your sig

[Anonymous Coward]

Yeah, it was something like "It's slashdot for god's sacks!"; his (I'm being presumptuous...) response to my question was to change the sig to that boring English guy's song title. How neurotic.
--ZM

Re:Thank you US Gub'ment

[Anonymous Coward]

If you check the documents you will see that this case started under the Clinton administration. In fact, the last data was collected on May 23, 1999. God forbid that anyone think that the Democrats ever invade civil liberties. :-)

To hell with them

[soupforare]

They just want all my pr0n passwords!

Easy solution.(Under a GUI)

[aldous]

Just present the user with a table with all the printable characters in it, in random order each time.The user won't *type* his password, but select the appropriate characters in the appropriate order, clicking on them with the mouse.
As the position is random each time, you can't find the password clicked, even if you logged the mouse coordinates.
I emailed this idea to 2 projects creating graphic interfaces for gpg, but haven't heard from them.

Re:Easy solution.(Under a GUI)

[delta407]

Then again, if they bug the PS2 or (in most systems at least) USB ports, they could easily get mouse clicks too. While they're at it, they could monitor the VGA out...

Or they could just send someone in and beat you up. That works.

when will it end?

[Chundra]

Let me preface this by saying I don't really have much of a problem with keyboard sniffing in and of itself. It has it's uses can be an enlightening experience. What worries me is what is to come a year or so down the road. It won't stop with keyboard sniffing. No.

So, I put my foot down when it comes to mouse sniffing. Cute as they may be, the little buggers carry any number of diseases, both airborne and from the parasites they host.

Thank you.

Antivirus Ignoring FBI Keyloggers

[substatica]

From what I recall, at least one major antivirus software company commented that they would not include FBI Keyloggers or other such tools in the virus updates. So for the average user, there is no defense.

Re:Antivirus Ignoring FBI Keyloggers

[dragons_flight]

Despite early reports to the contrary, the major antivirus companies came out saying they did not intend to intentionally leave any loopholes for the FBI.

http://www.usatoday.com/life/cyber/tech/2001/12/11 /fbi-virus.htm

Re:Antivirus Ignoring FBI Keyloggers

[delta407]

The antivirus companies have changed their stance after someone informed them that ignoring Magic Lantern was a Bad Idea.

Antivirus firms: FBI loophole is out of line:
"Antivirus software vendors said Monday they don't want to create a loophole in their security products to let the FBI or other government agencies use a virus to eavesdrop on the computer communications of suspected criminals."

This is a Double Edged Sword...

[Freija Crescent]

that I don't want the government brandishing.

Don't get me wrong, I'm not one of the types that thinks everytime the government makes a new law or whatever that it is a bad thing. I simply feel that privacy is one of our most sacred freedoms.

If the government taps me accidentally instead of their intended target, and they discover me doing something that violates a law in a minor way, they are going to pursue getting a warrant so that they can use the information legitimately next time it happens. Point is they didn't have the right to tap me in the first place.

Second point is this. If I get tapped by accident (net-criminal spoofed my IP/connection details) and a third party hacker (i'm simplifying this.. i know i'll catch heat for using hacker)intercepts the signal, he may learn of information that puts me, my career, or my life in danger.. information that would not have leaked had it not been for the government adding a hole to my system. I doubt the government would compensate me if I lost my job for leaking trusted information to the web.

I'm all for anything that aids our law-enforcement officials, as long as they are responsible and take ownership of the consequences.

Making it mandatory for the government to notify you that you are being snooped defeats the purpose of the monitoring in the first place. A more suitable method would be allow concerned individuals email or call to request whether or not they are being snooped. Then if they ARE snooping you, and they have reason, they can ask you to see a local court to discuss the matter without actually stating that they ARE monitoring you. That is one faster way of getting the criminals into court, if they are foolish enough. It also protects the innocent. Of course if the government is 'accidentally' snooping you, they will just tell you "no, we aren't monitoring you" because they think they are monitoring the person spoofing your connection.

A better solution is a time-passworded utility that you can install and call to request the current password. The utility would check your system for the trojan. If that is the case, I'm all for this course of action against cyber-crime.

-fc
.

Then the answer is don't use your keyboard

[J'raxis]

Point-and-click text entry for your passwords. Ever seen the Key Caps desk accessory on a Macintosh (or the Character Map on Windows)? Tie something like that into a graphical login display, and there you go. Logging mouseclicks is still a viable option, but how would the logger know that {x=260; y=580} was the letter F? It would need to hook into the software displaying the charac oh, look, now we can secure ourselves via the OS software, cant we?

Re:Then the answer is don't use your keyboard

[agentZ]

The heck with that. What if you had an icon on your desktop named "Shortcut MSWORD97.EXE". To enter your password, select this icon, copy it, and paste it into the password dialog box. Let's keep it simple folks... (Even chose a decent password too! upper and lower case, numbers, punctuation, spaces, and 21 characters to boot. Break that!)

Evasion Tool

[devnullkac]

Won't be long before the makers of privacy tools will change their GUI front ends so that a keyboard is no longer used to authenticate. The simplest method would be to display a virtual keyboard and have the user mouse over to each character. It would be difficult, though not impossible, to construct a "mouse sniffer" that gathers enough data to reconstruct the password based on movement history. Defeating that would simply require randomly moving the virtual keyboard between each click. A bit of a pain, but if you really want to avoid the rubber hoses, you may have to do it.

