Slashdot Mirror


Too slow! FBI Shuts Down Hosting Service

Chope writes "If FBI agents showed up at your data center bearing a warrant, would you be able to provide them prompt access to customer data? BZZZZT! I'm sorry, but you've taken too long to answer. We'll be confiscating all the hardware you use, er, used to use, to run your business. But we'll get it back to you 'real soon now.' Thank you for playing. CarrierHotels.com is carrying the story of a FBI raid on a web hosting company. When the hosting company didn't and/or couldn't provide the information the FBI was looking from its several terabytes of data within "several hours", the FBI decided it was more "efficient" to seize all the web servers and customer data as part of the FBI's investigation of a hacking incident."

58 of 928 comments (clear)

  1. More to the story by OPTiX_iNC · · Score: 3, Interesting

    I'm sure there is more to the story than what we are hearing...

    I wonder what the FBI was looking for.

    1. Re:More to the story by Alranor · · Score: 5, Interesting
      "The phrase
      "I disapprove of what you say, but I will defend to the death your right to say it"
      is widely attributed to Voltaire, but cannot be found in his writings. With good reason. The phrase was invented by a later author as an epitome of his attitude. It appeared in The Friends of Voltaire (1906), written by Evelyn Beatrice Hall under the pseudonym S[tephen] G. Tallentyre."

      (from here )
  2. Poor hosting company by Anonymous Coward · · Score: 5, Interesting

    The poor hosting company probably has ToS to live up to. This will ruin them.

    If nothing is found, will they have any recourse against the FBI or are they screwed?

    1. Re:Poor hosting company by LostCluster · · Score: 4, Interesting

      The poor hosting company probably has ToS to live up to. This will ruin them.

      Law always beats a ToS. If the FBI comes with a warrant for a piece of customer data, you've got to turn it over even if your ToS/Privacy Policy says you won't. To avoid getting caught in this jam, include a statement saying you'll turn over anything to any authority who presents a proper warrant.

      If their business was based on not turning anything over to the spooks, well, so much for that idea.

  3. How about the sustained financial damage? by devilkin · · Score: 4, Interesting

    And what if you run your website on those servers for commercial use? Will the FBI refund the finanial damage you suffered (e.g. when you run a webshop or smthing)?

    1. Re:How about the sustained financial damage? by misterpies · · Score: 2, Interesting

      >>You think they should compensate all the businesses that were affected?

      Suppose it was your business. You're not doing too well, but you've just had a big order that will keep you afloat. But the police close down the area and you can't fulfill. Maybe you sell perishable goods, so your stock is now worthless. You didn't fulfill the order, so you don't have the money to pay your supplier for the now-worthless stock. You have no option but to declare yourself bankrupt. You lose your business, your house and your car. All because of the police closing the road.

      Still so sure you shouldn't get any compensation?

      --
      The author of this post asserts his moral rights.
    2. Re:How about the sustained financial damage? by micromoog · · Score: 2, Interesting

      Have you seen the latest polls? Bush is on the run, and it's only February. Expect his dirtiest of tricks shortly.

  4. more important (?) how much customer data stored? by buzban · · Score: 5, Interesting

    IDNRADC (I do not run a data center), but don't let that stop me from making a completely unqualified comment ;) ....

    Perhaps just as important, or more important, are you storing customer data that could/should be regularly deleted? Not that burning everything when the FBI shows up is the best option, but having a sensible scheme for what needs to be stored, and what would be better deleted and overwritten, seems to me to be important...

  5. Foonet... by Anonymous Coward · · Score: 1, Interesting

    Some one who has been spamming using my domain as fake from addresses - cdatlow.com, their payment processor is heavily involved in some sort of credit card fraud; when poking around, i noticed a mysql connection error, to a host in foonet.

    I wonder if this sort of activity has anything to do with it...

  6. IRC servers huh? by dickiedoodles · · Score: 2, Interesting

    What do you think the chances are that this has something to do with the microsoft source code leak?

    --
    In Soviet Russia Slashdot cliches use you
  7. The FBI is already returning some equipment... by shyster · · Score: 5, Interesting
    Looks like the seizure occurred on 02/14, and that as of 2/23 some servers have already been shipped back and put back on-line. As of now, their IRC network is still down...though it's unclear whether that's due to an FBI decision, the FBI still having their servers, or a CITHosting decision.

    The only thing I find a bit odd about this whole thing is that it looks like they too the opportunity to relocate their data center to Chicago (it was previously in Cleveland). According to their news,

    The FBI has begun retuning equipment to CIT which is being shipped to our new facilities in Chicago.

    Wouldn't that unnecessarily delay the process of restoring service to their customers? Was the move already planned, or did they suddenly decide that they needed a different data center? Is it possible they're blowing the seize out of proportion in order to cover outages due to their move? Or did the seizure even actually happen?

  8. Seems to blow a hole in the theory.. by Linker3000 · · Score: 4, Interesting

    ...that 'the powers that be' are monitoring everything 'on the fly', if they need to get their hands on the physical data repository to check it out.

    --
    AT&ROFLMAO
  9. Re:I wonder... by AlgoRhythm · · Score: 2, Interesting

    ... but if they did it then there must have been something going on.

    Riiiiiiight, 'cause the FBI has always got the best interests of the american people on their minds ... they would NEVER do anything of questionable ethics.

  10. Re:Not fast enough by whathappenedtomonday · · Score: 3, Interesting
    you know, whenever europeans read such stories, there comes that awful feeling again - that something within the US must be terribly wrong and - what is more - only a few people seem to care or even notice.

