Odd man out

[Mirrorshades]

Originally Posted by 2425

Relax my brother. Maybe you have got a few flames against you but how could you not expect it? People are just being careful and if you are who you say you are then you should understand that.

I have no problem with people being skeptical; skepticism is good. It would just have been nice if people would have done a little research of their own before losing it entirely, hurling baseless accusations and, perhaps most importantly, calling for me to be silenced on that basis.

The other poster did raise some good points, he just could have been a little more diplomatic about it. He could have asked, why should we trust these links? Why should we trust the Tor project? These would have been perfectly legitimate questions, and I would not take umbrage in the slightest if someone had asked these.

All I can do is tell you why I trust the project; people can either accept or reject my reasons as they will. Conspiracy theories abound on the Net, they're literally a dime-a-dozen.

There are people who are convinced that the NSA has quantum computers and that they are capable of breaking every cryptographic system there is out there. (If they did have such resources, it would put the boots to just about every deployed system out there.)

There are others who are unshakeable in their belief that Phil Zimmermann (the creator of PGP) put a backdoor into later versions as the quid-pro-quo for the U.S. government dropping its investigation of him, over the export of cryptographic code (i.e. PGP) without a license.

I think the investigation into Phil was dropped because the government saw the handwriting on the wall, namely that the legal precedent in the Bernstein case, that source code = speech, was going to be upheld, and this would have rendered the entire U.S. government's cryptographic export control regime unconstitutional. Rather than allow that to happen, they just dropped the investigation, and potential prosecution against Phil.

Originally Posted by 2425

As far stating that you proved something (documented) I dont see it that way. You have belief in it some people dont. Oh well. Thanks for your input.

Tor is an open source project; anyone who wishes to can download the source code and examine it for themselves. If Tor did, in fact, contain malware or served as a honeypot, I think this would have come out long before now. Furthermore, I don't think that the Tor Project would have been funded by the Electronic Frontier Foundation (EFF), nor Amnesty International, if it were not legitimate.

The same goes for some of the other organizations recommending/using Tor: Reporters Sans Frontieres (Reporters Without Borders) to name but one.

In a talk given by Roger Dingledine and Jacob Appelbaum at the 28th Annual Chaos Communication Conference held from December 27th through December 30th, 2011 in Berlin, they described how dissidents in repressive regimes use Tor to protect themselves. Jacob Appelbaum related the following story:

I think that Syria is a particularly egregious example of a fascist state when it comes to the Internet. And in fact, you can look at an Internet connection in a country, and you can sort of tell in general how free the country might be in terms of terms of how people who govern the telecom infrastructure think that people should be, and effectively what regular people are free to do online. And Syria is an example of a place that is so incredibly bad for so many reasons, some of them are not public... I'd be happy to make some of them public right now.

One of them is that they actually record every single byte of traffic that goes in and out of the country... which sounds crazy until you remember that not a lot of people have Internet access. And with dedupliction, it is certainly the case that you can run a tcpdump on those links and record them, and it will not be a big deal. And I actually received some information from some people that built these systems, through a Mixmaster relay... And I mean I'd never received a serious email through an anonymous remailer before, which is pretty incredible.

What they seriously do, though, is record everything. So, just imagine everything you were doing is recorded... every phone call, every transaction, every email, all this stuff. One of the most critical components of a circumvention system then, is forward secrecy.

Does everybody understand forward secrecy? Raise your hand if you don't understand it. Ok, good... enough people don't.

In Tor, when you connect to a Tor relay, you generate a session key... that later if you were to steal the Tor relay, if you were to take it offline, and you were to break into it, it would not have that key anywhere anymore.

There's a long term identity key, and a short term session key that is generated. These are really, really important. It's a sort of oversimplification, but the point is, each connection has forward secrecy. So, when that connection is torn down, it's gone. That's a huge problem if you don't have forward secrecy in your protocol, and they record everything because what it means if you fucked up your protocol, and there are lots of people that have, and we'll talk about one of them in a second, if you do that, and they're recording this, they can retroactively go back, find people and kill them.

