If abuse is an issue, why not hash the IP with a nonce?
Only benefit I can think of is you can forget the nonce and now the data is securely useless, if the nonce was secure, but that doesn't seem that useful really.
—-
“ The subpoena, issued as part of an investigation seeking to identify a child sexual exploitation offender, was withdrawn after investigators found the person through other means, according to a notice the Justice Department sent to USA TODAY's attorneys Saturday.”
Or "we could always just buy this data, we requested it for some other reason but the media got more pissy than we expected."
The entire thing is just so strange, why was the challenge not hidden when the subpoena was?
The FBI is part of DOJ, which is an executive branch department under Biden's direct authority. If he thinks it's "simply wrong", he can just order them not to do it. He's not limited to "criticizing" it.
No, I am wrong, Hacker News is right, I have learned my mistake, we need anonymity - from everything. I don't want responsibility for my actions - that's why I support the EFF, and I don't care about the FSF. We deserve the same anonymity as the upper echelon of the government, and who cares about unconditionally accelerating the singularity with open-source.
Transparency - only Satan could want such a thing!
At least in my sect of Christianity, Satan only hurts bad people - it's people themselves that are evil or want to make others evil. Bit more theologically consistent.
Or for audit purposes (e.g. you might need to prove to some regulator no outside access was made, which is stupid but ...)
"Going forward, consistent with the President's direction, this Department of Justice – in a change to its longstanding practice – will not seek compulsory legal process in leak investigations to obtain source information from members of the news media doing their jobs," Justice Department spokesman Anthon Coley said in a statement Saturday.
If you don't know the nonce, you can't match against other users-- so not useful for abuse.
But I'm skeptical re: abuse uses. For commenters, sure-- you may need to store IPs to combat abuse. But for readers? At most you would need sampled data or in-memory counters (e.g. to catch high volume bots).
Unfortunately, there really isn't any penalty for failing to minimize private data collection.
Forgetful at the very least. Senile is unnecessarily pejorative. He's an old man who doesnt do much more than make political speeches in public.
> Biden's political experience
His team's political experience is more important, like almost all POTUS before him.
> “Going forward, consistent with the President’s direction, this Department of Justice – in a change to its longstanding practice – will not seek compulsory legal process in leak investigations to obtain source information from members of the news media doing their jobs,” Anthony Coley, Justice Department spokesman, said in a statement.
They are changing a "practice".
One uses laws to prevent practices one does not like, not "directions".
Obviously it's also wrong to seek this information, but it's not what Biden was talking about in the quote.
If you want a law to prevent this I'm not sure why you're criticizing Biden. He is the President, no the Legislature.
If you think there should be a law, then your complaint should be for congress.
Also, by removing unlikely candidates (IPs owned by irrelevant entities or that are not US based) you could get the search range much much smaller, and with the FBIs budget you could probably compute it all in a few days even with a 1-second hash time.
Its imperfect, but you'd expect definitely good folks to look a certain way
You d have a triple virtuous effect: people would stop being such insuferable asses once they understand basically their name is on the comment, readers would be completely safe because why not and abusers would be logged still.
It's even probably what most websites do: it news to me to keep the IP of every visitor, I'd have pruned them.
Plus the FBI could probably narrow their search to a few hundred thousand addresses (relevant ISPs, no unroutable/multicast/etc), then only use the list to confirm.
Finally, if it takes 120 years on one core, it'll take 1.4 months on 1000 cores. I'm willing to be the FBI has access to more computing power than I do. ~100 CPU years isn't a particularly daunting amount of computing work, even for fairly low stakes research.
That search would also decode all addresses in the logs, not just one targeted one...
Assuming you do that, you are looking at about 1193046 hours to hash the entire address space. More specifically, you are looking at 1193046 CPU hours.
You can rent a 96 vCPU c5.24xlarge instance from AWS for a rate of $4.08/hour; or $0.0425/CPU-Hour. Assuming this offers the same per-cpu hashrate as the general purpose web-server, you are looking at a cost of $50,704 to construct a rainbow table. That is no where near a prohibitive sum of money.
