To Keep TOR Hack Source Code Secret, DOJ Dismisses Child Pr0n Case

[Zarathustra[H]]

As we have reported on in the past, the FBI has successfully compromised TOR, the service used to anonymously browse the internet, and access the so-called "dark net." As part of the case against one of the suspects arrested on child pr0n charges in 2015, a Judge ordered the DOJ to disclose the details of how TOR was compromised. The problem here is apparently that the TOR exploit has been classified, and the prosecutor in the case does not have the authority to disclose the methods, and has been forced to dismiss all charges.

"The government must now choose between disclosure of classified information and dismissal of its indictment," Annette Hayes, a federal prosecutor, wrote in a court filing on Friday. "Disclosure is not currently an option. Dismissal without prejudice leaves open the possibility that the government could bring new charges should there come a time within the statute of limitations when and the government be in a position to provide the requested discovery."

 

[nightfly]

No problem, as long as there's some way for the public to know who was arrested for it. Public knowledge that he's a child pornographer will do the rest.

 

[Darunion]

I don't think this person will be very reachable by the time they want to prosecute him again. I feel like hes going to vanish to some tropical island lol.

 

[Gman1979]

I feel so much safer now knowing they'll turn a real piece of shit like the defendant loose just to avoid abiding by laws regarding evidence whenever the FBI feels like it.

 

[RogueTadhg]

I don't think this person will be very reachable by the time they want to prosecute him again. I feel like hes going to vanish to some tropical island lol.

"Vanish" is probably the best, nicest term to say.

 

[Ultima99]

No problem, as long as there's some way for the public to know who was arrested for it. Public knowledge that he's a child pornographer will do the rest.

While he's very likely a scumbag, you're suggesting mob violence that subverts the US Constitution which states the accused must stand trial and be found guilty before being punished. Yeah that's a scary precedent to set. Might as well have Rosie O'Donnell calling for military coup to prevent the peaceful transfer of power to a democratically elected president. Oh wait....

 

[NeghVar]

Now, how long before the FBI is hacked and that classified exploit is made public?

 

[lilbabycat]

I feel so much safer now knowing they'll turn a real piece of shit like the defendant loose just to avoid abiding by laws regarding evidence whenever the FBI feels like it.

Their argument is that their secrets are helping to catch many more of them now and in the future. And child pornography, as bad it is; is likely low on their priorities. Actual human trafficking, large scale drugs, money laundering, having a way to securely order hookers+blow for their top brass, etc.

 

[Deleted member 93354]

At the end of the day these guy will likely try again. LEO/FBI will be watching and find a more legal full proof way of catching him. Trust me, he's already on a close watch list.

That said, disclosure requires the prosecution to reveal the source of their information. Therefore they have a right to disseminate code out to make sure there were no errors in pointing to him as the perp. Sometimes the bad people do slip through the system as a result.

 

[lcpiper]

Now, how long before the FBI is hacked and that classified exploit is made public?

Even if the methods are made public, it doesn't mean that others can secure the resources needed to make the vulnerability possible to exploit. Sometimes they have things that the rest of the world simply can't have.

 

[PaulP]

No problem, as long as there's some way for the public to know who was arrested for it. Public knowledge that he's a child pornographer will do the rest.

Sure, who needs the rule of law and "innocent until proven guilty in a court of law" when we can have old fashioned mob justice? After all, the mob has proven to be so reliable and discriminating in the past. /sarc

 

[Deleted member 93354]

Even if the methods are made public, it doesn't mean that others can secure the resources needed to make the vulnerability possible to exploit. Sometimes they have things that the rest of the world simply can't have.

Brute force attacks on secure keys using a known set of subsets which reduce the possible number of keys you have to test.

OR

Putting up enough TOR points that are malicious in nature to track said traffic. This attack was discovered a couple years ago. But you need a lot of machines to do it and to randomnize the IP's as TOR got wise to this and started banning lots of machines from a similar IP group.

