Slashdot Mirror


FBI Dismisses Child Porn Case Rather Than Reveal Their Tor Browser Exploit (arstechnica.com)

An anonymous reader writes: Federal prosecutors just dropped charges against a child pornography suspect rather than reveal the source code for their Tor exploit. Of the 200 cases they're prosecuting nationwide, this is only the second one where the FBI has asked that the case be dismissed. "Disclosure is not currently an option," federal prosecutors wrote in a court ruling Friday. The Department of Justice is still prosecuting 135 different people believed to have accessed an illegal child pornography web site. Before shutting it down, the FBI seized the site and operated it themselves for 13 more days, which allowed them to deploy malware to expose the users' real IP addresses.

30 of 244 comments (clear)

  1. Which is more important? by Anonymous Coward · · Score: 5, Funny

    Secrecy or Child Pornography...

    We report, you decide.

    1. Re: Which is more important? by PoopJuggler · · Score: 4, Insightful

      I posit that it's unethical and treasonous to not disclose the vulnerabilities because those exact same vulnerabilities can be used against our own citizens and government agencies by foreign agents. Imagine if foreign hackers brought down the banking industry causing massive economic devastation using an exploit that the FBI knew about but didn't tell the banks?

    2. Re: Which is more important? by ShanghaiBill · · Score: 4, Insightful

      using an exploit that the FBI knew about but didn't tell the banks?

      How many banks rely on Tor?

    3. Re: Which is more important? by Pseudonym · · Score: 5, Informative

      Bank infrastructure is typically less secure than Tor.

      --
      sub f{($f)=@_;print"$f(q{$f});";}f(q{sub f{($f)=@_;print"$f(q{$f});";}f});
    4. Re: Which is more important? by Anonymous Coward · · Score: 5, Informative

      I'll counter, how many CIA agents rely on TOR? "The core principle of Tor, "onion routing", was developed in the mid-1990s by United States Naval Research Laboratory employees, mathematician Paul Syverson and computer scientists Michael G. Reed and David Goldschlag, with the purpose of protecting U.S. intelligence communications online. Onion routing was further developed by DARPA in 1997."

    5. Re: Which is more important? by gweihir · · Score: 5, Interesting

      This is not a "Tor" exploit. It is a Firefox exploit against the version of Firefox used in the Tor browser bundle. It may well still be exploitable in current Firefox versions, including the one used in the current Tor browser bundle versions. Otherwise there really would be no point in keeping it secret.

      Hence the FBI is actively and knowingly endangering anybody using Firefox. That seems to be legal, but it is hugely unethical.

      --
      Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
    6. Re: Which is more important? by lucm · · Score: 4, Insightful

      Bank infrastructure is typically less secure than Tor.

      Bullshit. I have worked for three banks and they all had the best IT security money can buy. One of my current clients has a core switch that's worth more than your house, it's crammed with IDS and IPS modules and whatnot.

      Meanwhile Tor has been the source of many incidents, especially once people started putting up fake nodes.

      --
      lucm, indeed.
    7. Re: Which is more important? by Zontar+The+Mindless · · Score: 4, Insightful

      "Treason" has a very clear definition under US law, and you apparently do not know or perhaps even do not care what this definition is. My guess is that this is because it's a word you like to use purely for effect, rather than for actual communication.

      --
      Il n'y a pas de Planet B.
  2. So 135 more dismissals in queue? by Anonymous Coward · · Score: 5, Interesting

    Sounds like there is a very simple formula for defense now and forever for any of their tor tapping. Smart, very smart.

  3. Re:Deploy malware? by TWX · · Score: 4, Interesting

    You do know that javascript, java, and flash exploits are still a thing, right?

    I would not be surprised if the FBI has learned of an exploit for one of these or in the Tor implementation itself, and has chosen to not disclose it because they can continue to use it for parallel-construction cases, or because their knowledge of it came from another agency that still wants to use it for international crimes.

    --
    Do not look into laser with remaining eye.
  4. Now we know where the moral compass is pointing. by MrCodswallop · · Score: 5, Interesting

    Interesting, albeit disturbing, insight into the moral compass of the FBI. Secrecy trumps child pornography.

  5. Wrong focus. by Gravis+Zero · · Score: 5, Interesting

    The question is if the FBI is actively seeking the child abusing producers of child pornography or if they are really only interested in catching the people who download it. It's all very distasteful but I'm more interested ending the abuse than throwing every twisted individual in jail for a period of time. I understand that it's a global problem which is why governments should work together to stop the madness.