The only problem after that is evading the "looking over your shoulder" that no-echo keyboard password prompts are so good at avoiding. Maybe a very low contrast virtual keyboard and cursor...

Re:Evasion Tool

[J'raxis]

Randomize the position of the window, the size of the keys (sometimes 16x16, sometimes 24x24, etc.), and the position of the keys relative to each other (sometimes QWERTY..., sometimes AZSGBR..., etc.). Maybe even have the window reconfigure itself after each click as an option for the paranoid.

Scanning mouseclicks would not be useful, as all they would get are coordinates. Unless they also hooked into the software to ascertain what key that coord represented, the logger would just simply not work, but in the software is where the logger could be detected and blocked.

Re:Evasion Tool

[dragons_flight]

So the FBI implements a system of screen capture to know when you are entering your password and what the "virtual keyboard" or other interface looks like. Tracking the mouse is no more difficult either. Hell if they can capture your screen, then they can just look at your files before/after they've been decrypted.

If your computer has been turned against you then there is no hope of using it protect your secrets.

Re:Evasion Tool

[SuiteSisterMary]

This is exactly how non-trivial keypads work. They keypad is a grid of 4x3 keys that are LED panels (think digital clock). When you want to put in your secret code, you hit the 'activate' button, and each key is randomly assigned it's number for that entry.

Bugs are Easier

[Greyfox]

They have that really cool one where they shine a laser through your window and it lets you listen in on conversations in the room with the vibrations sounds make in the glass of the window. There are other options for video, too.

Of course, the trick is not to plant the bug, the trick is to plant the bug in such a way that your intrusion is not discovered. I suspect that the brighter folks in the criminal world will be focussing on detecting such intrusions more than they will be focussing on preventing them.

MOD THIS DOWN

[Anonymous Coward]

This guy is obviously a terrorist.

Keylogger

[Dwedit]

Can't someone just kill the process? Poof, no more keylogger.

Re:Keylogger

[SuiteSisterMary]

Hardware keylogger that physically exists between keyboard and motherboard.

Re:Keylogger

[Anonymous Coward]

In case of a hardware bug a hammer will work just fine. Or carry your keyboard with you at all times.

How to avoid keyloggers

[3ryon]

B r o w s e t o a w e b p a g e w i t h l o t s o f w o r d s o n i t a n d t h e n c u t a n d p a s t e e a c h l e t t e r y o u n e e d.

Re:How to avoid keyloggers

[Sloppy]

Bwahaha! That reminds me about when I built up so much cat hair in my A3000's keyboard, that I couldn't type the letter Z anymore. For several days (until I got around to cleaning my keyboard) I had to paste whenever I wanted to type a Z.

Thank Yog it wasn't the V key. (Because pressing Amiga-V is how I pasted.)

Re:How to avoid keyloggers

[Anonymous Coward]

Or just use charmap if you're on windows.

Re:How to avoid keyloggers

[LeBain]

Or how about this: the "keyboard" you use for login is actually a window that pops up at a random position on the screen, and you use your mouse to point and click to your login, passphrase, secure key, etc. Saving mouse positions at clicks to infer keys by relative position in the window could be defeated by randomly re-positioning the window at each click.

Re:How to avoid keyloggers

[AIV]

This is all a cleverly-concocted PR hoax by the makers of Dragon Naturally Speaking software, 45% of whose stock has recently been purchased by those Enron clowns. However, as of the time of this post, they will sell all of the shares and make a jillion more dollars before Bloomberg can process my revelation and publicly warn all remaining and potential investors.

Don't you watch Law and Order?

[Uttles]

If the government taps me accidentally instead of their intended target, and they discover me doing something that violates a law in a minor way, they are going to pursue getting a warrant so that they can use the information legitimately next time it happens. Point is they didn't have the right to tap me in the first place.

Well, in that case, the charges they bring against you will be dropped (assuming your lawyer is decent) because of exactly what you said: they didn't have the right to tap you in the first place. Then you can sue them for your time.

reasoning more disturbing than the details

[Erris]

I feel the wheight of many wedges.

Isn't some kind of bizare expectation of privacy principle at work here as well? That so many people are denying such a thing for all things internet is very disturbing and in sharp contrast to laws for now obsolete communications methods, phone and post. How the bastards decide that the government can look into my private communications without reason is much less important than the fact that they will do so. The fourth amendment is going away.

What's to keep them from putting cameras into your house? That have worked just as well to get the passwords.

Safer Hell.. I feel richer already

[Mojo Geek]

Ima gonna git me somma that sniffer stuff and catch me a terrorist, what with the rewards they're offering. Never mind I'm not the FBI, all's fair in love and the war against Terrorism.

Look out neighbors, here I come.

Encrypted keyboard?

[J'raxis]

How about an encrypted channel between the keyboard/mouse and the computer?

Ive heard a lot about the media mega-corps talking about encrypting the output of video and sound cards to prevent people from copying their digital content the old-fashioned way; if thats possible, wouldnt this also be?

Ha!

[echomonkey]

Keylogging is simple to get around. Just use character map to get all your crime organized. :)

How to counteract the new threat

[Anonymous Coward]

Of course, there are plenty of organizations besides the government that may well become interested in keystroke monitoring. For instance, a company might well be worried about industrial espionage. If the government starts using keystroke capture programs, then it's only a matter of time before such software escapes into the private sector.