    Was I abducted by aliens and brought to Bizarro world

    no need to bring you there - and no aliens involved, either ;)

    see the link in my sig if you care to see how the authorities made such things possible.
    (check each of the "14 Defining Characteristics" you recognize, count checks and post your results ;)

    --
    I hope I didn't brain my damage.
  11. Re:script kiddy and spam proxy heaven by Anonymous Coward · · Score: 1, Interesting

    +2 from AC...now for the rest of the story...
    The virus that hit the NT server came from the only other NT boxes in the place which were deep behind firewalls. It appears that a sysadmin's PC got a virus via his broadband connection and the PC remote control software was used by the virus to hit the internal servers and then it started network scanning and installed another virus on the mostly protected NT box which then turned into a spam proxy. Once it triggered the alarm (by attempting to talk outside), I moved it to the lab where I let it talk out and it phoned home to collect spam to realy. It then tried to send billions of messages.

    Friends don't let windows boxes talk to each other.

  12. Re:FBI?? by takev · · Score: 2, Interesting

    Then again, I live in the Netherlands but I was at work in Belgium and in the hotel I was watching the news.

    There was a kidnapping of a rich kid (who lived in the netherlands) and he was found (alive) in belgium. This doesn't happen very much where I live (or at least it isn't reported).

    Now the interesting thing was, that the FBI helped in the investigation. The news didn't report why FBI agents helped, so I couldn't comment. It could be just some agents in a foreign exchange program though.

  13. Related Stories by Rameriez · · Score: 2, Interesting

    I believe this has something to do with with recent shutdown of the mIRCx IRC network (see: http://www.mircx.com/irc.html). There are rumours (see: http://kashin-anime.edwardk.info/mircx_downtime.tx t) of a DDoS "botnet" being held on foonet, which may have been responsible for recent IRC network attacks. This is just speculation however, I'm not sure I should believe that the FBI would take action against the attack of an IRC network with a less-than-wholesome reputation.

  14. They had good reasons to shut them down, indeed : by skaya · · Score: 5, Interesting

    I can't get access to the article, but I guess that the story is about the shutdown of FooNet. FooNet isn't a "real" hosting solution ; it's a cheap shell provider for script kiddies who want to have their own ircd. They might also provide "serious" hosting services ; but as soon as one provides shell services for such a targetted audience, she knows that she will have to handle some specific problems - DDOS, flood, etc.

    And according to what I know about the FooNet shutdown (if that's the same story), there was thousands of DDOS "drones" located at the datacenter, and the staff of the datacenter failed to shut them down. That sounds very dubious to me, but you might want to check this for another side of the story ...

    Quoting :

    "Perhaps the blackest of the black hat networks is finally gone, raided by the FBI. Foonet was home of spammers, packet kiddies, script kiddies, carders, and other illegal activities, as documented in the links below."

    PS: if the shutdown mentionned isn't the FooNet one, ignore this post :-)

  15. Re:FBI?? by Shinobi · · Score: 2, Interesting

    Actually, several FBI agents have been seized and more or less thrown out of the country by Swedish police, for failing to comply with Swedish law and international treaties.

  16. Stupid feds... by ca1v1n · · Score: 2, Interesting

    Even if they had the authority to seize all the data, and it wouldn't surprise me if they in fact did not, they're MORONS for seizing everything. It's much easier to copy the data from on-site than to relocate everything and set it up, and THEN dump the data. It's also a lot less expensive. It also doesn't spread ill will among people who are helping your investigation.

    After 9 days they've just barely started to get back up and running again. I guess the real moral of the story is to have an off-site co-lo contract you can activate in a heartbeat. Terabytes of backup restore would be a real pain though.

    As I understand it, suing the government over things like this is nearly impossible. They still might be able to sue the agent on whose authority the seizure was conducted. Proving damage is trivial. I think if they can convince a jury that it was a case of gross negligence, the usual government protections don't apply. Any lawyers in the house?

  17. Re:Move a complete data-center??? by denlin · · Score: 2, Interesting

    I don't buy it! How can they move that stuff, not only physically, but also logically? To re-plug the servers, they need:

    a suitable network, with configured routers, auth./DNS servers...
    logins/passwords for the servers
    knowledge, and not only general tech but specific setup of that company servers


    i suspect they took out the hds & disconnected the raid cans & pluged them into another machine.

    Normally (in democratic/free world), an investigation means a judge, some reasons, some rule brake, some arguments on why the police is acting.

    earlier in december, president bush signed legislation expanding the authority of the bureau and other u.s. authorities conducting counterterrorist intelligence. the law authorizes them to demand records from financial companies including casinos without seeking court approval.

    --
    Yes, I have RTFA. Yes, I have a girlfriend. Yes, I'm new here. And no, I don't want a free iPod.
  18. Re:Full Text by Anonymous Coward · · Score: 2, Interesting

    Haha That asshole ArGG finally got what he deserved.

    I use to hang on Undernet, and ArGG (Owner of FooNet) use to have a botnet that had been loaded with DoS attacks. He would wreak havoc on any channel that opposed him.

    Not sure if he is still into script kiddying, but I could see why the FBI would just take his shit. Knowing that fuck, he probably DoS'd the wrong server.

    FBI Probably knew that he'd probably delete/cover his tracks if it wasn't for the confiscation.