You can probably reduce the cost by shopping around for compute or using bare metal. You could see significant cost reductions by using hashing optimized ASICs.
Combine this with the fact that no website is going to spend 1000ms just computing the hash for every request (even if you allow for caching). And the fact that they can probably narrow down the address space they are interested in considerably if they wanted to save money.
2^32 is just too small of an asymmetry between legitimate use and an attack to be a viable defense.
They did not care who read the article itself which was benign.
They wanted to create a precedent to make their job easier, not realizing maybe people care less abt solving crimes than making it forever possible to track who reads what.
But yeah, everything else you said makes sense.
I don't understand how that reply works. Can you elaborate?
(The best way for me to reconcile those would be to interpret it as a snarky "you're realizing it's useless, they also realized that, so they withdrew it" but that doesn't answer the question of why they made the request in the first place. Or I could interpret it as "the quote below is why they withdrew it" but that's even further from answering the question of why they made the request in the first place. Is it supposed to mean "they withdrew it so we don't find out what they'd learn"? It's hard to see how withdrawing the request helps very much there. Overall, I'm lost.)
> The subpoena, issued in April, demands the production of records containing IP addresses and other identifying information "for computers and other electronic devices" that accessed the story during a 35-minute time frame starting at 8:03 p.m. on the day of the shooting.
A 35-minute window could still produce a large number of readers, but I assume they had some other information that would have immediately narrowed it down or otherwise confirmed their suspicions.
In an age where printed periodicals were delivered by subscription, the subscriber information was available (and yes, often tracked by local and federal law enforcement), but not the specifics of what articles were read.
Today, with Web-based document delivery and Javascript instrumentation, the specifics of who reads what articles, time on page, sections read, interactions, shares, and more, are available not just to the publishere but advertisers, any entities hacking into or accessing their systems, app developers, and more.
And, yes, law enforcement, whether under warrant, subpoena, or ... other methods.
That means they won’t subpoena journalists phone records when looking for whistleblowers. It doesn’t mean they won’t go after reader’s IP when looking for other suspects.
Depending on details, it may not be an unreasonable request. The question is more one of trust: do we trust the FBI that it's a reasonable request?
This is why all the stuff like the activities the Snowden leaks demonstrated or Trump's idiotic harassment of the press through the DOJ are so harmful far beyond the direct harm they did: they justifiable and seriously erode trust, and then there is a serious case like this and "trust us" no longer carries any value. A sad state of affairs where everyone loses.
most likely the fbi was monitoring some website somewhere and the person of interest posted a link to or talked about the article and it was 35 min after the story was posted when the guy linked to it.
That said...https://www.cbsnews.com/news/luka-magnotta-wanted-for-canada...
Would you personally be (as) worried about mass surveillance if you could somehow guarantee that every use of that power would be reported on to the public; and that any abuses of power would come to light? With the underlying assumption that those abuses of power would also have consequences.
What? Absolutely no one said or even implied any such thing.
Photos of in child sex abuse cases are routinely scrutinized in great detail to reveal clues about the location, time, and anything else that might lead to the individuals in the case.
Interpol has an entire website dedicated to help identify objects in pictures[1], asking members of the public to help identify everyday things like T-shirts. Actually, one of the top results pictures right now is "do you recognise this newspaper?"
No one is suggesting that "wearing this t-shirt" or "having this newspaper" is incriminating in and of itself. Finding these people from vague online pictures where they intend to remain anonymous is tricky business, and sometimes with a bunch of these clues combined with some other information they can identify offenders and/or victims.
Of course there are trade-offs involved in all of this, and it's important we have robust public conversations discussing those; as I mentioned in my previous comment, the lack of trust here is a big issue. But much of this entire thread is ... disappointing. I wish people would keep cooler heads (as well as, you know, actually read the article before commenting).
I suppose that if we get very technical you're technically correct. Seems like an odd and very pedantic hill to die on though.
Why isn't this made into a federal law? What constituency in Congress is opposed?