The interesting question then becomes, how does one counter the threat of this sort of attack? In other words, what protective measures can one take to ensure that even if someone were to gain physical access to your computer, they would be unable to successfully alter it to install a keystroke monitor.

I see at least two possible types of threat:

(1) Insertion of a physical hardware device into the computer or keyboard
(2) Insertion of monitoring software into the computer.

Protecting against the installation of physical hardware could probably be done with physical means -- for instance:

(a) tamper-evident seals placed across the screws holding the keyboard together, and also the case.
(b) A reed switch inside the computer case to power down the computer if the case is opened.

At least this way you would know if your computer had been physically tampered with.

There's always the issue of "magic-lantern" type software attacks. Let's assume for a moment that one can harden their computer against email and internet virus attacks. The issue here is that of someone breaking into your house, and altering your computer's software while sitting at your keyboard.

Protecting against a physical access attack would be more difficult, but I can think of at least one possible technology that might work.

There's a new product on the market -- USB keychains. These devices plug into a USB port, and emulate a small hard drive, ranging from some 16MB to 256MB.

Imagine loading such a USB flash drive with a boot partition, and a minimal root partition. The rest of the flash drive would be loaded with millions of bytes of cryptographic keys that would each encrypt a very small amount of data on the internal hard drive.

To toss in some numbers, the bootable partition in the flash drive need not be more than about 2MB in size, leaving at least 14MB available for cryptographic keys.

That would store around 3 million 40 bit keys, enough keys to provide a separate key for each 32KB of data in a 100GB system. That 32KB need not (and probably should not) be contiguous.

Under such a system, the entire contents of the internal hard drive would be completely encrypted. There would be no unencrypted boot block, or unencrypted directory structure. The hard drive would contain nothing but wall-to-wall encrypted data and would be unbootable. This would probably make it impossible to install keystroke monitoring software on such a computer without gaining access to it in a powered-up state.

In order to use such a system, you would start with the computer powered down. You would plug the USB drive on your keychain into the USB port in the front of your computer, and power up. The system would boot off of the USB drive. The system would ask for a startup passphrase, which would be used by a cryptographic HD device driver, in conjunction with the key data on the USB drive in order to allow access to the unencrypted contents of the computer's internal hard drive.

The purpose of the passphrase would be to prevent anyone from gaining access to the contents of your hard drive, even if they obtained your keyring.

The system would then boot like a ramdisk system, and finally overmount the USB disk root partition with the actual, encrypted root partition on the hard drive, using the cryptographic device driver, the passphrase, and the 14MB+ of cryptographic keys to access the hard drive.

When you were done using the computer, you would power it down, and remove the USB keychain. After all, you aren't leaving the house without your keys, are you? This leaves the hard drive 100% fully encrypted, and a properly designed 100% cryptographic filesystem utilizing 14MB+ of key data would be essentially unbreakable.

So what do you all think? Is this proposal workable? Does it protect against the installation of keystroke monitoring tools?

Re:Michael Doesn't Like Me

[dragons_flight]

I've had submissions marked as accepted that then waited nearly 12 hours before being posted. Slashdot (generally) tries to spread out the submissions on the front page. That you were rejected so quickly probably means that they had already seen and accepted this guy's story but were waiting till after some of the other constitutional issues stories had had some time to be commented on.

You want to help? -- Give to the EFF!

[GuNgA-DiN]

I just donated $100... and you should too!

If you are even REMOTELY concerned about civil liberties, freedom of speech, or privacy you should dontate to the Electronic Frontier Foundation today:

http://www.eff.org/support/

Re:Take this Slashdot Article Moderator Queers

[Anonymous Coward]

Linux is, at best, a toy operating system. At worst it is the kind of subversive force in America that Stalin only dreamed of creating.

There are "cells" reporting to unknown leaders that only go by names like "L33t_Kernal_Hax0r" that cannot be located - after all, "living in my momma's basement cause I have no real world skills to speak of" is not a true street address.

There is the Marxist concept of "give what you can, take what you need." Only, none of these people can give anything, excepting the few heroes of the revolution that have their own roach filled apartments and must give blow jobs in parks monthly to meet their rent. Yet, they all feel the need to take, take, take. MP3s? "We must have them! It is about freedom for the artists!!" Software? "We must have it for free! It will be good then!!" Movies? "Yes, we must have them for free!!!" Of course, the dirty secret all of these "give it to me free!!!" people are trying to hide is that they have no resources to actually acquire anything legitimate, due to their pathetic skill set and the fact that society has no use for them.

Society, in fact, had no use for them even during their formative years. That's why their lunch money was stolen. Darwin's law was trying to assert itself, but overprotectively indulgent parenting prevented such a thing from happening.

I'm afraid I must insist

[Anonymous Coward]

I know I'll get modded down for saying this, but here goes:

I demand that you mod this post down![*]



(fucking ben fucking franklin and his fucking daylight fucking savings time!)

Well...

[Anonymous Coward]

Even though I'm normally a bit on the paranoid side when it comes to privacy on the Internet, I really have no problem with keyboard sniffers, as long as they are targeted to suspected individual criminals. I think that it's perfectly OK for law enforcement officers to use almost any surveillance means whatsoever necessary to gain evidence provided that

1) they are targeted to a specific individual when there is other reason to believe that said individual has committed or is about to commit a specific crime (and not used as a wide net just to see if something illegal would happen to be going on)

2) the legal system (a judge) is kept aware of what is going on

3) complete records are kept of all police activity

4) if something illegal is found, it is used in prosecution immediately or dropped altogether (and not stored for future coercion etc. use)

5) if nothing illegal is found, the target of surveillance is informed that he has been under monitoring, possibly after a short period of time, the maximum length of which is fixed.