  19. Re:They had good reasons to shut them down, indeed by CommanderTaco · · Score: 5, Interesting

    No, it turns out you are right, cit & foonet are one and the same. http://www.easynetworknyc.com/foonet/

  20. Re:They had a warrant by UrGeek · · Score: 2, Interesting

    Give me a break. We have SECRET courts with judges who sit and rubber stamp just about anything the FBI or other jackbooted Imperial Stormtroopers want. The American Dream of freedom and righteous is dead and if you believe otherwise, you among the millions of sheep get sheared. Do not step out of line or you will be mutton!

    Watching the happy supporters of the Mad Emperor, laughing at the spoilage of the Old Egomanic, I see we have no shortage of sheep. Our oppressors will continue to use the Constitution for toilet paper.

  21. Re:There's gotta be more to this by Total_Wimp · · Score: 1, Interesting

    It's this kind of attitude that lets our police get away with so much crap. I'm tired at giving the police the benefit of the doubt while they stomp on our rights.

    TW

  22. Re:Move a complete data-center??? by DA-MAN · · Score: 3, Interesting

    I don't buy it! How can they move that stuff, not only physically, but also logically? To re-plug the servers, they need:

    Or they can clone all the drives with ghost (now with ext3 support) and use Ghost Explorer in Windows to find specific files and folders without ever booting the machines into Linux and dealing with bullshit. (also dd/mount -o loop)

    I prefer to read (between the lines) that they wanted something to be stopped, and eventually an occasion to get the information on the long term (weeks at least) on who/where it is

    I believe one of two things:
    1) They possibly thought whatever was going on might have been contributed to by someone on the inside and didn't want to give time for people to erase evidence. Maybe a raving lunatic anonymous coward but link.
    2) They got impatient and thought they could do it faster, which probably ended up not being the case.

    The strange part, for a European citizen like me, is that no reason at all is given. Normally (in democratic/free world), an investigation means a judge, some reasons, some rule brake, some arguments on why the police is acting.

    A warrant means that a Judge signed off on the investigation. They were able to convince a Judge that they had probable cause, how is this different from Europe? (I'm not trolling, I just don't know much about the legal system in European Countries and realize that it probably differs from Euro Country to Euro Country)

    I hope that with these new laws in Europe we are not going to become like that too soon ;-).

    I agree, big brother is getting scary here in the states.

    --
    Can I get an eye poke?
    Dog House Forum
  23. I know all about this.... by Anonymous Coward · · Score: 1, Interesting

    The FBI took all of my computer equipment and held it for almost a year. When I got it back I found out that they never even went through it. They just took all my shit, boxed it up and put it on a shelf somewhere.

  24. Re:Unlawful search and seizure? by Tarwn · · Score: 2, Interesting

    Look at it this way, if the police had a search warrant to search your house because their was considerable evidence that the thieves had stopped at your house, and they found the get away car in the garage, or the carefully drawn-out plans, would they not have the right to take these items because it was not in their warrant?

    Sorry. Now this situation may have been a little differant, and the FBI had a warrant to search the data (and possibly to temproraralyy move the servers, I haven't seen the warrant and doubt if you had either). Now considering that this company was hosting shell script accts and was overrun with all types of kiddie scripts and script kiddies, and the techs had done nothing about limiting the running scripts (or better yet removing them), and then could not find any data in 2 hours, I think the FBI was right to be a litttle concerned that the techs weren't trying to hard.
    Removal of the machines was in effect cordoning off the area so that no one would touch the data (ie, login to remove their scirpts, etc).

    But you can keep rooting for the script kiddies and spammers, we'll all stand behind you (ignore the snickers)

    --
    Whee signature.
  25. Re:They had a warrant by Anonymous Coward · · Score: 1, Interesting

    Before some of you "conspiracy theorists" start screaming about a police state and such, the FBI was acting in the bounds of the law, under a warrant issued by a judge.

    In a police state, the police tend to act within the bounds of the law too, why wouldn't they?

  26. Re:Kinda by metamatic · · Score: 3, Interesting

    Yeah, it's about time the FBI got involved in cleaning up the DDoS problem. Looks like there was at least plenty of circumstantial evidence that FooNet was harboring DDoS vandals and credit card scammers, so I don't have a problem with their suffering a few days of downtime while the situation is investigated. We're talking about people who destroy businesses and volunteer-run networks and rip off innocent bystanders to the tune of thousands of dollars each. I, for one, would like to see a few of them sent to prison.

    --
    GCHQ Quantum Insert installed. If only our tongues were made of glass, how much more careful we would be when we speak
  27. Re:They had a warrant by Asic+Eng · · Score: 1, Interesting
    As for those of you saying you're glad you don't live in the US, we are the most free, most law-abiding country in the world. While we may not be perfect, we're the best thing going. Sorry if I'm offending anyone, but I'm tired of hearing knee-jerk reactions to things

    How do you know, and how do you justify your knee-jerk "USA is best" claims? Did you really compare the rights and freedoms you have in other countries with yours? What makes you so sure you have more freedoms than others?

