FBI Operated 23 Tor-Hidden Child Porn Sites, Deployed Malware From Them (arstechnica.com)

An anonymous reader quotes a report from Ars Technica: Federal investigators temporarily seized a Tor-hidden site known as Playpen in 2015 and operated it for 13 days before shutting it down. The agency then used a "network investigative technique" (NIT) as a way to ensnare site users. However, according to newly unsealed documents recently obtained by the American Civil Liberties Union, the FBI not only temporarily took over one Tor-hidden child pornography website in order to investigate it, the organization was in fact authorized to run a total of 23 other such websites. According to an FBI affidavit among the unsealed documents: "In the normal course of the operation of a web site, a user sends "request data" to the web site in order to access that site. While Websites 1-23 operate at a government facility, such request data associated with a user's actions on Websites 1-23 will be collected. That data collection is not a function of the NIT. Such request data can be paired with data collected by the NIT, however, in order to attempt to identify a particular user and to determine that particular user's actions on Websites 1-23." Security researcher Sarah Jamie Lewis told Ars that "it's a pretty reasonable assumption" that at one point the FBI was running roughly half of the known child porn sites hosted on Tor-hidden servers. Lewis runs OnionScan, an ongoing bot-driven analysis of the Tor-hidden darknet. Her research began in April 2016, and it shows that as of August 2016, there were 29 unique child porn related sites on Tor-hidden servers. That NIT, which many security experts have dubbed as malware, used a Tor exploit of some kind to force the browser to return the user's actual IP address, operating system, MAC address, and other data. As part of the operation that took down Playpen, the FBI was then able to identify and arrest the nearly 200 child porn suspects. (However, nearly 1,000 IP addresses were revealed as a result of the NIT's deployment, which could suggest that even more charges may be filed.)

Comments

I'm afraid to click on any of this article's links

[JoeyRox]

For fear that I'll unwittingly be taken to a child porn site and then have my IP address logged for immediate arrest.

Is Tor still vulnerable?

[BitterOak]

That NIT, which many security experts have dubbed as malware, used a Tor exploit of some kind to force the browser to return the user's actual IP address,

Does anyone know if that exploit has been fixed or is it still unpatched? If the FBI can use this exploit to catch child pornographers then other, possibly malicious, people can use the same exploit.

Re:Is Tor still vulnerable?

[Anonymous Coward]

The EFF is trying to force the FBI to disclose the exploit they used. To date, the FBI has not publicly revealed it.

In addition to difficult questions concerning the Fourth Amendment, Rule 41, and the limits of government hacking, the Playpen cases raise an important question about the future of digital rights: whether, to what extent, and under what circumstances the government must disclose to criminal defendants how the government carried out its hacking.

In the Playpen cases, the government has provided some information to the accused about how the “network investigative technique,” or “NIT,” operated. But, critically, the government refuses to produce the exploit it used to allegedly take control of suspects' computers.

That refusal—in addition to all the other problems with the Playpen cases—violates the rights of the accused. And, as at least one court has correctly found, the refusal to disclose the exploit to the defense requires suppression of evidence obtained as a result.

At its core, the government's argument is: “You don’t need to know how we got into your computer (the exploit) because it does not change the information that we took from your computer (the private information copied and transmitted by the payload). Just trust us on this.”

entrapment

[lpq]

Why is this not entrapment?

If they offer 23 out of 29 sites, that would seem to be increasing enticement...

Re: entrapment

[Anonymous Coward]

Because they didn't make them do anything they wouldn't have otherwise done and they didn't force them to do it.

Re:entrapment

[dbIII]

Facts? Cases get thrown out due to obvious entrapment every now and again. It's not always like your cartoons.
It's off the top of my head so don't use the excuse that it is an old case, but one of the most utterly ridiculous ones was from the Clinton era that ended up being described in a book as "Saddams Nuclear Triggers". It took months for FBI agents to convince a British industrial parts supplier to buy an item from one FBI agent and sell the same thing to another and claim that the supplier was supporting a nuclear bomb program that didn't exist in Iraq. The amoral pricks who set it up just wanted a high profile case so they could get promoted so they manufactured a fake crime and spent about a year going shopping for a patsy to frame for it, then months "grooming" their patsy before he agreed. It took years but in the end all charges were thrown out. It is well established as a FACT that real entrapment, unlike your comic, was the situation there and that there would have been no crime or attempt at one without the involvement of the agents.
More recently a mentally ill person with no strong political or religious views was encouraged to get a bomb by FBI agents, once again with a very long "grooming" process, then provided with a bomb by FBI agents. That one is still going through the legal process so there may be more to it.
It does happen and merely manufactures convictions instead of stopping crime.

Question for the FBI

[Anonymous Coward]

When, may I ask, will the FBI go after the creators of child porn, and not just the consumers? The peopel who actually and directly abuse children for money? Or is it a lot simpler easier to entrap the customers, since you can wave the contraband in their faces? It's rather like penalizing people who drink poisoned water rather than finding the poisoners.

Except

[s.petry]

1. They had 2 warrants and judges approve the tactic. If you want to complain about the judges that is fair game, but the FBI did follow the rules. 2. The FBI did not setup these sites, they seized them through legal process.

I am extremely pro US Constitution and don't see what they did as wrong. They followed the legal process as they should. What I wish we could see is how many arrests they made from the tactic.