 

[Dead Parrot]

Given the number of times folks on this forum have argued that IP address != to firm identity in media piracy cases, I am surprised at the number of folks now wanting to convict based on IP address.

It sucks that given the number of times the Government has used the argument, "Think of the Children!" when bending the Constitution, that they now are willing to let an accused child pornographer go in order to protect their methods. Makes you wonder what else they are doing with the technology in question.

 

[Gman1979]

Their argument is that their secrets are helping to catch many more of them now and in the future. And child pornography, as bad it is; is likely low on their priorities. Actual human trafficking, large scale drugs, money laundering, having a way to securely order hookers+blow for their top brass, etc.

If they hadn't paid for the exploit to begin with, I could possibly see that point. But the true reason they didn't want to have to present information about the exploit they used is due to the fact they paid criminals for the exploit. That in itself is supposedly illegal.

 

[Darunion]

Given the number of times folks on this forum have argued that IP address != to firm identity in media piracy cases, I am surprised at the number of folks now wanting to convict based on IP address.

It sucks that given the number of times the Government has used the argument, "Think of the Children!" when bending the Constitution, that they now are willing to let an accused child pornographer go in order to protect their methods. Makes you wonder what else they are doing with the technology in question.

When it comes to child pornography, the general public doesn't even want to waste time on trials, they just want to deal out cruel punishments. It is similarly to the old witch trials, as long as someone says someone else looked at child porn, the mob mentality is fine with burning them at the stake.

Which is why I am glad there are courts to handle these things and it isn't just handled like a lot of people want and just a public opinion based trial.

 

[CaptNumbNutz]

Given the number of times folks on this forum have argued that IP address != to firm identity in media piracy cases, I am surprised at the number of folks now wanting to convict based on IP address.

It sucks that given the number of times the Government has used the argument, "Think of the Children!" when bending the Constitution, that they now are willing to let an accused child pornographer go in order to protect their methods. Makes you wonder what else they are doing with the technology in question.

I'm sorry, but when they are fully capable of hacking the TOR network, the chances of them linking him to the crime solely by IP address are slim to none.

 

[Teenyman45]

At the end of the day these guy will likely try again. LEO/FBI will be watching and find a more legal full proof way of catching him. Trust me, he's already on a close watch list.

That said, disclosure requires the prosecution to reveal the source of their information. Therefore they have a right to disseminate code out to make sure there were no errors in pointing to him as the perp. Sometimes the bad people do slip through the system as a result.

Curious how much large volume stuff would be trusted on TOR. Silk Road, for example, was mainly retail dealer to retail user from everything that was written about it.

 

[MrCaffeineX]

Given the number of times folks on this forum have argued that IP address != to firm identity in media piracy cases, I am surprised at the number of folks now wanting to convict based on IP address.

It sucks that given the number of times the Government has used the argument, "Think of the Children!" when bending the Constitution, that they now are willing to let an accused child pornographer go in order to protect their methods. Makes you wonder what else they are doing with the technology in question.

I am not familiar enough with the specifics of this case, but in general, when a warrant is obtained using similar methods, the accused often has incriminating evidence discovered on their computer. I think that this hacking is sufficient to provide reasonable suspicion of the activity to warrant further investigation, but if this is the only evidence that the accused had viewed illegal pictures or videos, then it is pertinent to know the methodology of the hacking in order to identify the perpetrator beyond the shadow of doubt, which is necessary for a conviction. If the presentation of this methodology creates a reasonable doubt that the defendant was the perpetrator, it should be able to be used in their defense.

 

[Darunion]

I am not familiar enough with the specifics of this case, but in general, when a warrant is obtained using similar methods, the accused often has incriminating evidence discovered on their computer. I think that this hacking is sufficient to provide reasonable suspicion of the activity to warrant further investigation, but if this is the only evidence that the accused had viewed illegal pictures or videos, then it is pertinent to know the methodology of the hacking in order to identify the perpetrator beyond the shadow of doubt, which is necessary for a conviction. If the presentation of this methodology creates a reasonable doubt that the defendant was the perpetrator, it should be able to be used in their defense.