And, in Syria, at the Arab bloggers' meeting in Tunisia, we met a person who told us that they had friends who were cut up into little pieces and mailed to their families in boxes. One guy who posted on Facebook about how he was sick of the revolution -- not a pro-revolutionary statement -- sick of the revolution and he didn't like the the Assad government for the way they were handling it -- and a death squad came to his house and killed him. They shot him to death. That's what happening when you're not using these circumvention systems....

Reporters Sans Frontieres (Reporters Without Borders) has been recommending Tor for more than 3 years now. I don' think they'd do that, if they had any doubts about its' security or effectiveness.

I've seen academic papers, (details below) where the author bemoans the fact that the Naval Research Laboratory "lost control" of Tor; the author bemaons the fact that it could be used by criminals and terrorists.

Abstract

Onion routers were born about 10 years ago as a sort of blended military/research project. The main goal of it was the avoidance of traffic analysis (TA). TA is used in part to identify the remote IP addresses that a given host seeks to contact. This technique may have various purposes, from simple statistical analysis to illegal interception. In response, to protect personnel whose communications are being monitored by hostile forces, researchers from the US Naval Research Laboratory conceived a system, dubbed "Onion Routing", that eludes the above two operations.

In this author's opinion, the original “owners” of the project lost control of it. Software is freely available that enables anyone to utilize a network of onion routers. The result is a strong evolution (in terms of “privacy”) that is very difficult to manage, especially when an international investigation must be performed

Keywords: Onion routing; Antiforensic; Anonymizers; Privacy; Security; Network investigation; Log files analysis; Traffic analysis; Network intelligence; Digital forensics

Digital Investigation, Volume 3, Issue 2, June 2006, Pages 85-88

Author profile:

Dario Forte, CFE, CISM, is adjunct Professor of Digital Forensic and Incident Response at University of Milano, Crema Research Center, where he is also responsible of the Italian chapter of the Honeynet Research Alliance. Former Police Officer, Dario is in the editorial board of advisors of Elsevier's Network Security and DI. He is also founder and CEO of DFLabs, an Italian company specialized in Incident Response and Digital Forensic (www.dflabs.com). The author acknowledges Eoghan Casey for his support during the editing/review phase of this article.

Source: Advances in Onion Routing: Description and backtracing/investigation problems 10.1016/j.diin.2006.04.007 : Digital Investigation | ScienceDirect.com

To read this article will set you back a cool $31.50, if you wish to purchase a copy from Elsevier publishing. However, you can see a .pdf copy of this article at Cryptome.org, at the following URL:

http://cryptome.org/isp-spy/TOR-spy.pdf

Originally Posted by 2425

Oh yeah as far someone saying ban your IP address dont insult them cause there not as technically savvy as you....besides we both know its fairly easy spoofing your ip address with vpn so why even mention static IP's if you are so intelligent?

I was responding to some of his digs with one of my own.

Now, on the subject of VPNs, I've been looking into those due the particular political circumstances in this country (more on that below). When you boil it down, VPNs are essentially a one-hop, encrypted proxy.

VPNs are perfectly fine for hiding one's activities from non-state actors. However, anyone who believes that employing a VPN to conceal their activities from law enforcement is going to protect them is deluded. This was most recently demonstrated in the case of two members of Anonymous. One (or both) unwisely admitted, in an IRC chat, to using HideMyAss.com, a U.K. VPN provider.

Within a day or two of that admission, HideMyAss was presented with an order from a U.K. court to reveal the identities of the two alleged members of Anonymous. Once unmasked, they were quickly scooped up by the FBI.

Mirrorshades

[2425]

Originally Posted by Mirrorshades

I have no problem with people being skeptical; skepticism is good. It would just have been nice if people would have done a little research of their own before losing it entirely, hurling baseless accusations and, perhaps most importantly, calling for me to be silenced on that basis.

The other poster did raise some good points, he just could have been a little more diplomatic about it. He could have asked, why should we trust these links? Why should we trust the Tor project? These would have been perfectly legitimate questions, and I would not take umbrage in the slightest if someone had asked these.