  28. Re:In response to a hacking incident? by flithm · · Score: 2, Interesting
    But seriously folks, yeah, the FBI is returning the equipment now, but how much damage was done to an innocent ISP just because the FBI couldn't figure out how to do on-site data mining?
    Everyone here is so quick to bash the FBI for doing what they did, but we can't really be sure what happened that caused them to confiscate their equipment. They may, in fact, be a an "innocent ISP," but in my experience how well any interaction goes really depends on both parties. For example maybe it went something like this:

    FBI: "We're going to need access to your logs."
    ISP: "Sorry, but the FBI can suck my ass."
    FBI: "We'll be back with the moving vans."

    or maybe it went like this:

    FBI: "We're going to need access to your logs."
    ISP: "Ahhh CRAP, CODE RED, CODE RED, hit the button JOHNNY THEY'RE ON TO US, JOOOHHHNNNYYY!!! [ahem] Sure thing FBI dudes."
    FBI: "We'll be back with the moving vans."

    and maybe it could have gone like this:

    FBI: "We're going to need access to your logs."
    ISP: "Sure no problem, we understand you want the requested information within two hours. We'll get you set up with stations you can use to search, and dedicate every available resource to helping you. We take this matter seriously."
    FBI: "Dammit, cancel the moving vans!"

    All I'm saying is... who knows what happened. If they were willing to wait two hours, then likely if diplomacy had gone well, they could have waiting three, or six, and eventually maybe a day or two.
  29. "no such thing as personal responsibility" by Anonymous Coward · · Score: 2, Interesting

    That's actually true, no matter how absurd Darrow's argument was. Especially in government.

    Yes, it's possible for Special Agent Joe Smith to disobey orders to seize data based on his own morality, but the practical upshot of that is that Joe Smith will be fired and replaced with someone willing to do the task. In the end, the task will get done no matter what Joe Smith's morality is - so how can he be held responsible for what is inevitable?

    Nations and their component organizations have monopoly over force, not individuals. If the FBI wants to search and destroy, the FBI is to blame, not its agents. (Even the word agent means 'representative'.) You don't shoot the messenger when the message is bad.

  30. Re:USA politics = one party system? by TheXRayStyle · · Score: 4, Interesting
    One thing you may want to look into is supporing Instant Runoff Voting. You can get some information about it here. It has been shown to be successful in places such as Papua New Guinea with an error less than that of US Presidential elections (yeah, what a high standard of comparison...). It allows people to vote their mind without worrying about a slightly lesser evil not getting their vote and losing to a greater one.

    Basically, it works like this: You rank the candidates in order and your first choice gets your first vote. All the votes are counted and the candidate with the least votes is eliminated. If the candidate eliminated is your first choice, then your vote goes to the second candidate on your list. This process continues until only one candidate is left, and they are then elected. (See the link above for a better explanation...)

    If this sounds like something you'd like instituted, contact your senators and representatives!

    Furthermore, support candidates such as Presidential Candidate Dennis Kucinich who have declared their support for IRV. As he says in his platform:

    I also support "Instant Runoff Voting." IRV offers a cost-effective way of insuring that the winning candidate is preferred by a majority of voters; it encourages voters to vote their wishes and not their fears; it promotes greater voter turnout and positive campaigning.
    I seriously believe that implimenting a system such as this is the best way to get out of the Kang "Go ahead, throw your vote away." mentality about 3rd party candidates that America seems to have. Hell, even I feel that way in this next election.

    Peace.

  31. Re:and....Absentee landlords. by Peter+Trepan · · Score: 2, Interesting

    I vote Libertarian.

    People tend not to vote for them because they are a "fringe" party, but if people did vote for them, they wouldn't be. Also, if you're disturbed by the party's more extreme views, keep in mind that the real extremists are already members, and as their membership increases, they can only become more moderate.

    Whatever you do, don't throw your vote away on a "small government" Republican or a "civil liberties" Democrat. They have never delivered what they've promised.

    --

    Step into a huge movement. Don't Tread In Me.

  32. Why wouldn't a disk mirror have worked? by mark-t · · Score: 2, Interesting

    When the FBI asked them for evidence, couldn't they have temporarily shut down to do a complete disk mirror, and handed over the mirror of their drives for the FBI to inspect at their leisure, that way ensuring that they stayed operational in the interim, but the FBI would still have the evidence they needed, even if the hacker somehow got back into their system to remove it?

  33. I'm Calling my Lawyer by rueger · · Score: 2, Interesting

    This story offers a very good example why ISPs and similar service providers should have the best lawyer possible on call. If nothing else they may have been able to halt or slow things while finding a judge who can come up with a more sensible solution.

    I see no good reason why the FBI should shut down an entire business with nothing more than search warrant. Surely such a warrant defines what exactly they are seeking, and it would have been reasonable for them to extract those chunks of data on-site.

    I have to conclude that the aim of the exersize was to shut down foo.net without the bother of legal proceedings, and it seems that they were successful.

  34. Re:and....Absentee landlords. by tippergore · · Score: 1, Interesting

    Voting very evil is the better option sometimes, because at least there's the hope that the evil will anger the people so greatly that the next time maybe there would be a viable option.

    Hey, remember Gore? If he was so likeable and so deserving to be the President of the United States, that is, if he was truly the best man for the job 4 years ago, what has changed? Why aren't the Democrats demanding he run again?

    Could it be that, perhaps, nobody liked him in the first place?

  35. Basement Datacenter by Anonymous Coward · · Score: 1, Interesting

    How would all of this change if your "datacenter" were the basement of your house, and the thing they were investigating was an IRC network run by the company doing the webhosting? It seems to me that if it were in a REAL datacenter, and not the owners basement, it might have gone over a little differently.

