FBI Sought Approval To Use Spyware Through FISC

An anonymous reader writes "Wired is reporting that the FBI sought approval to use its custom spyware program, CIPAV, from the secretive Foreign Intelligence Surveillance Court in terrorism or spying investigations. Affidavits prepared for the court are among 3,000 pages of documents gathered, but not yet released, in response to a Freedom of Information Act request from Wired. The FBI hasn't answered any questions about its use of the CIPAV since the program's existence became widely known in July. The FISC is generally regarded as a rubber stamp; it approved over 4,000 surveillance requests in 2005 and 2006[PDF], rejecting none."

Comments

Government Spyware

[milsoRgen]

I would just like to know, what could the FBI do to make it's spy ware different from anything else out there in the wild? It would seem to me they would limited to the same techniques anyone can use on a computer, so really wouldn't it be just one more obnoxious program out there?

However I am sure there methods of getting it installed are probably a little more sophisticated than most users are used to dealing with...

But I'm sure they should be using this very lightly, as once the right person figured out it was on their computer and released details to the curious masses, how much good would it do then? As most criminals are well aware they are doing something illegal. All it would take is a little extra effort on the part of the person who fears they could be under surveillance to discover it with proper information/tool, etc..

Re:Government Spyware

[TheRealMindChild]

They would be smart to take their cue from WeatherBug. Jesus bloody christ, its the only spyware Ive ever seen where the users fight me to keep it.

Re:Government Spyware

[mjtg]

I would just like to know, what could the FBI do to make it's spy ware different from anything else out there in the wild? It would seem to me they would limited to the same techniques anyone can use on a computer, so really wouldn't it be just one more obnoxious program out there?

Well, they could "lean on" anti-spyware vendors and "request" that they not publish signatures that identify their CIPAV. Who's to know that they haven't done this ?

Or maybe Microsoft might provide them with some useful information that isn't readily available.

Re:Government Spyware

[poopdeville]

Destroying a bug is not an admission of guilt.

Re:Not surprising

[garcia]

Reading up a bit: "The FISA Court did not reject a single warrant application from its beginning in 1979 through 2002. In 2003 it rejected four applications. In 2004, the number was again zero."

Why did it reject four in 2003 is what I want to know. Who was being investigated that it would decide to deny the application after 23 years?

Re:Not surprising

[Anonymous Coward]

Reading up a bit: "The FISA Court did not reject a single warrant application from its beginning in 1979 through 2002. In 2003 it rejected four applications. In 2004, the number was again zero."

That's not necessarily a bad thing. It could be that the government only goes to the FISA court when they have solid evidence that supports a warrant. There isn't enough information available to determine what is going on with FISA.

By comparison, most people who are charged with a crime are actually guilty - that's also a good thing. It means that most of the time, the police charge people with a crime when they actually committed the crime.

Now, that doesn't mean that everyone charged with a crime is guilty; police do make mistakes, and certainly some police are corrupt. But most people charged with a crime are guilty. Would you rather live in a country where most people charged with a crime are innocent?

Re:Meh, IT reporting these days...

[Anonymous Coward]

Why should Wired waste it's time doing that? The FBI made the same request last year and then blew Wired off after they got the questions. That's the reason why Wired was forced to submit a FOIA request. The link to the exchange is right there in THE FUCKING SUMMARY, you idiot. In fact, I'll post the link here in this post so it'll real easy for you to find.

http://blog.wired.com/27bstroke6/2007/07/thank-you-for-y.html

not news

[brass1]

This is not news. The US intelligence community, including the fbi, has been a known user of key loggers and spyware for about a decade. My link is from 2001, but I have knowledge of a federal investigation in 1998 that used key loggers to track suspects' use of certain services.

This can't be a problem

[Gazzonyx]

Yeah, but I think in Linux all you have to do is pull the microcode update support from your kernel (during a 'make menuconfig') and Intel can't update your CPU. I don't think AMD even has the ability to update the microcode. That and it'll probably take a reboot to enable the new code (complete assumption on my part), couldn't you do something to the effect of running tripwire on /dev/cpu to be notified of changes?

Surely they have a mechanism to roll back code updates, it would be borderline insane if they didn't... so, you've got the code (wireshark, tcpdump), the key (embedded in CPU), and the mechanism (kernel support code) - are you implying that this isn't enough to reverse engineer any/or revert microcode changes? I don't know the first thing about it, but this should be reversible for the same reason that DRM doesn't work - they have to give you the ability and the key if they want to run it on your machine.

Please correct me if I'm wrong.