I kind of agree, it almost feels like the prosecutor was trying to take a shorter path with this to turn it over quicker but yea like you said they would have to reveal too much. Likely this will just turn into a warrant and investigation into his stuff (unless he has the opportunity to destroy evidence safely) which could turn up a ton or nothing.

 

[wizdum]

I am not familiar enough with the specifics of this case, but in general, when a warrant is obtained using similar methods, the accused often has incriminating evidence discovered on their computer. I think that this hacking is sufficient to provide reasonable suspicion of the activity to warrant further investigation, but if this is the only evidence that the accused had viewed illegal pictures or videos, then it is pertinent to know the methodology of the hacking in order to identify the perpetrator beyond the shadow of doubt, which is necessary for a conviction. If the presentation of this methodology creates a reasonable doubt that the defendant was the perpetrator, it should be able to be used in their defense.

I am blanking on the exact term (fruit of the poisoned tree? maybe?), but I believe in US law you cannot use evidence that was obtained illegally. So if the warrant was issued based on this hack that was thrown out, all the evidence gained from the warrant also has to be thrown out. This would be like the police breaking into someones house, and finding a pile of cocaine on their coffee table. If the judge asks the officers how they found the cocaine, they can't just say "we wont tell you (because we broke the law)" and have the evidence still count.

 

[scojer]

The dude is straight up guilty. Stupid technicality bullshit.

 

[Gman1979]

I almost forgot to add this bit of info. Their so called Tor attack was not what they made it out to be. They used a premade exploit to hack a server over Tor, the same way hackers do it over the clear net. The FBI then placed a javascript snippet into the pages being served on the site. The javascript essentially caused the computers loading the pages to send information including IP to a FBI controlled server.

Now the FBI are claiming they can't turn over the "magic" exploit without revealing too much information. The only information that needs to be revealed is they didn't do anything special at all. But they don't want to admit that to the point they have let 2 suspects go already. Most likely just to keep justifying increased budgets for fighting crime on TOR (which they keep using to try and weaken TOR, much to the anger of the Navy and other entities that created and make use of TOR in real intelligence applications).

 

[lcpiper]

The case is one of many brought forward from the FBI's investigation of dark web child pornography site Playpen.

https://motherboard.vice.com/en_us/article/the-fbi-is-classifying-its-tor-browser-exploit

This is all closely related to the Playpen case. The code that everyone is asking for is the code that the FBI called a "NIT". Of course, from a legal perspective, if you are the defense, and you know the Government won't give you this data a great move is to ask for it.

 

[nightfly]

While he's very likely a scumbag, you're suggesting mob violence that subverts the US Constitution which states the accused must stand trial and be found guilty before being punished. Yeah that's a scary precedent to set. Might as well have Rosie O'Donnell calling for military coup to prevent the peaceful transfer of power to a democratically elected president. Oh wait....

Sure, who needs the rule of law and "innocent until proven guilty in a court of law" when we can have old fashioned mob justice? After all, the mob has proven to be so reliable and discriminating in the past. /sarc

Just like you'd understand a husband wanting to kill the person who raped and killed his wife, you'll understand this: I was molested as a kid. It went on for years. This shouldn't happen. I managed to survive, but I've lived a very messed up life because of it.
If people are aware that this person was arrested, they'll be watching, and he'll have a hard time repeating what he did.
See, no one was looking for it. And things like this continue to happen today, because no one is paying attention to what's going on with their kids right in front of their eyes. Older children, relatives, 'friendly' neighbors/teachers/scoutmasters/priests/pastors/etc., are routinely given a pass around people's kids, and it's the kids who suffer for it. I'm not for stringing someone up without cause, but when you have someone like that in your neighborhood, wouldn't you want to know? Or do you want to let it happen to your kids? Because few parents ever find out that their kids were molested. Even when it's a sibling or relative who did the deed.