All I can do is tell you why I trust the project; people can either accept or reject my reasons as they will. Conspiracy theories abound on the Net, they're literally a dime-a-dozen.

There are people who are convinced that the NSA has quantum computers and that they are capable of breaking every cryptographic system there is out there. (If they did have such resources, it would put the boots to just about every deployed system out there.)

There are others who are unshakeable in their belief that Phil Zimmermann (the creator of PGP) put a backdoor into later versions as the quid-pro-quo for the U.S. government dropping its investigation of him, over the export of cryptographic code (i.e. PGP) without a license.

I think the investigation into Phil was dropped because the government saw the handwriting on the wall, namely that the legal precedent in the Bernstein case, that source code = speech, was going to be upheld, and this would have rendered the entire U.S. government's cryptographic export control regime unconstitutional. Rather than allow that to happen, they just dropped the investigation, and potential prosecution against Phil.



Tor is an open source project; anyone who wishes to can download the source code and examine it for themselves. If Tor did, in fact, contain malware or served as a honeypot, I think this would have come out long before now. Furthermore, I don't think that the Tor Project would have been funded by the Electronic Frontier Foundation (EFF), nor Amnesty International, if it were not legitimate.

The same goes for some of the other organizations recommending/using Tor: Reporters Sans Frontieres (Reporters Without Borders) to name but one.

In a talk given by Roger Dingledine and Jacob Appelbaum at the 28th Annual Chaos Communication Conference held from December 27th through December 30th, 2011 in Berlin, they described how dissidents in repressive regimes use Tor to protect themselves. Jacob Appelbaum related the following story:



Reporters Sans Frontieres (Reporters Without Borders) has been recommending Tor for more than 3 years now. I don' think they'd do that, if they had any doubts about its' security or effectiveness.

I've seen academic papers, (details below) where the author bemoans the fact that the Naval Research Laboratory "lost control" of Tor; the author bemaons the fact that it could be used by criminals and terrorists.



Source: Advances in Onion Routing: Description and backtracing/investigation problems 10.1016/j.diin.2006.04.007 : Digital Investigation | ScienceDirect.com

To read this article will set you back a cool $31.50, if you wish to purchase a copy from Elsevier publishing. However, you can see a .pdf copy of this article at Cryptome.org, at the following URL:

http://cryptome.org/isp-spy/TOR-spy.pdf




I was responding to some of his digs with one of my own.

Now, on the subject of VPNs, I've been looking into those due the particular political circumstances in this country (more on that below). When you boil it down, VPNs are essentially a one-hop, encrypted proxy.

VPNs are perfectly fine for hiding one's activities from non-state actors. However, anyone who believes that employing a VPN to conceal their activities from law enforcement is going to protect them is deluded. This was most recently demonstrated in the case of two members of Anonymous. One (or both) unwisely admitted, in an IRC chat, to using HideMyAss.com, a U.K. VPN provider.

Within a day or two of that admission, HideMyAss was presented with an order from a U.K. court to reveal the identities of the two alleged members of Anonymous. Once unmasked, they were quickly scooped up by the FBI.

Mirrorshades

Good post my man. As far as vpn I mean from getting banned from the board I dont think people on here could find you. Also I employ my own vpn techniques I would never trust someone who writes code to help you hide (never trust a thief) LOL! Later my brother and thanks for the informative post.

[prime]

How does Hidemyass work for torrents? Do they kneel down and suck the mpaa when they want identities? Are there any vpns that don't keep logs?

[2425]

Originally Posted by prime

How does Hidemyass work for torrents? Do they kneel down and suck the mpaa when they want identities? Are there any vpns that don't keep logs?

As far as I am concerned if your relying on someone else to hide you then you can be found. The FBI leans on anybody there going to get the info they want.

[prime]

Originally Posted by 2425

As far as I am concerned if your relying on someone else to hide you then you can be found. The FBI leans on anybody there going to get the info they want.

Yeah..but isn't the business model of hma to hide you? Or does that mean, hide you except from the popo.

[2425]

Originally Posted by prime

Yeah..but isn't the business model of hma to hide you? Or does that mean, hide you except from the popo.