Your resident pedo here

[Anonymous Coward]

The hosting site in question was known as "Freedom Hosting", it was the host of many sites including OPVA (main CP video site), Lolita City (main CP pic site), TorMail (used by everyone and their dog) and many others. The cops took over *all* of them when they took the host, what they're talking about here is the server request logs. The NIT was supposedly only deployed on CP sites, but that's a lie it was deployed on all sites hosted by FH. I'm not about to testify on that though.

The exploit was based on a Javascript exploit in Firefox, in the CP community it was well known that you should disable any form of scripting that TorBrowser insist on shipping enabled because otherwise it'd break too many regular sites. So in the end they caught a few nobodies that didn't follow best practices, shafted someone who only did the hosting and punch water knocking out the main sites. It's like bittorrent, we tend to crowd but the crowd could always meet somewhere else.

For what it's worth, they also took over TLZ (The Love Zone) and ran it for half a year. Playpen they took over and ran for two weeks. They catch the people who do stupid things like pay for hosting with non-anonymous methods, say compromising things in private messages and so on. They pick of the stupid, the smart stay on... 20+ years and counting, the cops are n00bs. They think the scene is TPB, it's just barely scratching the surface.

Re:eh

[The Rizz]

i think most can argue even in true free markets that who cares what happens to people that like that.

The question is whether that data collection was legal, and fell with a scope that didn't amount to a fishing expedition. There are two main reasons everyone should care about this:

1) If it's not legal, then it risks these suspects going free on a technicality.
2) If it's not legal, but people decide to just let it slip by because "those people are horrible", then it sets a precedent that said methods are OK, and it gets harder for it later to be declared illegal when the government starts using it for less clear-cut or outright nefarious purposes.

Re:I'm afraid to click on any of this article's li

[ShanghaiBill]

Pedophiles fear many things. If they seek psychiatric help, the doctor is required to report them. So they stay untreated in the shadows. Other countries are more enlightened. In Japan, pedophiles can buy child-sized sex dolls. Although data is scarce, the dolls appear to provide a release for their predilection and reduce offenses against actual children. This is unlikely to happen in America, but soon we will have a sexual predator as our president, so maybe he will be more empathetic.

I know those raided over this, info inaccurate

[Anonymous Coward]

The FBI needlessly raided, embarrassed, and stole a lot of property from people it disliked irregardless of the fact they didn't even know who they were targeting in most cases. The IP addresses don't equal persons or places to be searched despite what the courts have accepted. I know that because I can demonstrate it here with this very example. I do know that in this case the FBI did know who they were targeting because they were targeting an activist or two or group who stood up against the FBI for immoral and reprehensible behaviour (distributing child porn). Mark Edge and Ian Freeman stood up and called the FBI out just two weeks before they raided the studio of Free Talk Live and home of numerous liberty activists. The government has been targeting Ian Freeman's reputation for some time and slandering/libeling his name making claims he's a paedophile who advocates for the rape of children under six. Ian advocates against the use of violence including against children and doesn't think children under six should be having or are ready for sex.

Here is what I can tell you: The warrants didn't name a person, place, location, and specific things to be seized. In this case they've stolen a few dozen computers and devices from many innocent parties. The courts literally rubber stamp these types of warrants and higher courts have ensured this continues.

You can see exactly what happens in the videos below (thanks to other activists who recorded the raid). FTL is a libertarian talk show that has promoted the Free State Project which is a migration of liberty minded activists to New Hampshire for the purpose of pursuing liberty and freedom. Check out www.freekeene.com for Liberty news in New Hampshire. And don't worry- if you join us there are thousands of people here already. You won't be raided as long as you don't live near the home of the most active activists. They didn't succeed in undermining the movement (which actually consists of numerous groups throughout New Hampshire) and within a handful of hours they raised $5,000 and got Free Talk Live on air- before they even missed airing a single episode.

Check out:

http://www.copblock.org/156621/got-enemies-have-the-fbi/

Raid itself:

http://freekeene.com/2016/03/20/men-donning-badges-steal-property-from-free-talk-live-studios/

Re: Just sayin'

[MightyMartian]

You've described the Libertarian alt-right future, where not only will you have the freedom to starve or die from treatable injuries and diseases, but where you'll have the added liberty of selling your children into sexual slavery.

Rule 29 b.

[bmo]

Rule 29 is now amended thusly:

Rule 29 (a) In the Internet all the girls are men and all kids are undercover FBI agents.
        (b) All child porn servers are FBI servers

Which should have been obvious before this.

--
BMO

Disgusted but not surprised

[dbIII]

Disgusted but not surprised - how about they put in the hard work of solving crimes instead of the quick way to promotion of enabling crimes and catching the people they have tempted?
The primary target should be catching the people molesting the kids in the first place, but instead those get left alone as being too difficult.

Re: eh

[Anonymous Coward]

Paedophiles are just like the rest of us. There isn't a risk of them molesting children any more than there is a risk of your heterosexual non-pedo neighbour raping your wife. They couldn't find enough child molesters so they fabricated it. The stories about cults of paedophiles were shown to be fabricated and false. They were created by terrible police tactics which got kids to say things that were false. What is a risk is reducing the supply of pornography of any type. The studies that have been done where pornography was legalized showed rapes fall and when outlawed again rapes go up. One study in one country where it was legalized, criminalized, and legalized against showed clear evidence of this. Some small percentage of paedophiles are going to rape children just like some small percentage of children population is going to go out and rape women/men.