Your choice. Think about this next time you send your child out the door to school/church/soccer or somewhere that some other older person is in charge of your child. The number of kids who are sexually abused is high, much higher than you'd like to believe. As recent as 2000 (when I was working with pediatrics) one in four girls, and one in six boys was subject to some type of sexual contact with an adult. Average, ONE IN FIVE. While that may have decreased since then, I assure you that it has not disappeared. The number of children who later show up in therapy with substance abuse disorders stemming from being molested is still high.

So it's still going on. The catholic church is STILL covering up for their pedophiles. That's how bad this situation is. They cover for themselves. So when something is wrong, you have to do what you can to change things. Giving someone a get out of jail free card isn't the way to do it.

 

[sfsuphysics]

Not sure why it is the judge's business about how they managed to get info on the guy, simple answers, did you have a warrant? yes? the end.

 

[Ultima99]

Just like you'd understand a husband wanting to kill the person who raped and killed his wife, you'll understand this: I was molested as a kid. It went on for years. This shouldn't happen. I managed to survive, but I've lived a very messed up life because of it.
If people are aware that this person was arrested, they'll be watching, and he'll have a hard time repeating what he did.
See, no one was looking for it. And things like this continue to happen today, because no one is paying attention to what's going on with their kids right in front of their eyes. Older children, relatives, 'friendly' neighbors/teachers/scoutmasters/priests/pastors/etc., are routinely given a pass around people's kids, and it's the kids who suffer for it. I'm not for stringing someone up without cause, but when you have someone like that in your neighborhood, wouldn't you want to know? Or do you want to let it happen to your kids? Because few parents ever find out that their kids were molested. Even when it's a sibling or relative who did the deed.

Your choice. Think about this next time you send your child out the door to school/church/soccer or somewhere that some other older person is in charge of your child. The number of kids who are sexually abused is high, much higher than you'd like to believe. As recent as 2000 (when I was working with pediatrics) one in four girls, and one in six boys was subject to some type of sexual contact with an adult. Average, ONE IN FIVE. While that may have decreased since then, I assure you that it has not disappeared. The number of children who later show up in therapy with substance abuse disorders stemming from being molested is still high.

So it's still going on. The catholic church is STILL covering up for their pedophiles. That's how bad this situation is. They cover for themselves. So when something is wrong, you have to do what you can to change things. Giving someone a get out of jail free card isn't the way to do it.

It's true, there are bad people everywhere. Truly terrible things happens on a daily basis and it sucks. You don't have to try and convince me of that.

The concern is that even the good people in this world aren't perfect and make mistakes. Consider that our best estimates show that over 4% of people convicted of murder are actually innocent. Now consider that those people all got their day in court with evidence presented, witness testimony, forensic experts, and the right to an attorney yet were still wrongly convicted of murder and sentenced to death. Despite all the care we take with a judge, jury of your peers, courtroom and all the rest, yet our government has put who knows how many innocent people to death. Throw all that out the window and let the mob have its chance this guy is probably dead because you know they'll assume he's 110% guilty without any evidence just based on the arrest. You've already done it yourself.

This is why to be convicted of a crime in this country it must be "beyond a reasonable doubt". Duke lacrosse team. Anyone remember that? Yeah, false rape accusations where everybody rushed to judgement. Even with all charges dropped and their names cleared by authorities their lives and reputations have been altered forever.

On a related note, the business law class I'm in right now if very interesting.

 

[Ultima99]

Not sure why it is the judge's business about how they managed to get info on the guy, simple answers, did you have a warrant? yes? the end.

Uh, maybe because the judge wants to make sure the information is credible?

With all the crap the government is up to these days who wants to be on the wrong end of some judge going "Oh, well the FBI said so, so is cool."

Its just the same as why they can't just say you killed someone. They must prove that you did it with full and complete evidence. Some judges want to be certain when their court finds someone guilty, you know, like how the founding fathers intended?

 

[sfsuphysics]

Uh, maybe because the judge wants to make sure the information is credible?

