Too slow! FBI Shuts Down Hosting Service

Chope writes "If FBI agents showed up at your data center bearing a warrant, would you be able to provide them prompt access to customer data? BZZZZT! I'm sorry, but you've taken too long to answer. We'll be confiscating all the hardware you use, er, used to use, to run your business. But we'll get it back to you 'real soon now.' Thank you for playing. CarrierHotels.com is carrying the story of a FBI raid on a web hosting company. When the hosting company didn't and/or couldn't provide the information the FBI was looking from its several terabytes of data within "several hours", the FBI decided it was more "efficient" to seize all the web servers and customer data as part of the FBI's investigation of a hacking incident."

Comments

All Your Rights Are Belong To Ashcroft

[Anonymous Coward]

someone had to say it..

Re:All Your Rights Are Belong To Ashcroft

[LittleBigLui]

someone had to say it..

... and judging by the finely crafted grammar, bush did. :)

Re:All Your Rights Are Belong To Ashcroft

[GodBlessTexas]

I hate to be the bearer of bad news, but the FBI has been doing this in computer crime cases since the last few years of the Clinton administration under that bastion of civil liberties (nevermind Waco, Ruby Ridge, or Elian Gonzalez) Janet Reno, and it didn't require several TB of potential evidence to make it happen.

The FBI will attempt to work with any provider in order to get the data they need to investigate a crime. If that is impossible to do in a 'reasonable amount of time' they have little choice but to confiscate the equipment in order to copy the existing data from the machines to conduct a forensic investigation. A reasonable amount of time is generally a couple of hours to a day. Believe me, the last thing some poor special agent wants to do is sift through TBs of customer crap and put a company out of business or under financial hardship.

Re:All Your Rights Are Belong To Ashcroft

[sjames]

Doing some simple math, with a decentish disk controller, it will take 3 hours just to stream 1TB from disk to /dev/null. That assumes that the data is perfectly sequential and that no 'analysis' (such as accessing in a filewise manner, looking for a particular name of other data within the stream, etc).

Touching the data at all will easily double that to 6 hours. Add in more time because the volume is probably archival (read slower) rather than being set up as an enterprise DB system. Add even more since the server has other things to do running the business.

Most likely, what they were after was logs. Logs tend to be optimized to be stored quickly rather than for fast access. After all, logs are being stored constantly, but unless something unexplained is going wrong, they aren't analyzed at all. When they are analyzed, it's usually one of a handful of standard reports (such as logins, changes to suid, etc) and is only done over a reletivly short span of time.

Given the above, and that there were multiple TB of data to sift, it is not even vaguely reasonable to expect a complete result in less than several days.

If this report is even vaguely factual, I sincerely hope the person who made the decision to sieze is forced to spend the remaining years of his career in the basement sifting through endless lines of:

1337 d00d> D000dZ! I R s0 1337!

To the best of my knowledge, there is no posibility of an all encompassing regular expression that can translate 1337 to english.

Re:All Your Rights Are Belong To Ashcroft

[Anonymous Coward]

1,$s/1337/english/g

Re:All Your Rights Are Belong To Ashcroft

[DarkMan]

To the best of my knowledge, there is no posibility of an all encompassing regular expression that can translate 1337 to english.

Not a perfect translation, no.

However, with a context free grammar (!) and some herustics with a spell checking engine, you can get conversion to something that is much more readable.

For example, I ran

1337 d00d> D000dZ! I R s0 1337!

through my munging engine and got

leet dude> Dudes! I are so leet!

(I prefer to leave 1337 as leet, cos I don't think it's really transatable to formal english.) It's not perfect, but the time to read drops down to something approaching printed english.

More relevently, as one can learn to read 1337 and other forms of munged english to the same speed as normal text, this step drastically cuts the learning time down, to about 20 minutes (for me, anyway).

So, what you say was strictly correct, but for practical purposes, the majority of it can be fixed. Certinally, for review by people not familar with it, it's handy. Still needs to have the original check, of course, but that would always have to happen anyway.

Re:All Your Rights Are Belong To Ashcroft

[Zeinfeld]

I hate to be the bearer of bad news, but the FBI has been doing this in computer crime cases since the last few years of the Clinton administration under that bastion of civil liberties (nevermind Waco, Ruby Ridge, or Elian Gonzalez) Janet Reno, and it didn't require several TB of potential evidence to make it happen

I remember exchanging emails with Timothy McVeigh who murdered 270 people in Oaklahoma. He murdered those people because of this type of crank theory. We have put up with this right wing crank politics for too long.

The fact is that the Waco loonies killed themselves, the Ruby Ridge guy was responsible for everything that happened and Elian Gonzalez should be back with his father. Castro is almost 80, not many dictators make it to 90 and are still in power. By the time Elian leaves school Castro will be dead. But I can see why a bunch of right wing cranks who talk big about the importance of family would think it would be better that he is kidnapped by a bunch of his relatives looking to exploit him for political purposes than grow up with his father.

Sure the FBI has done a lot of things that are stupid or outright corrupt. Hoover used the FBI to persue his own vendettas, he refused to prosecute the mafia. That does not mean that the federal government is at fault in every case and it certainly does not mean that the events cited by right wing cranks are proof of abuse. The persecution of Charlie Chaplin and John Lenon were abuses. If some nut gets some guns, holes himself up someplace and threatens to shoot members of law enforcement who might be looking to arrest him, well anyone who gets shot is primarily their responsibility, same way that 9/11 is primarily the responsibiliy of Al Zawahiri and his frat boy friend Bin-Laden. Sure the CIA and FBI screwed up big with 9-11, Freah's people thought the war on drugs was a higher priority than terrorism. But keep perspective here.

Believe me, the last thing some poor special agent wants to do is sift through TBs of customer crap and put a company out of business or under financial hardship.

Absolutely right, unless there is an ulterior motive. That is not very likely in this case. If the FBI were investigating planned parenthood or another group that John Ashcroft is opposed to politically there might be an issue. There has been a lot of suspicious uses of the IRS against political opponents under Bush II. Ashcroft has endorsed a lot of extra-constitutional activites but so far the FBI under Muller does not seem to be a problem.

I suspect what happened in this particular case is that the agents thought that the hosting provider were simply not interested in complying. They probably met a sysadmin that gave them some attitude.

What we need here is a better way of serving this type of intercept warrant so that the parameters of the search are predetermined and understood by the court. We have this for IM intercepts so it should be possible to define it for IRC

Re:All Your Rights Are Belong To Ashcroft

[Tackhead]

> Believe me, the last thing some poor special agent wants to do is sift through TBs of customer crap and put a company out of business or under financial hardship.

First part true. Separating the wheat from the chaff is a pain and slows the investigation. (Unless you can use the wheat for future investigations, but the Agents aren't getting paid to go on fishing expeditions yet.)

Second part untrue. What makes you think the Agents gives a flying fsck through a rolling doughnut about collateral damage to some business he's never heard of and isn't paid to protect?

I mean, what's the collateral damage gonna do? Sue an Agent? (Score +6, Funny) Sue the Agent's employer? (Score +7, Hysterical) And what if through some sick twist of fate, they win such a suit? (Score -8, Witness of Evolution In Action).

There's three kinds of people in the world. Cops, perps, and perps who haven't been caught. Power corrupts, but power without accountability is an awful lot of fun.

If you're in college, consider majoring in Criminal Justice and joining the winning side. You can be under the gun, or you can hold the gun. Better to be a killer than a victim.

Re:All Your Rights Are Belong To Ashcroft

[buysse]

Dude, the feebs take the backups too. The hax0r may have deleted the evidence which will then only exist on backups, and if the service provider retains them the chain of evidence is broken.

Re:All Your Rights Are Belong To Ashcroft

[rudedog]

Given that Randy Weaver's wife was shot at Ruby Ridge in August 1992, I'm wondering how this is Bill Clinton's and Janet Reno's fault. Or was Bill somehow responsible for this even while he was still governor of Arkansas?

Re:All Your Rights Are Belong To Ashcroft

[Dillusionary]

And do you seriously believe you can pump out TB worth of data within hours? Even with fiber? Ok not to mention the storage requirements for them to haul it out of. This posting makes me believe you might be an Ashcroft fan or supporter or government worker. Surprise? not really. Best thing for this country entirely is get Ashcroft and Bush out of Office. But if it has to be on I would say Ashcroft.

Re:All Your Rights Are Belong To Ashcroft

[ikeleib]

Believe me, the last thing some poor special agent wants to do is sift through TBs of customer crap and put a company out of business or under financial hardship.

It's far more serious than simply putting a financial hardship on the data center and their customers. It is entirely possible that the FBI has gone beyond the authority granted to them in the warrant. Their warrant only allows them to search and sieze specific items related to a crime.

It is highly likely that by siezing all machines and data of a commercial data center, that they have deprived several customer of their due process of law (5th) and freedom from search and siezure (4th).

Re:All Your Rights Are Belong To Ashcroft

[ivan256]

Absolutely right, unless there is an ulterior motive.

The agent that siezed the equipment probably has a boss who expects to see progress, and that progress is probably propagated up the line to the point where the details have been filtered out and it's just a number on a spreadsheet of how many computer crimes have been procecuted in the last however many days. The ulterior motive is to look like he's being productive in order to keep his job.

As an aside, if you think it's Castro that's still in power in Cuba, you're very naive. Look at the recent events there and you'll see it's clear that those close to him are taking steps to retain power when the man himself is gone. Then again, perhaps you're just one of those left wing cranks (whatever the hell a crank is) that comes to conclusions about what US foreign policy should be based on feelings instead of the painful facts. No wonder congress has to keep bickering about wether we should maintain travel bans and trade sanctions against Cuba.

Re:All Your Rights Are Belong To Ashcroft

[Gr8Apes]

Simple math:

LVD SCSI: 3.5 hours
U160: 1.75 hours
U320: 45 min

This is assuming maximum transmission speeds across a single bus. I would hope that TB of data would be on properly organized RAID arrays, and thus would span across multiple SCSI buses, and thus, creating a mirror of said data, while not cheap, should not take on the order of more than a couple of hours, provided hardware is available.

Place the cost of that against the cost of shutting you down, and it's pretty obvious which one you want. Then again, I'm astounded that the FBI would shut down a business.

Re:All Your Rights Are Belong To Ashcroft

[planetmn]

No wonder congress has to keep bickering about wether we should maintain travel bans and trade sanctions against Cuba.

Because clearly the 40 or so years of sanctions have worked.

Meanwhile, we give most favored nation trading status to China.

-dave

Re:All Your Rights Are Belong To Ashcroft

[fm6]

Waco, Ruby Ridge, Elvis... it's all the same!

Re:All Your Rights Are Belong To Ashcroft

[Rick the Red]

The fact is that the Waco loonies killed themselves, the Ruby Ridge guy was responsible for everything that happened and Elian Gonzalez should be back with his father.

The facts in the Waco case are in dispute by eye witnesses. The bottom line is that if the FBI listened to their advisers (who urged restraint) instead of the politicians (who wanted it wrapped up quickly), those people would still be alive today.

Randy Weaver (the "Ruby Ridge guy") was not responsible for the deaths, the FBI was. An Idaho court found this to be true, but as federal agents the people responsible were not answerable to a state court and they literally got away with murder.

The rules at the time were that any Cuban who made it to USA soil was eligible for asylum.

Buy why am I even discussing this with someone who exchanges emails with mass murderers? Or did you lie about that, too?

Re:All Your Rights Are Belong To Ashcroft

[Wateshay]

I love how those on the left (not to say there aren't those on the right who do the same thing) see it as troubling if the FBI abuses their power when dealing with left-aligned groups (like planned parenthood or John Lennon), but it's ok if it involves those on the right (like the "gun nut" at Ruby Ridge, or the Cuban expatriats in Miami). Personally, I think they're all troubling, and to say that the FBI under Ashcroft is any worse than the FBI under Reno is pretty naive, IMHO.

Re:All Your Rights Are Belong To Ashcroft

[ragefan]

There's three kinds of people in the world. Cops, perps, and perps who haven't been caught. Power corrupts, but power without accountability is an awful lot of fun.

If you're in college, consider majoring in Criminal Justice and joining the winning side. You can be under the gun, or you can hold the gun. Better to be a killer than a victim.

Then there is only 2 types of people: perps, and perps who haven't been caught. Cops being the latter.

Re:All Your Rights Are Belong To Ashcroft

[hchaos]

I hate to be the bearer of bad news, but the FBI has been doing this in computer crime cases since the last few years of the Clinton administration under that bastion of civil liberties (nevermind Waco, Ruby Ridge, or Elian Gonzalez) Janet Reno, and it didn't require several TB of potential evidence to make it happen.

I love to be the bearer of bad news, and you really need to check your dates. The Ruby Ridge incident happened in 1992, during the previous Bush administration. Unless, of course, this is all just a troll.

Re:All Your Rights Are Belong To Ashcroft

[HiThere]

If you think Reno was a leftist, you need a bit of study.

That said, yes, it's worse. A part of the reason is things like the "Patriot" act, which mean they don't have to care, even more than they already didn't have to care. Another part is that an entrenched authority has an inbuilt tendency to get more authoritarian (there are other tendencies, leading to other forms of corruption, also). If you wanted to reform the FBI, you would need to make them accountable for their actions. You would probably also need to replace the entire upper echelon of management. (There might be honorable & flexible individuals, but you couldn't identify them.)

Still, you are correct when you say that the left is no better than the right. That's not where the problem lies. Concentration of power into people who aren't held accountable for the misuse of it is the problem.

Re:All Your Rights Are Belong To Ashcroft

[Noren]

The fact is that the Waco loonies killed themselves, the Ruby Ridge guy was responsible for everything that happened and Elian Gonzalez should be back with his father. Castro is almost 80, not many dictators make it to 90 and are still in power. By the time Elian leaves school Castro will be dead. But I can see why a bunch of right wing cranks who talk big about the importance of family would think it would be better that he is kidnapped by a bunch of his relatives looking to exploit him for political purposes than grow up with his father.

The fact is that the Federal government used flammable military tear gas soon before the fire in which 80 people died, and then lied about doing so consistently for six years after the fact. The fact is that the FBI section chief in charge of an internal investigation on the Ruby Ridge incident pled guilty to obstruction of justice, admitting he'd ordered all the FBI's on-scene accounts of the actual incident destroyed. (The Ruby Ridge incident occured during Daddy Bush's term, anyhow) On the other hand, I agree for the most part with the government's actions in the Gonzalez case.

The existence of right wing cranks is not proof of abuse, but it is also not proof of innocence on the part of the FBI.

Re:All Your Rights Are Belong To Ashcroft

[Leomania]

Low-end hosting often doesn't work that way; I know because I've been on the receiving end of no backups recently. Someone buys a dedicated server with a particular configuration from the data center, and sells reseller or shared hosting to a lot of other people. The data is very often only on the disk(s) on that system; backups are often not done depending upon how much the purchaser of the dedicated server wanted to pay.

Other people who provide hosting services do take advantage of the backup capability offered by the data center, but it is seldom more often than once per week. If the feds wanted fresh logfiles, the only way to get them would be to go to the machines themselves; if they want older ones, the data center would need to have a mechanism to quickly go the the correct backup file(s) and extract just the pertinent ones. That is not a process that most places have down to a science.

What I'm surprised at is that they thought it would be more efficient to do this themselves. You'd think they'd send in their forensic folks and work with the admins to get what they needed. A few hours is not enough time, but a couple of days you'd think might.

- Leo

Re:All Your Rights Are Belong To Ashcroft

[Pig Hogger]

What ever happenned to Dan Quayle????

Re:All Your Rights Are Belong To Ashcroft

[John Courtland]

Leet is a derivative of Elite (or eleet, or 31337). I suppose if you wanted real English words thats the answer you are looking for.

Re:All Your Rights Are Belong To Ashcroft

[Zeinfeld]

As an aside, if you think it's Castro that's still in power in Cuba, you're very naive. Look at the recent events there and you'll see it's clear that those close to him are taking steps to retain power when the man himself is gone. Then again, perhaps you're just one of those left wing cranks (whatever the hell a crank is) that comes to conclusions about what US foreign policy should be based on feelings instead of the painful facts.

It was Reagan that kept telling us that sanctions would not work in South Africa. Only they did work, apartheid is gone.

Forty years later sanctions and the image of Fidel and Che are the only things keeping the Cuban communist party propped up. Castro uses sanctions the same way that Bush uses Al Qaeda, as an excuse for every failure of domestic policy.

The Cuban sanctions have failled because they have the exact wrong psychology. The only thing Cubans have that they can feel pride about is that they have taken on the greatest superpower and won. Kinda stupid thing to be proud of but that is what is keeping the bastards in power.

Open the floodgates to tourism and there is simply no way the communist party is going to last more than a few years. They will go the same way that the USSR went, their people will just get fed up.

Re:All Your Rights Are Belong To Ashcroft

[sunami]

It is highly likely that by siezing all machines and data of a commercial data center, that they have deprived several customer of their due process of law (5th) and freedom from search and siezure (4th).

