top | item 11473696

Judge Who Authorized Police Search of Privacy Activists Wasn't Told About Tor

404 points| nkurz | 10 years ago |thestranger.com | reply

222 comments

order
[+] walrus01|10 years ago|reply
The warrant is ridiculous even without the tor part. Read pages #6 and #7.

http://www.thestranger.com/images/blogimages/2016/04/08/1460...

ISPs maintain hash values of known child porn files? Show me a single ISP in the Seattle area that runs any of its residential customer http traffic through a caching proxy that examines and hashes each file, I'll eat my shoe.

[+] kempbellt|10 years ago|reply
There is so much explaining going on here that it seems like the judge has no understanding of how the internet works.

If that's the case, how could the judge be able to give a reasonable response to this affidavit? Seems like a case that requires such a long-winded technical preface could at least be handled by a judge who knows what an IP address is...

[+] iadnal|10 years ago|reply
That is an interesting read. They just seem to dump everything they know about how computers are used in relation to child pornography even if it's unrelated to the case at hand.

Even though they mention the hashing and Photo DNA (which is a real system that ISPs use) the warrant rests on regular old reporting of a video by site admins.

[+] dlgtho|10 years ago|reply
Don't know about Seattle but my ISP does run a transparent proxy that does mitm for http and caches files. They use http://www.peerapp.com/ devices to do so. I was also successful in poisoning their cache quite easily
[+] Godel_unicode|10 years ago|reply
There's no need for a caching proxy for this, Bro IDS will do this out of the box if you drop the hashes in it's intel framework
[+] jobu|10 years ago|reply
Money quote in the last paragraph:

"When we get into things like this," [Judge William Downing] said, "anonymizing stuff, that’s well over my head technologically, then it becomes very murky and hazy."

That sounds to me like the judge likely wouldn't have known what a TOR node was if the police had told him these guys were running one.

Technology isn't slowing down, so how can we make sure the law keeps up?

[+] vidarh|10 years ago|reply
He is willing to admit that it goes over his head, which presumably also means that he'd be willing to read up on it or seek advice if necessary.

The biggest problem isn't judges who doesn't know everything - they have to deal with cases covering every possible discipline and can't possibly know everything about everything put before them. The problem is when they believe they do, or don't care, or don't want to admit it and decides to just trust law enforcement blindly instead.

I'd like to think that a judge that readily admits what he doesn't know will make sure to learn or seek suitable advice when necessary.

[+] derefr|10 years ago|reply
The judge wouldn't have known what a Tor node is—but that's not a bad thing. What he's saying here is that the facts as originally presented to him translated into a well-known "cached" judgement; but the facts as they actually were would require original thought and research on his part (and/or those of analysts working for the judge) to come to a decision. "Guy has child porn on his computer" has a clear-cut answer; "open proxy server contains child porn" is indeed much less clear-cut. What the law says about that subject is murky; hazy, even. It's something you would need to think about.

And this thinking is, in practice, what the vast majority of a judge's every-day job is: to Do The Research—to become experts in the things they're asked to rule on, to build up the context necessary to discriminate between assertions made to them by opposed parties. Judges are already experts on the law; but that only helps when the law is already so well-established that a judge isn't even necessary. In most cases, the law is vague: it doesn't already have the answer for what should happen in this particular case, with these particular facts. The point of the judge is to decide what the law should be—to gather facts about the world, and use them to answer a question in a way that sets legal precedent going forward.

Everyone else in the court's job is, then, to feed the judge all the necessary facts about the case, on both sides, so that the judge can know just what subjects must be made clear—must be researched, or questioned, or followed up on—before the case can be decided.

(Even the irrelevant statements; the judge is the one expected to know what the law must blind itself to, so the judge wants to hear everything, and then cull the pile of statements themselves. When a jury is present and must be the one to decide, the judge will attempt to moderate the jury using this same legal-blinding... but with mixed results. In jury trials, you'll see judges trying to keep attorneys from making certain assertions that might irreparably bias a jury; but in non-jury trials, judges just want all the information they can get.)