And after all, isn't it better that the feds use sniffers to bypass encryption in individual cases, rather that try to get legislation passed that would require an escrow system, weak encryption or anything else like that?

What's with this surveilence-phobia?

[Tuxinatorium]

Whether surveilence is good or bad is totally dependant on how it is used. If the government keeps it to itself and only uses it to inforce just laws, than it is fine, regardless of the extremeness of the surveilence. You have nothing to fear unless you are doing something illegal. The problem arises when the government uses surveilence to enforce unjust, paternalistic laws (like those against marajuana), or lets third parties, like spammers, get their hands on the information it collects.
The only good reason for surveilence-phobia is that surveilence allows the government to enforce laws against "victimless crimes" (such laws are all unjust, in my opinion) that would otherwise be virtually impossible to enforce. Denying the government surveilence denies it the ability to enforce big-brotherish laws, but also weakens its ability to enforce good laws, like ones against murder. Civil rights advocates should be focusing on abolishing unjust laws that surveilence is used to enforce, not weakening law enforcement as a whole by stopping surveilence.

Re:What's with this surveilence-phobia?

[gilroy]

Blockquoth the poster:

You have nothing to fear unless you are doing something illegal.

And there we have it, ladies and gentlemen -- the exact sentiment that will help destroy justice and the rule of law.

We worry about too much surveillance because it empowers law enforcement far beyond what it needs. The surveillance society cannot be free, because every person must worry at every moment that he/she is under surveillance. What's more, as law enforcement rushes to make more of the citizenry's actions public through surveillance, law enforcement also demands that more of its own actions be made secret -- thereby undermining the public oversight that is the fundament of American liberty.

If we could count on the police to only use this when needed and justified, well, then we wouldn't need excessive brutality laws, Miranda rights, or any of the other trappings of a civil society.

I am not against law enforcement -- my family is deep in law enforcement -- but I am against unaccountable law enforcement. I am against intrusive law enforcement. I am against law enforcement that sees every citizen as merely a crook who hasn't been caught yet.

There are good cops, there are good DAs, there are good judges. You know what? They play by the rules and they welcome the active oversight of an informed public. When one of the anniversaries of Miranda rolled around, a news organization interviewed a bunch of tough law enforcment types to see what impact the decision had had... how many criminals had walked on "technicalities". You know what? Most of the cops said, the Miranda process strengthened law enforcement, because it marked clear boundaries and built civic trust in the justice process.

It is not a choice between liberties and law. The two can coexist... people are just too lazy to see how.

Laptops?

[st0rmshad0w]

And how exactly are they going to deal with all the serious criminals who use laptops and are never without them?

Re:Laptops?

[analyst99]

Mandatory Laptop Registration

Before you can purchase a Laptop you will need to show at least one picture I.D. and then give your full mailing and street address. That way if you become a susepct the P.T.B. can just break into your residence and swap your hard drive ;0)

A technical point

[WyldOne]

After reading the judges filing, I think that keylogger should be classified as a wire tap device. Therefore; you would need a wire-tap order to use it, and not a search and seizure.

I look at it this way: A search and seisure looks for something that exists at the time the warrant is acted upon. A wire tap is a method of obtaining information that does not exist 'right now' hoping that it might be useful eg. evidence gathering.

Now if they find the password on a piece of paper they seized, well then too bad.

Radiohead

[Anonymous Coward]

Wrong. Lyrically they are the smartest rock back around these days and musically they're top class.

So shut up, get back into your room and start listening your GWAR mp3s, you twit.

Re:Radiohead

[Anonymous Coward]

Lyrically they are the smartest rock band around these days

WTF is so smart about this?

That there
That's not me
I go
Where I please
I walk through walls
I float down the Liffey
I'm not here
This isn't happening
I'm not here
I'm not here

In a little while
I'll be gone
The moment's already passed
Yeah it's gone
And I'm not here
This isn't happening
I'm not here
I'm not here

Strobe lights and blown speakers
Fireworks and hurricanes
I'm not here
This isn't happening
I'm not here
I'm not here

Nothing, that's what. That is just godawful, terrible songwriting. How anyone can listen to that and call it "smart" is beyond me. And don't even get me started on their complete lack of musical talent.

I have 2 keyboards...

[Anonymous Coward]

1 for whackin & 1 for hackin! lol

Whats a man got left to fight for?

[Damon C. Richardson]

When he's bought his freedom.

Face it kids. The Government has been wanting to take what little rights we have away for a long time. Thanks to OBL and a american public that thinks it will never affect them they have it now. It's like a salesman that gets his foot in the door.

for years "Law enforcement" has been bitching that they need more powers to catch "bad guys" the fact is they are full of it! They have had more then enough power to stop everything that happened... But now they have a new weapon to bilk the american public out of even more rights. Now instead of the public houseing searchs of the late 80's leading to highway soberity check points. You now get to look forward to "Law enforcement" having the ablity to monitor every communication you have. Think I'm joking? Just wait. The world is full of Lemmins and the only thing you need to know about being a lemmin is to run when all the other lemmins run. The Gov knows that America is full of good little lemmins and they just love it when you run.