  36. Re:USA politics = one party system? by spitzak · · Score: 5, Interesting

    I have heard that instant runoff is mathmatically broken and somewhat of a scam. Supposedly it will allow votes for (as an example) Greens, until the point where Greens become powerful enough to actually make a difference. At that point a vote for a Green will suddenly be bad, just like it is under the current system. The main reason is (assumming you like Dems more than Republicans) is that at that point your Green vote will make your Dem vote as #2 really mean #2 and Dems will lose to Republicans who voted them #1.

    There is good analysis at http:://www.votingmethods.org. This site is obviously Libertarian, but their analysis seems accurate and their arguments about how to make Libertarians get votes without Republicans losing apply just as well to how to make Greens get votes without Democrats losing.

  37. Re:Hey Ted! What's this Magic Lantern icon for? by Tackhead · · Score: 2, Interesting
    > > I'm surprised that there hasn't been any discussion of Magic Lantern for awhile...
    >
    >Oh there has ... those members have just been dragged off, beaten, and then killed.
    > I really shouldn't attempt humor before breakfast. :-/

    I hereby propose two new /. moderations.

    (+1, Cynical): When someone tries for (+1, Funny) and gets (+1, Informative)

    (+1, Ironic): When someone tries for (+1, Informative) and gets (+1, Funny).

  38. Use RAID to protect against RAIDs by ziegast · · Score: 5, Interesting

    I see all alot of, "their rights have been violated", and "this is why I don't host in the US", and "here's what I think they're investigating", but I don't see anything constructive about how to protect your service uptime against a raid.

    At a local security meeting, I learned about security incident handling, and things you can do to help preserve the chain of custody of the evidence (aka data). It's one thing to copy data, but just by reading data on most filesystems, you alter it. If a hacker determines that you are investigating them, that can and will try as fast as they can to cover their tracks, and it's alot quicker to delete/destroy/taint data than copy data.

    The fastest and best to preserve a single machine's data is to break a RAID 1 array (pull out live disks). Your machines keep running, and the FBI gets a pristine copy of the disks that they can put into (hopefully antistatic) evidence bags and document chain of custody without modification of the data. They can go read it at their leisure off-site. Using RAID5 doesn't cut it. Using single disks with frequent backups doesn't cut it. Use RAID1.

    Another way to protect data and preserve service is to store all non-OS data on enterprise storage that supports advanced mirroring or snapshot capabilities. If I had a NetApp, I could create a read-only snapshot and give the FBI access to that point in time copy of data and never delete it until I can do a DR copy of my filer onto another box. If I have an EMC or Hitachi or other large RAID1-capable unit, I can beak off a very large mirror and present it to FBI hosts on a SAN and continue to run off of unprotected data or implement a disaster recovery plan to get me running again on another similar storage. This data isn't as clean as a "drive in a bag", but with proper notes and techniques, the FBI can be convincing enough to a jury that the data was used in the investigation was correctly read unmodified "beyond a reasonable doubt".

    If I'm really good, and have a bigger budget, I'll have a near-real-time mirror of that data (NetApp SnapMirror, EMC SRDF, "rsync", etc.) in a remote location that runs independently of my primary site and a plan that will help keep me running while I let the FBI tears apart my primary data center.

    If you run a 100% uptime service ("Show me the nines!"), it's your responsiblity to to have an effective disaster recover plan. An FBI or Secret Service raid is an equivalent of a jumbo jet crashing into your data center. You as an individual, have a RIGHT to privacy and due process, but your company has created obligations to your customers to which you've guaranteed service, and your customers care more about the latter than the former. It's more responsible to have a DR plan and sue the FBI to replace your hardware than not have a plan and sue for lost business.

    -ez

    If the checksum doesn't fit, you can't commit!

  39. Re:All Your Rights Are Belong To Ashcroft by ikeleib · · Score: 4, Interesting

    Believe me, the last thing some poor special agent wants to do is sift through TBs of customer crap and put a company out of business or under financial hardship.

    It's far more serious than simply putting a financial hardship on the data center and their customers. It is entirely possible that the FBI has gone beyond the authority granted to them in the warrant. Their warrant only allows them to search and sieze specific items related to a crime.

    It is highly likely that by siezing all machines and data of a commercial data center, that they have deprived several customer of their due process of law (5th) and freedom from search and siezure (4th).

  40. Re:Not fast enough by Beryllium+Sphere(tm) · · Score: 2, Interesting

    >Hard drives are forensically examined by being removed from their machines and duplicated (usually using dd). No investigator would ever boot a machine which is the subject of an investigation - auto-deletion scripts are just too easy to write.

    In addition, you want to be able to tell a court that what you examined was really the same as what was there before you looked. Even without an auto-delete script, do you have any idea how many files get touched on a normal boot of, say, Windows XP?

    The hard part is deciding how to unplug the machine. Forensics people love to argue about whether to yank the plug, risking a damaged file system and snide questions from opposing attorneys, or whether to do a normal shutdown flushing caches, running shutdown scripts, making other changes, thus risking a changed file system and snide questions from opposing attorneys.

    dd is a start, but a pro will have a hardware write-blocker for the drive under examination and at least one strong hash generator to prove integrity of the copied files.

    This is outside my firm's core expertise, so read up on it if you need definitive info.