Unfortuantly, neither of these are true. Due process is removed when a legal warrent has been disclosed. Also, the 4th amendment, search and siezure, is only disallowed when there is no warrent.

Re:All Your Rights Are Belong To Ashcroft

[Rolo Tomasi]

Powerline internet?

Re:All Your Rights Are Belong To Ashcroft

[GreaterThanZero]

English has well-defined rules that are consistently broken by itself.

Take a linguistics course. Learn how languages evolve and why they evolve in the distinct patterns that they do.

Language is always undergoing change. The only reason that style books need to be updated is to accommodate that. There is still debate going on about whether to introduce a gender-neutral third-person singular term, or if "they" or "s/he" or something else is acceptable. Google it for several impassioned pages.

So if it shows up in one of your style books, will you then correct everyone on it?

Re:All Your Rights Are Belong To Ashcroft

[Shakrai]

Unfortuantly, neither of these are true. Due process is removed when a legal warrent has been disclosed. Also, the 4th amendment, search and siezure, is only disallowed when there is no warrent.

I think his point was that the warrant didn't cover the other few dozen customers who also had data on these hard drives/arrays.

If the cops come busting into my local gym because somebody told them that Locker #514 has dope in it and they have a warrant to search said locker can they seize the entire bank of lockers because the owner couldn't find the key in time? Could they then charge me (the user of locker #515) if they found something incriminating in my locker when they never had permission to search it in the first place?

Think about it along those lines. What if they found pirated software (or god forbid the MS Source Code) or kiddie porn on an account that they weren't interested in and didn't have a warrant for? Can they then charge that guy or open an investigation?

Re:All Your Rights Are Belong To Ashcroft

[Rick the Red]

it is only a matter of time before O.J. finds the real killers

Who must be in Florida, since that's where he's looking.

Re:All Your Rights Are Belong To Ashcroft

[zakath]

"The rules at the time were that any Cuban who made it to USA soil was eligible for asylum."

Rules be damned...the truth is a little kid probably doesn't give a flying fuck about your immigration law and would rather be with his Dad than a pawn in some international pissing match to advance the agendas of people who down't even know him.

Re:All Your Rights Are Belong To Ashcroft

[BenEnglishAtHome]

The fact is that the Waco loonies killed themselves, the Ruby Ridge guy was responsible for everything that happened and Elian Gonzalez should be back with his father.

Look, I'm one of the first to be less than sympathetic to some of the folks who've gotten themselves killed in confrontations with feds. Hell, one of the ATF SAs killed at Waco was a casual acquaintance of mine. But your statement above is dangerously oversimplified.

At Waco, yes, technically, it's probably true that they killed themselves. However, that happened after a lengthy siege during which the FBI screwed up just about everything they could screw up. At the heart of it, the FBI didn't have a clue as to the emotional state they were forcing on the people inside that compound. It's like standing outside the monkey cage at the zoo wearing a loud shirt that just drives the monkeys ape-shit (Yes, that was an intentional pun). Theoretically, it's the monkeys that are stupid. Ideally, it's the monkeys that should, of their own volition, calm down. But in the real world it's you, the thinking human being, who has to recognize that your presence is causing a problem and, rightness or wrongness be damned, it's you who should step away from the cage till the monkeys calm down. The FBI should have understood that they were forcing a bad end to that situation and backed the hell off. As we've seen since then, as with the family that's holed up in east Texas right now, it's a lot better to just keep a loose cordon around the site and keep watch; eventually, the situation will resolve itself peacefully.

As for Weaver at Ruby Ridge, you're being way too harsh. Did he set up the situation? Sort of. When the feds obliquely threatened to take from him the only earthly possession he valued, his land, he bunkered down. He probably shouldn't have. But your flat statement that he was responsible for everything simply doesn't hold up. There's no way he was responsible for the sniper's bullet that killed his unarmed wife. That was, pure and simple, a result of the "Nobody disses us! Shoot to kill!" attitude of the feds.

Oh, and btw, you *are* aware that Weaver was found not guilty of all the charges in that case, aren't you?

As for Elian, I agree with you completely and I don't know how the govt could have acted differently. Of course, if it weren't for things like Ruby Ridge and Waco, the general populace would be more likely to cut the feds some slack when they have to bust into a little house and snatch a kid, in the process producing some pictures with far more drama than they needed.

In short, I don't think it was out of line for the grandparent of this post to point out that federal agency civil rights abuses are to be expected, with computer seizures on one end of the range of behavior and worse things on the other. Dismissing those horrific situations as anomalies (or whatever point you were trying to make) does a disservice to everyone who takes seriously their duty to resist the erosion of our liberties.

Re:All Your Rights Are Belong To Ashcroft

[Anonymous Coward]

The FBI is incompentent. I worked at a internet cafe in Portland, OR. Dunno if anyone remembers the somewhat recent execution style murder of a cop in northern CA, but 2 days after it happened someone posted unmentioned explicit details of the murder on a NRA message board from our shop.

The FBI showed up, first it was just 3 agents, they said they were going to clone the HDDs. Our boss said they can use his Norton Ghost setup to copy the 20gb NTFS disks.

The FBI declined saying they had special software that could do it quickly. So another 5 agents showed up and using thier software it took 8 agents 8 hours to simultaneously copy 5 disks.

On the brighter side, we charged them $6/hr on each machine for the process. I have a strong feeling that they later didn't even bother to look over the copies they made anyway since they supposedly caught him 2 days later after making more posts. (I still don't know if this person is the one that did it, was a friend or was clairvoyant.)

Re:All Your Rights Are Belong To Ashcroft

[filtur]

Think about it along those lines. What if they found pirated software (or god forbid the MS Source Code) or kiddie porn on an account that they weren't interested in and didn't have a warrant for? Can they then charge that guy or open an investigation?

They can't collect evidence relating to anything but the warrant, but that doesn't stop them from getting a another warrant. "Fishing Expeditions" are illegal meaning, they can't just seize things and search randomly. Warrants are usually pretty specific as to what you can look for.

Re:All Your Rights Are Belong To Ashcroft

[John Courtland]

Well, being Elite (in the 31337 sense) means you're on top of your cracking/hacking game. That sort of makes sense if you correlate that with the term elite, being someone better than most/all others.

Re:All Your Rights Are Belong To Ashcroft

[Marduk45]

Actually, it has nothing to do with what some poor FBI agent wants to do. It has to do with what some U.S. Attorney wants to do, and yes, they often times want to put a company under financial hardship, as it's much harder to defend yourself when they've taken all of the records. Trying to get it all back in a reasonable amount of time before your business goes under is an exercise in patience, to say the least.

Re:All Your Rights Are Belong To Ashcroft

[sjames]

creating a mirror of said data, while not cheap, should not take on the order of more than a couple of hours, provided hardware is available.

For a raw backup, that is true. However, I know I would be hard pressed to just come up with a spare couple TB RAID unit for such a mirror right this instant. I could order one now, but it would take a day or two to get here.

If the FBI brought such a RAID along, it would be just a few hours. Either they were not prepared to actually recieve the data in bulk, or there's an important part of the story missing.

OTOH, there is DLT, but that's not much cheaper and IS much slower.

The alternative would be to attempt to grep for the relevant information and write it to a big IDE drive (which would be a lot more likely to be just laying around somewhere). However, actually grepping the data would slow things down even more than writing to DLT.

and....

[Digitus1337]

and who says they abuse their power? (I wouldn't...)

In response to a hacking incident?

[mehaiku]

Oh my, which one our corporate overlords were offended this time?

Re:In response to a hacking incident?

[ScottGant]

If everything was shut down, how come http://www.cithosting.com/ is still up and running? If all the equipment was taken, wouldn't the web page that's being shown on that site be gone...shouldn't it be hard to connect to anything on that site at all?

The fact is, this story is old because the FBI has already started returning the equipment back as of yesterday. The FBI confiscated everything on the 14th. CIT's web site says:

02/23/2004 CIT re-establishes service.

We have restored service at Equinix's Chicago Data Centers. We are in the same facilities as MSN and many fortune 500 companies. The facility has multi OC192 connections to the backbone.

The FBI has begun retuning equipment to CIT which is being shipped to our new facilities in Chicago.
At this time CIT will continue to provide dedicated DDOS Protected web hosting only.

Yes, the FBI overstepped they're bounds and yes it's frightening to think of this happening...but let's not get the facts wrong. The story here on Slashdot made is seem like the equipment was seized and the FBI probably won't be returning it, which isn't the case.

When reporting the crap that the US Gov throws at us, don't embelish...just report what is known and not a lot of speculation.

Re:In response to a hacking incident?

[Ian Wolf]

I don't believe the headline overstated anything. The FBI's track record for returning anything seized is appalling.

Re:In response to a hacking incident?

[Snaller]

Yes, the FBI overstepped they're bounds and yes it's frightening to think of this happening...but let's not get the facts wrong. The story here on Slashdot made is seem like the equipment was seized and the FBI probably won't be returning it, which isn't the case.


Bullshit - it reported about another step towards the police state in the US - nobody said anything about not getting it back. But by previous accounts they never care much about getting it back.

Re:In response to a hacking incident?

[Anonymous Coward]

It is routine, however, that the FBI or police seize computer equipment and never return it. So it was reasonable to assume that this was the case here (they still haven't returned 100% of the equipment anyway). It's not obviously stated under the law one's rights when this happens, nor are there limits to how long your equipment can be held (so far as I know). This is a huge problem.

Re:In response to a hacking incident?

[orthogonal]

The fact is, this story is old because the FBI has already started returning the equipment back as of yesterday. The FBI confiscated everything on the 14th. CIT's web site says:

02/23/2004 CIT re-establishes service.

Hey, look, I tried my best, by submitting this three days ago:

2004-02-21 09:18:16 FBI confisticates (sic) ISP's servers: "more efficie (articles,usa) (rejected)

and it was rejected in about thirty minutes.

Maybe I should write more sensationalistic submissions? ;) Or to be fair, maybe it's because I misspelled "confiscate". But aren't they supposed to be editors -- oh! never mind! Ah, I guess Chope needed the Karma more than I did.

But seriously folks, yeah, the FBI is returning the equipment now, but how much damage was done to an innocent ISP just because the FBI couldn't figure out how to do on-site data mining?

And if searching for evidence on a computer requires the FBI to physically cart the equipment to some distant lab, I guess we just write off any expectation that they'll be able to find data quickly in an emergency -- like, just off the top of my head here, for instance, wholly unlikely I'm sure, an imminent terrorist act?

Well, maybe a business got ruined, maybe the FBI can't scan data quickly enough to stop a terrorist crime in progress, but at least we all feel safer now that arch-criminal Tommy Chong is in jail.

Re:In response to a hacking incident?

[Angry_Admin]

There's an old line saying the only way they'll be able to enforce all of these laws is to make a police state.

Regarding the seizure of equipment, though. Why on Earth would they bother taking all of that equipment off-line to conduct their investigation? Whenever I deal with Federal level investigators, they always make an image of the hard drive and work off of that. They NEVER work off of the hard drives, themselves.

If it was just a "hacking incident", then they should be able to accomplish everything they want by working off of those images.

Re:In response to a hacking incident?

[Anonymous Coward]

But seriously folks, yeah, the FBI is returning the equipment now, but how much damage was done to an innocent ISP just because the FBI couldn't figure out how to do on-site data mining?
I'm sorry to break this to you all, but this hosting provider is far from innocent. This particular provider has been a PITA for the major IRC networks for a long time due to the amount of DoS drone nets being held on private ircds hosted by foonet. Good riddance, and applause to the feds for finally dealing with this.

Re:In response to a hacking incident?

[orthogonal]

So who's being senationalistic (sic) now? There is nothing in TFA about the FBI being too incompetant (sic) to datamine on-site. Spare us, please.

According to the ISP's original notice, the FBI tried to access the data on site for several hours, before giving up and carting the servers to the FBI labs.

Re:In response to a hacking incident?

[caseydk]

Regarding the seizure of equipment, though. Why on Earth would they bother taking all of that equipment off-line to conduct their investigation? Whenever I deal with Federal level investigators, they always make an image of the hard drive and work off of that. They NEVER work off of the hard drives, themselves.

Exactly, in order to establish the non-tamperedness of the hardware, they *MUST* work off the images instead of actual. Imagine if some bad/new tech accidentally did a "rm -Rf". If they worked on the originals, then they could easily claim that the company did it.

Re:In response to a hacking incident?

[ScottGant]

I stand by my statement that the story here on Slashdot made it seem like the equipment was seized and the FBI probably won't be returning it.

In case your memory isn't that great, I'll quote straight from Slashdot's front page story:

I'm sorry, but you've taken too long to answer. We'll be confiscating all the hardware you use, er, used to use, to run your business. But we'll get it back to you 'real soon now.' Thank you for playing.

I guess "real soon now" should have read "9 days"? But regardless, you saying that "nobody said anything about not getting it back" is wrong as "real soon now" implies either never or a very long time from now...which HAS been the case before, but not here. Not to mention the fact that this story was posted on Slashdot AFTER the equipment was already returned.

Re:In response to a hacking incident?

[flithm]

But seriously folks, yeah, the FBI is returning the equipment now, but how much damage was done to an innocent ISP just because the FBI couldn't figure out how to do on-site data mining?

Everyone here is so quick to bash the FBI for doing what they did, but we can't really be sure what happened that caused them to confiscate their equipment. They may, in fact, be a an "innocent ISP," but in my experience how well any interaction goes really depends on both parties. For example maybe it went something like this:

FBI: "We're going to need access to your logs."
ISP: "Sorry, but the FBI can suck my ass."
FBI: "We'll be back with the moving vans."

or maybe it went like this:

FBI: "We're going to need access to your logs."
ISP: "Ahhh CRAP, CODE RED, CODE RED, hit the button JOHNNY THEY'RE ON TO US, JOOOHHHNNNYYY!!! [ahem] Sure thing FBI dudes."
FBI: "We'll be back with the moving vans."

and maybe it could have gone like this:

FBI: "We're going to need access to your logs."
ISP: "Sure no problem, we understand you want the requested information within two hours. We'll get you set up with stations you can use to search, and dedicate every available resource to helping you. We take this matter seriously."
FBI: "Dammit, cancel the moving vans!"

All I'm saying is... who knows what happened. If they were willing to wait two hours, then likely if diplomacy had gone well, they could have waiting three, or six, and eventually maybe a day or two.

Re:In response to a hacking incident?

[Atryn]

I guess "real soon now" should have read "9 days"?

My guess is that as these folks provide dedicated hosting for companies concered about DDOS attacks, the web sites they host probably don't like to be offline for a few hours much less 9 days. So 9 days is a VERY long time. I would bet they will lose some clients over this, regardless of whose "fault" it was.

Re:In response to a hacking incident?

[aonaran]

I seriously doubt they'd retain enough clients to stay in business after a 9 day outage.

I'm sure that it's also quite hard on some of the clients. Depending on the business you are in being offline for over a week can be quite a stress on the business. The smart ones will have their own backups and will find another data centre to get them back online, but the odds of them switching back, I think, would be very slim.

Re:In response to a hacking incident?

[Tackhead]

> There was: Hosting Provider Shut Down By FBI

Five days before 9/11. A Texas-based host of Arabic websites, shut down as part of a terrorism investigation. Yep, just coincidence. Move along. Nothing to see there.

The memory hole is deep indeed. I'd even forgotten my own posting, four days before 9/11, which turned out to be pretty fucking spot-on. The ISP was indeed part of the Holy Land Foundation, a front group that laundered money for terrorists, and was declared as such while New Yorkers were still cleaning the dust from their apartments.

As for me, I'm going to start keeping very close watch on the implied volatility of options contracts in the publicly traded securities of certain industries this week.

A huge increase in implied volatility in the options market was the second tipoff that civilians could have used to figure out that something was afoot during the days before the attack.

Being an armchair open source intelligence analyst is a hell of a lot of fun. If the options market starts to go screwball in the obvious target industries, the next two weeks are gonna be a hell of a lot of fun.

Meantime, cross your fingers, and even if you're an ACLU sympathizer, just once, root for the FBI. Imagine what things would be like they not fucked up so fucking badly in 2001. Now, do you really want them to fuck it up again? During an election year?

More to the story

[OPTiX_iNC]

I'm sure there is more to the story than what we are hearing...

I wonder what the FBI was looking for.

Re:More to the story

[MisanthropicProggram]

I don't know why your were modded down to -1, but I had the same thought. I haven't seen this story picked up on any other news outlet yet. And the article was posted on Feb 19th! What's going on here.

Re:More to the story

[millahtime]

I bet there is more to the story than we are hearing. There was a search warrent from the "United States District Court for the Southern District of Ohio"

To get a search warrent you have to have something to go on already.

Re:More to the story

[Ian Wolf]

A search warrant is one thing, shutting down a private enterprise because a couple agents got impatient or paranoid is another issue entirely.

We keep hearing about liberal judges this and liberal judges that in the media, but there are just as many conservative judges giving law enforcement rubber stamps on warrants.