It is quite common to know something about the recent behavior of someone that has some connection to a crime but not know who they are.
You might not know who robbed the bank, say, but you know their getaway car was a red Corvette with a license number that ended in 6. Or you might know that a recently killed body was disemboweled with a Kobalt brand model #TRS-5CF-K34714 trenching spade (it was left at the scene) and your forensics people were able to determine that it had not been used before this so was probably recently purchased.
In the first case, you are going to ask your state's motor vehicle department for a list of all registered red Corvettes in the area of the robbery. In the second case you are going to see if any Lowe's in the area (Kobalt is their house brand) can tell you who recently bought a #TRS-5CF-K34714 trenching spade.
You aren't asking because owning a red corvette is incriminating, or because owning a #TRS-5CF-K34714 trenching spade is incriminating [1]. You are asking because whoever did the crime is probably either in the set of red corvette owners for the robbery or the set of #TRS-5CF-K34714 trenching spade owners for the disemboweling, or someone in those sets is connected to whoever did the crime. Even if the connection is innocent talking to them can be useful--the red Corvette may have been a ride share, for example, and the driver had no idea he was serving as getaway driver, but he still may be able to provide details about the robber that will help find him.
Here it sounds like they determined that there was someone connected to the shooter and they wanted to find that person but did not know their identity, but did find out somehow that it was likely they had read that article within a 35 minute window on a particular day (I have no idea how they would have found that out).
[1] I own one. It's great!
No. Under no circumstances is it acceptable for governments to ID readers of a news article. Such an act is a direct attack on the freedom of speech, freedom of thought, and freedom of the press. IMO it very clearly crosses a line on what law enforcement can and cannot do in a democratic society.
Note that law enforcement has (over)broad powers for investigation at their disposal already, and they were able to find the suspect "through other means." There was no justification whatsoever for the subpoena.
It could be a smoke and mirrors response to get people to say “well in that case...” but the article does answer the question.
Someone usually will have archived the article there.
If you feel a bit more ambitious you could make a bot that runs on a vps somewhere and automatically scrapes news articles.
While there probably are thousands of real issues that don't make it onto HN and thus never get resolved, there's probably multiple millions of people just as desparate that are just trying to skirt some rule or are telling half-truths to try to get their way and bypass policies.
For example, if you are talking with Alice and she says that she heard from Bob chat Charlie was in the office at a weird hour on the day in question investigators have gains nothing that they can admit as evidence [0]. However, there is nothing that anyone (defense or a third party) can do challenge this portion of the investigation other then keep it out of evidence, and the investigators are free to follow up with either Bob or Charlie to get something that would be admissible.
Otherwise you could use a privacy hardened firefox version along with some kinda proxy.
I would say you could rent your own vps, use a vpn service that maintains their own servers, use a decentralized vpn (these are a new development) or just use someone else’s wifi that you don’t also use with your „real“ identity.
Opsec can be hard to maintain but boy is doing so fun.
Archive.is runs Tor through a Cloudfront captcha which fails consistently in my experience.
I'd call it "profoundly misleading about a serious matter" at best.
Another guess is they want a precedent to subponea Fox News readers and classify people by political opinion. Albeit less charitable, it has equal probability.
Let's say one day you stumble upon some nuclear centrifuge in the middle of a field. Who do you even call and how do you do it in such a way that you don't end up on the no-fly list for the rest of your life?
- Drawings, 3D renderings,
- People you don’t have the ID of. Remember the joke: “Actress ___ turned 18, it is now legal to watch her films.”
While one of the gravest crimes, accusations of CP made by police are wildly different from a human’s definition of it, and it is also at high risk of being used for political reasons, we need to keep that in mind.
I was thinking along the lines that evidence already exists that would provide much the same value as the access logs might, but the access logs would either provide cover for introducing that evidence, or provide the value without disclosing other surveillance methods.
Either of those prospects is troubling.
Chief value of (public/general) VPNs seems to be 1) accessing region-zoned content or 2) protection against local-segment interception.