"Except" is my opinion yes. I can speak from experience without giving details they will find you if they want to. Were small fish nobody wants to find us but if they did and you used any of those services they would still find you. I am in IT everything is I do is safely and thinking worst case scenario. The way I look at if you install something that someone gives do you really know what your installing? What its placing on your machine and who can track you and what can they get? I wouldnt buy speakers from the guy selling em in the parking lot either if you know what I mean LOL. Whatever I do is on my own I have no one to blame but myself if I am careless. Trust is hard to find on the internet thats all I can tell you.

[imajica]

Originally Posted by 2425

"Except" is my opinion yes. I can speak from experience without giving details they will find you if they want to. Were small fish nobody wants to find us but if they did and you used any of those services they would still find you. I am in IT everything is I do is safely and thinking worst case scenario. The way I look at if you install something that someone gives do you really know what your installing? What its placing on your machine and who can track you and what can they get? I wouldnt buy speakers from the guy selling em in the parking lot either if you know what I mean LOL. Whatever I do is on my own I have no one to blame but myself if I am careless. Trust is hard to find on the internet thats all I can tell you.

Agreed.

[Mirrorshades]

Originally Posted by prime

How does Hidemyass work for torrents? Do they kneel down and suck the mpaa when they want identities? Are there any vpns that don't keep logs?

I don't know if HideMyAss works for torrents or not, offhand. One of the Torrentfreak articles linked-to below might give you a better idea, however.

Are there any VPNs that don't keep logs? I very sincerely doubt it.

The main point to remember here is: No provider is going to defy a court order issued in their jurisdiction.

Whether there is room for the provider to fight any such order or not depends on the individual circumstances. Now mind, I'm not a lawyer, I'm not even an American, but my layman's understanding of U.S. law is this: a subpoena can be fought in court, a search warrant cannot.

To take one example, Google fought an attempt by then-Attorney General Alberto Gonzales to subpoena Google for massive amounts of information about their users, in particular, which users searched for pornography. Google fought that subpoena in court, and won.

Sometime last year, there were a series of animated cartoons posted to Youtube and elsewhere, created by an allegedly disgruntled Renton, Washington police officer, using the handle "Mr. Fiddlesticks". These cartoons lampooned the force, and aired quite a bit of their dirty laundry, including officers' actions investigated by Internal Affairs. The police chief responded by attempting to have the videos taken down, which led to their being spread all over the net. Next, the chief arranged for a judge to rubber-stamp an search warrant ordering Google to hand over the information associated with the GMail account, MrFiddlesticks@gmail.com.

Google was unable to fight this, as it was a search warrant; if it had been a subpoena, Google would no doubt have attempted to fight this in court. However, because it was a search warrant, they had no option but to comply with the order. Unfortunately for the chief, in the final analysis, the IP address turned out to be that of a hotspot, so the trail was a dead-end.

Twitter is another example of a company that will fight for its users. In its investigation of the Wikileaks affair, the DOJ attempted to subpoena Twitter for information held by Twitter about five users: Birgitta Jonsdottir, Ron Gonggrijp, Jacob Appelbaum, Bradley Manning and Julian Assange. The final ruling was just handed down the other day, and Twitter lost. (The court case had been ongoing for about a year.)

Not many companies will go to these lengths to protect their users' privacy. Unfortunately, many of them will roll-over on you at the first flash of a badge.

Now, as far as VPNs and logs are concerned, let me tell you a little (true) story in that regard. Several years back, the FBI, Interpol and the Australian police busted-up a kiddie porn ring. About 22 of the 60-odd members were arrested. All those arrested had one thing in common (aside from indulging in kiddie porn) -- they were all customers of a VPN service called Privacy.Li.

Privacy.Li stated that they "kept NO logs" and that they were located outside of U.S. jurisdiction. When push came to shove, their 'privacy' provider rolled-over on them.
Moral of the story: I wouldn't count on any VPN if I were doing something illegal.

Now, you could argue (and you would be completely correct) that child pornography is a heinous crime -- no argument with you there. You could also argue that copyright infringement is a purely civil matter -- in the past, I would have agreed with you.