Re:More to the story

[millahtime]

There is a lot that is not being said. Such as, did CIT cooperate? Did they obviously stall or with hold information? Did they claim to not have records they obviously had? This is not the whole story and maybe the only alternative to getting the information was to take the equipment. Maybe CIT gave them no alternative. We are speculating based on one sides point of view.

Moderators: I know this may be redundant but I was responding to his comment. He obviously didn't read the 50 posts in front of this one.

Re:More to the story

[Anonymous Coward]

Let's see:

According to the linked forums:

the "datacenter" is being run out of some guy's basement;

the "datacenter" housed, among other things, IRC networks of somewhat dubious (at best) value;

many boxes were claimed to be owned;

and, as part of an ongoing investigation, none of the above is possibly true. :)
Since the owner is forbidden to talk (probably on the advice of his lawyer, not the FBI) about what's going on, it's a little useless to speculate. So, let's not jump to conclusions.

Re:More to the story

[dotmaudot]

I haven't seen this story picked up on any other news outlet yet
Maybe you looked at the wrong sources :-) Anyway, if you are interested in knowing more, have a look at the records at SPEWS . ciao, .mau.

Re:More to the story

[Alranor]

"The phrase

"I disapprove of what you say, but I will defend to the death your right to say it"

is widely attributed to Voltaire, but cannot be found in his writings. With good reason. The phrase was invented by a later author as an epitome of his attitude. It appeared in The Friends of Voltaire (1906), written by Evelyn Beatrice Hall under the pseudonym S[tephen] G. Tallentyre."

(from here )

Re:More to the story

[gertsenl]

If you consider 2600 a news outlet, then you'll be glad to know that Off the Hook spent quite some time last week talking about the incident.

Re:More to the story

[AntiOrganic]

While we're randomly throwing around Googled websites to get to the bottom of this quote issue, how about this one?

"Then along comes Norbert Guterman to claim that what Voltaire _did_ write in a letter of February [6,] 1770 to a M. Le Riche was: 'Monsieur l'Abbe, I detest what you write, but I would give my life to make it possible for you to continue to write.' So, whether or not he used the precise words, at least Voltaire believed in the principle behind them."

Re:More to the story

[Ian Wolf]

I read every single one, fine thank you. The article too.

Maybe we are only getting half the story, and maybe we are getting all of it. The difference is that I am relying on the information I do have and you are relying on information that _must_ exist, but have no proof of because you can't believe that this kind of thing would happen otherwise.

I believe it is entirely possible that the FBI acted in such a manner because they felt that CIT was either stalling or even destroying evidence. I can only assume that they presented this theory to a judge, backed it up with some evidence and got the warrant. However, all of that is speculation.

I worked in the legal system on both sides of the coin as a paralegal before I saw the light and switched to IT. I can only go on my personal experience when I say that this could indeed be the whole story. I have personally seen judges rubber stamp warrants with zero evidence and I have seen judges refuse to sign warrants with all kinds of evidence. I have seen law enforcement officials embellish and even fabricate evidence for the purpose of getting a warrant and I've seen law enforcement officials vehemently defend a defendant's rights.

My point in the previous post, may have been a little incendiary, but the point is DO NOT discount the story simply because you think there MUST be more to it, when it could simply be all there is to it.

Re:More to the story

[Frater 219]

Anyway, if you are interested in knowing more, have a look at the records at SPEWS

Ah. That explains a lot. The anti-spam folks (including SPEWS) have been trying to bring this ISP's child-porn-spammer problem to their attention for months. It hadn't worked; the child porn stayed up on their servers and the spammers kept blasting ads for it to all and sundry -- including a very worried biologist at my site, who wanted to know why he seemed to be on some spammer's list of paedophiles?

By the time the FBI got around to investigating, the ISP had probably (as "bulletproof bulker hosting" ISPs usually do) told their spammer customer that they were taking fire. Under those circumstances, the FBI's move was probably a good one -- to keep the child-porn spammers from deleting all their files and hiding their traces.

Re:More to the story

[pcraven]

I wrote a letter to a DA once about a slashdot story. I was really irritated that the DA would prosecute someone who was just demonstrating how a security hole worked for a company.

Several months later, I got a letter from the DA. Now she could talk about it, as the case was over. Turns out the guy pleaded guilty. He not only had demonstrated the hole, but before he had been running all over the company network doing stuff that was clearly not legal. I felt like such a heel writing a letter of support for this sod.

This story, of course, was never posted by Slashdot to my knowledge.

So while I do not discount the story, I'll start by asking for more information, and not by calling the FBI a bunch of jerks. (I'll do that later when I have more info, and am reasonably sure I won't stick my foot in my mouth.)

Re:More to the story

[Viv]

There's almost certainly more to the story. I've had some experience with FBI "raids" where I used to work. It was a semi-large hosting provider in south Florida. I worked there from about 1999-2002. In that time, we had FBI "visits" at least 5 times in that time period because of nasty stuff our customers were doing.

Not ONCE did the FBI leave the property with our machines. The key was cooperation. The FBI agents knew what would happen if they left with our equipment, and knew that we would do everything in our power to help them get the job done without having to resort to that.

Heck, I even showed them better ways to get data off of the machine. We had a good working relationship. They'd show up with the warrant/subpoena, we'd go pull the machine that had the data they wanted. We'd assign one of our technicians (usually me) to help them copy everything over. They'd be out the door with whatever data it was they needed by the end of the day on hard disks they brought onsite with them.

The fact that the FBI left with their machines indicates to me that the provider did something stupid to piss off the agents. They probably made everything as difficult as they possibly could, and the FBI agents got sick of it, and said, "Screw this, I can get this done in the lab without all of this bullshit."... and then they did it.

In my experience, most law enforcement (especially FBI) consider themselves professionals. Usually, they're not out to get you personally, they're just out to do their job. If you don't make their day any harder than necessary, they're not going to make YOUR day any harder than necessary.

So to the extent that you feel you can, MAKE THEIR DAY EASIER. They'll tend to do the same.

Re:More to the story

[Ian Wolf]

Well, I've definitely done that while working on the defense side of the table. You tend to distrust your clients, but every once in a while they come across pretty convincing. Then 6 months in you not only realize that your client was lying, but they've done a bunch of other things to make your job impossible, unfulfilling, and distasteful. That's why I moved on.

I rarely blame law enforcement for taking extensive measures, trying to bend the rules. Its their job to do that. What I really became disgusted with were judges that routinely threw the Bill of Rights out the window OR the gutless wonders absolutely terrified of being overturned. Its their job to keep law enforcement under control; to balance the rights of the individual versus the greater good. There are a great many out there that are not doing their job.

Poor hosting company

[Anonymous Coward]

The poor hosting company probably has ToS to live up to. This will ruin them.

If nothing is found, will they have any recourse against the FBI or are they screwed?

Re:Poor hosting company

[LostCluster]

The poor hosting company probably has ToS to live up to. This will ruin them.

Law always beats a ToS. If the FBI comes with a warrant for a piece of customer data, you've got to turn it over even if your ToS/Privacy Policy says you won't. To avoid getting caught in this jam, include a statement saying you'll turn over anything to any authority who presents a proper warrant.

If their business was based on not turning anything over to the spooks, well, so much for that idea.

Re:Poor hosting company

[carou]

If their business was based on not turning anything over to the spooks, well, so much for that idea.

I think the parent was probably referring to uptime guarantees, which the confiscation of equipment has caused the ISP to fail on, rather than anything to do with data privacy.

Re:Poor hosting company

[thona]

Exactly.

And for the other customers, the FBI raid is a non-issue.

Basically, if they guarantee MY server's uptime, and MY server is confiscated due to them not providing the data on another customer (important point) in time, THEY pay ME. Their fault.

OTOH some customer's may realize that 99% uptime mean an agreed upon downtime of about 3.5 days which CAN be taken in one block :-)

Re:Poor hosting company

[fallen1]

If their business was based on not turning anything over to the spooks, well, so much for that idea.

Well, that is easy to remedy - DON'T KEEP ANY LOGS. Fuck 'em. If I remember correctly there is no law that says an ISP/hosting company/etc. are supposed to keep logs. Give your customers the same option - clean wipes on the logfiles. Yes, of course, the data stored in customer databases is still fair game but at least you are giving them some privacy options.

Re:Poor hosting company

[Ath]

And for the other customers, the FBI raid is a non-issue.

Basically, if they guarantee MY server's uptime, and MY server is confiscated due to them not providing the data on another customer (important point) in time, THEY pay ME. Their fault.

Wrong. There is a clear common law legal principle that is considered inherent in contracts. You cannot contract anything that is a violation of the law.

In this situation, the facts are rather murky. If the hosting company was the cause of the FBI seizure then you might have a contractual violation. But the hosting company cannot be held to have violated its ToS because the FBI made a unilateral decision to seize equipment. The alternative that you suggest is that the hosting company resist compliance with the search warrant and ultimately the seizure. You, as a customer, cannot insist on that...no matter what your contract says.

Re:Poor hosting company

[jrockway]

If I were the ISP, I would just not keep logs. Then there's nothing to turn over, right?

Re:Poor hosting company

[Sloppy]

If they ran redundant systems, then the redundant systems would have been seized too. Hmm.. unless they were somehow placed outside of FBI's reach.

Now there's an idea. If you truly want fault-tolerance, then you need your computers physically spread out over multiple governments' jurisdictions.

Re:Poor hosting company

[whereiswaldo]

If I were the ISP, I would just not keep logs. Then there's nothing to turn over, right?

As an ISP, you are required by law to keep all logs. If you don't, you're in (thick accent)"veddy veddy deep shit".

How about the sustained financial damage?

[devilkin]

And what if you run your website on those servers for commercial use? Will the FBI refund the finanial damage you suffered (e.g. when you run a webshop or smthing)?

Re:How about the sustained financial damage?

[cybermace5]

What if a criminal escaped onto the street where your brick-and-mortar shop was located, and they closed down a several-block radius for as long as it took to find him? You think they should compensate all the businesses that were affected?

Re:How about the sustained financial damage?

[Threni]

That's the clumsiest analogy I've heard for a long time! Thanks for a lunchtime giggle!

Re:How about the sustained financial damage?

[ca1v1n]

They don't do that, except in cases of people believed to be dangerous, and then only for a very short period of time. That's the point. They went WAY too far in this case.

Re:How about the sustained financial damage?

[vanillacoke]

Yes but buildings aren't constantly evolving and revolving of capitalism At one point it's still a box containing stuff you sell. People will still come back and 1 day hit is minimal at best to finances. (Ex: You sell bred. Your store is closed down. Your bread will still be there tomorrow) Online service companies OTOH have contacts to hold up. They must compensate for when they are down on their end. ( Ex: funnywittyp0rnname.com sells a service, they having income coming in and must continue to provide services at any giving time on the internet (for people um, who want porn at 3:30 in the afternoon). No porn, that guy now has to break the law and download for free of kazza. Net loss both parties (Legal porn, source of revenue))

Re:How about the sustained financial damage?

[Threni]

How long will the FBI retain the hardware for? I'm not sure that the police would stop trading in a location involving more than one business/shop for what would be days/weeks/months just to catch one person who's allegedy committed a crime. Perhaps you could point me in the direction of some information about such a case.

Afternoon tea isn't for another hour and a half, but i'll raise my mug of Assam tea to you when I finally get around to it. And my teeth are fine, thanks!

Cheers!

Re:How about the sustained financial damage?

[SoTuA]

Do they close the several-block-radios for ten days?

Re:How about the sustained financial damage?

[R.Caley]

The closest model I can think of would be the Steve Jackson Games case where they got damages, eventually.

Of course, that was a long time ago, these days they would probably just have sent anyone suspected of having a copy of Illuminati to Guantanamo.

Re:How about the sustained financial damage?

[misterpies]

>>You think they should compensate all the businesses that were affected?

Suppose it was your business. You're not doing too well, but you've just had a big order that will keep you afloat. But the police close down the area and you can't fulfill. Maybe you sell perishable goods, so your stock is now worthless. You didn't fulfill the order, so you don't have the money to pay your supplier for the now-worthless stock. You have no option but to declare yourself bankrupt. You lose your business, your house and your car. All because of the police closing the road.

Still so sure you shouldn't get any compensation?

Re:How about the sustained financial damage?

[micromoog]

Have you seen the latest polls? Bush is on the run, and it's only February. Expect his dirtiest of tricks shortly.

Re:How about the sustained financial damage?

[ratamacue]

Absolutely, they should provide full compensation for everybody who is affected. Shuting down a business (or detaining an individual) is a penalty. Under no circumstances should a law-abiding business (or individual) be penalized for the actions of somebody else. If the court finds no other way to solve the case than by penalizing innocents, then at least they should be compensated for the time, effort, and lost business.

Re:How about the sustained financial damage?

[sjames]

What if a criminal escaped onto the street where your brick-and-mortar shop was located, and they closed down a several-block radius for as long as it took to find him? You think they should compensate all the businesses that were affected?

Since a net based business lives on it's servers, we'll have to adjust your analogy a bit.

What if a criminal escaped onto the street where your brick-and-mortar shop was located, and they hauled the building and it's contents to their warehouse for a few weeks? You think they should compensate all the businesses that were affected?

Considering that most of those businesses will otherwise fail leaving their owners and employees without an income, YES!

Re:How about the sustained financial damage?

[chrisbtoo]

Do they close the several-block-radios for ten days?

Damn, that's a big radio.

Not fast enough

[RedShoeRider]

"the FBI determined that it was more efficient (from their point of view) to remove all of our servers and transport them to the FBI local laboratories for inspection,"

Ok, so it's faster to have to unplug all of the servers, carry them out of the building, put them on a truck, drive them several (dozens?) of miles, unload them from the truck, put them in a warehouse, re-plug them all in, and now have to datamine without the assistance of the people who operate the systems.

Was I abducted by aliens and brought to Bizarro world while I slept last night, or am I just missing something here?

Re:Not fast enough

[whathappenedtomonday]

you know, whenever europeans read such stories, there comes that awful feeling again - that something within the US must be terribly wrong and - what is more - only a few people seem to care or even notice.

Was I abducted by aliens and brought to Bizarro world

no need to bring you there - and no aliens involved, either ;)

see the link in my sig if you care to see how the authorities made such things possible.
(check each of the "14 Defining Characteristics" you recognize, count checks and post your results ;)

Re:Not fast enough

[Ian Wolf]

Every European government's law enforcement agencies have the same horror stories. Correction, every government's law enforcement agencies have the same horror stories. The principle difference is in America its a lot easier for people to shine a light on these activities. Of course most of my fellow citizens are suffering from terminal apathy, so little ever gets done about it.

Re:Not fast enough

[Handpaper]

re-plug them all in
Never. Hard drives are forensically examined by being removed from their machines and duplicated (usually using dd). No investigator would ever boot a machine which is the subject of an investigation - auto-deletion scripts are just too easy to write.

Re:Not fast enough

[Lord of Ironhand]

Speaking as a European, I would say that you are both mostly correct.

In Europe, most governments actually show that they care for the citizens that elected them. (There is always the knee-jerk reaction that you mention to anything reminding us of Nazi Germany, but since some people that lived through the holocaust are still alive today, and being reminded of that period is unsettling for them to say the least, that's one of the few areas where I think restrictions to free speech might be justifiable.) Social security ensures that good education and health facilities are available to anyone, including the poorest. Legal protection for citizens from large commercial entities is generally OK.

On the other hand, Europe is starting to suffer more and more from the same problems the US currently has. Our governments are becoming aware that a scared citizen doesn't question its government. Privacy and freedom are things for extremists, good citizens care about safety and nothing else. Social security is being slowly broken down, and large commercial entities are gaining more and more power over government decisions.

Re:Not fast enough

[Beryllium Sphere(tm)]

>Hard drives are forensically examined by being removed from their machines and duplicated (usually using dd). No investigator would ever boot a machine which is the subject of an investigation - auto-deletion scripts are just too easy to write.

In addition, you want to be able to tell a court that what you examined was really the same as what was there before you looked. Even without an auto-delete script, do you have any idea how many files get touched on a normal boot of, say, Windows XP?

The hard part is deciding how to unplug the machine. Forensics people love to argue about whether to yank the plug, risking a damaged file system and snide questions from opposing attorneys, or whether to do a normal shutdown flushing caches, running shutdown scripts, making other changes, thus risking a changed file system and snide questions from opposing attorneys.

dd is a start, but a pro will have a hardware write-blocker for the drive under examination and at least one strong hash generator to prove integrity of the copied files.

This is outside my firm's core expertise, so read up on it if you need definitive info.

Re:Not fast enough

[whathappenedtomonday]

> every government's law enforcement agencies

agreed. i do think that the rudeness with which things can be done in the US is of an altogether different quality, though.

> in America its a lot easier

uhm, not sure. wouldn't you agree that there's quite a lot of things you'd rather not speak out in public? not exactly for fear of being prosecuted by your government, but that happens, too (cf. anti war protesters and the likes).