Yes Sept 11th was a terrible thing to happen.

But to throw out everything our veteran's of war have fought for ( me included ) is insane!

You can all pretend that the Bush administration has the support of the people but the fact is that there are citizens that are afraid to speak up about the way the Bush administration has handled and propagated the fear of the American people. Thanks to the idiots that think "My country right or wrong." and a mob mentality. Well Our country is wrong. Sept 11 is a far sadder day then most of you will ever know. We are losing alot right now. And no one person or group seems to be able to stop this nightmare domino affect.

Doesn't anyone think this never ending war is a little TOO much like the made up conflict in the movie 1984? I do! I would have died for my country in 1991. But now only one thing remains, distrust.

Can a logger be detected or stopped?

[joshv]

Is there any reliable way to detect the characteristic activities of a keylogger? Rather than trusting a virus scanner, or trying to keep every possible back door fixed, I would like a utility that would look for suspicious activity indicative of such a key logging attack. I am assuming though that this would be relatively operating system dependent.

Beyond this, are there ways of making the operating system itself immune to keylogging? In windows this might be a custom keyboard driver. In Linux perhaps a kernel module.

No matter what you do they can always log at the hardware level (essentially bug your keyboard), but it'd be nice to make it as hard as possible for them.

-josh

Re:Can a logger be detected or stopped?

[Anonymous Coward]

And what about the technology used bye the NSA... it scanned signals generated bye the electronic circuits of the keyboard to log every key... What are you going to do against that!?!? live in a metal box?!!?

Quantum Keyboards

[argoff]

There is a theoretical solution to this, using quantum diodes and open source software it is possible to create an untapable system. The quantum diodes would be part of an optical based keyboard. When any photons are prematurely observed, the whole thing errors out.

The nature of open source software would make it difficult to add flaws that couldn't be detected if wanted. In fact, the encription program could do MD5 sums on the kernel and all parts of the OS that grap keystrokes making that impossible too.

Other ways like a video grab of the keyboard, or biometrics on the individual typing could be done too. But I think the simplest way would be with a smart card that had a mini ATM keyboard on it. The user would keep it in his wallet at all times, and key in a pin before using it - too many guesses would permanently disable it.

Alternatively ...

[Tim Ward]

... if you want to catch criminals, to make it safer for you to walk down the street, why not make a donation to your local police force?

I dunno what it's like in the US, but over here the police are always having to turn down requests from the public to enforce the law because they don't have enough money.

Re:Alternatively ...

[King_TJ]

Umm, no ... here in the U.S., police officers still take "requests" without any problems.

If you call, they'll show up.

Granted, our police officers are probably underpaid for the work they do - but I have no inclination to give any of them donations either.
I've already done so, indirectly, by paying for a couple of exhorbitantly expensive speeding tickets.

(In fact, I paid a lawyer to get them reduced to plain old parking tickets, but the "court costs" alone were close to $200 for each of them. Obviously, they're making plenty of money off of their traffic courts.)

FUCK THEM.

[phat_rat]

I say fuck the FBI,if I catch one of them little bitches on my system Ill take my rights to the limit and self-defend.Whos with me?I mean..do they think that THEIR HACKERS should have special rights?If I catch one and pinpoint his ass..Ill take it to court and sue the government,we need to start a movement..we need to get rid of the queer fucks..

WHO IS FUCKING WITH ME?DEFY THE FUCKING FEDERAL GOVERNMENT AND FRY THE FUCKING FEDERAL HACKERS!

Re:FUCK THEM.

[Anonymous Coward]

I think it's time we opened an investigation on you...

Physical Security

[Anonymous Coward]

Get a laptop for your criminal activities, use pgp to crypt your files and NEVER connect to the internet. (We're just talking about business records) Sleep with the laptop under your pillow, take it everywhere you go, and if you suspect it's been compromised, sell it on EBay with a formatted hard drive and get a new laptop. These methods depend on thier physical or network access to your computer. If it's that important don't give them either chance.

Let's seem them sniff, or tap that.

What about broadband users?

[bedmison]

If this thing is configured to not catch keystrokes when the modem is active, what does that mean for crooks with "always on" broadband links like DSL or cable modems? Would that require a search warrant and a WIRETAP warrant ? Wiretaps are much more difficult to get...

Also, there is the extended issue of ethernet being a broadcast medium. Thus, there is the potential for intrusion on a system OTHER THAN the system targeted by the warrant. Could you get a search warrant authorizing the government to exploit a known security hole in Windows, for example, in order to gather evidence? At least with this keystroke recorder, you might realize something was going on by looking for files/apps you don't recognize.

mobsters typing?

