Slashdot Mirror
Bizarre Porn Raid Underscores Wi-Fi Privacy Risks
alphadogg writes "Lying on his family room floor with assault weapons trained on him, shouts of 'pedophile!' and 'pornographer!' stinging like his fresh cuts and bruises, the Buffalo homeowner didn't need long to figure out the reason for the early morning wake-up call from a swarm of federal agents. That new wireless router. He'd gotten fed up trying to set a password. Someone must have used his Internet connection, he thought. Sure enough, that was the case. Law enforcement officials say the case is a cautionary tale. Their advice: Password-protect your wireless router."
Guilty until proven innocent.
So maybe... just maybe, this is a clue that it's not quite right to break down people's doors because of an ip address?
...to set up a password? I've never had much of a problem, and I'm a Luddite.
But, yes, this is an area inhabited by much hysteria, mostly generated from "Think Of The Children" LE Nazis and - yes - the News Media looking for the sensational story...
If you want news from today, you have to come back tomorrow.
If someone is sitting outside my house, where there is no mobile phone service, and they really desperately need to make a quick Skype call or check their e-mail, it is a neighbourly thing to do to let them use my wifi, just as if their car broke down, it would be a nice thing to offer them a glass of water and a quick phone call to their car breakdown company.
Child pornography trading was not a strict liability offence last time I checked. You have to show some intent, damnit. And until that happens, I'm going to say fuck you to fear and be a good neighbour.
So rather than two Federal Marshalls in ties having a discussion with the gentleman, the Feds come in Police State style, tossing American citizens around like ragdolls and trampling the Constitution and the natural rights of man.
What is wrong with this country?
Hoist Number One and Number Six.
"Law enforcement officials say the case is a cautionary tale."
The summary is a perfectly accurate representation of how the police/statist spokespeople are spinning this, and of course the mass media just regurgitates it verbatim. But that is totally the wrong point to take from this. It's a cautionary tale, all right -- of the horrifying real-life consequences of our brain-addled priorities towards pornography. And the result is they'll want to make it illegal to share our Internet and information access with fellow citizens. Pretty outrageous.
We know where leadership by an anti-intellectual "strongman" who scapegoats minorities and likes boisterous rallies goes
...to set up a password?
If you run a business that offers WLAN Internet service to its guests, how do you reliably communicate the password to legitimate guests without also communicating it to those who deal in child pornography and unlicensed controlled substances?
... but it's the police who need to learn.
Maybe we don't need to send SWAT teams in to arrest people unless there is specific evidence that the person being arrested is armed and violent?
Maybe what passes for "probable cause" is a joke these days?
Law enforcement officials say the case is a cautionary tale
Indeed, this should be a cautionary tale: obtain better evidence before you make an arrest. Surely there is some kind of penalty in our well-designed system for such sloppiness on the part of law-enforcement. Surely our freedoms have built-in protections. Surely we do not need to respond to attempts by law-enforcement to try to scare us into using encryption if we don't want to ...right?
Just because it's easy for you, Mr. "I Compiled^W Gent^H^H^H^H Installed Ubuntu Last Weekend", doesn't mean that you represent the mean computer intelligence of your peers.
Big surprise, son! Not everyone has the patience for tech regardless of its ease of use.
Gov't: Hey we are planning a raid on your house next week what time would work for you for us to swing by?
You: I'm kinda busy this week. I have some computers I need to toss out. How bout you swing by next Thursday
Govt: Ok see you then
My advice would be "No one password protect your router"
Then all your concerns about the federal government snooping in on your internet traffic become moot.
Having everyone password protect their router gives the state more power over you.
Democrats or Republicans. They are both taking us to the same place and they are not afraid of us anymore.
Why don't you have a seat over there? ... What were you thinking?
fak3r.com
I'm more bothered about the fact that a screenshot and an IP address is enough to warrant (no pun intended) an armed unit (from Immigration and Customs, for some reason) smashing the door down and throwing the guy down the stairs. When the evidence is that slim, I'd suggest maybe turning up in the daytime and knocking on the door with a warrant to search/confiscate the computers would be a more measured response.
maybe while they're at it, they could stop considering putting certain arrangements of molecules into other arrangements of molecules a crime as well.