> terminal apathy

well, that seems to be a widespread disease all over the planet - still i'd admit that some of your fellow citizens really do seem to lead the table ;)

Re:Not fast enough

[jnicholson]

Speaking with the limited perspective of an outsider, I don't think that Americans are actually all that free.

TV networks are forbidden to use language that's used every day by a large number of people, apparently in order to protect other people - and more especially, their children - from hearing that language. (Never mind that they hear it on the playground anyway.)

If you have any opinions on religion, or abortion, and you are ever heard to speak on them without the careful alteration of a PR expert, you can forget ever running for public office.

It looks to me as though the appearance of truth is more important than actual truth when it comes to politics and law (if those two things are even separate.) Someone with enough money and anything that even looks like a valid case can apparently sue you until you're too poor to defend against it any more.

And when you've read British tabloids (I'm not British, BTW) you'll have a new appreciation for what 'freedom of the press' actually means. Those guys can (and do) print anything! The more ridiculous seeming, the better!

This is just what it looks like from the outside, though, so I can't know if it's accurate.

But... But... But

[Anonymous Coward]

"if you don't have anything to hide or have not done anything wrong, then you have nothing to worry about[TM]"

or something like that? I wonder how their other clients feel?

FBI??

[Ratface]

If the FBI shoed up at my door... there would be a hell of an international incident as I live in Sweden (you insensitive clod!)

Re:FBI??

[takev]

Then again, I live in the Netherlands but I was at work in Belgium and in the hotel I was watching the news.

There was a kidnapping of a rich kid (who lived in the netherlands) and he was found (alive) in belgium. This doesn't happen very much where I live (or at least it isn't reported).

Now the interesting thing was, that the FBI helped in the investigation. The news didn't report why FBI agents helped, so I couldn't comment. It could be just some agents in a foreign exchange program though.

Re:FBI??

[Shinobi]

Actually, several FBI agents have been seized and more or less thrown out of the country by Swedish police, for failing to comply with Swedish law and international treaties.

Re:FBI??

[suwain_2]

If the FBI shoed up at my door...

For a minute I thought you were going to say you lived in Holland.

I wonder...

[millahtime]

if CIT might have been uncooperative. This article is very one sided and if it was taking hours and they weren't seeing it get anywhere then there might have been a legitimate problem. I don't know if taking the servers was the best solution but if they did it then there must have been something going on.

Re:I wonder...

[AlgoRhythm]

... but if they did it then there must have been something going on.

Riiiiiiight, 'cause the FBI has always got the best interests of the american people on their minds ... they would NEVER do anything of questionable ethics.

Effects on Business Rules?

[Jackdaw Rookery]

Aren't there rules on how the FBI can act in these situations?

I thought there actions could not significantly damage a company's business if that company wasn't the one under the kosh.

It's not the ISP's fault in this case and they are the ones getting screwed.

Assholes.

[grub]

So the FBI took the machines and were able to copy and peruse all data on the system, not just the data the warrant was for. Welcome to 1984!

Re:Assholes.

[teamhasnoi]

Nah, if this were 1984, the hosting company would gladly hand over the servers.

Not to mention you could've just used a box of floppies to copy the hard drives.

script kiddy and spam proxy heaven

[Anonymous Coward]

Last year I found the a controller of the proxy that was installed on a NT workstation happened to be controlled out of the same data center that was shut down. That machine was telling the NT box to send out massive amounts of spam.

This is about the last data center on earth where script-kiddies can get free shell accounts.

This is a case were many servers got caught in the crossfire aginst the script kiddies and spamers.

Website of Mass Destruction?

[ka9dgx]

What were they looking for, a Website of Mass Destruction or something?

--Mike--

Nazis? - I hate Illinois Nazis

There's gotta be more to this

[queen of everything]

There has to be more to this story. From what the article says, the FBI just walked in and shut them down. While that might have happened this story seems to be extremely one sided and a little short on the detail.

Initially, I don't like the sound of it at all given that I host several domains and don't want the FBI coming in and taking all of my servers. But, we don't know what led up to the seizure....maybe it was a legitimate action? We shouldn't judge too harshly until we have all the information. I'm trying to play devil's advocate here.

Re:There's gotta be more to this

[shyster]

Yeah, the more of the story is pretty well detailed in the WHT forums.

Rumors have ben flying for quite awhile that Paul (the owner) was either involved or turned a blind eye to DDoS drones on his network. Some rumors stated that he's DDoS competitors to prove the superiority of CITHosting's DDoS hardened servers.

Seeing as this "data center" seems to have been his basement, I'd bet his (lack of) logs, records, and monitoring left the FBI little choice but to seize the whole thing. And, we can assume he was uncooperative as he may have been involved or at least knoweledgeable.

The general reputation of Foonet also seemed to be a bit on the black hat side. No doubt there may have been some legitimate customers as well, but they seem to be known more for their spammers and script kiddies (and cheap shell accounts) than for their legitimate webhosting.

All in all, it looks to me like the FBI did what it had to do to effectively process the warrant. They were evidently going after a network, not a specific machine. Unfortunately, some legitimate customers got caught up in it.

It looks like CTIHosting was recently sold, and is being moved to a new data center in Chicago. Let's hope that it comes back as a legitimate business this time. They've already stated that IRC will be down indefinitely, so that's a good sign.

Re:There's gotta be more to this

[WNight]

Tell that to Steve Jackson Games. If the FBI really wanted to get in get the info and get out, they'd shut down everything, image every hard drive in the company, and leave.

Instead, they confiscate everything and make you wait months or years to get it back, if you ever do.

What kind of sick joke is this?

[elchulopadre]

First their webserver farm gets seized by the FBI, then you post their story on /. ??? Give these guys a break!

um...

[boogy nightmare]

I would be more worried about the fact that rather than being supplied with the data that they originally requested, they now potentially have the logs/records/recordings/information of all the transactions and customer records and IRC conversations ever hosted by this...

Will they delete the 'copied' data after they have finished, keeping only the information that they originally wanted, please this is v bad...

Thank God i dont live in the US

Re:um...

[Desert Raven]

In the United States, due process requires that the evidence collected by the warrent only be used against the people the warrent was issued against. There's no real point to keeping the data around, since they couldn't use it to convict anyone, even if they find a crime.

Wow, where did you get that line of crap from? Any evidence discovered in the execution of a legally issued and legally executed search warrant is admissable in *any* court proceeding. If you stashed your kiddie porn in your employer's filing cabinets, who was coincidentally being searched for evidence of financial fraud, you'd better believe that they are admissable. As long as the warrant covers the area being searched, it's fair game.

And yes, I have first-hand experience with search warrants and their execution.

Full Text

[Anonymous Coward]

FBI Shutters Web Host

By Rich Miller
Carrier Hotels Editor
Posted Feb 19, 2004

If FBI agents showed up at your data center bearing a warrant, would you be able to provide them prompt access to customer data? How long would it take?

That's an important question in the wake of an FBI raid of Columbus, Ohio hosting company CIT Hosting last Saturday. Federal agents wound up shutting down the entire operation, seizing all the company's web servers and all customer data as part of its investigation of a hacking incident.

CIT Hosting, also known as FooNet, markets itself as "the leader in the IRC and DDoS protection business for the last 5 years." The company posted a web page informing customers that its data center was shut down, and instructing customers to contact the FBI if they needed access to their files.

"The FBI executed a search warrant issued by the United States District Court for the Southern District of Ohio regarding the IRC network that we host," the company said in its statement.

IRC (Internet Relay Chat) is a live chat system that allows users to create private discussion rooms. While IRC has a lengthy history of legitimate use, it is also a medium for discreet communication between hackers. CIT said the FBI was "investigating whether someone hosted on our network hacked and attacked someone else."

"After several hours of attempting to track down, inspect and audit the terabytes of data that we host, the FBI determined that it was more efficient (from their point of view) to remove all of our servers and transport them to the FBI local laboratories for inspection," the statement continued. "The FBI has assured us that as soon as the data has been safely copied and inspected, the equipment will be promptly returned. Unfortunately, the FBI has not been able to tell us when they will be completed with their inspection."

The seizure isn't standard procedure, and there's no way to know exactly what prompted it. CIT's account suggests the FBI may have lost patience with the process. The IRC-focused nature of CIT's business may also have been a factor.

But if you're a data center operator, you want to avoid any scenario in which the FBI gets impatient and starts hauling away your servers. Just one more item on the contingency planning checklist for the times in which we live.

Re:Full Text

[Anonymous Coward]

Haha That asshole ArGG finally got what he deserved.

I use to hang on Undernet, and ArGG (Owner of FooNet) use to have a botnet that had been loaded with DoS attacks. He would wreak havoc on any channel that opposed him.

Not sure if he is still into script kiddying, but I could see why the FBI would just take his shit. Knowing that fuck, he probably DoS'd the wrong server.

FBI Probably knew that he'd probably delete/cover his tracks if it wasn't for the confiscation.

Re:Over the top anyone?

[BigDork1001]

This is the US we're talking about. We sue everyone for everything. In fact I just might sue you for implying we wouldn't sue.

Grass roots report

[rf0]

Its worth reading this thread
Rus

Re:Grass roots report

[CountBrass]

Informative?

Did the mod' even read the stuff pointed to- it's basically a thread of:

• "what happened?"
• "that's terrible"
• "thread merged with other thread"
• "what happened?"
• "that's terrible"
• "thread merged with other thread"

In otherwords just like a /. thread but without the occassional useful post!

Re:Grass roots report

[1u3hr]

Informative? Did the mod' even read the stuff pointed to- it's basically a thread of...

But if you skip a few pages on you see some intersting stuff a few days later: like this

We were in contact with Agent White earlier today. They did confirm that they had all of the hardware. They are apparently working 24/7 to mirror all the hard drives.

In our case, we are the owners of the hardware and it is necessary for us to have the computers to continue operate as a business. Apparently, we will be receiving our hardware within a week of signing the waiver. The hardware will be shipped directly to us.

Before the hardware is released, we are required to fill a waiver. Basically it says that we "waive the provisions of Rule 1002 of the Federal Rules of Evidence as it applies to the aforementioned computers which were seized by the FBI on February 14, 2004"

The waiver also states that you "agree that the duplicate images of the hard disk drives of said computers created by the FBI on February 15, 2004 or later will be admissible as original evidence of the contents of said hard disk drives at any court proceeding relating to this investigation and further agree not to contest the admissibility of the contents of said duplicate images in any court proceedings which may result from this investigation"

Apparently the basement was specifically built for the purpose of hosting servers. Everything was in racks.

No one has any clue as to what the feds were lookng for. Though apparently the hosting service was very indiscriminate with what it hosted. Probably not the hot button "terrorist" or "kiddie porn" that people keep imagining; I rather think the FBI would have been much less polite in those cases.

more important (?) how much customer data stored?

[buzban]

IDNRADC (I do not run a data center), but don't let that stop me from making a completely unqualified comment ;) ....

Perhaps just as important, or more important, are you storing customer data that could/should be regularly deleted? Not that burning everything when the FBI shows up is the best option, but having a sensible scheme for what needs to be stored, and what would be better deleted and overwritten, seems to me to be important...

Threat?

[glpierce]

Well, what if there was a credible threat made by terrorists through the hacking? Perhaps time is of the essence, and tracking the person down could bring down a terrorist cell.

Re:Threat?

[Chundra]

Abdul, Mohammed, Mustafa Ali, greetings! The goat is roasted. I repeat, the goat is roasted. Run! Run like the great camel to tell Uncle.

Returning Equipment

[millahtime]

There is an article here that tells that equipment is already being returned.

Re:Returning Equipment

[back_pages]

Don't go and ruin this for the rest of us! We have our torches, we have our pitchforks. We've decided to discard our individual responsibility and replace our own thoughts with groupthink! Damn it, man, don't ruin this for the rest of us with your petty "details" and "facts"! This is no time for the voice of reason. No time at all!!!!

Look! I'm whoring!

[teamhasnoi]

From their site - don't forget to let the FBI know what you think! rwhite3@leo.gov

02/23/2004 CIT re-establishes service.

We have restored service at Equinix's Chicago Data Centers. We are in the same facilities as MSN and many fortune 500 companies. The facility has multi OC192 connections to the backbone.

The FBI has begun retuning equipment to CIT which is being shipped to our new facilities in Chicago.
At this time CIT will continue to provide dedicated DDOS Protected web hosting only.

CIT provides reliable and scalable solutions for customers of all sizes and services. Located in Equinix's Chicago Data Centers , CIT has access to all the major carriers without the need for local loop circuits.

Our Chicago staff is focused first and foremost on customer satisfaction, and will take every action necessary to accommodate each customer. Unlike many large ISPs, CIT prides itself in its ability to provide personalized service to each customer - if a customer calls twice for assistance, they can usually speak to the same representative. Our sales and support teams are allowed a great deal of flexibility to work together to resolve each customer's needs on an individual basis. Our success and rapid growth can be attributed to the satisfaction of our customers - word-of-mouth referrals account for a large portion of the new business we receive each month.

The IRC Network will remain down until further notice.

02/14/2004 FBI Confiscates all servers

Dear Customers of FOONET/CIT:

We regret to inform you that on Saturday February 14, 2004 at approximately 8:35 am EST, FOONET/CIT's data center in Columbus, Ohio temporarily ceased operations.

Here are the facts of what occurred:

The FBI executed a search warrant issued by the United States District Court for the Southern District of Ohio regarding the IRC network that we host. According to the warrant, it appears that the Bureau is investigating whether someone hosted on our network hacked and attacked someone else.

After several hours of attempting to track down, inspect and audit the terabytes of data that we host, the FBI determined that it was more efficient (from their point of view) to remove all of our servers and transport them to the FBI local laboratories for inspection. This was completed at 7:00 pm EST same day.

The FBI has assured us that as soon as the data has been safely copied and inspected, the equipment will be promptly returned. Unfortunately, the FBI has not been able to tell us when they will be completed with their inspection.

We have been told by the Special Agent in charge of the investigation that If you need access to your data you are asked to please contact the Bureau via email to rwhite3@leo.gov. Make sure to include in your email your name, mailing address, and telephone number with area code.

Since we wish to focus 100% of our efforts on restoring services, we would appreciate it very much if you do not attempt to contact us directly. Please rest assured that we are doing everything possible to restore service to you as quickly as possible.
To the many who have inquired, Paul and family are OK, although shaken by these events. They are at home and awaiting the blessed event of their new child's birth. We thank you for your good wishes and prayers.

Please check back here often. Through this site, we will keep you informed of ongoing developments as we know them.

Thanks again for your understanding.

Re:and....Absentee landlords.

[Anonymous Coward]

Marked troll already. That's slashdot for you.
Anyway this incident illustrates why the citizentry needs to be active in government instead of reactionary and "woe is me" after the fact. The government isn't very good at self-disciplining. That's our job. An absentee citizentry breds the results you see. Get out and vote in 2004. Get involved in local and national politics. Stop being a wallflower.

IRC servers huh?

[dickiedoodles]

What do you think the chances are that this has something to do with the microsoft source code leak?

What really sucks....

[Ghostx13]

Is that if the FBI, ATF, *BI, or whoever seizes your property in the investigation of a crime, they are in no way liable for any damage that occurs to your property, if you can even consider it your property anymore, because, even if your property was deemed to have NOTHING to do with the crime being investigated, said above entities are not required to return your property. You have to SUE to get it back. Now how's that for some bullshit.

DOS

[MikeFarrington]

Ironically, they were probably investigating a Denial Of Service.

The FBI is already returning some equipment...

[shyster]

Looks like the seizure occurred on 02/14, and that as of 2/23 some servers have already been shipped back and put back on-line. As of now, their IRC network is still down...though it's unclear whether that's due to an FBI decision, the FBI still having their servers, or a CITHosting decision.

The only thing I find a bit odd about this whole thing is that it looks like they too the opportunity to relocate their data center to Chicago (it was previously in Cleveland). According to their news,

The FBI has begun retuning equipment to CIT which is being shipped to our new facilities in Chicago.

Wouldn't that unnecessarily delay the process of restoring service to their customers? Was the move already planned, or did they suddenly decide that they needed a different data center? Is it possible they're blowing the seize out of proportion in order to cover outages due to their move? Or did the seizure even actually happen?

Seems to blow a hole in the theory..

[Linker3000]

...that 'the powers that be' are monitoring everything 'on the fly', if they need to get their hands on the physical data repository to check it out.

Re:Seems to blow a hole in the theory..

[vegetablespork]

That's exactly what they want you to think. Perhaps they already had sniffed the evidence illegally, and needed to extract it from the servers under the cover of a search warrant in order to subsequently be able to use it in court.

This is all just speculation, naturally, but such a scenario would be very similar to other fourth amendment workarounds--perform broad, illegal searches (e.g. infrared through walls, which is inadmissible in the U.S. without a warrant) to target homes for additional surveillance. From the results of that illegal search, "happen to" notice something "on routine patrol," then get a warrant, and voila`--untainted evidence usable in court.