[Anonymous Coward]

I've been watching a lot of the Soprano's lately (2nd season on DVD - Excellent), and the only guy on the show who types at all is Christopher Maltani (sp?), and he is typing screenplays. And I don't believe anyone in the Godfather series typed on a computer at all. If the FBI think they'll catch mobsters, I think they're barking up the wrong tree.

lawyer: really a procedural question

[hawk]

I am a lawyer, but this is not legal advice. If you need that, pay a properly licensed attorney

>It is important for law enforcement to have the
>tools at their disposal to be able to properly
>investigate crime and gather evidence.

yes, but this is largely a procedural issue. THere *was* judicial oversight, and there definitely *will be* judicial oversight.
The question is as to the *form* the oversight should take. A very simple look over the shoulder, such a as a warrant, or the higher standard we use with a more intrusive wiretap. In *some* way there will be judicial approval. the question is how.

hawk

Try not being a loan sharking mobster scumbag

[nanojath]

I wonder how many of you freedom fighters actually read the judges actual decision. Here are the real facts of the case, which you will find nowhere in the Wired article: The FBI went in with a warrant that very specifically defined what they could look for, including files on the computer, and specifically stated that they could install gadgets for the specific purpose of seeking an encryption password. If the feds have probable cause on you for comitting a crime then yes, they could very well throw one of these things on your computer and shake down your password, with a valid warrant expressly permitting that action. Big fucking deal. This seems totally valid to me, it isn't a wire tap and it sure doesn't look to me like the exercise of a general warrant, a judge sent them in with the tools to look for a specific piece of information that they had probable cause to believe would implicate criminal activity and they did so and no more. Read the decision. It is thoroughly and thoughtfully executed with a great deal of explanation and precedent supporting the judges decision. Scarfo's attornies' objections, on the other hand, look exactly like what they are: straw-grasping attempts to get damning evidence thrown out on technicalities of dubious merit. Get over it.

Good for crypto

[Elvis Maximus]

I actually think the Scarfo case is a good thing. The logger was used in accordance with a court order, and the whole thing gives lie to the argument that we can't have readily available crypto because it makes the actual bad guys invulnerable to law enforcement.

Re:Good for crypto

[BACbKA]

Agreed, but the main case against in that argument usually refers to intercepting the data while you don't know how to physically catch them. It is not as much about trying to catch them with a "smoking gun", where the crypto just "obscures the smoke" (as in the Scarfo's case).

when we dont here

[cyberbob2010]

while i am just as concerned about this as everyone else. the problem comes when the technologies and methods used are not disclosed
when the gov. starts using tech to spy on us but we arent even aware that they are even capable or when we quit getting info like this is when the
fbi is allowed to run rampant because, if they can tap what we do withought us knowing then whats to keep them from doing other more harmfull things withought us knowing im all for the counterterrorism measures being taken but i would rather live in danger than sacrafice my rights
srry, typing with DC controller

What's wrong with the FBI sniffing keyboards?

[Anonymous Coward]

I sniff mine every day. Smells nice after having used that air freshener on it. Why shouldn't the
FBI be able to do it? They're people too.

In future news...

[weave]

April 1, 2002, Wilmington, Delaware: The FBI's plans to install keyboard sniffing programs on "mobsters'" computers was dealt a serious setback last month when it was revealed that some old crotchity hacker named Zorch revealed he had a patent on "keyboard sniffers." The patent describes a program that covertly installs itself onto an unsuspecting individual's computer and records keystrokes for later examination.

Zorch released a statement two weeks ago saying that he was not interested in licensing his invention to the United States government at any cost.

Neither friends nor family have heard from Zorch for the past two weeks. His whereabouts are unknown.

CIPA???

[Anonymous Coward]

The interesting thing about this case is the FBI invoking CIPA so they don't have to explain to the defense how the KLS actually did not violate the rights of the defendant. A secret meeting was held between the government and the judge. The defense was never allowed to know how the KLS actually worked because of "National Security".

Judge:
"So how do you know Mr. Public broke the law?"

Justice department:
"The super secret squirrel told us so"

Judge:
"The super secret whaaa???"

Justice department:
"Its secret, we can't discuss it, National Securtiy and all"

Judge:
"National Security, why didn't you say so..."

Once again the MAN takes a big bite.....

[Newer Guy]

Once again the MAN takes a big bite out of our civil liberties! My problem isn't with what they did actually...it's with the arrogance they show. OUR government, under the guise of protecting US in reality is permanently eroding OUR freedoms. What's truly scary is that they feel like because they're the 'good guys' then they're allowed to 'bend' a law or two, to 'take away' a freedom or two...it's okay, because they're the righteous 'good guys', remember? To me, the line between good and evil gets very blurry when this kind of crap is allowed to happen. Is it okay for 'good' to act in 'evil ways' to catch 'evil'? I don't believe so. I don't trust law enforcement any more then the criminals! In fact, I think I may trust the criminals more...at least with them you KNOW what you're getting. You know what to expect. With the govt., you really don't know any more. Unfortuantly, too many people show way too much apathy these days, which allows this crap to fester. Our system of politics needs scrutiny, citizen input and checks and balances to work properly...to keep it 'honest'. That just isn't happening any more....and that's really sad.

Secret. Heh.

[dmaxwell]

How many people here would LOVE to catch someone in the act of futzing with their boxes? If they try this on someone who is halfway awake then the cat is out of the bag. One way or another, the software and physical devices involved are going to be revealed. If they're lucky, it will be "HA! HA!" cypherpunk style messages posted loudly to the net. If they're unlucky then organized crime types are going to have a joyous time feeding them misinformation. Mafiosi can employ good IT and security people too. If enough of this sort of thing happens then they certainly will.

Re:Secret. Heh.

[gilroy]

Blockquoth the poster:

Mafiosi can employ good IT and security people too.

Of course they can, like Cosmo. :)

Martin Bishop: Organized crime?

Cosmo: Hah. Don't kid yourself. It's not that organized.

You are SO off base!