With all the crap the government is up to these days who wants to be on the wrong end of some judge going "Oh, well the FBI said so, so is cool."

Its just the same as why they can't just say you killed someone. They must prove that you did it with full and complete evidence. Some judges want to be certain when their court finds someone guilty, you know, like how the founding fathers intended?

Oh bullshit, this isn't a matter of explaining biology to a judge and the remote possibility that they might actually understand it (or at least pretended like they do), this is a matter of deciphering supposed "cryptology" to find who someone is on the internet, no judge is going to understand all the technical details of this. FBI should have been like "we setup a honey hole, and made it so it wasn't anonymous why it seemed anonymous on the client side" and that should have been the end of it.

 

[dgz]

Oh bullshit, this isn't a matter of explaining biology to a judge and the remote possibility that they might actually understand it (or at least pretended like they do), this is a matter of deciphering supposed "cryptology" to find who someone is on the internet, no judge is going to understand all the technical details of this. FBI should have been like "we setup a honey hole, and made it so it wasn't anonymous why it seemed anonymous on the client side" and that should have been the end of it.

That's an elaborate way of saying you just want some blood to be spilled and move on with your life

 

[Ultima99]

Oh bullshit, this isn't a matter of explaining biology to a judge and the remote possibility that they might actually understand it (or at least pretended like they do), this is a matter of deciphering supposed "cryptology" to find who someone is on the internet, no judge is going to understand all the technical details of this. FBI should have been like "we setup a honey hole, and made it so it wasn't anonymous why it seemed anonymous on the client side" and that should have been the end of it.

How about I call bullshit on you and remind everyone of the Microsoft trial about IE where the judge took it upon himself to learn how to manually remove IE from a Windows system even though Microsoft tried to claim it was too well integrated into the OS and that it couldn't happen. Some judges give a shit and want to do their jobs well. They will go to great lengths to ensure that both the law and peoples rights are upheld.

Your move sir.

 

[MrCaffeineX]

I am blanking on the exact term (fruit of the poisoned tree? maybe?), but I believe in US law you cannot use evidence that was obtained illegally. So if the warrant was issued based on this hack that was thrown out, all the evidence gained from the warrant also has to be thrown out. This would be like the police breaking into someones house, and finding a pile of cocaine on their coffee table. If the judge asks the officers how they found the cocaine, they can't just say "we wont tell you (because we broke the law)" and have the evidence still count.

That is another possible conclusion. However, there have been many cases throughout history where this reasoning has not resulted in a dismissal of charges. Also, as far as I know, the burden of proof required to establish a reasonable suspicion to get a warrant is lower than the burden of proof needed to convict. The former is obtained in order to gather the evidence necessary for prosecution.

 

[Bounty]

I find this interesting in light of the recent wikileaks drop of CIA exploits. Makes me wonder if there are TOR exploits in there since these agencies do work together. http://www.hardocp.com/news/2017/03/07/wikileaks_exposes_cia_hacking_tools

 

[Zarathustra[H]]

I find this interesting in light of the recent wikileaks drop of CIA exploits. Makes me wonder if there are TOR exploits in there since these agencies do work together. http://www.hardocp.com/news/2017/03/07/wikileaks_exposes_cia_hacking_tools

I was thinking the same thing. If the TOR methods have been leaked, this concern disappears, and maybe the creep can be brought up on charges again immediately.

 

[Deleted member 93354]

I was thinking the same thing. If the TOR methods have been leaked, this concern disappears, and maybe the creep can be brought up on charges again immediately.

once the case is thrown out, he can't be re-prosecuted because of double jeopardy rules

 

[Zarathustra[H]]

once the case is thrown out, he can't be re-prosecuted because of double jeopardy rules

Read the quoted portion of the OP again:

"Disclosure is not currently an option. Dismissal without prejudice leaves open the possibility that the government could bring new charges should there come a time within the statute of limitations when and the government be in a position to provide the requested discovery."

 

[Master_shake_]

TIL some people just want kangaroo courts.