  41. This was foonet,, hardly a reputable company by Anonymous Coward · · Score: 4, Interesting

    The company in question, known as "Foonet" or "Creative Internet Technologies" is well known to anyone who frequents efnet as a safe haven for anyone involved in illegal activities, including DDoS, childporn, compromising hosts, spamming, carding etc, the staff of foonet are well known for overlooking illegal activity by their customers..
    Most likely the fbi turned up to confiscate one or two customers boxes and saw how stuffed with illegal data their network is, virtually everyone on efnet who is involved with illegal activity used to base their operation from foonet, the servers there will be a total goldmine of evidence for the fbi..
    Infact, the staff themselves at foonet are well known for breaking the law, in particular "Paul" who owns the company gives shell accounts or free hosting to people who will ddos for him, and often the staff at foonet have used their customers credit cards for fraudulent transactions.

  42. Unrelated, or disappointing? by kenners · · Score: 3, Interesting

    While everyone seems to be focusing on the FBI and it's antics, hackers behind the scenes are running around making fools of intelligent men.

    This weekend, we saw foonet disappear without a trace, mirc-x, aniverse, and rizen brought down in flames by DDoS attacks, and (ranked least important on this list) the anime fansubbing scene, as well as Paul (the one actually served with the warrant says #foonet on efnet) in complete disarray and confusion.

    Maybe in a few weeks, some legitimate news corporation will repost what I'm about to suggest with more information.

    foonet's ircd was probably a host for some sort of illegality, hence the FBI's raid.

    The warrant may have been formed with the help of an IRCop on mirc-x.

    While sustaining DDoS attacks, a user visited mirc-x appearing to "be the culprit," and left a few locations he could be found.

    Reading between lines, the lingo announced the reason for the attack: That damn IRCop reported my irc server with a lot of hacked computers taken away. So I'm bringing down his network.

    What was the reason the IRCop reported anything? Did he crack a joke about the hacker's mother? Or was he just doing the "right thing?"

    Sadly enough, by the end of the weekend, the anime scene had pretty much caused the death of 3 servers either due to load, or to followed DDoS attacks on other servers.

    I have to wonder if there's actually a connection between the two events. 3 IRC networks down and an entire hosting company at a local FBI headquarters because of hacker squabbles? Are they really that important and/or worth the time?

    I wish I knew. I wish someone could actually write about it. My story can't possibly be true.

    --
    -Kenners EE,CE,JP&RPI.EDU
  43. Hmm scary but... by Grimster · · Score: 2, Interesting

    After several hours.. (etc)

    Let the fbi show up at my door with a search warrant for a customer's data and they'll be given a choice of how they want the data handed to them, and then they'll have it, in as much time as it takes me to open the case and hand them the secondary harddrive of the system (break the raid) or if they have a minute I can burn 'em a CD rom of the customer's data in as much time as it takes to tar and scp the data to the machine with the burner in it. Time required would be measured in minutes, and no toes required to count them.

    After reading about this story in a few places I said from the first I heard of it "there's more to this". They host an irc network, bastions of warez and mp3s (hey I like IRC too, and have my own server but I know what happens on them if they're not policed heavily). They are (accused) of being carder/hacker friendly and their "ddos proof" hosting and irc services definitely sounds like something a hacker would like... It's sounding like they slept with the pigs and are covered in mud.

    Another choice comment: The seizure isn't standard procedure, and there's no way to know exactly what prompted it.

    That sounds to me like a thinly veiled attempt at insinuating foonet might not be as innocent as they'd like to be seen, "isn't standard procedure" "no way to know exactly what prompted it".

    Call me a chicken or even (gasp) a Republican but if a lowly sheriff's deputy shows up with a warrant he's gonna get 100% cooperation and anything he wants ASAP from me, let the FBI show up? Shit that's when I get out my shoeshine kit...

    --
    --- www.f-theocean.com
  44. Re:All Your Rights Are Belong To Ashcroft by Leomania · · Score: 3, Interesting

    Low-end hosting often doesn't work that way; I know because I've been on the receiving end of no backups recently. Someone buys a dedicated server with a particular configuration from the data center, and sells reseller or shared hosting to a lot of other people. The data is very often only on the disk(s) on that system; backups are often not done depending upon how much the purchaser of the dedicated server wanted to pay.

    Other people who provide hosting services do take advantage of the backup capability offered by the data center, but it is seldom more often than once per week. If the feds wanted fresh logfiles, the only way to get them would be to go to the machines themselves; if they want older ones, the data center would need to have a mechanism to quickly go the the correct backup file(s) and extract just the pertinent ones. That is not a process that most places have down to a science.

    What I'm surprised at is that they thought it would be more efficient to do this themselves. You'd think they'd send in their forensic folks and work with the admins to get what they needed. A few hours is not enough time, but a couple of days you'd think might.

    - Leo

    --
    You don't use science to show that you're right, you use science to become right.
  45. Exactly by macdaddy · · Score: 4, Interesting
    Second part untrue. What makes you think the Agents gives a flying fsck through a rolling doughnut about collateral damage to some business he's never heard of and isn't paid to protect?

    Right on target. In my experience the FBI couldn't give a rats ass about causing the least amount of colateral damage or returning your siezed property. In 2001 (I believe that's right) the FBI siezed a Sun 20 from a lab at a University I worked for. The lab was less than maintained. It was full of SGIs that were vulnerable to every possible exploit for the last 5 or 6 years. It was a joke really. The Sun was also unmaintained. I pointed out to my super 10 months before the siezure that the Sun was an open relay and had services running that shouldn't be (I still have that email!). Nevertheless it wasn't touched for 10 months. Right about the time I volunteered to help the lab maintainer get everything up to date and secure again the FBI came in and siezed the Sun. It apparently was used for something bad. I haven't been with that University for a while now but last I knew it still hadn't been returned. The FBI couldn't give a rat's ass about causing the least amount of colateral damage. Their actions speak for themselves. What if the machine used for the attack (or probe for that matter) was the Unv's mail server? It was poorly maintained too and had been hacked before. What if an attacker used it as a launching pad for an attack. Would the FBI sieze that piece of state property, effecting bringing email on campus to a complete halt? It's sad really to think about it.