In short: as long as judges are doing their jobs, the law keeps up. That's what we pay judges to do. If the law isn't keeping up, we've just hired some bad judges.

[+] intherdfield|10 years ago|reply
Just pointing out that the judge who authorized the warrant didn't say that. From the article:

Judge Bowman, who authorized the warrant, said he could not talk about the case and referred me to his colleague Judge William Downing, who spoke about some of the underlying issues. "When we get into things like this," he said, "anonymizing stuff, that’s well over my head technologically, then it becomes very murky and hazy.

[+] cmurf|10 years ago|reply
For good or bad, the American legal system (and the English one on which it's largely based) is about who makes the better argument. It's a debate contest among expert jurists. The judge is supposed to be knowledgeable about the law, and particularly good at recognizing logical fallacies.

A good judge who is not an subject matter expert should be good at asking the salient questions and stopping a rambling jurist in their tracks. The whole idea isn't to become an expert, it's to find the right questions, and provide the opportunity to expediently arrive at conclusions and solution to them. And it often is just one question.

[+] dsmithatx|10 years ago|reply
Let's hope that was his quick answer to reporters. I'd hate to think that when a Judge has a hard time learning something he decides, well I don't understand this so, let's just violate someone's 4th amendment rights and go harrass them rather than learning how I should apply the law (aka do my job).
[+] riskable|10 years ago|reply
Here's what I don't understand: You go to a judge for a warrant and the only piece of evidence you have an IP address. How is an IP address even remotely considered "evidence" enough to search someone's home? An IP address is not an identity. It is not a location. It is not even permanent in most cases!

I cannot fathom that police are granted warrants to search and seize people's homes and property based solely on, "logs indicate an illegal file was uploaded from this IP address." That is incredibly flimsy evidence.

At the very least they should create a profile on the individuals and demonstrate that they were present in the home and appeared to be using their computers at the time of the crime. They didn't even do the most basic of police work in this case. WTF!?

[+] bcook|10 years ago|reply
PSA: "Tor", not "TOR".

https://www.torproject.org/docs/faq.html.en#WhyCalledTor

"Note: even though it originally came from an acronym, Tor is not spelled “TOR”. Only the first letter is capitalized. In fact, we can usually spot people who haven't read any of our website (and have instead learned everything they know about Tor from news articles) by the fact that they spell it wrong."

[+] gambiting|10 years ago|reply
I usually say "TOR" because "Tor" means "track" my language so people can get confused and writing it in all capitals makes it clearer.
[+] 746F7475|10 years ago|reply
That note seems so childish.

"We rebranded and if you don't know about it you are just uneducated mongrel on the mercy of media"

[+] Arzh|10 years ago|reply
People still do that crap with Go (Golang) for no damn reason, it'll never stop because even if they have read that they don't care.
[+] Freak_NL|10 years ago|reply
This is probably what I find most worrying about the TOR concept. By running an exit node, you open yourself up to all sorts of legal actions. But if you can't run a TOR exit node as an average citizen, won't all exit nodes end up being run by NSA, GCHQ, and their ilk?
[+] dublinben|10 years ago|reply
Best practices for running an exit node cover most of these concerns.[0] The most important one the individuals here didn't follow is 'don't run your relay from home.' A properly registered tor exit relay running in a datacenter somewhere will attract a courteous inquiry, rather than a 6am raid.

[0]https://blog.torproject.org/running-exit-node

[+] Synaesthesia|10 years ago|reply
It really shouldn't be illegal, it should be protected, like free speech, as noted in the article, "It's like raiding the mailman's house for delivering an illegal letter with no return address"

In fact I think that's why they withheld the fact that he runs a TOR node from the judge.

[+] djsumdog|10 years ago|reply
They thing is, they knew he was running a TOR node. They knew they wouldn't find anything. In a _real_ raid for suspected child porn, they confiscate all the equipment. If it's encrypted, you don't get it back (without the money to spend on good lawyers, and then it will be 6 months minimum. Without good lawyers, even if you're never charged, it will probably get wiped and auctioned off, because US police can confiscate anything they damn well please).