However, over the past number of years, the situation has become more nebulous. In some circumstances at least copyright infringement can now be deemed a criminal offense. The RIAA/MPAA have pushed hard for this, as it transfers the cost of enforcement from their own pockets to that of the public (courtesy of law enforcement.)

Using a VPN may provide you with protection, but there are absolutely NO guarantees. Furthermore, to complicate things. a lot depends on where you live. In the United States some judicial circuits have proven more receptive to these massive sue-em-all "John Doe" suits than others.

In Canada, several years back, the Federal Court threw out a number of suits brought by rightsholders against alleged copyright infringers where the sole data were the IP addresses of the alleged offenders. I seem to recall that these suits were thrown out on the basis that the IP addresses alone were not sufficient evidence to proceed.

Last year, in 2011, some suits have been filed against alleged infringers, for allegedly pirating the film, The Hurt Locker. I'm not sure what led to the change in policy, whether it was a change in the law, or a higher court ruling. Previously, Canadians had been largely immune from such suits as were common in U.S. courts-- this does not appear to be the case any longer.

Possibly as a result of those Federal Court rulings a few years back, the government in Canada, sometime in the next six months or so, will introduce their so-called "lawful access" legislation. The justification trotted out by the government for this appalling legislation is (as is to be expected) child pornography and organized crime.

Under current legislation, a Canadian ISP can voluntarily hand over a customer's information on request; this is frequently done in cases of child exploitation. If, for whatever reason, the ISP refuses to hand over the information, the police have to get a court order. After lawful access is passed, the ISP will be required to hand over the customer's information, on request.

What this means is that given a customer's IP address, the police will be able to demand the customer's: real name, address, phone number, email address and a boatload of other information. ISPs will also be permitted (as opposed to required) to hand the same information over to private investigators.

What this means is that any Canadian Internet user will be able to be unmasked by the authorities more or less at will. (This may be the final nail in the coffin for Hushmail.)

Finally, you might wish to hav a look at the following TorrentFreak articles:

Which VPN Providers Really Take Anonymity Seriously?

Last month it became apparent that not all VPN providers live up to their marketing after an alleged member of Lulzsec was tracked down after using a supposedly anonymous service from HideMyAss. We wanted to know which VPN providers take privacy extremely seriously so we asked many of the leading providers two very straightforward questions. Their responses will be of interest to anyone concerned with anonymity issues.

https://torrentfreak.com/which-vpn-p...iously-111007/


VPN Providers Mull ‘Fraudster’ Database In Wake of Lulzec Fiasco

Last month it became clear that an alleged Lulzsec member who had carried out attacks on various organizations including Sony and the UK’s Serious Organised Crime Agency, had used an ‘anonymous’ VPN service supplied by HideMyAss. According to documents obtained by TorrentFreak, VPN providers worried by the bad publicity are now considering data sharing to combat ‘fraudsters’.

https://torrentfreak.com/vpn-provide...fiasco-111006/


What’s The Best VPN / Proxy for BitTorrent?

Privacy is important on the Internet, and BitTorrent users are certainly not excluded. Already, hundreds of thousands of BitTorrent users have decided to hide their IP-address to the public, and more are joining every day. Some use specialized BitTorrent proxies and VPNs like BTGuard, but there are many other options. Unfortunately, however, not all VPNs [...]

https://torrentfreak.com/best-vpn-pr...orrent-110618/

Mirrorshades

[Mirrorshades]

Originally Posted by 2425

As far as I am concerned if your relying on someone else to hide you then you can be found. The FBI leans on anybody there going to get the info they want.

I disagree. I would argue that the evidence actually leads to the opposite conclusion, that is, if one employs the appropriate tools, that even the FBI will be powerless to locate you. As evidence, I would point to two of the largest child pornography investigations in recent years; in both cases, the majority of the perpetrators remain at large, the FBI (and/or other police forces) having failed to locate them.

As I alluded to in another post, in the first case, (the one I have the most documents for) out of some 60-odd members, only 22 were ever located and arrested. (All of the 22 apprehended were convicted, and are currently serving time -- the other 40 or so are still at large.)