Financial damage may not be worst...

[millahtime]

what about their reputation for having illegal or compromising people using thier service. That reputation alone may be worse than the downtime.

Steve Jackson Games

[dmoen]

If this case follows the same course as Steve Jackson Games (the Secret Service confiscated most of a business's assets as part of an investigation), then the hosting company may not get their stuff back for years, if ever, and they'll need to fight a court battle.

Doug Moen

In other news....

[arduous]

... slashdot alerts carrierhotels.com that they have 1 minute to prepare for slashdoti.... oops, times up!

Arcticle text:

FBI Shutters Web Host

By Rich Miller
Carrier Hotels Editor
Posted Feb 19, 2004
Print This Story

If FBI agents showed up at your data center bearing a warrant, would you be able to provide them prompt access to customer data? How long would it take?

That's an important question in the wake of an FBI raid of Columbus, Ohio hosting company CIT Hosting last Saturday. Federal agents wound up shutting down the entire operation, seizing all the company's web servers and all customer data as part of its investigation of a hacking incident.

CIT Hosting, also known as FooNet, markets itself as "the leader in the IRC and DDoS protection business for the last 5 years." The company posted a web page informing customers that its data center was shut down, and instructing customers to contact the FBI if they needed access to their files.

"The FBI executed a search warrant issued by the United States District Court for the Southern District of Ohio regarding the IRC network that we host," the company said in its statement.

IRC (Internet Relay Chat) is a live chat system that allows users to create private discussion rooms. While IRC has a lengthy history of legitimate use, it is also a medium for discreet communication between hackers. CIT said the FBI was "investigating whether someone hosted on our network hacked and attacked someone else."

"After several hours of attempting to track down, inspect and audit the terabytes of data that we host, the FBI determined that it was more efficient (from their point of view) to remove all of our servers and transport them to the FBI local laboratories for inspection," the statement continued. "The FBI has assured us that as soon as the data has been safely copied and inspected, the equipment will be promptly returned. Unfortunately, the FBI has not been able to tell us when they will be completed with their inspection."

The seizure isn't standard procedure, and there's no way to know exactly what prompted it. CIT's account suggests the FBI may have lost patience with the process. The IRC-focused nature of CIT's business may also have been a factor.

But if you're a data center operator, you want to avoid any scenario in which the FBI gets impatient and starts hauling away your servers. Just one more item on the contingency planning checklist for the times in which we live.

Unlawful search and seizure?

[bsDaemon]

We, my comrades, live in dangerous times. It is not the threat of "terrorism," for terrorists do not want to take away our liberty (directly). No, it is the threat of the United States Government. The treat is posed militarily to those outside her boarders, and by gross incroachments on fundimental constitutional rights and liberties against those within her boarders. The 4th Amendment to the United States Constitution is as follows:
The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized.
So I say to you: is this not a blatant violation of the US Constitution? The warrent did not say to take the servers, did it? And where are the warrents of TSA people at the airports? where is their probably cause? where are OUR GODGIVEN, CONSTITUTIONALLY PROTECTED freedoms?

Re:Unlawful search and seizure?

[CountBrass]

Interestingly your quote does not tie a warrant to a search being reasonable. And who exactly decides what is reasonable? The US Constituion was deliberately left vague in such areas to allow some room for manoevuer.

So "I say to you" no it doesn't look like it was to me. But if they think it was they have recourse to the proper guardians of the Constitution: ie the courts.

Re:Unlawful search and seizure?

[Tarwn]

Look at it this way, if the police had a search warrant to search your house because their was considerable evidence that the thieves had stopped at your house, and they found the get away car in the garage, or the carefully drawn-out plans, would they not have the right to take these items because it was not in their warrant?

Sorry. Now this situation may have been a little differant, and the FBI had a warrant to search the data (and possibly to temproraralyy move the servers, I haven't seen the warrant and doubt if you had either). Now considering that this company was hosting shell script accts and was overrun with all types of kiddie scripts and script kiddies, and the techs had done nothing about limiting the running scripts (or better yet removing them), and then could not find any data in 2 hours, I think the FBI was right to be a litttle concerned that the techs weren't trying to hard.
Removal of the machines was in effect cordoning off the area so that no one would touch the data (ie, login to remove their scirpts, etc).

But you can keep rooting for the script kiddies and spammers, we'll all stand behind you (ignore the snickers)

Hey Ted! What's this Magic Lantern icon for?

[teamhasnoi]

Perhaps the FBI is installing some evil logger/sniffer crap on the servers or some hidden hardware. Or perhaps I need to watch more episodes of the Lone Gunmen.

I'm surprised that there hasn't been any discussion of Magic Lantern for awhile...

Re:Hey Ted! What's this Magic Lantern icon for?

[Niet3sche]

I'm surprised that there hasn't been any discussion of Magic Lantern for awhile...

Oh there has ... those members have just been dragged off, beaten, and then killed.

I really shouldn't attempt humor before breakfast. :-/

Re:Hey Ted! What's this Magic Lantern icon for?

[Tackhead]

> > I'm surprised that there hasn't been any discussion of Magic Lantern for awhile...
>
>Oh there has ... those members have just been dragged off, beaten, and then killed.
> I really shouldn't attempt humor before breakfast. :-/

I hereby propose two new /. moderations.

(+1, Cynical): When someone tries for (+1, Funny) and gets (+1, Informative)

(+1, Ironic): When someone tries for (+1, Informative) and gets (+1, Funny).

Yes the police can seize things with a warrant

[SmallFurryCreature]

The police and FBI can request from a judge a search warrant wich allows them to take pretty much everything as evidence and they don't have to search for it in a nice way. If they suspect that something is hidden in your sofa you can just as well order a new one. Doesn't matter wether you hid it or someone else did. If it did then all criminals could hide evidence in their neighbours house and be safe.

Wether you find this acceptable depends I guess on wether you find it acceptable that the police can investigate crimes beyond posting a little poster asking criminals to please come to the station and answer their questions and to bring in any evidence on their own.

Normal search warrants on an office mean that the FBI and police storm the building and everyone inside is ordered to stop doing anything. No more accessing PC's no shredding of documents no phone calls no nothing. The reason is simple to prevent evidence from being destroyed.

I am frankly amazed that they even allowed the company to provide the info this shows that they probably don't suspect the company but rather that they hope to find evidence against someone else on their systems.

There was a rather nasty ddos attack on mircx and aniverse. The FBI seems to be investigating wether the IRC network hosted by this company was used in the attack. There seems to be a lot of hints as to the person who was behind the attack but sadly in america you need that silly evidence stuff (at least for use against americans).

So the FBI asked and got a search warrant. They then gave the company time to hand over the data but they couldn't. So the FBI used the law and did what we expect them to do. Secure any evidence by removing access to it. They are even giving the hardware back. They waited wich they don't have to and give the hardware back after copying data wich they don't have to do. Frankly I think they went way beyond what they needed to do to minimize damage.

Quit frankly the original poster seems to be one of those people that want the police to disappear. That line about wich coorperate master they offended is clear bullshit. mircx and aniverse are hardly the powers that be.

In any society that doesn't chose to be an anarchy you have to give some powers to the police to investigate crimes. Search warrants are pretty common in all democracys and also work pretty much the same way. If you get one it sucks but so far noone has come up with a better alternative except to just allow criminals free reign.

Re:Yes the police can seize things with a warrant

[TubeSteak]

The FBI, Police etc.. usually use a program called EnCase to create images of computers. A warrant must be specific (no fishing expeditions) if the police want to use it to find "that silly evidence stuff." And no, search warrants don't work the same in all democracys. More often than not, the police have much more expansive and easily abused authority than the United States. Hell, they don't always need a warrant (or your permission) to search and seize assets. Ever been to Mexico? I believe the police there are considered entrepreneurs as well as enforcers of the law.

Foonet will probably sue the FBI and seriously you can't reasonably expect 12 people to believe that the FBI needed to confiscate all their equipment to solve an investigation into someone else.

Related Stories

[Rameriez]

I believe this has something to do with with recent shutdown of the mIRCx IRC network (see: http://www.mircx.com/irc.html). There are rumours (see: http://kashin-anime.edwardk.info/mircx_downtime.tx t) of a DDoS "botnet" being held on foonet, which may have been responsible for recent IRC network attacks. This is just speculation however, I'm not sure I should believe that the FBI would take action against the attack of an IRC network with a less-than-wholesome reputation.

They had good reasons to shut them down, indeed :

[skaya]

I can't get access to the article, but I guess that the story is about the shutdown of FooNet. FooNet isn't a "real" hosting solution ; it's a cheap shell provider for script kiddies who want to have their own ircd. They might also provide "serious" hosting services ; but as soon as one provides shell services for such a targetted audience, she knows that she will have to handle some specific problems - DDOS, flood, etc.

And according to what I know about the FooNet shutdown (if that's the same story), there was thousands of DDOS "drones" located at the datacenter, and the staff of the datacenter failed to shut them down. That sounds very dubious to me, but you might want to check this for another side of the story ...

Quoting :

"Perhaps the blackest of the black hat networks is finally gone, raided by the FBI. Foonet was home of spammers, packet kiddies, script kiddies, carders, and other illegal activities, as documented in the links below."

PS: if the shutdown mentionned isn't the FooNet one, ignore this post :-)

You know...

[Niet3sche]

It's not like I agree with this, if indeed things happened as the article state... but a quick google on FooNet (AKA / DBA CIT ) turns up some VERY interesting results.

I google'd quickly on a hunch, and sure enough I got some rather interesting hits.

I claim to know nothing about SPEWS and how they go about adding to the blacklists, but they apparently are no stranger to it.

Furthermore, it seems that this IS NOT the first run-in with the FBI that FooNet/CIT has had: from here, if you scroll down a bit, you'll see the following text: The FBI executed a search warrant issued by the United States District Court for the Southern District of Ohio regarding the IRC network that we host # We regret to inform you that on Saturday February 14, 2004 at approximately 8:35 am EST, FOONET/CIT's data center in Columbus, Ohio temporarily ceased operations. And this was from Feb. 14 ...

Another incident was reported out here on 07/12/03 (search the page for "foonet") ... seems that 84898 spams swamped a box, and follow-up by FooNet sucked - e.g. they turned a blind eye.

There are far too many hits to return ... if you're interested in more, you can always head here. For now, I'll close with this: I do not agree with the methods used, if they were as described ... however, FooNet/CIT is no stranger to the FBI, and perhaps this is all rolled in to the Feb. 14th notice ... maybe the FBI actually gave them 10 days to comply... I'd really like to see how this ends.

Stupid feds...

[ca1v1n]

Even if they had the authority to seize all the data, and it wouldn't surprise me if they in fact did not, they're MORONS for seizing everything. It's much easier to copy the data from on-site than to relocate everything and set it up, and THEN dump the data. It's also a lot less expensive. It also doesn't spread ill will among people who are helping your investigation.

After 9 days they've just barely started to get back up and running again. I guess the real moral of the story is to have an off-site co-lo contract you can activate in a heartbeat. Terabytes of backup restore would be a real pain though.

As I understand it, suing the government over things like this is nearly impossible. They still might be able to sue the agent on whose authority the seizure was conducted. Proving damage is trivial. I think if they can convince a jury that it was a case of gross negligence, the usual government protections don't apply. Any lawyers in the house?

Re:Stupid feds...

[zenyu]

Even if they had the authority to seize all the data, and it wouldn't surprise me if they in fact did not, they're MORONS for seizing everything. It's much easier to copy the data from on-site than to relocate everything and set it up, and THEN dump the data. It's also a lot less expensive. It also doesn't spread ill will among people who are helping your investigation.

I'm not surprised. I had a friend that had his machine hacked and had some threats left on his machine. He had hosted some political content. He called the FBI for help and talked to a reasonable sounding agent. Then they came to inspect his computer, after about an hour of looking around they wanted to take his computer with them. They didn't ask if they could copy the drive or anything of his files, but when he balked at the request to take his computer away they started accusing him hiding child porn. They never followed up on the case after he refused to have his computer diagnosed for an indeterminate time.

My guess is that the FBI is not being evil, they are just completely unqualified to deal with crimes involving computers. The solution might be to pass a rule that they must make a copies of the hard drives on site and give the victim/host/suspect a 2nd copy of the drives in a lockbox in addition to the original. This way they can't do any funny business that takes very long, and there is another copy to prove they didn't do any tampering off site. And this way their incompetence only costs us money not additional pain for the victims of crime or FBI investigations. If we had a legitamite government at this time I might even send them a letter suggesting such a thoughtful policy.

Re:Move a complete data-center???

[denlin]

I don't buy it! How can they move that stuff, not only physically, but also logically? To re-plug the servers, they need:

a suitable network, with configured routers, auth./DNS servers...
logins/passwords for the servers
knowledge, and not only general tech but specific setup of that company servers

i suspect they took out the hds & disconnected the raid cans & pluged them into another machine.

Normally (in democratic/free world), an investigation means a judge, some reasons, some rule brake, some arguments on why the police is acting.

earlier in december, president bush signed legislation expanding the authority of the bureau and other u.s. authorities conducting counterterrorist intelligence. the law authorizes them to demand records from financial companies including casinos without seeking court approval.

They had a warrant

[kill-9-0]

It seems that many people didn't read the text. The FBI had a warrant, which means they had to go before a judge, justify the need, and spell out what would be looked for/taken. If it wasn't initially spelled out that the servers would be taken, they might have had the warrant amended as such. Before some of you "conspiracy theorists" start screaming about a police state and such, the FBI was acting in the bounds of the law, under a warrant issued by a judge. John Ashcroft and George Bush had nothing to do with this. Maybe once you stop looking for black helicopters, you can see this. As for those of you saying you're glad you don't live in the US, we are the most free, most law-abiding country in the world. While we may not be perfect, we're the best thing going. Sorry if I'm offending anyone, but I'm tired of hearing knee-jerk reactions to things, without anyone reading the facts. Believe it or not, not EVERYTHING the government does is wrong.

Re:They had a warrant

[UrGeek]

Give me a break. We have SECRET courts with judges who sit and rubber stamp just about anything the FBI or other jackbooted Imperial Stormtroopers want. The American Dream of freedom and righteous is dead and if you believe otherwise, you among the millions of sheep get sheared. Do not step out of line or you will be mutton!

Watching the happy supporters of the Mad Emperor, laughing at the spoilage of the Old Egomanic, I see we have no shortage of sheep. Our oppressors will continue to use the Constitution for toilet paper.

Re:They had a warrant

[MikeFarrington]

Just because they had a warrant, that doesn't mean it was right. Just because they had a warrant, that doesn't make their actions immune from review. Your blind faith in government is dangerous. It is 'We The People' who must keep them in line.

Re:They had a warrant

[Hittite Creosote]

we are the most free, most law-abiding country in the world.

No, you're not. Finland is.

Re:They had a warrant

[Peyna]

Uhm, yeah, the US has some of the highest crime rates in the world pal.

Re:They had a warrant

[Hittite Creosote]

Well, maybe if you want more economic freedom, you could try Denmark instead, or New Zealand - both have less restrictive business environments than the US (according to the Wall Street Journal and the ), while still having good press freedoms and low levels of corruption.

But I can't see any way to declare that it is the US. Sorry. Just saying it is, or singing that it is, doesn't make it true.

Re:They had a warrant

[demigod]

As for those of you saying you're glad you don't live in the US, we are the most free, most law-abiding country in the world.

Any documentation to support these statements?

Most free? US is ranked 31st

• in freedom by the world press
• in freedom here

Most law-abiding? US is ranked

• 40th in per capita murders,
• 15th in embezzlements (per capita),
• 57th in rapes (per capita),
• 53rd in total crimes (per capita)
• 61st in Prisoners (per capita)

No you just aren't thinking

[SmallFurryCreature]

The company itself wasn't involved in the crime just their machines. Wich means someone from OUTSIDE has access to them. Leaving the machines in place as you wade throught the evidence leaves it wide open for the outsider to erase evidence. Worse what if one of those helpfull techs has other motives?

You are a cop and arrive at a murder scene with a dozen doctors standing around the corpse. Would you really allow any of these medical experts to assist you with determining the cause of death?

A shutdown machine cannot erase data and the fbi got the tools to simply copy data from HD's without the computer it was in being involved. This prevents any chance of the data being destroyed.

Saying they replug them back in at the fbi shows you have no idea of what is involved in this kind of investigation. They copy the HD's directly and completly by taking them out and putting them in their own hardware.

How the fbi does this kinda stuff has been discussed often enough on /.

This is nothing else then the police sealing of a crime scene. Any inconvenience is considered though luck. It really is no different from streets being closed off to allow marathons or demonstrations or repairs. Yes they do attempt to minimize damage but the investigation comes first.

But lets turn it around. If the FBI raids a place like enron would you find it acceptable if the bosses were allowed to keep making phone calls and keep working on their pc's and play with their shredders as they could loose money if the police removed access and took everything away?

Of course not. Just because this is a small hosting company doesn't change the law.