 

[Deleted member 93354]

Older children, relatives, 'friendly' neighbors/teachers/scoutmasters/priests/pastors/etc., are routinely given a pass around people's kids, and it's the kids who suffer for it. I'm not for stringing someone up without cause, but when you have someone like that in your neighborhood, wouldn't you want to know? Or do you want to let it happen to your kids?

So it's still going on. The catholic church is STILL covering up for their pedophiles. That's how bad this situation is. They cover for themselves. So when something is wrong, you have to do what you can to change things. Giving someone a get out of jail free card isn't the way to do it.

While I have EXTREME empathy for what you went through, and understand the ramifications of child abuse, including a high suicide rate, low self esteem, drug abuse, and sexual promiscuity your perception of the dangerous areas is a bit skewed.

Boy scouts and cub scouts now require that all meetings be held in public locations and at all times there are at least two pack leaders present at all times. At no time may a scout master be allowed 1:1 time alone. In fact parents are encouraged to attend all away camps and events. Also one of the badges earned includes cyber safety badge which talks about a lot of these issues.

While those of the cloth, and the catholic church in the past have had offenses against children, statistically speaking your child is safer in church than out in the general populace. And the catholic church has handed down strict orders that "any claims of abuse must be handled immediately and the offending person removed from any contact with children."

Everybody here in PA needs a clearance now to work with children. Even if a volunteer coach at baseball.

 

[Deleted member 93354]

Read the quoted portion of the OP again:

hmmm if the trial never went forward I guess that's possible. Double jeopardy only applies once the trail has started and he was found innocent.

 

[sfsuphysics]

How about I call bullshit on you and remind everyone of the Microsoft trial about IE where the judge took it upon himself to learn how to manually remove IE from a Windows system even though Microsoft tried to claim it was too well integrated into the OS and that it couldn't happen. Some judges give a shit and want to do their jobs well. They will go to great lengths to ensure that both the law and peoples rights are upheld.

Your move sir.

Because removing IE from Windows is maybe a tiny bit easier and achievable than decryption of however the TOR system work due to one having a plethora of websites that give you step by step instructions.

I'm not saying they shouldn't know that something was done to "reverse lookup" the people posting pictures or what not, but to have the dirty details? Yeah, I'm sorry no judge is going to take the time to learn about that. What rights are being violated in this case anyways? Is this a case like the MPAA saying "this IP did it, so lets prosecute" ... if that's the case then yeah fuck the FBI for being this god damn lazy. I'm going to hope they got an IP address, which got them a warrant, which allowed for them to search his physical computer which found all the CP evidence they needed.

In fact looking through a few of the links in the articles it seems the only reason why this is an issue is because the defense lawyers wanted the information to find out how their client was connected, this is NOT about a judge wanting to know if rights were violated, but a defense lawyer looking for a legal out when his client was caught redhanded.

 

[Ultima99]

Because removing IE from Windows is maybe a tiny bit easier and achievable than decryption of however the TOR system work due to one having a plethora of websites that give you step by step instructions.

I'm not saying they shouldn't know that something was done to "reverse lookup" the people posting pictures or what not, but to have the dirty details? Yeah, I'm sorry no judge is going to take the time to learn about that. What rights are being violated in this case anyways? Is this a case like the MPAA saying "this IP did it, so lets prosecute" ... if that's the case then yeah fuck the FBI for being this god damn lazy. I'm going to hope they got an IP address, which got them a warrant, which allowed for them to search his physical computer which found all the CP evidence they needed.

In fact looking through a few of the links in the articles it seems the only reason why this is an issue is because the defense lawyers wanted the information to find out how their client was connected, this is NOT about a judge wanting to know if rights were violated, but a defense lawyer looking for a legal out when his client was caught redhanded.

They have to prove the veracity of the evidence. No judge should just take the FBI's word that Mr. ABC committed crime XYZ. I'm not sure whats so hard to understand about this.

What if some chick just claims you raped her? Is her word good enough? I hope and expect you'd say no, but I'm not too sure at this point.