    --
    Anons need not reply. Questions end with a question mark.
    1. Re:Wrong focus. by gweihir · · Score: 5, Interesting

      Well, judging from their tactics in "fighting terrorism", they would produce child pornography themselves, if they legally could. They have been producing "terrorists" for a while now. Hence my take would be they have zero interest in in actually doing anything real about the problem because that could dry up the ready supply of downloaders that they can catch and prosecute easily. And with that supply drying up, their funding and power would get reduced. If that is not a perfectly fine motive explaining what they are doing, then I do not know what is.

      --
      Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
  6. Re:Deploy malware? by Ramze · · Score: 4, Interesting

    Tor disables javascript, java, and flash by default... so the exploit must have been in the mozilla firefox code base or the onion routing protocol -- unless they run and/or spy on all the Tor nodes to figure out where things are really being routed.

    I've read stories where the feds attempted to shake down libraries to get them to close their Tor nodes, yet the feds run their own. If you control all the nodes, it's easy to figure out the real routing through the onion network.

  7. Re:Now we know where the moral compass is pointing by rtb61 · · Score: 4, Insightful

    Or letting one more child be raped and murder equals what the fuck exactly? Those child porn rings require content and every time a content producer is exposed, an arrest and rescue should immediately occur, 'IMMEDIATELY', fuck future prosecutions.

    --
    Chaos - everything, everywhere, everywhen
  8. Re:Deploy malware? by Anonymous Coward · · Score: 4, Informative

    Tor does NOT disable Javascript by default. It ought to, but it doesn't. The last official statement was they felt nobody would use Tor if it shipped with Javascript disabled, because so much of the web depends on it.

  9. Re:Now we know where the moral compass is pointing by ShanghaiBill · · Score: 5, Interesting

    Or letting one more child be raped and murder equals what the fuck exactly?

    There are many myths about "snuff films" that record actual murders, but none have ever been verified. In the most famous case Ruggero Deodato was prosecuted for murder, but was acquitted when the actors and actresses that he had allegedly murdered showed up to testify in his defense. It is hard to imagine how some scenes in his films could have been made without killing someone, but they obviously were, since the people "killed" were still alive and healthy.

  10. Re:Now we know where the moral compass is pointing by gweihir · · Score: 4, Insightful

    There is actually some genuine "murder porn" out there: You get to see it on the news, perfectly legally. Think for example, the footage exposed by Manning. It even comes with mocking comments by the murderers while they kill innocent civilians.

    --
    Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
  11. Re:Now we know where the moral compass is pointing by joe_frisch · · Score: 4, Insightful

    Considering that the argument for why distributing and owning (as opposed to producing) child porn is that the images actively harm children, I do not think there is any way to justify the FBI's behavior. I think its been generally established that law enforcement cannot commit felonies in order to gather evidence. Otherwise we could have police informants carrying out gang hits in order to capture higher level crime bosses. This is not the start of a slippery slope, it is well down the slope.

    They can't have it both ways. If the images don't do actual harm to children, the people who posses the images are only guilty of a minor crime. If the images do harm children, then the FBI should destroy them as soon as they are discovered to prevent continuing harm .

    On the central topic there need to be clear rules about what capabilities we want law enforcement to have. It is probably technologically possible for law enforcement to scan all of the records of the great majority of citizens to look for criminal activity. Is that what we want?

    Personally I would vote to reduce surveillance and accept a higher rate of criminal activity.

  12. Re:What authority is FBI using to NOT disclose? by gweihir · · Score: 5, Insightful

    Child abuse, horrible as it is, does not qualify as "National Security". Also, because they did disclose the name of the accused, they should be sued into the ground after dropping the charges. While it is not pretty, civil liberties need to be defended, even if it means defending scumbags. Otherwise they can just destroy anybody in the future by first publicly accusing them and then dropping the charges, possibly without ever providing any evidence or only fake evidence they then withdraw when asked to prove that it is genuine and how they obtained it. Not good at all.

    --
    Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
  13. Re:Now we know where the moral compass is pointing by Harlequin80 · · Score: 5, Insightful

    This guy was charged with accessing and possession, not creation. If he had been a content creator then prosecution would not have been stopped.

    Lets put this a different way. Would you grant pardon to a person who viewed child porn if it meant you could catch someone who made it? It's the same as offering deals to a street drug dealer to catch their supplier.

  14. Re:Now we know where the moral compass is pointing by gweihir · · Score: 4, Interesting

    Exactly. Freedom always includes the freedom to do wrong and a realistic chance to get away with it (depending on the magnitude of the crime). I believe freedom is of critical importance and the only purpose of law-enforcement is to keep crime at a level that society continues to function reasonably well. They are clearly not doing that, or the banksters would all be in prison now for a long, long time. Nobody on recent memory did this much damage to society and individuals.