Just using a password isn't safe either. I 'cracked' my own home router that was running WEP encryption in about 5 minutes using a live-cd distribution for that purpose. I've made sure that everything is on WPA2 now, but very few home users are going to know the difference between encryption types.
It's not just wireless that presents problems like this. If your computer or router gets cracked and starts routing illicit traffic for third parties the exact same thing in the article can occur.
The raid could have tipped off the actual perp so he could destroy evidence.
I hope they assign smarter agents to violent crime and terrorism.
you will be cited for not locking your door, on your car, house or modem/router. The problem is all will be penalized in this stupid police state called America, the home of the 'free' where that means free to take the liberties of the huddled stupid masses. Dumb the population down via poor education and what do you get, a bunch of sheaple willing to be taxed to death and afraid to do anything about it. Get what you deserve here, sadly this country is hopeless until a very blood revolution and a system pride by education occurs.
Remember when SWAT teams were only used on violent offenders in situations that were expected to get excessively violent?
Unfortunately, I don't, I was only born in the 80s. I know SWAT teams as being used for everyday arrests and serving warrants, most often by busting down doors of family homes in the dark and shooting people's pets (like the DC area mayor who's dog was shot in the back as it ran away from police during a raid for a crime police had strong evidence he didn't commit but set him up for anyway). No police force needs APCs. Nor should the first line of investigation involve Afghanistan-style street warfare. And where's the police force policing these out of control police forces?
Well, other than the fact that he did nothing illegal but got raided and harassed by police and probably has his name associated with kiddy porn all for leaving his wifi open. What difference does it make if he left it open due to ignorance or if he was just being nice? That facts are that an IP address is not a person and the police need to stop treating it as such.
.... and use assault weapons to arrest someone you have no reason to believe is armed and dangerous.
The police has become a domestic military force.
My Nintendo DSi only supports WEP for certain games, what other solution is there?
Change is certain; progress is not obligatory.
The Feds could readily determine that the router was unsecured. That means that anybody within a certain radius of the computer could have downloaded the picture.
Probable cause means facts and circumstances that would cause a person of reasonable prudence to believe that the computer in the house that was searched was used to download criminal material or used to store criminal material.
The router is evidence of a crime. It is the device used to get the criminal material. The feds had a legit reason for the search and seizure of the router.
The problem that I have is that the ICE agents behaved like pigs--complete pigs--with respect to the man whose home they invaded. They had facts sufficient to know that they had no probable cause to believe that the man they threw on the ground had done anything wrong. They were under no threat, yet they assaulted him for no good reason.
MAC addresses are easy to spoof.
Mike O'Donnell http://people.cs.uchicago.edu/~odonnell/
If securing wifi becomes mainstream and hackers start producing tools to crack common wifi entry points, it would be much harder to explain away an intrusion if your network is password protected than if it is not.
My only real concern would be with bandwidth consumption and there are a lot of teens in my neighborhood I could see streaming like fiends.
I swear to God...I swear to God! That is NOT how you treat your human!
I have lived in my neighborhood for several years. Within my home detection range, I have access to nearly a dozen wireless hotspots. A few are open. A few use WEP. Two use WPA. A few use WPA2. In the course of my experimenting with wireless security and man in the middle attacks, I have gained access to all of them. The hardest one to crack forced me to set up a dedicated laptop for a week. Now, I'm just a computer guy with an interest in security. I tried just to see what could be done and to gain a better understanding. But the tools I used and the knowledge I have are available to virtually anyone. I'm far from some 'super-hacker'. My point is that if I were a pornographer, none of these would be secure enough to stop me. And yet the police are trying to spin this that somehow the homeowner who was wrongfully arrested was at fault for some security lack on his part. Ridiculous. It's obvious that the police didn't have enough information to justify the raid, and they are just covering that up. Can you imagine the police doing a major raid on your house, doing property damage, seizing your assets, etc. then being told "Hey, you have the same initials as the guy we're really after. We really didn't know enough to figure out if it was you or not, but we figured what the heck, we'd raid you anyway."