  46. FooNet/CIT/Xerox/Paul by nerdherder · · Score: 2, Interesting

    First let me preface that I havn't had any association/communication with Paul in years, but back in the mid-90's I Knew Paul, the owner of FooNet (Now CIT) in relation to a Small ISP I used to be a corporate officer of/part own/work for (we were the coloc host of the fledgling FooNet.net's first server 'foonix' if I recall correctly). Things could have changed since then but I very much doubt so.

    Back in the day, Paul was very much into the warez/irc scene and seeing the UseNet Articles that are around about FooNet, it seems to be pretty much the same as it used to be, only quite a bit larger. I don't know that I'd actually place CIT in the 'innocent' category, as even back then he knowingly hosted practically anything and anyone that would pay him.

    Evidence seems point to quite similar behavior of FooNet/CIT as I had experienced in the 90's, so, I'd say good riddence to one more large spam/DDoS host.

    1. Re:FooNet/CIT/Xerox/Paul by Grimster · · Score: 2, Interesting

      Wow some interesting reading here... Like I said, way more to this story than the jackbooted thugs yanking the poor innocent foonet's servers.

      --
      --- www.f-theocean.com
  47. Re:Oh, foonet? (IRC transcript) by Anonymous Coward · · Score: 1, Interesting

    Hey. I know that guy... well, one of the guys they're talking about, anyway. He used to hang out in a couple of the #2600's around me.

    Was wondering why I saw him get kickbanned this morning. :-)

  48. Re:All Your Rights Are Belong To Ashcroft by BenEnglishAtHome · · Score: 2, Interesting
    The fact is that the Waco loonies killed themselves, the Ruby Ridge guy was responsible for everything that happened and Elian Gonzalez should be back with his father.

    Look, I'm one of the first to be less than sympathetic to some of the folks who've gotten themselves killed in confrontations with feds. Hell, one of the ATF SAs killed at Waco was a casual acquaintance of mine. But your statement above is dangerously oversimplified.

    At Waco, yes, technically, it's probably true that they killed themselves. However, that happened after a lengthy siege during which the FBI screwed up just about everything they could screw up. At the heart of it, the FBI didn't have a clue as to the emotional state they were forcing on the people inside that compound. It's like standing outside the monkey cage at the zoo wearing a loud shirt that just drives the monkeys ape-shit (Yes, that was an intentional pun). Theoretically, it's the monkeys that are stupid. Ideally, it's the monkeys that should, of their own volition, calm down. But in the real world it's you, the thinking human being, who has to recognize that your presence is causing a problem and, rightness or wrongness be damned, it's you who should step away from the cage till the monkeys calm down. The FBI should have understood that they were forcing a bad end to that situation and backed the hell off. As we've seen since then, as with the family that's holed up in east Texas right now, it's a lot better to just keep a loose cordon around the site and keep watch; eventually, the situation will resolve itself peacefully.

    As for Weaver at Ruby Ridge, you're being way too harsh. Did he set up the situation? Sort of. When the feds obliquely threatened to take from him the only earthly possession he valued, his land, he bunkered down. He probably shouldn't have. But your flat statement that he was responsible for everything simply doesn't hold up. There's no way he was responsible for the sniper's bullet that killed his unarmed wife. That was, pure and simple, a result of the "Nobody disses us! Shoot to kill!" attitude of the feds.

    Oh, and btw, you *are* aware that Weaver was found not guilty of all the charges in that case, aren't you?

    As for Elian, I agree with you completely and I don't know how the govt could have acted differently. Of course, if it weren't for things like Ruby Ridge and Waco, the general populace would be more likely to cut the feds some slack when they have to bust into a little house and snatch a kid, in the process producing some pictures with far more drama than they needed.

    In short, I don't think it was out of line for the grandparent of this post to point out that federal agency civil rights abuses are to be expected, with computer seizures on one end of the range of behavior and worse things on the other. Dismissing those horrific situations as anomalies (or whatever point you were trying to make) does a disservice to everyone who takes seriously their duty to resist the erosion of our liberties.

  49. Simple way to get them back by t_allardyce · · Score: 2, Interesting

    I really dont understand how the FBI can treat every computer system they confiscate as safe to pick-up and stick in the back of a van. Either that or i dont understand how anyone with data thats either criminal or very confidention hasnt caught on to the fact that they could erase it before its even loaded into the van! take a few machines (or remote backup if needed) and stick them on a UPS. The vital data is then loaded into RAM along with the 'loading/unloading' program and removed from the drive, only a correct procedure will restore it back to disk. In come the FBI and shut it down, oops they just lost all the evidence they were looking for including the program that was responsible for loading and unloading the data into memory - absolutely no evidence left, no trace, nothing to say you even damaged evidence - an offence in itself.

    --
    This comment does not represent the views or opinions of the user.
  50. Re:All Your Rights Are Belong To Ashcroft by Anonymous Coward · · Score: 2, Interesting

    The FBI is incompentent. I worked at a internet cafe in Portland, OR. Dunno if anyone remembers the somewhat recent execution style murder of a cop in northern CA, but 2 days after it happened someone posted unmentioned explicit details of the murder on a NRA message board from our shop.