    --
    Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
  15. Re:Deploy malware? by Ramze · · Score: 4, Insightful

    Good catch! You're right. It instead has NoScript installed, but not even configured properly.

    I'm frankly surprised anyone there would even argue to leave it on. Better to have a web site break than have a malicious site track you when the purpose of using it is to NOT be tracked.

  16. To avoid public scrutiny by Anonymous Coward · · Score: 5, Informative

    https://arstechnica.com/tech-policy/2015/04/fbi-would-rather-prosecutors-drop-cases-than-disclose-stingray-details/ April 7, 2015

    The FBI actually has a policy to drop cases instead of revealing their detection (spying) methods, to avoid public scrutiny of what they're doing.

    The new document, which was released Tuesday by the New York Civil Liberties Union (NYCLU) in response to its March 2015 victory in a lawsuit filed against the Erie County Sheriff’s Office (ECSO) in Northwestern New York, includes this paragraph: "In order to ensure that such wireless collection equipment/technology continues to be available for use by the law enforcement community, the equipment/technology and any information related to its functions, operation and use shall be protected from potential compromise by precluding disclosure of this information to the public in any manner including but not limited to: press releases, in court documents, during judicial hearings, or during other public forums or proceedings."

    That has to do with their 'Stingray' technology, but I'm sure it applies to any kind of digital surveillance.

    Besides, if they didn't drop the case the court would have probably ruled against them, like what happened in a case that slashdot mentioned last year: https://yro.slashdot.org/story/16/07/13/0411255/us-judge-throws-out-cell-phone-stingray-evidence-for-the-first-time

  17. It would be interesting to see the tipping point by mykepredko · · Score: 5, Interesting

    Where is the point where the crime is so egregious that the FBI is willing to publish the exploit? I presume their keeping the exploit secret because once it's known, it will be fixed and they will no longer be able to monitor the "deep, dark, black, web"?

    What if there was a terrorist attack and the FBI knew about it and sat on it because they thought the expected value of the property and lives lost was less than the value of the exploit and the intelligence received from it?

    Would the FBI (and the US government) be liable for damages because they could have prevented the crime?

  18. Think of the children... by GuB-42 · · Score: 4, Insightful

    It's funny how often child porn is used as a justification for more spying.
    But when actually dealing with child porn goes against more spying, well, fuck children, literally.

  19. Re:Now we know where the moral compass is pointing by ShanghaiBill · · Score: 4, Informative

    Uhh there was one busted in Australia not too long ago who was raping, torturing, and murdering kids on a private darknet PPV.

    Peter Scully. He is accused of murdering one girl, but he didn't film it. The things he did film were horrific, but did not include any killings. So no "snuff film".

  20. Odd by Archfeld · · Score: 4, Interesting

    Should the FBI have the ability to not prosecute in a child porn case ? In California there are several types of cases that failure to pursue result in criminal liabilities for the prosecutor's, among them spousal abuse, child abuse, child porn. It is one thing to lack the evidence or documentation to pursue, or to continue to investigate but to dismiss with jeopardy attached should be a crime in itself.

    --
    errr....umm...*whooosh* *whoosh* Is this thing on ?
  21. Re:It would be interesting to see the tipping poin by AmiMoJo · · Score: 5, Interesting

    There is another explanation. They might not want to release it because it might not stand up in court. If it gives them the ability to run arbitrary code on the target machine, if they can places files on that machine, the defendant will claim that the FBI planted those images. I'm no expert on US law but it seems like there would be some issue with the evidence being tainted too, and then everything else i s fruit of the poisoned tree.

    --
    const int one = 65536; (Silvermoon, Texture.cs)
    SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
  22. Re:Now we know where the moral compass is pointing by AmiMoJo · · Score: 4, Interesting

    Even better would be to stop the victimization happening in the first place. The only way to do that, which was suggested in the UK recently and shot down by the majority of reactionary commentators, is to decriminalize viewing such images. Instead focus on helping people who feel attracted to children to get help, discreetly and without threat of prosecution or persecution, to prevent the future crimes they might otherwise commit.

    In the current atmosphere, if someone did feel that way, what are the chances they would go to their doctor and ask for help with a mental illness? No, more likely they will turn to the internet, where there are sites normalizing and justifying their feelings and where the community of fellow paedophiles will accept them.

    The way to protect children is not to catch the offender after they already hurt them, it's to stop them breaking the law in the first place.

    --
    const int one = 65536; (Silvermoon, Texture.cs)
    SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC