Rackspace, Indymedia, and the FBI

chill writes "Remember when Indymedia hard drives were seized as part of an international 'criminal terrorism investigation'? Rackspace pulled the whole hard drive and shut down a dozen websites, and the Slashdot community cried 'Say it ain't so!' It ain't so. The documents have been unsealed and CNet is reporting that Rackspace made a mistake. The government wanted only copies of logs, not entire hard drives. It seems the week of downtime wasn't really necessary. Oops!"

Comments

Just copy the disks before turning them over

[jurt1235]

If they just decided to copy the disks so they would have had limitted downtime. Downtime=How long it takes for dd take to make a bit by bit copy of the drive depends on the size, use multiple machines to do one drive per machine, so it goes as fast as possible.

That would have made them make the jump of the previous posts and still have limitted impact.

A good mistake IMHO

[Adult film producer]

Otherwise nobody would have known the FBI was harvesting log files, or am I wrong about that? Hopefully all ISP's when faced with sneaky orders like this will do the same. Regardless, the damage has been done, the FBI has their log files.. it's really too bad about the victims of this witchhunt.

Re:A good mistake IMHO

[ScentCone]

Otherwise nobody would have known the FBI was harvesting log files

Not known? Since when is it news that when the FBI is presented with a reason to think they have a crime to investigate, and evidence related to that crime is likely buried in some data on a computer, that they'll get a court order to investigate the evidence? If it was your kid kidnapped, or your business extorted, or your favorite [choose thing] vandalized by some nut job who then bragged about the crime on a logged web server - wouldn't you want the law enforcement people involved to be able to investigate the evidence? If the evidence is web server log files, then a copy of the hard drive is probably the most sensible way to get it, and that's what they went and asked a judge for, and he/she issued a court order saying just that. And Rackspace just coughed up the drives rather than making a copy - you'll have to ask them why. But you deliberately use the word "harvest" as if they were out on their daily mission to collect logs files from every ISP for the fun of it - that's BS.

faced with sneaky orders like this

There wasn't anything sneaky about it! They did exactly what they always do when needing to collect evidence for a criminal investigation. Doesn't matter if it's web log files, paper records from a money-laundering faux pizza business, or shipping documents hidden by a company bringing in fake Rolexes from China. It's evidence, and you have to go get it if you're going to pursue the case. Sneaky? The only reason to "sneak" is if you have to work on the case without tipping off the suspect (say, because they're continuing to commit the crime in question and you want to catch them in the act, or get info on their associates so you can make a more effective arrest - just like they do with the kiddie pr0n jackasses).

But of course, you're not even aware of the particulars in this case. The ITALIANS requested the evidence. The hosting was in the UK. The issue was the publication of photos and names of undercover law enforcement people in Switzerland (completely against the law). The hosting was overseas, but was being done by a US-based company, so by treaty, the FBI was asked to make arrangements for the evidence collection. There was no "harvesting" going on, there was a European request for evidence related to crimes being committed in Europe, with evidence that just happened to be piled up in the facilities of a company that happens to be based in the US.

Regardless, the damage has been done

Right - to the reputation of the company that did more than it was asked to when pulling log files.

it's really too bad about the victims of this witchhunt

By which you're referring to the undercover officers who have had their faces and names published by anti-globalization crazies? If not, that's what you should be talking about. If the indymedia people didn't encourage that sort of use of their systems, they wouldn't have to care about their log files, either.

Hanlon's Razor

[GozzoMan]

Never attribute to malice that which is adequately explained by stupidity.

(From TFA: "A Rackspace employee mistakenly used the word 'hardware' to describe the contents of a federal order,")

Dropped the ball indeed

[SimilarityEngine]

Talking about dropping the ball: (from the EFF site)

the logs that the government requested didn't exist, so Rackspace should never have given the government anything at all.

Just what is going on here exactly?

Re:Large Mistake

[Bimo_Dude]

While it is a large mistake to make, I can almost see this mistake as a good thing.

The reason for this is that it brings to light how aggressive the US government can be (or is assumed to be, arguably), in cens^H^H^H^H protecting the people from those 'dissenting terrorists.' [sarcasm]After all, if you're not with us, then you must be a terrorist. [/sarcasm] ... and this seems to include reporting on anything that is not approved by the Ministry of Truth.