[Newer Guy]

Okay..so your argument is:. "Well, it's okay to take away a small amount of freedom for security's sake". Am I right there? Okay...that's fine..until the NEXT time comes around....and the NEXT time and so on and so on.... Then one day you wake up and find that a BIG chunk of your freedom is gone! Tell me..where do YOU draw the line?? How much freedom can be taken away before YOU think too much is too much? Searches without warrants? How about just bugging everyone? Do you even HAVE a line? Where is it? See, law enforcement (and I used to work in it) works on this premise: they zero in on a POSSIBLE suspect and then do their best to PROVE they did it. In other words, they employ 'tunnel vision'. They don't care if the person is guilty or innocent..all they care is can they get a CONVICTION! I know of proscecutors who KNEW who really DID a crime..and yet they put an INNOCENT PERSON IN PRISON for the crime..did you just hear me? They put a person in PRISON that they KNEW FOR A FACT WAS INNOCENT!!!! People complain all the time that guilty people sometimes go free. WELL...it also works the other way! Do you know how many innocent people are in jail? Let me assure you, it's a lot more then you think! There's even been a couple of people who have been PUT TO DEATH only to later find out thet they were innocent. But you think that's okay, don't you? Why not fry a few for the greater good, right? Until that day when they come for you, that is..... Let me clue you into something....by the time THAT happens, it'll probably be too late.

Re:You are SO off base!

[Hatechall]

The point of my post was to say that there IS NO LINE. It is up to us, the citizens, to define how much freedom encompasses. Not to sound dramatic, but it is a continual battle to mold how society thinks about freedom and restrictions.

Nothing is absolute as you make it out to be. It is simple and easy to say: freedom is good, Limits are bad, but it is a much more complicated issue that to figure out the balance between extremes.

And of course its never perfect. Nothing is. And it is a great shame that there has to be errors in the justice system, based on errors in humans. And yes, of course you have some valid arguements. But do you think that giving everyone infinite freedoms will stop unjust actions?
Think about it.

No, REALLY think about it.

Thomas Jefferson beat you to this saying....

[Newer Guy]

By about 225 years... "People who are willing to sacrifice liberty for security deserve neither".

Niche product : GPG encrypted keyboards!

[billcopc]

If you really want to piss off would-be keyloggers, build a keyboard solution that encrypts the scancodes somehow, right inside the keyboard's encoder chip, so that the keypress info is undecipherable to any device hooked between your keyboard and the PC. Then sell the idea for thousands of bucks to mob kings!

Anyone notice?

[Daunting*Alligheri]

That cleverly placed to the side of the Scarfo piece is an ad for the Sopranos DVD? Its advertising in action... ooo...

dvorak

[FigBug]

what if you use a dvorak keyboard?

Serial modem never blocks kbd logger?

[BACbKA]

Others have rightfully mentioned that most stuff that goes out on the wire (like email) is often typed offline. OK, so maybe the judge didn't understand this subtlety and missed this point.

But it looks from the article that the FBI convinced him (and the defense) that by blocking the logger during the modem activity, truly "online" communications won't be looked at. Such as, say, intercepts of passwds from within a telnet window session.

My point is that it is not true as well! At least, if you have a 1-CPU box, and especially if the modem is a "winmodem", actual sending or receiving of data via the modem channel is not done simultaneously with the keyboard interrupt processing, because both are different CPU-intensive tasks (actually done in different level interrupt handlers.) For other OS+hardware combinations this also might happen, but I don't exactly know what the suspect had in his PC.

Also, sometimes, especially with things that fingers are used to, one can actually type things ahead of the transmission start into an online communication channel...

No weapon is good on foolish hands.

[Anonymous Coward]

I fell pretty scared about these issues.

Think, FBI and CIA have fabulous resources, and they are claiming for more and more... However, they failed in preventing all tha greats tragedies that stroke USA.

Someone says Oklahoma? Timothy McVeigh? How about Terry Nichols and his Freemen movement? Why in the hell all that people wasn't investigated? Or they was, but FBI shutted their mouth?

Why give more money for people that don't know how to use the money they already have?

Why give more power for people that don't know how to use the power they already have?

Why we will, as always, pay with our freedom the mistakes done by the goverment?

MOD PARENT DOWN

[Anonymous Coward]

you're the terrorist

What I fear

[leereyno]

I fear the forces of "law enforcement" far more than I do their new boogie man of choice, terrorists. I fear them more than I do drug dealers, kiddie porn perverts, communists, or any of the other boogie men used in the past to justify increased powers and decreased accountability or oversight.

What the government fears the people there is freedom. When the people fear the government there is tyrrany. Guess which scenario we live in?

Lee

More like evidence in your car trunk

[billstewart]

It's not so much like the bag of dope on your car seat - it's more like them sneaking in your house, copying your car keys, opening your trunk, and finding the bag of dope there.