Like what tho. How do you gather more evidence of such a thing without going into someone house, taking their computer and looking in it. Only ways i can imagine is by hacking his pc. But that would be even worse.
Downloading child pornography doesn't seem to be a violent crime to me. Why did they need to send a SWAT style raid rather than knocking on the door with a warrant? Did the guy have a history of violent crime?
Aggresive raids get people killed - both the people being raided (e.g. http://www.washingtonpost.com/wp-dyn/content/article/2006/01/26/AR2006012602136.html) and the police doing the raid (e.g. http://amarillo.com/stories/112201/tex_firedfor.shtml - note that was a raid of someone who owned a lot of guns, but the police did manage to fire 369 shots killing one of their own while the guy being raided did not touch a gun let alone fire a single shot).
For suspects of non-violent crimes (and downloading/viewing child pornography is not more violent than downloading/viewing videos of an assault - that the production of the pornography involves violence is irrelevant) and even for convicted non-violent criminals "kicck the door down and point guns at everyone" raids are only going to increase the risk of death and injury.
Bruce Schneier wrote an insightful essay explaining why he does not protect his wireless node. There are pointers to other essays agreeing and disagreeing with him. I personally agree with Schneier. I consider myself the steward of my Internet connection, more than owner.
Mike O'Donnell http://people.cs.uchicago.edu/~odonnell/
No, they use assault rifles because they like to pretend their soldiers at war, but are really cowards.
Proverbs 21:19
And yet these pussies won't go after the REAL threats. Trying going after MS 13 you cowards!
Life is not for the lazy.
Anyone with any sense agrees that a raid with a warning wouldn't be useful. The point is that there should not have been a raid in the first place. Send a couple officers out with a warrant and have them bring the guy in. Life is not an action movie, and wearing a badge does not change that.
Ah, child support: where the woman gets to regard the foetus as her property until parturition, at which point it becomes the man's responsibility.
Yep, the law's about as wrong on that as it is to prohibit the noting down of particular sequences of 0s and 1s. Easier than actually stopping child abuse as all you have to do is subpoena the ISP for the "identity" (oh, wait..) behind a particular IP address and then turn up at the address they supply.
Although IIRC the sequence when talking to cops in the US is ...so any cop telling you to "please step out of the house" is doing it wrong, as it either means "I'm about to arrest you" or "I'm about to ask you to do something you won't do anyway".
(i) never let them into your property without a warrant;
(ii) tell them calmly that you have nothing to say;
(iii) ask whether you're free to go;
(iv) close the door / walk away...
This is it exactly. IP's addresses aren't people especially with IPv4 addresses. I don't know about the average slashdotter, but on my single IP address are 4 people, with 9 different computers.
If one person fails to update one computer with a zero day patch, and that machine gets comprised and can then download whatever they want, and leave behind incriminating evidence getting someone else in trouble for your dirty deeds.
NAT's are good at such things. Heck I am now tempted to leave an unsecured computer on my network and let it get infected with crap. Just so if the ops ever raid me for "music/video/porn" I can point to the honeypot and machine and claim ignorance.
i thought once I was found, but it was only a dream.
> Lying on his family room floor with assault weapons trained on him...
> Law enforcement officials say the case is a cautionary tale. Their advice: Password-protect your wireless router.
I have some advice for law enforcement. Don't treat someone suspected of a non-violent crime as an excuse to play with all the new weapons you just got budget for. Things go wrong. People end up dead. Read http://reason.com/archives/2007/07/02/our-militarized-police-departm or http://www.cato.org/pub_display.php?pub_id=6476 or Google for "Paramilitary raids", "militarized police".
- For the complete works of Shakespeare: cat
That boils down to the same reason ANYONE is armed though: it's better to have it and not need it than to need it and not have it. I don't think it's a wise move for our police to leave home their weapons because someone might find it scary.
Nobody has suggested the police should have gone in unarmed. They would have had their pistol at their side as they would at any other moment they were on-duty. It's the assault weapons that were a problem here. They are appropriate when raiding gangs or drug houses, but even then they are rarely used. Making intimidation the rule of thumb is part of what is making things worse for police departments and the citizens of the USA.