Re:They had good reasons to shut them down, indeed

[CommanderTaco]

No, it turns out you are right, cit & foonet are one and the same. http://www.easynetworknyc.com/foonet/

Other reports

[AndroidCat]

Not exactly news outlets, theWHIR had a short bit on the 16th, and it was mentioned in a thread in nanae on the 15th.

I do wonder how cooperative CIT was. After several hours of requests for the info (with a warrent) the FBI must have been riled to say "F-this-S, haul it away!". Think about how much extra work that must have been. There's more to this story, pity no news service has looked into it yet.

Re:Other reports

[LinuxInDallas]

Well, it makes for a better story to say that the poor web hosting company was raided by the FBI and stripped of all their equipment for no reason other than they couldn't react fast enough.

It's like when you see those videos of supposed poilce beatings where they only show the part where the cop is whacking the guy with his night stick. Nevermind the ass whooping that the suspect tried to give the cop 30 seconds prior. That seems to matter none. Just go for the most sensational story possible.

Re:Other reports

[ikeleib]

It's like when you see those videos of supposed poilce beatings where they only show the part where the cop is whacking the guy with his night stick. Nevermind the ass whooping that the suspect tried to give the cop 30 seconds prior. That seems to matter none.

Resisting arrest and assualting an officer are crimes. These crimes are to be tried by jury and if the defendant is found guilty, punished. The trial and punishment is not to be to sumarily given by police. The police are entitled to use force in their efforts to subdue a suspect or protect themselves and other from a suspect. They are not entitled to beat a suspect as retribution.

Seizing an entire data center

[emtboy9]

Perhaps someone can clarify this for me... the article/letter seems to point to the FBI seizing CIT's entire data center... Now, as big as they seem, I am sure they have more than just one hosting customer, and more than one IRC server... so did the feds just take the IRC servers, or the hosting servers too?

The reason I question this is the legality of seizing an entire data center like this. For example... lets say CIT had 10 web servers and one IRC server. On those 10 web servers there are 5000 web hosting customers.
Now, the feds want to track ONE user out of 5000 hosting customers, and God knows how many IRC users on the one IRC server, but instead take all 11 machines. So they have, in effect, seized the IP of 5000 innocent people to get the effects of only one.

This to me, seems akin to having the FBI sieze property from every house in a subdivision to get evidence on only one resident.

Given the state of IP law in the US, and how thanks to things like the DMCA and other legislation, IP is being treated like a tangible, wouldnt the FBI have to A: justify seizing the IP of all those customers, and B: be answerable to legal or civil suits regarding lost revenues? What about lost data?

Re:Seizing an entire data center

[bruns]

Let me fill you in on Foonet.

Foonet was the blackest of the black hat networks in existance. They hosted spammers, carders (credit card theives), DDoS drones, floodnets, and various other illegal activities and blindly turned the opposite way and let it happen.

Foonet was based out of the basement of the owners' house. There was no actual 'data center'. They had a T3 and a few T1s - nowhere near the OC-X level they were claiming.

They got tossed off of GBLX about a week before they were raided, and were humping the light at Qwest right before they got pulled.

I knew about this right after it happened.

Foonet will not be coming back, so get over it kiddies. Your DDoS drones are gone. Spammers, your mail servers are gone. Go run and hide under another rock.

A little hint for all of you who can't figure it out - the FBI doesn't usually seize all equipment if its something small. If they took all of the equipment, there is a good reason why they did (not that foonet was acting 'too slow').

I have a list of stuff about foonet on the AHBL page here.

Kinda

[SmallFurryCreature]

Seems they are investigating the attacks against mircx and aniverse. Since mircx is now down and aniverse is barely holding on I think you might claim that they are looking for someone with mass destruction capability.

the guy behind it seems to have been boosting about about a 200k botnet. 200.000 machines under his control. I think this is no longer some harmless hacking. This is stuff the fbi needs to investigate cause quit frankly nobody else seems able to stop this.

So unless you believe the net should be total anarachy ruled by those with the most bots then this kinda off stuff is sadly needed. To bad for those caught in the crossfire but that is live. Nothing really different from when all trains are disrupted because someone jumped in front of one. A marathon closing off all the streets despite the fact you hate sports. A demonstration causing massive gridlock despite the fact that only 200 people in a million people city are taking part.

Live sucks at times. Really this story shows that /. is getting more and more tabloid. A serious tech site would have asked what the fbi was investigating and wether the hosting company was hosting the person investigated or had servers wich were hacked or was simply a place where the hacker might have left evidence.

Re:Kinda

[metamatic]

Yeah, it's about time the FBI got involved in cleaning up the DDoS problem. Looks like there was at least plenty of circumstantial evidence that FooNet was harboring DDoS vandals and credit card scammers, so I don't have a problem with their suffering a few days of downtime while the situation is investigated. We're talking about people who destroy businesses and volunteer-run networks and rip off innocent bystanders to the tune of thousands of dollars each. I, for one, would like to see a few of them sent to prison.

Re:Move a complete data-center???

[DA-MAN]

I don't buy it! How can they move that stuff, not only physically, but also logically? To re-plug the servers, they need:

Or they can clone all the drives with ghost (now with ext3 support) and use Ghost Explorer in Windows to find specific files and folders without ever booting the machines into Linux and dealing with bullshit. (also dd/mount -o loop)

I prefer to read (between the lines) that they wanted something to be stopped, and eventually an occasion to get the information on the long term (weeks at least) on who/where it is

I believe one of two things:
1) They possibly thought whatever was going on might have been contributed to by someone on the inside and didn't want to give time for people to erase evidence. Maybe a raving lunatic anonymous coward but link.
2) They got impatient and thought they could do it faster, which probably ended up not being the case.

The strange part, for a European citizen like me, is that no reason at all is given. Normally (in democratic/free world), an investigation means a judge, some reasons, some rule brake, some arguments on why the police is acting.

A warrant means that a Judge signed off on the investigation. They were able to convince a Judge that they had probable cause, how is this different from Europe? (I'm not trolling, I just don't know much about the legal system in European Countries and realize that it probably differs from Euro Country to Euro Country)

I hope that with these new laws in Europe we are not going to become like that too soon ;-).

I agree, big brother is getting scary here in the states.

Re:and....Absentee landlords.

[The Unabageler]

I 100% agree. I get in political discussion with folks who complain about the system not working...when I ask if they write their representatives they say no. I ask if they vote, they say they aren't registered. How dare someone say the system is broken when they've never bothered to participate!! Register to vote if you haven't already and GET OUT AND BE HEARD. Vote on election days, write your senators and representative whenever you have something for the government to hear. A government of the people means we are their bosses! They don't listen to the majority, they lose their job. And don't say to me "the /. geeks will never be the majority" until you all are registered to vote and participate in our government! It's more important for us to do it now more than ever...

Redundant, maybe...

[syberanarchy]

...but it bears repeating -

One more reason to get hosting based outside the US, if your site does anything but blindly wave the flag and speak the newspeak.

Re:and....Absentee landlords.

[The AtomicPunk]

It won't help. People won't vote third party, they only vote for the current reigning Demopublican party.

The democrats and republicans use rhetoric to convince the less intelligent that there's actually a difference between the two, assuring that almost everyone votes democrat to vote AGAINST the republican, or republican to vote AGAINST the democrat.

Unfortunately, there's no appreciable difference betwixt the two, so we're condemned to continue down the slippery slope.

Re:more important (?) how much customer data store

[Rebar]

But with IRC, unless you're making logs, there is nothing 'saved'. There is nothing static about IRC.

This company appears to have had terabytes of data. Lessee:

/me is in the hizzle fo shizzle

is oh, about 40 bytes. Say there's a comment every second of evey day... a terabyte would hold over 20,000 years of such comments. Or 20,000 such IRC channels for a year.

Sure this doesn't account for file trading, dead channels, bots, etc... but it gives you some idea about the amount of data in a terabyte, and if you think there is anything anonymous about IRC, think again...

in fact, this comment will probably be stored somewhere for way too long.

Foonet/Creative Internet Technologies

[Anonymous Coward]

I live in Columbus, and have had the misfortune of working with foonet/Creative Internet Technologies/Creative Internet Techniques - they have called themselves all three. The small ISP which I used for my website unexpectedly moved our web site to a server at foonet. All of our mail forwarding was getting blocked by about every blacklist on the planet, and the uptime was horrendous. Needless to say, despite the 3 month prepay, we immediatly moved to another ISP. While we were being hosted at foonet, located about 10 minutes from us, I called them (local, no 800 # - ) multiple times, telling them that they were on blacklists. I never could talk to anyone, just leave messages that would go unanswered. If you are doing anything remotely important, avoid foonet/CIT like the plague. Their phone numbers are/used to be Sales - 614 353 8243 and General Inquires - 740 881 0323

Electronic Evidence Gathering

[nologin]

Well, it is a pretty simple premise.

The FBI cart equipment away to their premises in order to duplicate the systems and environments. If ever you get into information systems forensics, they would at least perform 2 copies. One is kept as an exact duplicate (to keep for their investigation records) and at least another to actually run analysis against (since searching on an active system can change the data stored in it).

It also makes it easier to catalog what they are working with, and prevents any interference from the outside.

And the moral of the story is

[El]

Delete your logs. Delete them early, and delete them often. Searching through 24 hours worth of data is a lot easier then searching through 2 years worth...

Re:I know all about this....

[2MuchC0ffeeMan]

how can you tell they never went through it? usually they don't fire the computer up, but just clone the hard drive directly.

so unless there was a piece of scotch tape that had to be broken to take out the ide cable to the hard drive, it's impossible to know.

There is more to the story

[jasonhamilton]

If you'd been watching IRC sites such as SearchIRC, and IRCJunkie, there has been discussions over this topic since the 15th.

The only problem is, no one really seems to know what is going on!

Speculation on cause has ranged from DDoS attacks to having to do with the Microsoft leaked source code.

Search warrants are a joke.

[Anonymous Coward]

To get a search warrent you have to have something to go on already.

Like a lie? As a former LEO I've seen search warrants that were based on 100% lies. "Anonymous" or "confidential" sources are the classics. Or just squeeze someone to lie and bam!, you're in business. Twisting the facts into probable cause like "container with a white powdery substance found on suspect's vessel. Possibly narcotics." You know that it's flour in the galley but that part is just left out. Telling half the truth is still a lie, something most cops ignore.

I suspect they were fishing, looking for one piece of data but really wanted a reason to grab everything (like all the irc logs). It's possible that the company pissed the agents off (by not bending over on command) and they're just getting a little revenge.

Please, do not trust the police. They are there to arrest as many people as they can (and these are the "good" ones). Rogue cops are a nightmare. Ever wonder why most of the time when a police action is investigated it's only done by cops or an ADA (nothing more than a cop in a suit)? Isn't that like Tony Soprano investigating a mob hit? Law enforcement in the US answers only to themselves.

Do a search on news.google.com and find news stories about cops that broke the law (beat downs, dealing drugs, OUI, etc.) and you'll find almost everytime they've received a much lighter sentence (if any) than the average joe. Welcome to the Pig States of Amerika. I guess Abby Hoffman was right.

"Quis custodiet ipsos custodes?"

Sounds like a good reason to mirror

[McFly777]

If you are a data center, this sounds like another good reason to have a mirror (RAID 0, or is it RAID 1). That way you can just unplug the mirror drive and give it to the FBI without disturbing the rest of your service.

Actually this makes the acronym RAID (Redundant Array of Inexpensive Devices) have dual meaning... RAID is what you want when you are raided!

Irvingnet

[dr_dank]

Irvingnet, the home of the Fark IRC channel, was also affected in the raid. The MOTD said that the entire datacenter was cleaned out by the FBI.

Re:They had good reasons to shut them down, indeed

[AndroidCat]

there was thousands of DDOS "drones" located at the datacenter

Doing it in-house sounds so old fashioned. They should look into out-sourcing like spammers have been doing with under-utilizied home Windows computers. Does anyone have contact information for the people who did MyDoom.A and .B? I might have a deal lined up involving a few hundred thousand dollars of business. (I could use the reward money.)

USA politics = one party system?

[beaverfever]

I have believed for a long time that more Americans should be voting for the Green party. There are many who prefer the Green's stand but fear that a vote for Green is a vote wasted and would only serve to help put the Republicans in office. I suggest accepting the (relatively) short term pain of Republican rule and looking at the long term.

Currently the Democrats and Republicans are essentially different flavours of the same poison. Forget the next election, forget the next five elections. Even if the Democrats gain power they will produce more of the same crap. Vote Green in the next election - they won't get much this time around, but if everyone who wanted to vote Green did, then the Greens would probably make the coveted 5% mark, which means more money. With more money they could do better the next time around, and after two or three more elections they could mount a real challenge to the status quo (if they manage to not become a part of the status quo).

Forget tomorrow; tomorrow is already a disaster. Think of your children and think of your grandchildren.

As for the Green party itself, getting Nader elected (as implausible as it may be) would not be a great triumph as I can easily imagine the dems and repubs in the houses making his life hell. The Greens need to seriously focus on getting seats in the two houses. With balances teetering at 51-49 for a long long time, the Greens getting just a few seats and being able to tip a house one way or the other could provide a breath of fresh air that American politics has needed for a very long time. Why the US generally believes it can only function with a two-party political system (with little difference between the two) is baffling and perhaps a little sad.

Re:USA politics = one party system?

[TheXRayStyle]

One thing you may want to look into is supporing Instant Runoff Voting. You can get some information about it here. It has been shown to be successful in places such as Papua New Guinea with an error less than that of US Presidential elections (yeah, what a high standard of comparison...). It allows people to vote their mind without worrying about a slightly lesser evil not getting their vote and losing to a greater one.

Basically, it works like this: You rank the candidates in order and your first choice gets your first vote. All the votes are counted and the candidate with the least votes is eliminated. If the candidate eliminated is your first choice, then your vote goes to the second candidate on your list. This process continues until only one candidate is left, and they are then elected. (See the link above for a better explanation...)

If this sounds like something you'd like instituted, contact your senators and representatives!

Furthermore, support candidates such as Presidential Candidate Dennis Kucinich who have declared their support for IRV. As he says in his platform:

I also support "Instant Runoff Voting." IRV offers a cost-effective way of insuring that the winning candidate is preferred by a majority of voters; it encourages voters to vote their wishes and not their fears; it promotes greater voter turnout and positive campaigning.

I seriously believe that implimenting a system such as this is the best way to get out of the Kang "Go ahead, throw your vote away." mentality about 3rd party candidates that America seems to have. Hell, even I feel that way in this next election.

Peace.

Re:USA politics = one party system?

[ttsalo]

I seriously believe that implimenting a system such as this is the best way to get out of the Kang "Go ahead, throw your vote away." mentality about 3rd party candidates that America seems to have.

Maybe, but the power to turn the current two-party system into a multiparty-system rests in the hands of the two parties in power. Why on earth would they give any power away, ever? There's about as much chance of a two-party system going multiparty as a one-party system going two-party, i.e. none (barring revolution).

Re:USA politics = one party system?

[Stephen Samuel]

Maybe, but the power to turn the current two-party system into a multiparty-system rests in the hands of the two parties in power. Why on earth would they give any power away, ever?

That's part of why it's important to vote for 3rd party candidates. It encourages the Dems and Reps to consider something better than the current system if they can never figure out who's gonna win because of the 'spoiler' candidates.

Best case is, the 'spoiler' gets in and forces a change.

Re:USA politics = one party system?

[spitzak]

I have heard that instant runoff is mathmatically broken and somewhat of a scam. Supposedly it will allow votes for (as an example) Greens, until the point where Greens become powerful enough to actually make a difference. At that point a vote for a Green will suddenly be bad, just like it is under the current system. The main reason is (assumming you like Dems more than Republicans) is that at that point your Green vote will make your Dem vote as #2 really mean #2 and Dems will lose to Republicans who voted them #1.

There is good analysis at http:://www.votingmethods.org. This site is obviously Libertarian, but their analysis seems accurate and their arguments about how to make Libertarians get votes without Republicans losing apply just as well to how to make Greens get votes without Democrats losing.

Re:USA politics = one party system?

[sketerpot]

Why on earth would they give any power away, ever?

Love of freedom and democracy, and caring about the rights of the people? *snort*

Re:and....Absentee landlords.

[The Unabageler]

Voting for the lesser of two evils is better than not voting at all. If you're about to be killed, and the murderer says "should I use this shotgun and blow your head off, or stick you with tiny needles until you bleed to death?" would you make a choice or let him choose? Not to say that our government elections are akin to murder per se (though some might interpret them as such).

Government participation is important after the election too, there are many websites that make it easy to send letters to your elected officials to tell them your opinion. That way you can make a difference every day for their elected term, instead of just once every few years. Don't say I'm full of shit if you don't try.

"no such thing as personal responsibility"

[Anonymous Coward]

That's actually true, no matter how absurd Darrow's argument was. Especially in government.