The benefit of 2) is balanced against the fairly strong probability that the VPN provider itself is heavily surveilled or actively aiding in monitoring activities.
Just tried it now and works for me.
It is an annoying captcha, it had something like five steps to complete, but I've seen worse. I'd rather this captcha than the one that Roblox uses.
Please remember to always use a VPN, Tor, or other similar technologies when using the internet to shield your self from basic infringements of your privacy like this.
The danger comes when law enforcement uses the evidence they gather from one case, to target someone who hasn’t committed a crime. Which clearly hasn’t been shown to be done here.
It could also be used to de-anonymise someone if they made an OpSec mistake e.g. accessing the news site outside of Tor or a VPN and you happen to know (via some out of band method) that they did this and so could use it to get their actual-IP.
It wouldn’t be a straight forward “if you accessed a news page you are guilty of something”.
Still, everybody on the street could see what we read while carrying the paper home. That can easily be dozens or hundreds of people. In some sense the periodic subscription via snail mail is in some sense the most private form. Sure, in the Web everything is tracked but in the average case literally nobody is aware of what we read. The worst case scenario can be quite bad though...
So... I have no idea how they thought it would apply in this case, or what investigators had in mind.
That said, very broadly and in theory, in today's world almost any data point can be predictive of almost any behaviour. This is the premise of ad-tech. Less amorphously, you could probably construct a theory. People reading the story within a certain window of time, within a certain geographical area... etc.
Evidence, probable cause & reasonable suspicion as legal terms, that's a different matter.
I’ve seen this before where a user got an email from Google legal about a subpoena against them, spent $7k successfully fighting it, but it didn’t matter because several other $BigCos didn’t even let the user know.
Was he a person of interest in the lead up to the shootout, who got away, and they were just grasping at straws to discover a list of local area IPs correlated with known addresses he might have been hiding out at so they could obtain a search warrant?
If that's the case, then honestly I don't think this is any worse than when they force say Google or Facebook to provide such data to government.
I don't see why the USA Today should get any special privileges over any other tech company just because they are "media".
If we want to have an argument about the Government abusing it's power to spy on us in general, that's one thing. But the USA Today is literally saying its more important they protect the illusion of their readers "privacy" (which we all know they don't care about your privacy are willing to sell all your personal info to the highest bidder, its in all their TOS) than it is to try and help the cops catch a child predator...
I do agree that this does establish a troubling precedent, but i kinda thought Snowden already made it blatantly clear that the NSA and the CIA is already doing this.
It seems to me that the FBI is basically just trying to play catch up, which we should be concerned about because they are supposedly the agency put in place to police us. Those other agencies are supposedly only supposed to police the world.
(which i never understood why thats supposedly okay. Americans are the only people entitled to their privacy?)
Because freedom of press is (in all democracies) one of the highest ranking human rights.
I agree that turning on JavaScript with Tor is risky from a security viewpoint. It significantly increases the risk that your real identity may be unmasked.
They said: "personal computer", which could easily have 2x GPUs and 16+ cores. Heck, laptops nowadays can have a pretty good discrete GPU.
Using password grade hash with a =nonce= is absolutely no way to be accomplished per each request. The nonce would have to be the same for multiple uses - hence NOT a 'nonce'. The sharing of the said non-nonce would require a form a replicated Map (or IP-sticky processing with a local map). It's rather convoluted solution for absolutely no benefit as it's still not hard to brute force.
Storing it in such a way - slow hash + salt yields no benefits for debugging either, so I wonder why would you do so? Password hashes are useful for proving a match with an unknown plain text (while making it expensive to brute force) - so what would be the exact purpose of having non-nonce+IP?
b/scrypt and all other password grade hashes are slow on purpose but they are slow per each use. Imagine the processing takes 0.1s (which is on the low side of hardness) per each request - you just killed all your servers w/o any designated DoS. If you abandon the nonce and use the same salt multiple times (so the computation is amortized), it'd take a replicated cache of IP->hash and even then it still doesn't accomplish much...