In this case, the alleged ringleader re-appeared about a year after the busts, and tried to explain what went down. In particular, they stated that everyone who used a VPN (Privacy.Li) was apprehended, those who used Tor and/or Anonymous remailers remained free.

The second case involved something called "Dreamboard" -- according to the Wikipedia entry for "Operation Delego":

Operation Delego[1] is a major international law enforcement [2] investigation which dismantled an international pedophile ring that operated an invitation-only Internet site named Dreamboard .... Only 72 charges were filed against the approximately 600 members of Dreamboard due to the extensive encryption involved

I think it can be reasonably argued that:

1) In child pornography/child exploitation cases, police officers are understandably highly motivated to do everything in their power to apprehend the perps and rescue the kids;

2) International cooperation is a given -- there are no 'safe harbors' when it comes to this type of crime.

3) Resources are not an issue -- whatever is needed in the way of money, manpower and equipment is expended to get results.

Notwithstanding all the foregoing, only a fraction of the perpetrators can be identified, located and apprehended.

Mirrorshades

[ApC]

Originally Posted by Mirrorshades

I disagree. I would argue that the evidence actually leads to the opposite conclusion, that is, if one employs the appropriate tools, that even the FBI will be powerless to locate you. As evidence, I would point to two of the largest child pornography investigations in recent years; in both cases, the majority of the perpetrators remain at large, the FBI (and/or other police forces) having failed to locate them.

As I alluded to in another post, in the first case, (the one I have the most documents for) out of some 60-odd members, only 22 were ever located and arrested. (All of the 22 apprehended were convicted, and are currently serving time -- the other 40 or so are still at large.)

In this case, the alleged ringleader re-appeared about a year after the busts, and tried to explain what went down. In particular, they stated that everyone who used a VPN (Privacy.Li) was apprehended, those who used Tor and/or Anonymous remailers remained free.

The second case involved something called "Dreamboard" -- according to the Wikipedia entry for "Operation Delego":



I think it can be reasonably argued that:

1) In child pornography/child exploitation cases, police officers are understandably highly motivated to do everything in their power to apprehend the perps and rescue the kids;

2) International cooperation is a given -- there are no 'safe harbors' when it comes to this type of crime.

3) Resources are not an issue -- whatever is needed in the way of money, manpower and equipment is expended to get results.

Notwithstanding all the foregoing, only a fraction of the perpetrators can be identified, located and apprehended.

Mirrorshades

thanks bro every much

[2425]

Originally Posted by Mirrorshades

I disagree. I would argue that the evidence actually leads to the opposite conclusion, that is, if one employs the appropriate tools, that even the FBI will be powerless to locate you. As evidence, I would point to two of the largest child pornography investigations in recent years; in both cases, the majority of the perpetrators remain at large, the FBI (and/or other police forces) having failed to locate them.

As I alluded to in another post, in the first case, (the one I have the most documents for) out of some 60-odd members, only 22 were ever located and arrested. (All of the 22 apprehended were convicted, and are currently serving time -- the other 40 or so are still at large.)

In this case, the alleged ringleader re-appeared about a year after the busts, and tried to explain what went down. In particular, they stated that everyone who used a VPN (Privacy.Li) was apprehended, those who used Tor and/or Anonymous remailers remained free.

The second case involved something called "Dreamboard" -- according to the Wikipedia entry for "Operation Delego":



I think it can be reasonably argued that:

1) In child pornography/child exploitation cases, police officers are understandably highly motivated to do everything in their power to apprehend the perps and rescue the kids;

2) International cooperation is a given -- there are no 'safe harbors' when it comes to this type of crime.

3) Resources are not an issue -- whatever is needed in the way of money, manpower and equipment is expended to get results.

Notwithstanding all the foregoing, only a fraction of the perpetrators can be identified, located and apprehended.

Mirrorshades

Good info bro thanks. I find alot of people that do not want to be caught do not even us their own ISP. I think most of us who know very little could break wireless security. Probably the best way not to get caught. Not that I have ever done it (fingers crosssed LOL). Obviously no where near your own house.

