Slashdot Mirror
FBI Raids Security Researcher's Home
Sparr0 writes, "The FBI has raided the home of Christopher Soghoian, the grad student who created the NWA boarding pass site. Details can be found on his blog including a scanned copy of the warrant. The bad news is that he really did break the law. The good news is that Senator Charles Schumer did it first, 19 months ago, on an official government website no less. The outcome of this trial should be at least academically interesting. At best, it could result in nullifying some portion of the law(s) that the TSA operates under." Read on for Sparr0's take on what laws may apply in this case.
Boiling down some of the legalese, the charges (if any are filed) will be "conspiracy to knowingly present a false and fictitious claim upon or against the United States, or any department or agency thereof in violation of USC 18 (secs. 2, 371, 1036, 1343, 2318) and USC 49 (secs. 46314 and 46316) and 49 CFR (secs. 1540.103 and 1540.105)" (edited for brevity).
Even faced with potential jail time, some people have a burning desire to be in the limelight. I wonder why Christopher Soghoian didn't just create a site anonymously. It would likely have the same effect, and he'd stay out of prison.
It's unfortunate that exposing holes in our security gets no press until someone actually leverages the hole to cause harm. For years before 9/11, the U.S. knew our airports were pitifully insecure, particularly Boston Logan, yet failed to do anything about it. So even though we'll be safer as a result of Christopher's work, he may be in prison. Unfortunately our society aplauds the whistleblower only well after the whistle has been blown, and the government aplauds them almost never at all.
Crack - Free with every butt and set of boobs
The gov't doesn't like to look bad. They don't like flaws being publically seen of their great "system" of boondoggles which they have created.
We all now the TSA is a scam, we all know we are not one bit safer, we all know the airways are no better than they were before 9/11. Just a great hat trick.
Of course, at this point...I wonder if they even care that the public would be aware.
Buy Steampunk Clothing Online!
Look, if my house has poor security, you're still in trouble if you start a factory to create keys for criminals to break in.
What did he expect from this? It doesn't matter how good or poor security is -- what matters is whether you conspired to break that security.
What a fool. I have absolutely no sympathy for him. If he had just published a paper, then I'd be a bit more sympathetic. But the guy actively sought to bypass airline security. What, does the guy not realize that people are a WEE BIT CONCERNED these days about airline security?
Sometimes it's best to just let stupid people be stupid.
1. "If you don't like it, move away." Considering the fact that Congress is severely limited by the Constitution in creating NO law that infringes on our God-given (or inherent, if you prefer) right to speak freely on our property, the laws listed above have nothing to do with what he did. In fact, his website IS his property, he rents it, and he's protected. Congress here should be the ones behind bars for continuing to violate the Constitution they took an oath to uphold.
2. "He broke a law, he should go to jail." The court system should be mandated to tell the jurors in all trials about their right to nullify terrible laws. Jury nullifaction is more than a priviledge, it is a right even greater than serving on a jury.
3. "He didn't do anything wrong." This shouldn't matter either way unless he violated someone's property or person himself. I find it outrageous that people are arrested for inciting violence -- the gun doesn't kill, the inciter doesn't kill, it is the person who physically performs a violent act that is the cause of the violence. Not only did he do nothing wrong, we shouldn't even be considering whether or not he did or didn't. Did he harm anyone physically? Did he physically steal anything? Did he trespass?
On top of those 3, we should also realize that the laws pertaining to security are 100% unconstitutional. The airplanes are private. The airports should be privatized (I can't see how airports could be considered federally-regulated properties). The passengers are generally private citizens. The Constitution is clear on this, too -- it should be left up to the individual States and the people.
This is what you get when you have democracy -- even a republican form of it.
"Democracy is the most vile form of government...democracies have ever been spectacles of turbulence and contention: have ever been found incompatible with personal security or the rights of property: and have in general been as short in their lives as they have been violent in their deaths." James Madison
"Democracy... while it lasts is more bloody than either [aristocracy or monarchy]. Remember, democracy never lasts long. It soon wastes, exhausts, and murders itself. There is never a democracy that did not commit suicide." John Adams
The U.S. isn't going to hell in a handbasket, it's been there since 1913 (or 1865, if you consider the traitor Lincoln's actions).
Thankfully, there are a great number of opportunities to vacate from the system without leaving the lands of the "Nation." I can only hope that more freedom lovers just stop voting for authority and move forward to taking that authority back.
This guy is not a terrorist, he's a security researcher. I live in Bloomington as well and work with a guy who is taking a cryptographic protocols class with Chris. He says that Chris is a decent guy, which is probably the case. I for one commend Chris for releasing this kind of information to the public. Even if he had released it to the FAA or Northwest Airlines, its doubtful that the public would have ever known. He is simply doing what most security researchers do, its just that his research coincides with current hot topics in politics and public interest.
Dear Senator,
I would like to bring your attention to the outrageous behaviour our government agencies have displayed regarding the matter of security researcher Christopher Soghoian's comments on the TSA security procedures.
Quite frankly the FBI raid on his premises are beyond comprehension for a country that preaches freedom and respect for human rights.
Not only would I like you to help in resolving Christopher's plight, I would also ask that you investigate and bring to the public's attention the true nature of the effectiveness of the TSA policies as well as to the rather offensive nature of the "secrecy" of the policies upheld by the organization.
Public transparency of the government is very important to me and any help you can give to avoid being virtually disenfranchised due being unable to evaluate the performance of my elected officals is critical.
Sincerely
The only way to get this situation under control.
The man affirmed that he created the page, the FBI had plenty of grounds to charge him. Why search his premises? Looking for other dirt to kick up in case the judge disagrees with the prosecutor?
Freedom requires that people stand up, publicly, for what they believe in. That is why the 1st Amendment reads:
Simply striking against a convenient target does not get you any closer to being Free. Nor does it keep you Free.
Freedom is not safe.
Even if he did break a law, and I'm a lawyer and I'm far from convinced that he did, this is a prime example of when the US Attorney should use some prosecutorial discretion and, after investigating the matter and being content with the subject's explanation as to what happened and why he did what he did, decide not to prosecute. The worst thing this guy did was act imprudently. No terrorists got on airplanes, nor could they have. The best thing this guy did, and I don't think there is any question about his intentions, is to bring attention to a security flaw. He took down the website when asked (maybe even prior to that) and nothing bad resulted from his actions. He had no intent to hurt anyone, no intent to steal or deprive anyone of property, and no intent to help anyone actually break the law. So, even if he could be prosecuted, he shouldn't be. Not everyone who breaks the law should be charged with a crime.
Stupid people make stupid things profitable.
Doesn't matter. I don't even think the FBI much cares if they win or lose the case, or if it even goes to trial. What does matter is that they've terrified some other potential geeks from publishing anything else negative about the TSA or other government organ. It's a win-win from their perspective. Pretty much a lose-lose from where I'm sitting ... free speech takes another hit. This is exactly the kind of situation the Founders envisioned when they came up with free speech and plugged it into the Constitution. Here's someone that saw something wrong with government, and wanted the rest of us to know about it. So, of course, in true Constitutional spirit the FBI raids his place and charges him with a crime. Doesn't matter what crime, so long as the kid is terrorized sufficiently. I mean, there are so many laws on the books nowadays that everyone, and I mean everyone, is guilty of something and can be nailed to a cross for little reason, or no reason at all.
Cripes.
The higher the technology, the sharper that two-edged sword.
terrorist noun A person who uses terrorism in the pursuit of political aims.
terrorism noun The use of violence and intimidation in the pursuit of political aims.
I quote from his blog:
This is a case of classic police-state gestapo tactics.
This guy hasn't done anything wrong, he hasn't even hilighted a previously unknown security flaw, and now he's subject to this kind of treatment...
Specialist Mac support for creative pros, Melbourne
"The fact that he is going through this for pointing out a flaw is pretty horrifying."
Pointing out a flaw and developing a tool to exploit it are two different things.
That Guy
The chance of them knowing is the probability of them finding the information multiplied by the probability of knowing the value multiplied by the probability of producing a workable exploit.
The chance of you knowing if they know is the probability of them knowing multiplied by the probability of you knowing who the bad guys even are, multiplied by the probability of obtaining real information (they can jam anyone monitoring them by flooding the information space with junk information), multiplied by the probability of you knowing you even have real information, multiplied by the probability of being able to determine what the information actually means.
Counterintelligence is an exceptionally difficult field with a painfully poor track record. Most published successes have been by a series of sheer fluke events and staggering luck. Most published failures were unlikely to be anything else. We don't know about the unpublished stuff, but percentagewise, are we more likely to see bragging over achievements or failures, if both can be equally hidden?