    The FBI showed up, first it was just 3 agents, they said they were going to clone the HDDs. Our boss said they can use his Norton Ghost setup to copy the 20gb NTFS disks.

    The FBI declined saying they had special software that could do it quickly. So another 5 agents showed up and using thier software it took 8 agents 8 hours to simultaneously copy 5 disks.

    On the brighter side, we charged them $6/hr on each machine for the process. I have a strong feeling that they later didn't even bother to look over the copies they made anyway since they supposedly caught him 2 days later after making more posts. (I still don't know if this person is the one that did it, was a friend or was clairvoyant.)

  51. That analysis is flawed too,,, in truth: by IBitOBear · · Score: 2, Interesting

    There is only one voting system where it is impossible to produce a "surprising" outcome. That being literally "one man (wiht) one vote", i.e. a dictatorship. *All* of the other schemes have a mathematical "odd part."

    In your summary of the analysis you overlook the fact that in order to suffer a reversal, there still has to be more people who want the republican than the democrat. (etc.) That is, the point of inflection happens *only* *if*, in this scenerio, thre are four party candidates: Republican, Democrat, Republican-lite (libertarian?) and Democrat-lite (Green?). [The *-lite candidates are candidates who are selected as first-vote candidates, with their second-vote going to the non-lite party.]

    In order for the Republican to win (in the inferred degenerate case), the number of the Republican and Republican-lite voters must must make up more than 50% of the electorate. The FUD is that IRV is flawed becasue the least-voted-for person in the current iteration becomes the swing-votes for the next iteration. This isn't however, the real flaw.

    The Real Flaw(tm) is that IRV degenerates as voters disapear in the runoffs. Lets keep our original candidate pool of R Rl D and Dl but then add a Comunist (spoiler). In the definition of the spoiler here, lets say that S always gets the least votes. In the simplest spoiler scenerio the spoiler-voters only vote for S. After the first iteration the Comunist is removed and we are back to the original model with those votes distributed among the other parties. Seems fair right?

    But what if the S voters don't have a second choice? Well then the fact that they voted just disapears from the model. Still fair.

    The apparent purturbation happens when, say, the S voters have a second choice of Rl, but don't have a third choice of R. If Rl is still the next eleminated party. You can end up with a situation where the sum of (R + Rl + D + Dl) nets no winner, but when Rl is eleminated you might end up with the total voter pool reduced in size so that R becomes the winner. But for that to be true, the total voters for R must outnumber th total voters for D and Dl.

    I call this the "apparent" purturbation because it is only a correct result if all the S voters wouldn't have voted at all if there hadn't been an S party.

    That is, R wins with less than 50% of the "original" vote even though they have more than 50% of the surviving vote. This looks like a problem because people start guessing about the "mandate of the people" for those people who got eleminated.

    This isn't really a problem, however, if the voter can rank all the candidates. That is, if the voter isn't limited to, say 5 ranked votes in a field of 7 or more candidates, then the "failure to rank" into the final vote is a proper abstain.

    It is also proper to discount the abstained voters because if you don't you could easily end up with no result at all.

    Only if the IRV rankings are limited to some number less than the size of the field do you end up with really purturbed results.

    Another complication arrises with voters who would rank Dl, Rl, then D, for instance, because their second choice (Rl) may never experience the benefit of their second-standing. In particular it appears that, in a change up situation where most/all of the *-lite voters have "the other" *-lite as their second rank, things may seem a little dicy. You get some chaotic cross over that, if you look at the raw numbers seems "surprising."

    This is not *really* a problem mathematically, but the whining electroate might see it as unfair.

    Still in all, if the voters percieve there to be dominant parties (R and D) and rank their votes all the way up to their perceived dominant party, the system ends up "closest to fair" of the curent alternatives.

    The "odd looking" part comes out if you were to sum up the votes "the other way" by adding a tickmark next to each candidate if that candidate appears in any chain of votes. You might find that Rl h

    --
    Innocent people shouldn't be forced to pay for inferior software development.
    --"Code Complete" Microsoft Press
  52. Re:Not fast enough by jnicholson · · Score: 2, Interesting
    Speaking with the limited perspective of an outsider, I don't think that Americans are actually all that free.

    TV networks are forbidden to use language that's used every day by a large number of people, apparently in order to protect other people - and more especially, their children - from hearing that language. (Never mind that they hear it on the playground anyway.)

    If you have any opinions on religion, or abortion, and you are ever heard to speak on them without the careful alteration of a PR expert, you can forget ever running for public office.

    It looks to me as though the appearance of truth is more important than actual truth when it comes to politics and law (if those two things are even separate.) Someone with enough money and anything that even looks like a valid case can apparently sue you until you're too poor to defend against it any more.

    And when you've read British tabloids (I'm not British, BTW) you'll have a new appreciation for what 'freedom of the press' actually means. Those guys can (and do) print anything! The more ridiculous seeming, the better!

    This is just what it looks like from the outside, though, so I can't know if it's accurate.

    --
    "Do not drill any holes in your cat - it will not like it."
    -- Nick Davies
  53. Re:Is the actual court order available? by the_greywolf · · Score: 2, Interesting

    interestingly, a good friend of mine in Canada ran a legitimate hosting service from that very datacenter. so technically speaking, if you're right, this is a huge issue.

    --
    grey wolf
    LET FORTRAN DIE!