There was another article, either here or slahdot or somewhere, talking about how there have been several of these TOR node raids. I doubt they even had any evidence of illegal material being downloaded. I think the FBI got all these local police departments to do this intentionally to scare people.

The guy should have never turned over his passwords either. He would have lost his machine, but IIRC, the Seattle privacy group he's with decided to scrap those machines anyway since they couldn't be sure the PD didn't tamper with the tor server.

[+] ianleeclark|10 years ago|reply
It's actually really sad because I was wanting to see if I could implement an exit node all by myself as a side proejct, but then I realized the potential danger I'd be putting myself in. Naturally, I'd have to host it to test it, so I had to throw this one to the way-side
[+] spudfkc|10 years ago|reply
Isn't that exactly what those agencies want?
[+] cortesoft|10 years ago|reply
Really, the only way for it to work is if everyone is an exit node.
[+] pjc50|10 years ago|reply
By running an exit node, you open yourself up to all sorts of legal actions

This is not going to be popular here, but IMO this is actually reasonable: you ought to be aware that running an exit node is enabling all kinds of terrible behaviour. You can't just handwash your responsibility away from this.

(No, this is not the same thing as providing encryption software, or general public chat forums etc)

[+] AdmiralAsshat|10 years ago|reply
I seem to recall Mozilla talking about running some exit nodes. I wonder if that fizzled out under government or law-enforcement pressure.
[+] Overtonwindow|10 years ago|reply
Point of clarification: I know the police are allowed to lie and fudge the truth to suspects and defendant, but is there a legal requirement for them to be forthcoming and truthful to Judges in warrants?

Also, tending to agree that even if they had included TOR in the search warrant, the judge would have most likely signed it anyways becasue child porn is a big "must do something" thing, and the technology would have probably gone over the Judges' head anyways. In this day if the police use the words "child porn" they could get a warrant for just about anything under the sun.

[+] tombert|10 years ago|reply
If my job requires me to have an understanding of something new, I learn it. Like an adult. Why the hell is technology the only exception for people on this front?
[+] downandout|10 years ago|reply
I'm all for privacy technologies like Tor, but this is one of the risks you assume when you operate an exit node. The alternative would be to give all Tor exit node operators not only legal immunity, but immunity from investigation, for illegal activities originating from any IP address associated with them. Even if the judge and the police were aware of the exit node, it wouldn't have changed the way this was investigated.
[+] AnthonyMouse|10 years ago|reply
Suppose I'm AT&T and one of my customers is running a Tor exit node. Do I now have "immunity from investigation, for illegal activities originating from any IP address associated with them"? I can certainly use a router spoof my customer's IP address for any connections I want to use for illegal activity. Then the IP address will trace back to that customer, which is a Tor exit node, and the police can't investigate me.

For that matter, every user of Tor is in the same situation.

But the premise is wrong. The police can investigate you as much as they like, they just can't assume that the traffic coming from that IP address has anything to do with anyone in particular.

You're still going to jail when you buy something with a stolen credit card and have it shipped to your house, regardless of whether you used Tor or operated a Tor exit node or are an ISP and used an IP address assigned to a customer.

[+] imchillyb|10 years ago|reply
You jest about immunity, but...

We don't prosecute the Department of Transportation when someone transports several hundred million dollars of cocaine across their roads.

Why should we treat digital highways, overpasses, and offramps, any differently?

[+] ajmurmann|10 years ago|reply
Let me pay devil's advocate for a moment: let's say I want to do bad things on the Internet and obviously I don't want to get my house raided. So now I set up a Tor node in my house. Doing that I created reasonable doubt and my house can't get raided.
[+] stonemetal|10 years ago|reply
An ip address is not good enough to locate someone. If they have evidence beyond an ip address sure raid the house, but if they have no identity evidence beyond an ip address then they need to understand they have no identifying evidence.