The interesting thing to me is that this apparently has not happened with the /. servers, given some of the comments that some people make here (extreme on both sides of the fence).

"compelled to produce a copy of the server"

[Yeb]

Another interesting line, perhaps meaningful, perhaps not, is from Certification of the log files.

[Rackspace] was compelled to produce a copy of the server owned and operated by Rackspace containing the data as outlined above. The compact disc provided herein is the true disc as provided by said entity.

"Produce a copy of the server"? Does that mean the whole system? Rackspace has said they turned over complete hard drives. The data certainly wouldn't have fit all on one CD (we're talking gigs of data on the servers). If the FBI just wanted log files, why did they take complete hard drives (which would have been around 6 drives or so)? The FBI certainly had the opportunity to look at all data on the hard drives. Do you think they did that or restricted themselves to a couple logfile lines? ;)

-Jeff

Not a mistake

[pavera]

It states in the article that Rackspace tried to turn over just the log files but then had to send the entire hard drive to comply with FBI rules.

Do any of you work for an ISP? I used to. If the FBI asks for logs like that you seriously have 12 hours generally to comply or the ISP is fined heavily. If they ask for something specific, and you're slogging through 6TBs of data, you can't possibly find exactly what the FBI wants in less than 12 hours.

The EFF lawyer says it would be like turning over a whole warehouse of documents instead of just one document... Well, good luck finding that needle in a haystack in 12 hours or face a fine that will bankrupt your company.

Rackspace

[Anonymous Coward]

I knew someone who worked at Rackspace a couple years ago. He said that in the year after 9/11, the FBI installated a huge rack of mystery equipment at each of their OC-12 connections at all of their data sites.
Thanks for your cooperation.

Those installations alone must give the FBI a pretty good coverage of all web traffic, since Rackspace hosts many thousands of the largest sites on the web.

Re:Knee Jerk Reactions...

[networkBoy]

I like my ISP.
I ost a gripe site, which is obviously not popular with the company. They sent a C&D e-mail to my ISP and to me.
My ISP said blow me, talk to the admin, the site is not against our TOS we won't shut it down.

While they are not the feds, I hear about many ISPs terminating a site because a large company sicks their lawyers on the host rather than the admin.

the site (if you're interested) is http://farmersreallysucks.com/

The takedown notice is a good read:
http://farmersreallysucks.com/E1_First_Takedown.ht ml
-nB

Re:I'll Never Forget My One Boss

[putko]

Well, the fact that he was anti-authoritarian Jew that fit a certain type celebrated by some Jews was germane. The guy even had a pet parrot named after a Yiddish vulgarism, which he carried around the office. So yeah, he was very aware of his ethnicity, and quite in-your-face about it.

The comparison to Woody Allen, who had made fun of obstreperous Jews in the past was meant to evoke the type (Al Goldstein, Abbie Hoffman, Irv Rubin, etc.). When my boss rebelled against the authority figures, it was entirely habitual and natural to him, it would have taken great effort for him to comply entirely with their wishes. I genuinely wish more Americans were like this.

The fact that Rackspace rolled over like this and sent in the disks when the govt. just wnated logs makes me think they could use more backbone, which I why I brought up this guy. He never would have overcomplied like this, unless it was going to cost him big money.

Re:quite off topic, but...

[quarkscat]

I'm sorry, but exactly which DHS server are you posting this from?

Even a delusional paranoid can be right, sometimes, that others are out to get him/her. One of the basic problems with liberty and open democracies is that they are reliant upon each other. The regime currently in power in the USA has shown an affinity for (1) ignoring international treaties and laws, (2) instituting draconian and repressive domestic laws (eg. US Patriot Act), and (3) embracing government secrecy (now SOP) as a cloak for all their policies and actions, even to the point of restricting Legislative and Judicial branch oversight. These are not the actions of a government sworn to preserve either liberty, open democracy, or the US Constitution.

That, in a nutshell, is why "The viewers of /. are becoming more and more conspiracy oriented each day." With good reason IMHO.

(Now, I have the perfect thing for both your "headache" and your lack of "paying attention" to events around you -- a 2x4 smack up between the eyes.)

#*^!~#$%@**#

You're welcome.