Sniffing Passwords vs. Sniffing File Contents

[billstewart]

Of course the whole case is bogus, and allowing cops to exercise warrants on people in secret rather than to their face are bogus, and laws against gambling are bogus, especially in states that run lotteries themselves, and racketeering laws that make conspiracy to repeatedly run gambling games into Federal crimes are bogus (yer winnings, governor!), and bogus laws like that encourage gambling to be run by thugs like Scarfo, and the idea that Feds should be able to call technology like this "classified information" when you can buy products that do this on the street and when they're lobbying Congress to let them develop better ones is bogus, but leaving all of that aside....
There's a difference between the Feds sniffing the passphrase, which is indirect evidence, and sniffing the contents of the file as he typed it, which would have been more direct evidence had they done that. The Feds are trying to hide how they stole the passphrase, and they're arguing about exactly what kind of warrant is needed for stealing it (wiretap vs. search warrant), but once they've stolen the passphrase and legally obtained the encrypted file, they can use it to show a jury that the passphrase they stole decrypts the file into the text they're alleging that Scarfo typed which allegedly shows that he's a mobster. And if they'd simply guessed the passphrase (hint, don't use simple words or your father's prison ID # as your passphrase) they could have done the same. By contrast, if they'd used the SEEKRIT keyboardsniffer to snarf up the file itself, they'd have to tell the jury "Nicky really typed this incriminating letter, trust us, we can't tell you how we know that, cuz it's RILLY SEEKRIT, but we're the FBI and we'd never lie to you, so he's GUILTY GUILTY GUILTY", they'd have a much weaker case. (Any self-respecting jury would throw them out on their expletive-deleted for even trying that, but American juries often fall for that sort of thing, and judges fall for it even more often.)

US rules of evidence, since the early-1960s Supreme Court decisions which promulgated the "Exclusionary Rule", say that you can't use illegally obtained evidence, and there's a doctrine called "Fruit of the Poisoned Tree" which says that if you illegally obtain information that you use to obtain other information, you can't use that as evidence either. So if they'd beaten or tortured the information out of Scarfo, or if they hadn't had a warrant when they first searched his computer, they'd be unable to use it legally, which is part of why Scarfo's lawyers were arguing about the precise type of warrant they needed before stealing his passphrase.

On the other hand, if they'd gone asking around the mobster social club if anybody wanted to call in an anonymous tip with Nicky's usual passwords or offering get-out-of-jail-free cards to temporarily-retired mobsters in return for the passphrase, that'd be legal, and unlike the cases where stool pigeons give false testimony about people in return for reduced jail time, a passphrase is demonstrably either correct or incorrect. (And of course, an "anonymous tip" is often nearly indistinguishable from illegally gathered evidence used to obtain a search warrant.)

The real issue here

[Anonymous Coward]

Is not whether or not it's right for the FBI to intercept your communications. As long as they have a warrant, I have no problem with this, 4th amendment, 5th amendment or otherwise.

My problem is with judges who find probable cause in "Of course your honor, he's guilty, just give us the warrant and we'll prove it".

We live in a society that goes bonkers over any crime, remember how pissed most of you got when OJ was acquitted? Since judges are (unfortunately) politicians they have to do what society wants of them otherwise they'll never make it to the circuit court or the supreme court.

It will not change, because for it to change, most of us will have to want it to change, and that just ain't the case.

The saying used to be "It's better for 10 guilty men to go free than for 1 innocent man to go to jail." We used to believe that. Some of us still do. But when people are so easily outraged, so few of us actually voting on election day, and the desire of any reasonable person (judges included) to keep his/her job. Does this really surprise any of you?

Well this is odd...

[Xemoka]

Ok think about this.. The FBI gets a warent to be able to place this software on your computer, but how are they going to do this without breaking the "Terrorist" item that bush created... deaming that all "Hacking" "Cracking" or "Script-Kiddies" are deamed terrorists.. before you know it the entire FBI will be behind bars.. HA! What fun!

If you call, they'll show up

[Tim Ward]

Not here.

Your call is compared to all the other outstanding calls and if they're busy they only go to the highest priority ones.

Many people here say they want to pay more of the relevant local tax so as to get more police, but the politicians seem not to believe them and don't do it.

BTW, anyone who doesn't really understand what the police do with their time might find it interesting to spend a shift riding (or cycling or whatever) round with their local policeman. Access to this service is likely to differ in different places, but I just had to ask nicely.

Re: AOL and the Mob

[satanami69]

(Scarfo used AOL dialup).

The FBI should have just waited until he started up AIM and got him then...

defense against key loggers...

[Anonymous Coward]

Could virtual keyboards like the one offered by CryptoHeaven and E-gold defend against password sniffing trojans?

quiet keyboard

[azidtryp]

after reading the judges decision on the scarfo evidence ruling. This bit stuck out in my mind.

" Recognizing that Scarfo's computer had a modem and thus was capable of transmitting electronic communications via the modem, the F.B.I. configured the KLS to avoid intercepting electronic communications typed on the keyboard and simultaneously transmitted in real time via the communication ports. See Murch Aff., 6. To do this, the F.B.I. designed the component "so that each keystroke was evaluated individually." See id.

As Mr. Murch explained: The default status of the keystroke component was set so that, on entry, a keystroke was normally not recorded. Upon entry or selection of a keyboard key by a user, the KLS checked the status of each communication port installed on the computer, and, all communication ports indicated inactivity, meaning that the modem was not using any port at that time, then the keystroke in question would be recorded.

Murch Aff., 6.
Hence, when the modem was operating, the KLS did not record keystrokes. It was designed to prohibit the capture of keyboard keystrokes whenever the modem operated. See Murch Aff., 15. Since Scarfo's computer possessed no other means of communicating with another computer save for the modem, see Murch Aff., 6, the KLS did not intercept any wire communications.See footnote 55 Accordingly, the Defendants' motion to suppress evidence for violation of Title III is denied."

Does this mean that if we keep a stream uploading or downloading constantly, they can't use the keylogger against us?

thoughts ??