Yes, it's possible for Special Agent Joe Smith to disobey orders to seize data based on his own morality, but the practical upshot of that is that Joe Smith will be fired and replaced with someone willing to do the task. In the end, the task will get done no matter what Joe Smith's morality is - so how can he be held responsible for what is inevitable?

Nations and their component organizations have monopoly over force, not individuals. If the FBI wants to search and destroy, the FBI is to blame, not its agents. (Even the word agent means 'representative'.) You don't shoot the messenger when the message is bad.

Facts

[FriendofFoonet]

1.) Foonet/CIT did cooperate. 2.) Warrant was sealed. 3.) Not many, if any, got "free" accounts there. 4.) 300 or so servers were taken. 5.) Agent responsible to contact hasn't been returning calls/emails. 6.) Only a couple of machines have been returned, some should be sent out today. 7.) Warrant was served on a house which contained foonet/cit, Paul, his very pregnant wife, and two small children. 8.) Paul has always cooperated with the FBI. 9.) A 200K botnet would have clogged the lines Foonet/CIT was on, get real for pitys sake, 200K? lol 10.) Those crying DDos kiddies being freely housed are mostly terminated customers. 11.) The ownership of Foonet/CIT had recently changed, some guy named Jay owns it now. 12.) Nobody directly working for/owning Foonet/CIT knows why this raid was done, why do kiddies claim they do? I'm going to work now, feel free to flame. Sincerely, Kelly

Re:and....Absentee landlords.

[Mr. Slippery]

I get in political discussion with folks who complain about the system not working...when I ask if they write their representatives they say no. I ask if they vote, they say they aren't registered.

I write my representatives. And I vote. Know what? It still doesn't make a damn bit of difference so long as at election time I'm given no real choice.

As Bill Hicks put it, "I think the puppet on the right shares my beliefs. I think the puppet on the left is more to my liking. Hey, wait a minute, there's one guy holding both puppets."

They don't listen to the majority, they lose their job.

The majority are easily led around by those in power. Most Americans beleive that Iraq as involved in 9/11 and that we have found weapons of mass destruction in our invasion there. Our "leaders" have gotten people more disturbed about destroying a flag than about destroying the land that the flag represents.

The game is rigged. Third-party candidates are doomed from the start. Any candidate talking about real change is not permitted to get past the primaries - look at how they savaged Dean for speaking truth. Betting on a Senator for re-election is about the safest bet you can make, and Representatives only risk losing their seats if their opposing party gets ahold of the state legislature and manages to redistrict them out.

So, yeah, I vote, I give to the ACLU, I write my Congresscritters, but I don't expect it to make much difference. Me, I'm looking for Yin revolution. And if that don't work...well, that's why there's a rifle in the closet.

Re:and....Absentee landlords.

[Peter Trepan]

I vote Libertarian.

People tend not to vote for them because they are a "fringe" party, but if people did vote for them, they wouldn't be. Also, if you're disturbed by the party's more extreme views, keep in mind that the real extremists are already members, and as their membership increases, they can only become more moderate.

Whatever you do, don't throw your vote away on a "small government" Republican or a "civil liberties" Democrat. They have never delivered what they've promised.

Why wouldn't a disk mirror have worked?

[mark-t]

When the FBI asked them for evidence, couldn't they have temporarily shut down to do a complete disk mirror, and handed over the mirror of their drives for the FBI to inspect at their leisure, that way ensuring that they stayed operational in the interim, but the FBI would still have the evidence they needed, even if the hacker somehow got back into their system to remove it?

I'm Calling my Lawyer

[rueger]

This story offers a very good example why ISPs and similar service providers should have the best lawyer possible on call. If nothing else they may have been able to halt or slow things while finding a judge who can come up with a more sensible solution.

I see no good reason why the FBI should shut down an entire business with nothing more than search warrant. Surely such a warrant defines what exactly they are seeking, and it would have been reasonable for them to extract those chunks of data on-site.

I have to conclude that the aim of the exersize was to shut down foo.net without the bother of legal proceedings, and it seems that they were successful.

Be more suspicious

[Karem Lore]

If I were the ISP in question I would look long and hard at what the FBI might have put onto the systems...Some backdoors, sniffers etc. I hardly see what taking the hardware to a lab can do over onsite data mining. I would bet my bottom dollar that there is something the FBI put on those machines...

I would recommend that the ISP gets all the user data (non-executable) off into storage, wipe clean, re-install everything, copy data back on...Problem is that the setup for this would be exhaustive and time-consuming. However, if there is an IRC informant tool that has been added to this (I remember slashdot articles concerning a system developed by FBI or CIA on a system to snoop) it would conflict with the ISP's promise of security and privacy...

An argument against The War on Terror

[0x0d0a]

The problem is the ratio of times that terrorists are *really* involved.

How many major terror acts are perpetrated or confounded each year relative to how much we've seen "The War on Terror" used to justify anything and everything anyone can get away with. Funding for every agency under the sun derives from whether they're combatting terror. The DOE needs money "to combat terror" by developing methods to protect our utility grid. The DoD needs funds to "help combat terrorism" by developing new monitoring and data-mining technologies. The CDC needs money to "help combat terror" by producing vaccines. I'll bet that even the Department of Agriculture has funding initiatives based on "terror" somewhere -- maybe they want to monitor use of crop dusters, who knows.

It's freaking ridiculous. The "War on Terror" certainly saves lives, but the amount of resources that have been claimed in its name *vastly* outweigh the amount of damage that terrorism has done to us. A lot more people lost their lives to car crashes in 2001 than to terrorist attacks. Did we have black helicopters ready to swoop down on speeders? How about long-range alcohol sensors? What about armed guards at strategically-placed toll booths that search cars and people thoroughly for any kind of alcohol? All these sorts of things have been done in the name of "The War on Terror", instead of being used in an area where more American lives are being lost. The "War on Terror" is, frankly, a tool based in fear to help manipulate the masses. It has little practical value.

I claim that terrorism on the order of at 200:1 life amplification (roughly what the 9/11 terrorists achived -- something like 4000 lives to around 20 terrorists) cannot be eliminated without massively curtailing and altering a free society. There are just too many ways for a person willing to die to kill many people.

I would like to point out that people are only willing to throw their lives away if they are incredibly upset over something you've done. You don't see Iceland coming under terror attacks, because Iceland doesn't anger people to the point of being willing to die to kill Icelanders (or whatever a citizen of Iceland is called).

We have spent masses of money and effort on trying to figure out how to crush terror rings, on making people so afraid to resist the United States that they won't dream of it. The problem is, it can't be done. The Soviets couldn't crush resistance with years of secret police and encouraging children to inform on their parents. I don't think Bush Junior can do so in our society. Sheer force and fear just don't work when you're dealing with people who are willing to lose their lives to kill. You have no cards that they are interested in.

How much money has been spent on diplomatic and social solutions to eliminating terrorism? Supposedly the United States has a negative image in Islamic countries -- how much work have we gone through to improve that image? How much effort has gone into determining the things that are making people so angry that they are willing to *die* to hurt citizens in the US and resolve those issues?

A lot of people feel that trying to resolve things peacefully would be "giving in to the terrorists", and encourage future terrorist acts. I don't agree. The only value to a hard-core refusal to ever attempt peaceful solutions is as an attempt to establish prescedent governing future acts -- that no terrorist would ever be willing to attack the United States if it was *guaranteed* that doing so would hurt his cause, and damn the consequences to us in hurting that cause. The problem is, the prescedent has clearly not been established during the time we have taken a hard-line approach. The United States was attacked several times, despite having followed tough guidelines for dealing with terrorism in the past.

I'm curious as to what would happen if the 70 billion or whatever dollars that are being spent to keep us in Iraq (which at least originally was supposed

Not just CIT / FooNet's boxes

[jackDuhRipper]

It wasn't just CIT's stuff that was confiscated and / or shut down, but EVERYTHING in the datacenter where CIT's stuff happened to be; everything included my hosting provider, as well. N.B. - I am typically all for law enforcement and would rather err on the side of caution - esp if CIT was "reasonably believed" to have been stalling or destroying data.

Use RAID to protect against RAIDs

[ziegast]

I see all alot of, "their rights have been violated", and "this is why I don't host in the US", and "here's what I think they're investigating", but I don't see anything constructive about how to protect your service uptime against a raid.

At a local security meeting, I learned about security incident handling, and things you can do to help preserve the chain of custody of the evidence (aka data). It's one thing to copy data, but just by reading data on most filesystems, you alter it. If a hacker determines that you are investigating them, that can and will try as fast as they can to cover their tracks, and it's alot quicker to delete/destroy/taint data than copy data.

The fastest and best to preserve a single machine's data is to break a RAID 1 array (pull out live disks). Your machines keep running, and the FBI gets a pristine copy of the disks that they can put into (hopefully antistatic) evidence bags and document chain of custody without modification of the data. They can go read it at their leisure off-site. Using RAID5 doesn't cut it. Using single disks with frequent backups doesn't cut it. Use RAID1.

Another way to protect data and preserve service is to store all non-OS data on enterprise storage that supports advanced mirroring or snapshot capabilities. If I had a NetApp, I could create a read-only snapshot and give the FBI access to that point in time copy of data and never delete it until I can do a DR copy of my filer onto another box. If I have an EMC or Hitachi or other large RAID1-capable unit, I can beak off a very large mirror and present it to FBI hosts on a SAN and continue to run off of unprotected data or implement a disaster recovery plan to get me running again on another similar storage. This data isn't as clean as a "drive in a bag", but with proper notes and techniques, the FBI can be convincing enough to a jury that the data was used in the investigation was correctly read unmodified "beyond a reasonable doubt".

If I'm really good, and have a bigger budget, I'll have a near-real-time mirror of that data (NetApp SnapMirror, EMC SRDF, "rsync", etc.) in a remote location that runs independently of my primary site and a plan that will help keep me running while I let the FBI tears apart my primary data center.

If you run a 100% uptime service ("Show me the nines!"), it's your responsiblity to to have an effective disaster recover plan. An FBI or Secret Service raid is an equivalent of a jumbo jet crashing into your data center. You as an individual, have a RIGHT to privacy and due process, but your company has created obligations to your customers to which you've guaranteed service, and your customers care more about the latter than the former. It's more responsible to have a DR plan and sue the FBI to replace your hardware than not have a plan and sue for lost business.

-ez

If the checksum doesn't fit, you can't commit!

More details from the company's news page

[kbahey]

Here are the details and a time line.

They were out of business from 14 to 23 February.
When they are back, they are only providing web hosting and not IRC. So the warrant was definitely related to IRC and they decided not to be in the business again?

http://www.cithosting.com/news.htm

02/14/2004 FBI Confiscates all servers

Dear Customers of FOONET/CIT:

We regret to inform you that on Saturday February 14, 2004 at approximately 8:35 am EST, FOONET/CIT's data center in Columbus, Ohio temporarily ceased operations.

Here are the facts of what occurred:

The FBI executed a search warrant issued by the United States District Court for the Southern District of Ohio regarding the IRC network that we host. According to the warrant, it appears that the Bureau is investigating whether someone hosted on our network hacked and attacked someone else.

After several hours of attempting to track down, inspect and audit the terabytes of data that we host, the FBI determined that it was more efficient (from their point of view) to remove all of our servers and transport them to the FBI local laboratories for inspection. This was completed at 7:00 pm EST same day.

The FBI has assured us that as soon as the data has been safely copied and inspected, the equipment will be promptly returned. Unfortunately, the FBI has not been able to tell us when they will be completed with their inspection.

We have been told by the Special Agent in charge of the investigation that If you need access to your data you are asked to please contact the Bureau via email to rwhite3@leo.gov. Make sure to include in your email your name, mailing address, and telephone number with area code.

Since we wish to focus 100% of our efforts on restoring services, we would appreciate it very much if you do not attempt to contact us directly. Please rest assured that we are doing everything possible to restore service to you as quickly as possible.
To the many who have inquired, Paul and family are OK, although shaken by these events. They are at home and awaiting the blessed event of their new child's birth. We thank you for your good wishes and prayers.

Please check back here often. Through this site, we will keep you informed of ongoing developments as we know them.

Thanks again for your understanding.

02/23/2004 CIT re-establishes service.

We have restored service at Equinix's Chicago Data Centers. We are in the same facilities as MSN and many fortune 500 companies. The facility has multi OC192 connections to the backbone.

The FBI has begun retuning equipment to CIT which is being shipped to our new facilities in Chicago.
At this time CIT will continue to provide dedicated DDOS Protected web hosting only.

CIT provides reliable and scalable solutions for customers of all sizes and services. Located in Equinix's Chicago Data Centers , CIT has access to all the major carriers without the need for local loop circuits.

Our Chicago staff is focused first and foremost on customer satisfaction, and will take every action necessary to accommodate each customer. Unlike many large ISPs, CIT prides itself in its ability to provide personalized service to each customer - if a customer calls twice for assistance, they can usually speak to the same representative. Our sales and support teams are allowed a great deal of flexibility to work together to resolve each customer's needs on an individual basis. Our success and rapid growth can be attributed to the satisfaction of our customers - word-of-mouth referrals account for a large portion of the new business we receive each month.

The IRC Network will remain down until further notice.

Ruby Ridge?

[Shadowin]

Clinton administration under that bastion of civil liberties (nevermind Waco, Ruby Ridge, or Elian Gonzalez)

I hate to get offtopic here, but it really annoys me when democrat bashers don't even know what they're talking about. I bet you listen to Rush Limbaugh or Michael Savage religiously.

Hint, Ruby Ridge happened in '92.

This was foonet,, hardly a reputable company

[Anonymous Coward]

The company in question, known as "Foonet" or "Creative Internet Technologies" is well known to anyone who frequents efnet as a safe haven for anyone involved in illegal activities, including DDoS, childporn, compromising hosts, spamming, carding etc, the staff of foonet are well known for overlooking illegal activity by their customers..
Most likely the fbi turned up to confiscate one or two customers boxes and saw how stuffed with illegal data their network is, virtually everyone on efnet who is involved with illegal activity used to base their operation from foonet, the servers there will be a total goldmine of evidence for the fbi..
Infact, the staff themselves at foonet are well known for breaking the law, in particular "Paul" who owns the company gives shell accounts or free hosting to people who will ddos for him, and often the staff at foonet have used their customers credit cards for fraudulent transactions.

Their equipment is being returned right now

[SoopahMan]

From their site:

02/23/2004 CIT re-establishes service.

We have restored service at Equinix's Chicago Data Centers. ... The FBI has begun retuning equipment to CIT which is being shipped to our new facilities in Chicago. At this time CIT will continue to provide dedicated DDOS Protected web hosting only.

The rest of the page is chaff about who the company is, and things already quoted here.

This puts the downtime they experienced at about 2 weeks - which must have been very disruptive to their business, but not in line with most "the FBI is here" horror stories. Though I understand the FBI agents in this case not wanting to be any more disruptive than they have to be, it is incompetent of the FBI as an organization to not have a more unitrusive means of auditing large datahouses unannounced - although the companies they arrive at cannot possibly be prepared, the FBI must anticipate this frequent eventuality.

A bit of behind the scene information

[Senior Frac]

I know the Ashcroft-obsessed crowd will drown out this message, but I will say it anyway.

foo.net has, for the longest time, been protecting carders. They've been told so, repeatedly, by the anti-spam community and weaseled. My suspicion at this point is that either they are actively involved and/or some of their members are involved. FBI methods aside, foo.net isn't the innocent-victim they would have you believe.

This is not a bad thing...

[Anonymous Coward]

As someone who has had multiple run-ins with Foonet and their customers over the years, I'm personally glad to see this happen, even if it's only temporary. The FBI doesn't just decide to dismantle an entire datacenter on a whim, there obviously has to be just cause. I feel that in this case, there's probably more than enough cause. If you are a (wannabe) "hacker" or "packet kiddie", Foonet is the place for you, and most people know it.

I run a large text based chat server (IRC), and as such we see frequent (D)DoS attacks. Far too many of these attacks in some way lead back to Foonet. It's even rumored that some of their employees harvest and sell Denial of Service drone networks... how's that for service! Since Foonet was raided a week and a half ago, we've seen maybe 25% of the DDoS attacks that we reguarly receive.

Bottom line... don't target "kiddies" as your primary customer base, and don't tolerate their abuse and things like this will not happen. But hey, what do I know.

We're not talking about a Database being taken...

[reverendG]

And most likely, the FBI didn't tell the hosting company exactly what it is they wanted. When the Feds come in with a search warrant, they don't ask for your help. They say, "stand aside" and commence ransacking.

It's just a job...

[The Queen]

The agent that siezed the equipment probably has a boss who expects to see progress, and that progress is probably propagated up the line to the point where the details have been filtered out and it's just a number on a spreadsheet of how many computer crimes have been procecuted in the last however many days. The ulterior motive is to look like he's being productive in order to keep his job.

Ah, there's the rub.

Behind every job is a human being. That job could be something as heroic and altruistic as a fireman, or something as shady and questionable as this FBI guy. What all the folks in the country need to realize is that all the things we bitch about are being done TO us, BY us. If people would refuse to fill jobs that had questionable consquences, things might be different. We will never know that, since we all have bills to pay, and somebody will always take those crappy jobs.