From hell's heart I fstab at /dev/hdc
Indeed, I am sick of this sort of behavior from the police. For instance, near my home they shot a 12 year old girl with a beanbag gun because she was being "unruly" and swinging at officers. They justified this by saying that the police need to maintain their own safety. This is about the biggest load I've ever heard. You're a cop -- your job is not safe. The reason you took this job is to protect others, not yourself. If you wanted a nice safe life you'd go into a safer business, like cleaning swimming pools. Instead we have armored thugs shooting little girls with beanbags because they're scared they might get punched in the eye. Buncha fucking pansies, whiners, and scaredy cats. Do your fucking jobs, assholes.
I think the actual title to this story should be "Bizarre Porn Raid Underscores Utter Lack of Investigative Work".
Recently I looked on my phone trying to get it to connect to my Wifi and noticed that of all the signals it was picking up (about 9) mine was the only one NOT using WEP. Its surprising that people are so incredibly clueless about the technology they use. It's not like it would take that much effort to learn a little about your router before you plug it in.
When I was trying to set up wireless internet between my router and my DS/Wii console, some parts only worked with WEP for one reason or another. This left my choices as either no internet on console (which I use to watch the BBC iPlayer), use WEP, or use unsecured with MAC filtering. Neither are particularly secure, but think what someone who doesn't have a technological background would do when their console complains about wireless security, they'll probably just turn it off entirely to make the problem go away.
From the police perspective: You've just trained that kid that the police are the last word... we have guns and can tell you what to do.
The kid would grow up scared of police, doing whatever they say without question and perpetuate power. Then when that kid is old enough to start posting on the Internet, they are the first to blame the person being arrested no matter what the guilt level is.
Every time I start to have faith in humanity, I ruin it by driving to work between 7 and 8 am.
The whole point of child porn laws is to prevent children from being sexually exploited. I'm 100% behind that. But all those pictures and videos that the police take down were taken a long time ago. You don't protect any children by keeping that stuff off the internet. If anything, by taking down the old stuff, you encourage perverts to make new stuff - to hurt more children.
A more enlightened country would release all the child porn they have ever seized to registered perverts. So if you're willing to register as a pedophile, you can get access to the government's entire stash (maybe not all at once, but gradually). Registration would require a fee and mandatory counseling, and all materials would be watermarked specifically for you so that you wouldn't share them. But if you abided by all this, could do your pedophilia legally. I have a feeling that this would satiate the porn needs of most pedophiles.
The police could then focus on the real source of harm: The people who take sexual advantage of children. The whole point of the scheme would be to destroy the demand for more child victims. If law enforcement worked with the pedophiles a little, I'm sure that the people who are victimizing children now would also be easier to catch. There might be special rewards for snitches whose tips lead to arrest.
I think that with the sheer grossness of the crime of pedophilia, we lose track of what would be the most effective way of dealing with it. Kicking down doors and throwing innocent people down their own stairways is not it.
Let me tell you a story about excessive force:
A few years ago in Atlanta, the police got a tip from an informant about drug dealers. They sent three undercover officers to serve a no-knock warrant. In other words, they sent three heavily-armed men who weren't dressed as police to kick in somebody's door without any warning. Guess what happened next.
That's right: the old lady who lived alone in the house (and who was not a drug dealer), scared out of her wits, fired a single shot at the armed thugs invading her home. She missed. The "officers" returning fire, on the other hand, used 39 bullets instead of one, and didn't miss five or six times.
Then, of course, they planted drugs on the old lady as she was dying, and it turned out that that the informant had lied (under pressure from police) in the first place.
For more information.
"[Regarding the 'cloud,'] ownership was what made America different than Russia." -- Woz
I think the process is a little more complicated than "Child porn? Well it couldn't have been me!" "You heard the man, let him walk!". If there is probable cause they can seize the computers. Encryption or a "panic button" would only slow things down while they send the drives off to data forensics.
I *like* to help people. Providing password-less wireless access is a nice way to help others. I don't do it at the moment, but only because of time pressures; I hope to do this in the future. It'd be best if there was a common convention that "no password means anyone can use" because there's no other way to make that obvious. In the meantime, I suggest using "public" somewhere in the network name, so that people will know that you're intentionally providing a service to others. Bruce Schneier has similar comments.