[Mirrorshades]

Originally Posted by 2425

Good info bro thanks.

You're welcome.

Originally Posted by 2425

I find alot of people that do not want to be caught do
not even us their own ISP. I think most of us who know very little could
break wireless security. Probably the best way not to get caught. Not that
I have ever done it (fingers crosssed LOL). Obviously no where near your
own house.

With all due respect, this is extremely bad advice, for three separate reasons:

1) Such measures are generally NOT necessary, unless you are already under surveillance, or you are at high risk of being surveilled (e.g. your friends/colleagues/associates are already being investigated); and

2) Unauthorized use of a WiFi connection is considered in many jurisdictions as a computer crime in and of itself; and

3) If not carried out properly, you increase the risk of your activities being detected,

See some examples below, as the end of my post.

At the risk of being repetitive, I once again have to return to the superb research carried out by Christopher Seghoian, whom I have written about elsewhere. Some of the documents Mr. Soghoian has obtained through his numerous Freedom of Information Act (FOIA) requests, are quite illuminating.

He discusses his research in the following presentation from Defcon 2010, which can be viewed at YouTube: https://www.youtube.com/watch?v=jJDCxzKmROY

In a nutshell, his findings are as follows:

The vast majority (86%) of wiretaps are for narcotics offenses:

Major offense specified in intercept orders (2009)

Arson, explosives, and weapons 18

Bribery 2

Extortion (includes urury and loan-sharking) 3

Gambling 35

Homicide and assault 82

Larceny and theft 35

Narcotics 2,046

Robbery and burglary 9

Racketeering 61

Other or unspecified 85


Total 2,376

Mr. Soghoian points out several things:

1) That these types of wiretaps require what is referred to as a 'super warrant' -- the police must have probable cause to show that a crime has been committed plus they must also be able to demonstrate that other methods to obtain the information they are seeking have been tried and failed; and

2) That most of the requests come from two states: New York and California. Both states have task forces of officers who are specially trained to apply for and obtian these warrants. Primarily, these officers operate out of special units in New York, LA and San Francisco.

3) Surveillance of phones continues to increase every year, primarily due to the States. Surveillance of computers is effectively nil. In 2009, 95% of all intercept orders were for a portable device. Electronic intercepts (i.e. computers) for 2009 account for something like 5-10 a year combined for both Federal and State.

4) Mr. Seghoian askes the question, "Why are there no network wiretaps?" He points out that it is easier for law enforcement to access stored communications such as email, search queries, and the like. As he says,

"Why tap your ISP in real-time when your email provider will readily give up the files later?"

Look at it from a law enforcement perspective:

Real time electronic surveillance:

- Expensive -- requires leased line to ISP datacentre

- Hard to get -- requires complicated 'super warrant'; only available if all other methods have failed.

- Requires scarce resouces -- requires specialized equipment/expertise to sift though gigabytes of TCP traffic; (in technical terms, a tcpdump.)

Why bother with all that, when:

- Email is easy to get -- under the Electronic Communictions Privacy Act (ECPA) and the Stored Communications Act (SCA) email 180 days old or less requires ony a warrant to access; email 181 days old (or older) can be handed over on request.

- Traffic analysis information/Pen Register info, i.e. who you've been communicating with, requires only that the information have "relevance to an ongoing investigation".

Pen register info includes:

- IP headers

- To/From: for email

- Phone numbers dialed

- In some cases, URLs visited

- Real-time geo-location data (when accompaned by an 18 USC 2703(d) order.


When you think about it, from a law enforcement perpective, email is a bonanza, the motherlode, when it comes to information:

- Email(s) are written by the suspects themselves; essentially, emails containing incriminating information are, for all intents and purposes, a confession.

- They are conveniently indexed by Subject: line

- They each bear a time/date stamp, so there is never any doubt about the order of events, or when precisely when something was said


So, realistically, they don't lose very much by not monitoring your communications in real-time.


Now Let me cite some examples of how people have been apprehended for using other people's WiFi:

Case #1:

A Michigan man has been fined $400 and given 40 hours of community service for accessing an open wireless Internet connection outside a coffee shop.