What I find fascinating is that so many of us have jobs where the harmful consequences are so far down the chain that we can't even see how we have contributed. But alas we are all a part of our own mess.

Unrelated, or disappointing?

[kenners]

While everyone seems to be focusing on the FBI and it's antics, hackers behind the scenes are running around making fools of intelligent men.

This weekend, we saw foonet disappear without a trace, mirc-x, aniverse, and rizen brought down in flames by DDoS attacks, and (ranked least important on this list) the anime fansubbing scene, as well as Paul (the one actually served with the warrant says #foonet on efnet) in complete disarray and confusion.

Maybe in a few weeks, some legitimate news corporation will repost what I'm about to suggest with more information.

foonet's ircd was probably a host for some sort of illegality, hence the FBI's raid.

The warrant may have been formed with the help of an IRCop on mirc-x.

While sustaining DDoS attacks, a user visited mirc-x appearing to "be the culprit," and left a few locations he could be found.

Reading between lines, the lingo announced the reason for the attack: That damn IRCop reported my irc server with a lot of hacked computers taken away. So I'm bringing down his network.

What was the reason the IRCop reported anything? Did he crack a joke about the hacker's mother? Or was he just doing the "right thing?"

Sadly enough, by the end of the weekend, the anime scene had pretty much caused the death of 3 servers either due to load, or to followed DDoS attacks on other servers.

I have to wonder if there's actually a connection between the two events. 3 IRC networks down and an entire hosting company at a local FBI headquarters because of hacker squabbles? Are they really that important and/or worth the time?

I wish I knew. I wish someone could actually write about it. My story can't possibly be true.

Hmm scary but...

[Grimster]

After several hours.. (etc)

Let the fbi show up at my door with a search warrant for a customer's data and they'll be given a choice of how they want the data handed to them, and then they'll have it, in as much time as it takes me to open the case and hand them the secondary harddrive of the system (break the raid) or if they have a minute I can burn 'em a CD rom of the customer's data in as much time as it takes to tar and scp the data to the machine with the burner in it. Time required would be measured in minutes, and no toes required to count them.

After reading about this story in a few places I said from the first I heard of it "there's more to this". They host an irc network, bastions of warez and mp3s (hey I like IRC too, and have my own server but I know what happens on them if they're not policed heavily). They are (accused) of being carder/hacker friendly and their "ddos proof" hosting and irc services definitely sounds like something a hacker would like... It's sounding like they slept with the pigs and are covered in mud.

Another choice comment: The seizure isn't standard procedure, and there's no way to know exactly what prompted it.

That sounds to me like a thinly veiled attempt at insinuating foonet might not be as innocent as they'd like to be seen, "isn't standard procedure" "no way to know exactly what prompted it".

Call me a chicken or even (gasp) a Republican but if a lowly sheriff's deputy shows up with a warrant he's gonna get 100% cooperation and anything he wants ASAP from me, let the FBI show up? Shit that's when I get out my shoeshine kit...

Other systems *are* possible

[Gorimek]

So giving the Police the right to trash anyone's home or business is the only way to prevent anarchy? The only ways that are at all possible are this way, or the small poster way?

Besides the option of a large poster, it seems to me it would be possible to have a system where the police can search for evidence with a warrant, but have to pay for any damages they cause if the victims turn out to be innocent.

The current system invites abuse. The police don't even have to frame anyone they dislike enough to get them convicted, only enough to get a warrant. Evidence can be hidden in furniture, walls, cars etc, all of which can be smashed down in the search for evidence, easily costing any uppity person $100k+.

Abuse of police power is arguably a bigger problem in the world than regular crime, so don't think it's a small issue.

Re:Other systems *are* possible

[DF5JT]

"Besides the option of a large poster, it seems to me it would be possible to have a system where the police can search for evidence with a warrant, but have to pay for any damages they cause if the victims turn out to be innocent."

It should be the other way round: Unless there is danger of life or other physical harm involved, any investigation should set its priority in such a way that no one should feel hassled by the investigation. It feels strange to see that no one seems to question the means necessary to conduct an investigation.

Was it necessary to do the raid on a Saturday? Was there an imminent threat that had to be averted now and then? Monday would have been to late?

Investigators in the US seem to have completely disconnected from the actual proportions of crimes. A suspected center of DDoS attacks does not warrant the same level of agency involvement as a murder case.

Who to blame

[Sloppy]

Instead of blaming the FBI, here's an idea: maybe judges should be more responsible. Remember, a person with the legal authority to do so, signed a warrant that empowered the FBI to sieze some equipment that would disrupt many people's lives and businesses. Once that paper was signed, the FBI was just a machine.

I would like to ask this person: was it worth it? Is the evidence that this will result in, going to have value that exceeds the harm? Did you even ask yourself that question, before you signed the warrant?

I guess you can blame the FBI too, for bringing that unsigned warrant to some judge to be signed. But the responsibility ultimately fell on the judge.

Who judges the judges?

Steve Jackson Games vs Secret Service

[Anonymous Coward]

See the comments here. The a search warrant can kill your business. With a datacenter, a a warrant can allow an eager agent to pull up everything and load into trucks for analysis. You have no way stop this. If you're very very cooperative you may be allowed a copy of your data, at the conveniece of the government.

A data center adds this risk, which needs to be considered in a disaster recovery plan. Do you have off site backups at your hosted site? If the hosting site has the tapes, they may included when the warrant is executed. Your equipment may be swept up in a search of the datacenter, your first notice may be the watchdog scripts

And you all thought isps could play dumb

[nurb432]

" sorry we don't log that data for more then 24 hours " or some other excuse..

Face it, all transactions must be logged and kept forever, or face the wrath of the government...

And if you get caught trying to delay, or reduce said logs infinite length of retention, expect a jail sentence for obstruction..

Exactly

[macdaddy]

Second part untrue. What makes you think the Agents gives a flying fsck through a rolling doughnut about collateral damage to some business he's never heard of and isn't paid to protect?

Right on target. In my experience the FBI couldn't give a rats ass about causing the least amount of colateral damage or returning your siezed property. In 2001 (I believe that's right) the FBI siezed a Sun 20 from a lab at a University I worked for. The lab was less than maintained. It was full of SGIs that were vulnerable to every possible exploit for the last 5 or 6 years. It was a joke really. The Sun was also unmaintained. I pointed out to my super 10 months before the siezure that the Sun was an open relay and had services running that shouldn't be (I still have that email!). Nevertheless it wasn't touched for 10 months. Right about the time I volunteered to help the lab maintainer get everything up to date and secure again the FBI came in and siezed the Sun. It apparently was used for something bad. I haven't been with that University for a while now but last I knew it still hadn't been returned. The FBI couldn't give a rat's ass about causing the least amount of colateral damage. Their actions speak for themselves. What if the machine used for the attack (or probe for that matter) was the Unv's mail server? It was poorly maintained too and had been hacked before. What if an attacker used it as a launching pad for an attack. Would the FBI sieze that piece of state property, effecting bringing email on campus to a complete halt? It's sad really to think about it.

Is the actual court order available?

[Animats]

Has anyone obtained a copy of the court order?

Unless the hosting service itself is involved in criminal acts, it is unlawful for the FBI to request a search or seizure of "work product materials possessed by a person reasonably believed to have a purpose to disseminate to the public a newspaper, book, broadcast, or other similar form of public communication, in or affecting interstate or foreign commerce". This includes hosting services; that was established in the Steve Jackson Games case. The service itself, not its users, has to be engaged in criminal activities before search and seizure can take place.

The FBI is usually quite careful about this, having been publicly embarassed in the Steve Jackson Games case. So the question is whether there are criminal charges against the hosting service.

Re:Is the actual court order available?

[the_greywolf]

interestingly, a good friend of mine in Canada ran a legitimate hosting service from that very datacenter. so technically speaking, if you're right, this is a huge issue.

FooNet/CIT/Xerox/Paul

[nerdherder]

First let me preface that I havn't had any association/communication with Paul in years, but back in the mid-90's I Knew Paul, the owner of FooNet (Now CIT) in relation to a Small ISP I used to be a corporate officer of/part own/work for (we were the coloc host of the fledgling FooNet.net's first server 'foonix' if I recall correctly). Things could have changed since then but I very much doubt so.

Back in the day, Paul was very much into the warez/irc scene and seeing the UseNet Articles that are around about FooNet, it seems to be pretty much the same as it used to be, only quite a bit larger. I don't know that I'd actually place CIT in the 'innocent' category, as even back then he knowingly hosted practically anything and anyone that would pay him.

Evidence seems point to quite similar behavior of FooNet/CIT as I had experienced in the 90's, so, I'd say good riddence to one more large spam/DDoS host.

Re:FooNet/CIT/Xerox/Paul

[Grimster]

Wow some interesting reading here... Like I said, way more to this story than the jackbooted thugs yanking the poor innocent foonet's servers.

Simple way to get them back

[t_allardyce]

I really dont understand how the FBI can treat every computer system they confiscate as safe to pick-up and stick in the back of a van. Either that or i dont understand how anyone with data thats either criminal or very confidention hasnt caught on to the fact that they could erase it before its even loaded into the van! take a few machines (or remote backup if needed) and stick them on a UPS. The vital data is then loaded into RAM along with the 'loading/unloading' program and removed from the drive, only a correct procedure will restore it back to disk. In come the FBI and shut it down, oops they just lost all the evidence they were looking for including the program that was responsible for loading and unloading the data into memory - absolutely no evidence left, no trace, nothing to say you even damaged evidence - an offence in itself.

That analysis is flawed too,,, in truth:

[IBitOBear]

There is only one voting system where it is impossible to produce a "surprising" outcome. That being literally "one man (wiht) one vote", i.e. a dictatorship. *All* of the other schemes have a mathematical "odd part."

In your summary of the analysis you overlook the fact that in order to suffer a reversal, there still has to be more people who want the republican than the democrat. (etc.) That is, the point of inflection happens *only* *if*, in this scenerio, thre are four party candidates: Republican, Democrat, Republican-lite (libertarian?) and Democrat-lite (Green?). [The *-lite candidates are candidates who are selected as first-vote candidates, with their second-vote going to the non-lite party.]

In order for the Republican to win (in the inferred degenerate case), the number of the Republican and Republican-lite voters must must make up more than 50% of the electorate. The FUD is that IRV is flawed becasue the least-voted-for person in the current iteration becomes the swing-votes for the next iteration. This isn't however, the real flaw.

The Real Flaw(tm) is that IRV degenerates as voters disapear in the runoffs. Lets keep our original candidate pool of R Rl D and Dl but then add a Comunist (spoiler). In the definition of the spoiler here, lets say that S always gets the least votes. In the simplest spoiler scenerio the spoiler-voters only vote for S. After the first iteration the Comunist is removed and we are back to the original model with those votes distributed among the other parties. Seems fair right?

But what if the S voters don't have a second choice? Well then the fact that they voted just disapears from the model. Still fair.

The apparent purturbation happens when, say, the S voters have a second choice of Rl, but don't have a third choice of R. If Rl is still the next eleminated party. You can end up with a situation where the sum of (R + Rl + D + Dl) nets no winner, but when Rl is eleminated you might end up with the total voter pool reduced in size so that R becomes the winner. But for that to be true, the total voters for R must outnumber th total voters for D and Dl.

I call this the "apparent" purturbation because it is only a correct result if all the S voters wouldn't have voted at all if there hadn't been an S party.

That is, R wins with less than 50% of the "original" vote even though they have more than 50% of the surviving vote. This looks like a problem because people start guessing about the "mandate of the people" for those people who got eleminated.

This isn't really a problem, however, if the voter can rank all the candidates. That is, if the voter isn't limited to, say 5 ranked votes in a field of 7 or more candidates, then the "failure to rank" into the final vote is a proper abstain.

It is also proper to discount the abstained voters because if you don't you could easily end up with no result at all.

Only if the IRV rankings are limited to some number less than the size of the field do you end up with really purturbed results.

Another complication arrises with voters who would rank Dl, Rl, then D, for instance, because their second choice (Rl) may never experience the benefit of their second-standing. In particular it appears that, in a change up situation where most/all of the *-lite voters have "the other" *-lite as their second rank, things may seem a little dicy. You get some chaotic cross over that, if you look at the raw numbers seems "surprising."

This is not *really* a problem mathematically, but the whining electroate might see it as unfair.

Still in all, if the voters percieve there to be dominant parties (R and D) and rank their votes all the way up to their perceived dominant party, the system ends up "closest to fair" of the curent alternatives.

The "odd looking" part comes out if you were to sum up the votes "the other way" by adding a tickmark next to each candidate if that candidate appears in any chain of votes. You might find that Rl h

Who pays the costs?

[IshanCaspian]

No reasonable person would be in favor of a state without police...that's just a straw man argument. The issue here is that the FBI can just shut you down simply because it believes you're doing something wrong, and you don't get any compensation regardless of whether or not you really were doing something wrong.

If I'm hiding coke in my sofa, and the FBI raids my house and confiscates the sofa, I have no reasonable expectation that I will ever get the sofa back. If they also take apart my easy chair looking for more coke, but don't find it, then, well, I shouldn't have been hiding drugs in my furniture. Tough luck.

However, what if the FBI screws up, and they don't find anything, even though they trash all of my furniture? It seems pretty reasonable that they owe me the cost of all the furniture, EVEN IF there was no way they could have known. In other words, even if they cross all their t's and dot all their i's, if they don't come up with anything, they still wrongfully accused me, and thus they owe me compensation.

By the same token, if they shut down a business, and they don't find evidence to accuse the business owner of a crime, the FBI should be responsible for every penny the company lost while their equipment was getting sniffed and probed by the FBI nerds, plus something for their trouble.

There's no reason why I should have to sue to get compensated...if you're not going to falsely accuse me I should be automatically compensated the instant my name is cleared.

The problem is that as it stands now is that the FBI could just hose an operation like 2600 for some minor offense and just keep their equipment indefinitely. Accountability, especially the financial kind will go a long way towards preventing the Gov's cronies from abusing their powers.

Apply the Second Amendment

[tintruder]

This is one of those times where the government violates all constitutional protections to the point that citizens so violated damn near have a DUTY to exercise their second amendment rights. There is no excuse for the government putting a company out of business if their only requirement is to copy data. And if the FBI is unable to do so on-site in an orderly manner, it is their failure not the fault of the ISP. ISPs have long been given the protection of a "Common Carrier" just like the telcos. They are not responsible for monitoring the content of user conversations any more than ATT/MCI/Sprint are to monitor personal phone calls. Can you imagine the FBI shutting down AT&T and confiscating their equipment because a couple hackers were discussing DDoSing? It really is getting to the point that US citizens need to start pushing back against an overbearing government. Quite frankly, take away cable TV and consumer goods and little separates the USA of today and the Soviet Union of the 1960s and 70s as far as freedom and liberty go.

Re:Zero damage done !

[orthogonal]

Zero damage done to "an innocent ISP". CIT aka Foonet are far from innocent of anything.

Yeah. Honestly, I thought about this when I originally wrote my comment. I briefly considered doing a little Googling to get some background on CIT, mainly because I know that part of the fun of Slashdot is there's always someone here who know much more -- about some subject, however esoteric --, and that someone inevitably comes along to challenge your assertions.

But then I remembered that I'm an American, and that in America everyone no matter how despicable, is innocent until proven guilty.

And that is the sense of "innocent" I was using -- particularly apropos when one considers it was the FBI which was involved.

And whatever CIT has done, no matter how bad, it's not bad enough for us to sacrifice our liberties so as to more easily punish CIT.

There's an easy solution to this problem!

[Bob Davis, Retired]

Steel doors, three feet thick slam closed sealing off the datacenter. Have all the computers in a vault. Single entry door (now covered by three feet of steel), and sets of quintuple, automatically locking one-way exit doors for the techs in the vault. When the FBI comes, push the Red Button. The vault main doors close, and the techs descend fire poles, with foot thick steel apertures closing off the vertical entrances. Then they file out of the escape doors, into the basement of the administrative facility. When the all clear is sounded (via radio-frequency tags embedded in employee ID tags) and everyone is out of the vault, epoxy resin is force-injected into the space between the quintuple evacuation doors.

Anyway, these places usually have gobs of venture capital. What the FUCK are they spending it on, pool tables and nerf guns?

Good for the feds!

[JimtownKelly]

The FBI will not seize computers without a warrant. I know this because I just lost a job for ratting to them about child pornography at one of the country's largest construction staffing firms ($100mil in sales last year). Though the local field agents were anxious to put the keibosh on the whole operation, they couldn't, because heresay is not enough evidence to get a subpoena for a raid. It takes a long time to collect evidence before such a raid will ever be authorized, sometimes months or years. So if the CTI data center was seized/shut-down, you can bet there was plenty of evidence already collected, enough to satisfy a judge. Most likely, their traffic was already being monitored, and they have only themselves to blame for condoning illegal activities.