- David A. Wheeler (see my Secure Programming HOWTO)
Law enforcement officials say the case is a cautionary tale. Their advice: Password-protect your wireless router.
All because THEY (the lazy law enforcement officials) have have long ago forgotten how, or even why, to do what used to be done ... actually INVESTIGATE the crime. So what is their advice for cases where the router is buggy, or for trojans running on Windows that let others relay network access?
now we need to go OSS in diesel cars
We would like to believe that law enforcement types are bright enough to collect a great deal of hard evidence before raiding, arresting, detaining or even interviewing a suspect. That raid was absurd.
And it gets worse. In Florida complaints of abuse to a senior citizen are handled by Children and Family Services. These meat heads only investigate 10% of the reports made. This state agency is responsible for deaths of children and harm to the disabled and a total lack of responsibility to seniors. Funding and low job qualifications are probably at the root of it all. We need to eliminate that agency and start from ground zero with all new people and a quality budget. Constant budget restraints murder people. Thank the right wing for dead children and abused seniors.
Wonder what would have happened if he kept financial records or embarassing, but legal porn in a truecrypt/ecryptfs/etc volume. What if he had a work computer that had full disk encryption because his company said so. Or what if he installed with encrypted everything because the check mark was there.
Would they have presumed the kiddy porn was the place they couldn't read?
XML is like violence. If it doesn't solve the problem, use more.
Well, you could ask some questions:
1. How many people are in the house?
2. When is the owner most likely alone?
3. Would that time be best to knock on the door when you know he's the only one there?
4. Do you have the back door covered in case he tries to flee?
Also, you could do some basic investigatory collection of data:
1. If his router was unencrypted and open, start up a sniffer in a parked car around the corner, [or "Hey, the city is fixing that storm drain"]. (Get a warrant if there's question.)
2. Make sure that the data is truly bad...
3. Identify the MAC address that the data is coming from.
4. Does it stay consistent? No spoofing?
5. Attempt to triangulate source... this may need two+ listening devices.
Every time I start to have faith in humanity, I ruin it by driving to work between 7 and 8 am.
What irks me other than the obvious is this line: "Agents arrested John Luchetti on March 17. He has pleaded not guilty to distribution of child pornography."
What if he goes to trial and is found not guilty? He still has the stigma attached to him. If you google his name you've got more than plenty of links on the poor sap and some on this story. They're basically treating him as if this case is already closed and frankly, that's just fucked up.
he probably would have been shot on sight.
My beliefs do not require that you agree with them.
It's whatever these jack-booted bastards feel like doing to you this week. And you can talk until you're blue in the face to people about how bad this is for all of us, how it's a slippery slope, but they'll just look at you and say stuff like 'but if the police went after them, they must have been doing something wrong'.
The only thing that ever convinces people that there's a problem is if they or someone close to them gets a taste of that boot, by which point it's too late, because now as far as everyone else is concerned they must have deserved whatever they got.
Here's a test. Ask 10 people if they think it's better for our justice system to accidentally lock up an innocent person now and again or if it's better to never lock up an innocent person but occasionally let a criminal go free. People I thought I knew really well were happy to lock up the neighbors they didn't know if it would also get some imaginary criminal threat off the streets. NIMBY is alive and well.
No one claimed that IP address = person, AFAICT. What was claimed was quite accurate: The IP address can be used to track down the subscriber. Maybe he didn't use the router, but he's the guy who paid for the connection the IP address was assigned to.
Clever signature text goes here.
They could easily have done this without going into this guys house if they had not been so gungho to start. The article clearly states that once they realized they screwed up they went back to the file sharing app they had found the alleged guy on in the first place. Originally they took the most recent IP and ran with it. However, when they went back (after the first snafu) they used that app to find the other IP addresses that the same username had connected from. They used the new IP address information to determine that a student at a university had connected and they found that the student lived across the street. Now, seems they could have done all that the first time around and saved themselves and this poor guy from having to go through all of this.
My present is the activity I am currently engaged in with the purpose of turning the future into a better past.