Media, news and journalists and their sources have special protections and consideration that random private club does not.
Having only one connection going over Tor is a big risk that forces the user to constantly recalculate the information horizon. Easy mistake to make.
Yes, I read it on my iPad through an app, but it simply renders a PDF of the actual physical newspaper and its layout.
So there's no way to fit dynamic ads, JavaScript nuggets, etc. They can't really determine what article I read.
I think that should really be the norm for electronic newspapers. How is it in other parts of the world?
This isn't really true, though, even in theory. In practice it's much worse, as we aren't very good at using even large collections of data points in most cases to predict behavior. We can in some very few, narrow contexts occasionally do better (sometimes much better) than a random guess once in while.
That said, the one relatively broad concept where "we" consistently do better than random guesses is ad-tech, which is where the bulk of private efforts to this effect are concentrated currently. The premise here is quite literally "every data point is predictive of behaviour," behaviour being stuff related to the goals of advertisers.
It's not a huge leap to suggest that fb & adwords' system can be used to predict crime, insurance claims, HR-related stuff etc.
They‘re like tor where anyone can run their own node, but unlike tor there is a financial incentive to run them because they come with built in payment processing solutions via cryptocurrencies.
Some people are skeptical of cryptocurrencies but I consider this to be an excellent use case:
Securing coordination between actors that don’t necessarily trust each other through market incentives.
This would incentivize people to run their own nodes and it would be less like tor where most exit nodes are allegedly run by intelligence agencies.
A site I was repairing after a hack fortunately had server logs which included IP data. That IP allowed me to identify the specific exploit used.
So, there are definitely uses for IP data in security terms.
The subpoena, and USA Today's response [1] paints a picture of an incompetent and/or inexperienced FBI agent, who is unaware of existing Justice department guidelines specifically prohibiting her from serving such a subpoena.
Reading between the lines, citing "other methods" is the FBI's way of quietly withdrawing a subpoena that should never have been served.
[1] https://storage.courtlistener.com/recap/gov.uscourts.dcd.231...
The FBI served USA Today with a subpoena. USA Today's lawyers replied to the FBI, stating that the subpoena is "not authorized under federal regulations, and object to its service" [1]
[1] (page 15) https://storage.courtlistener.com/recap/gov.uscourts.dcd.231...
Indulge my hypothetical:
1. A newspaper article is posted at 1PM.
2. A suspicious comment that contains nonpublic, incriminating information is posted on a message board at 1:15PM. That comment links to the USA Today article. The message board is outside of FBI jurisdiction.
3. The Feds already know the identity of the commenter through an illegal and/or unconstitutional means of data gathering. (Think of all the secret taps built into AT&T's networks, their Stingray devices, all of the unpublished vulnerabilities exploited every day by TLAs, etc.)
4. If the Feds can get the identities of everyone who read the article during the window immediately before and after that comment's submission, they may be able to use other information to narrow that list down to one or two suspects and use that to sway a judge to issue a search warrant. Because they already know who they're looking for, I wouldn't expect this "narrowing down" process to be particularly even-handed.
> "The subpoena is being withdrawn because intervening investigative developments have rendered it unnecessary," an FBI spokesperson said.
I think this is nothing like a "mea culpa", but instead has absolutely everything to do with managing the establishment of precedents to work in the favor of the FBI whenever possible.
It's an inside HN joke, to point out that the less exposed something "bad" is, the more likely it is to continue, and if it becomes widely known (not merely publicly available), then there is often visible backpedaling.
To what extent do Americans want to not help investigate crimes to defend corporations “protecting user privacy” (all while these corporations collect and keep the data to themselves and do as they please, including profiling and selling it to third parties).
I guess there is some greater good that your position intends to stand for, but what is that greater good?
Genuinely curious.
Answering this from the point of view of an informal request: If it's not a situation of active harm, then they have time to get their court order. If it is a situation of active harm, there should still be a process to ensure the request was valid after the fact. Police can and do lie to get access under false pretences. Without a valid followup process, you can't be assured their request is legit.