Under a little known state law against computer hackers, Sam Peterson II, of Cedar Springs, Mich., faced a felony charge after cops found him on March 27 sitting in front of the Re-Union Street Café in Sparta, Mich., surfing the Web from his brand-new laptop.

Last week, Peterson chose to pay the fine instead as part of a jail-diversion program....

Michigan Man Fined for Using Coffee Shop's Wi-Fi Network | Fox News

This man was on his lunch hour, checking his email -- he was not involved in anything remotely illegal. If here were involved in anything remotely illegal, it would have been discovered in relatively short order, as his computer would hve been searched pursuant to the investigation into his 'offense'.

Essentially what happened here was that the man had done the same thing for about a week, i.e. parking in front of the coffee shop to check his email.

Peterson stated there was no request for a password, there was no indication that the network was anything but free and open. What Peterson could not possibly have known was that the local police were on the lookout for an online stalker, whose victim was a local hairdresser, so when police got a call from the barber shop across the street, citing suspicious behavior, they acted on it.

If Mr. Peterson had been a customer of the coffee shop, the police would not have had justification to lay charges. That said, because they were investigating a case of online stalking, that may have provided them with legal justification to search his computer. Please remember: currently, in many states, in an interpretation of the so-called "plain sight" rule, a suspect's electronic devices may be liable to search and/or seizure.

This is been done in some jurisdictions even pursuant to something as innocuous as a traffic stop. (Another reason, as if any is needed, why carrying a smartphone is a bad idea.)

ACLU: Michigan Police Stealing Cell Phone Info
Saturday, 23 Apr 2011 01:29 PM
By Martin Gould

Michigan state police have been stealing information from cell phones during routine traffic stops, a complaint alleges. Officers can even tell where a person has been, with information they can grab from location devices, according to Popular Mechanics.

Email, call logs, photos, contacts and posts on Facebook and Twitter can also be grabbed, according to an April 13 letter from the ACLU to the state police. Such action would violate the Fourth Amendment, the group says.

The Michigan State Police force has several forensic cell phone analyzers, including a handheld forensic system called the Cellubrite UFED that can bypass passwords to seize just about any data, according to the ACLU.

Source: ACLU: Michigan Police Stealing Cell Phone Info

Case #2: A man is spotted for a few nights in a row, parked on a street. He is observed sitting in his car, due to the illumination from his laptop screen. Given the lateness of the hour, neighbors presumed he was up to no good, and called the police.

Police respond to the complaint, and the man is ultimately charged with unauthorized access to a computer network.


Case #3: Man in Japan is accused of hacking into his company's network

An apparent disgruntled employee was arrested for hacking into his company's network. Apparently, he made the mistake of going to the local McDonald's, where he used their WiFi, and paid for his Big Mac with his credit card. His employers were able to tie the times of the hack to the times he spent at the McDonald's. Furthermore, his credit card confirmed the fact that he had eaten there, and the date/time of the purchase were recorded, and as the final nail in his particular coffin, he was recorded on surveillance camera in the store.

Needless to say, this was/is the wrong way to go about it.

If you wish to stay below the radar of both the police and the public, you have to observe a fundamental principle -- you have to blend-in -- you have to avoid attracting attention to yourself.

It is possible to use WiFi safely and anonymously -- the case of the disgruntled cop from the Renton Washington force who used he handle "Mr. Fiddlesticks" proves this. In his particular case, using a public WiFi hotspot was a necessity -- because he knew that as a member of the force, his home Internet connection might be monitored, so he had to make sure that there was nothing that could possibly point back to him, if investigated.

Moral of the story: If you mustuse a hotspot, preferably make use of one far away from home/work, pay for your coffee/meal in cash and wear a hat to help foil surveillance cameras.

Mirrorshades

[ApC]

Originally Posted by Mirrorshades

I'd suggest two things:


Remember, TorMail is anonymous; it is NOT private unless you use PGP/GPG.


Mirrorshades

ok what is the differences between PGP/GPG vs GnuPG what would you prefer