I'm not saying that everything should be published, merely that it should not be assumed that not publishing is the same as others not knowing.
Now, can a case ever be made for publishing everything? Yes. Game Theory requires that all "full information scenarios" have a strategy for one side and one side only that will ALWAYS result in the winning conditions being met, no matter what the other side does. It is possible to imagine situations, particularly in computing where there is essentially no randomness and a "full information scenario" is possible, where the outcome can be guaranteed, if you want it to be.
No matter what anybody else might say, it is not the job of an enemy to make your life easy, so we shouldn't expect them to. We should expect them to do the researcxh, the legwork, the analysis to figure everything out. They might indeed just wait until someone tells them, but that should be a bonus. It should not be your modus operandi. In computer security, you must assume that there are opponents out there who could have all of the industry-standard backdoor passwords, a complete printout of every Operating System and network device QA test that failed and got overlooked, and a copy of the highest-end vulnerability scanner the commercial sector has going for it.
Hell, we know that a Russian spammer got a tier-1 backbone provider to turn off Blue Frog's Internet connectivity. Turning off a link like that is very traceable, but appears to have been regarded as mere amusement for the backbone provider. The same provider is hardly likely to show scruples when it comes to handing out internal or commercially-sensitive data, software or anything else. Given the repeatedly low scores on security for many US government departments and the almost routine mishandling of classified data, there are probably those in the information black markets who know more national secrets than the entire White House combined. If one backbone provider is riddled with corruption and pwned by organized crime, then we must assume that such people are unlikely to be avoiding big money out of a sense of decency and moral fortitude.
But if the most dangerous people have the most dangerous information already - and that includes whatever terrorists might actually exist - then most of the obscurity only serves to increase the value of what has already been stolen. This makes the thieves rich, the criminals dangerous, and the politicians popular for appearing to do something, but it doesn't make anyone else - users, vendors, bystanders - any better off at all. Illusions are fun on the stage, but they should be left there.
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
And there's only one use for ethereal: to read network traffic you don't otherwise have access to. There's only one use for for a password cracker. The legitimate uses differ from the illegitimate uses only in who's using the tools, not what they're doing with them. If you can say that Kismet is legal because I can use it to hack my own network, then I can say that this researcher's tool is legit because airlines and airports can use it to test their own security systems.
Of course he was stupid to publish it, but it shouldn't be stupid. Publishing security vulnerabilities that already exist, and even exploits for those vulnerabilities, shouldn't get you investigated by the FBI.
We won't be ANY safer after Christopher's work. Not because he was wrong about his claims but because he is right. We only have security theatre.
No rational allocation of resources would have beefed up passenger screening after 9/11. I don't care if you do get a AK-47 on a plane nowadays you won't be able to hijack it and crash it into a building for the simple reason that the people on the plane KNOW they will die if they let you fly the plane.
9/11 was a one time deal. It worked because no one expected terrorists to fly planes into buildings. After 9/11 any hijacking would end like flight 82. While this would be a horrible tragedy it would be far easier to create such a tragedy with surface to air missiles, gas attacks in subways or a hundred other ways we aren't guarding against.
The real risk now is new attacks not a repeat of 9/11. We should be spending our money securing chemical plants or defending our water supply not inconveniencing people in airports. Any security in airports beyond pre 9/11 levels is nothing but a show designed to make people think they are safer while wasting resources.
Christopher is showing that the post 9/11 security measures are total theater. He isn't being arrested because he put people at risk, he is being arrested because he made uncomfortable.
If you liked this thought maybe you would find my blog nice too:
First you have to define aiding and abetting, and that ain't exactly a cut and dried issue. For example, if I loan a friend my car, I am not a principal to him using it to run over the ambassador to Sweden. Likewise, you first have to show that his site actually significantly aided anyone in committing said crime. As you said, it comes dow to how he is "aiding" these people. Considering the incredibly low hurdle of forging boarding passes, I do not thing he can be considered as significantly aiding. Anyone with a scanner, a printer, and Microsoft Paint could do this. The fact that this kind of thing is so dirt simple is proof enough that no one needs any help.
Second, back to the issue of aiding and abetting someone to commit the crime. Who was the person who committed the crime? Without that person, 18 USC 2 is irrelevant anyway.
Third, I think both Soghoian and Schumer would fall under free speech. Both were trying to speak out about the holes in the security. Both Schumers HOWTO and Soghoian's demonstration site could reasonably fall under that kind of speech.