Per this article yesterday, MaxMind(a geolocation ip service) lists a farm in Kansas (selected because it is roughly the midpoint of the US) as it's unknown location as a result it is given as the address for something like 600 million ip addresses. The farm's owner has been harassed by several law enforcement agencies and countless vigilantes.

https://news.ycombinator.com/item?id=11466849

[+] joemi|10 years ago|reply
That's a fair point. The raid seemed to have been fairly quick, efficient and polite (compared to other raids I've read about). So, combine that and the fact that nothing was seized, and it sounds to me like the police were just checking to make sure the situation you outlined was not the case. It sounds like they were just doing due diligence. I'm not really sure why folks are so surprised and/or offended by this.
[+] jakobegger|10 years ago|reply
I think that traffic originating from an IP address is very weak evidence, regardless of whether someone runs a Tor node or not. With all the malware and insecure, unsupported software running everywhere, it might be more likely than not that random illegal traffic is coming from IPs whose owners are oblivious.

I would hope that law enforcement has more evidence than just an IP in a server log when they raid your place.

[+] Cpoll|10 years ago|reply
No, you can/should just do the bad things through Tor, then you're not even a target of suspicion.

If they have some other link to you, the fact that the traffic is coming out of your house isn't doing you any favors.

[+] phasmantistes|10 years ago|reply
At what point does lack of information disclosure in the warrant application render the warrant itself invalid? Is there any precedent for invalidating warrants -- and therefore any information gleaned from the search, and perhaps allowing suits against the offending searchers -- due to circumstances surrounding the application for the warrant?
[+] zaphar|10 years ago|reply
I have a question for any Legal Professionals here.

Reading these news stories it sounds like warrants can be very invasive but that there is no advocate for the target of the warrant involved in the process. What protections for the target are there in the process of obtaining a warrant, given the serving of one can be so invasive and damaging?

[+] yason|10 years ago|reply
Obviously running a TOR node will attract interest. It can be debated whether acting as a TOR router/carrier should impose on the operator at least some requirements to divulge connection logs to the authorities -- not that TOR would actually produce any meaningful logs in the first place. That's roughly what physical ISPs need to do if one of their IP addresses is associated with child porn. There's also the argument that if TOR nodes were given a guaranteed free pass when it comes to illegal content then why wouldn't people just run a TOR node and an open wifi on their home network just to cover their ass should they intend to use a torrent of shady network services.

However, the question that pops into my mind is that given how easy the trigger finger on child porn actually is in the current climate, then why are the producers and consumers of child porn still on the regular internet and not in the TOR darknet? If consumers are already willing to use TOR to access these sites there's no barrier to switch at all. The producers could even offer a legit site with no illegal content hosted there but which just redirects the browser to the (current) TOR address. I suppose there's a market for consumers who aren't using TOR but I would suspect that segment to be continuously shrinkin in the form of being prosecuted.

[+] Gratsby|10 years ago|reply
Does operating a Tor node preclude someone from being investigated? I should hope not. Just because they do operate a node doesn't mean that a given household is free from criminal activity.
[+] usrusr|10 years ago|reply
I never understood the value of a judge authorization requirements for surveillance. Has there ever been a recorded case where the request was denied, except maybe for even more shady reasons? I just don't see any incentive the judge could have to actually make an informed decision instead of just issuing rubber-stamp approval. Even in the unlikely worst case scenario of a scandal of rampant spouse-spying, a simple "but i trusted these guys!" would grant complete forgiveness. The only advantage, in terms of civil right is a weak paper trail and a slight slowdown of operations.

What if, instead of the judge approval requirement there would be a simple, "mechanical" lockdown of surveillance capabilities that would just ensure a paper trail and enforce an artificial quota of operations per time?

"Want to spy on that guy because you don't like his face? Your call, but don't come running when you have run out of quota, you really don't want to be that guy who could not stop an actual terrorist because he wasted all his surveillance wildcards on a personal vendetta".

This sure would not yield perfect results, but i really believe that the existing judge authorization requirements are even worse.

[+] blowski|10 years ago|reply
What would you set the quota at? Surely 'zero' is the best quota and each case deserves thorough oversight and consideration.

If you do put in a quota you're implicitly saying 'police should be searching this number of times but no more' and there is simply no way of knowing what that number should be in advance.

[+] cplease|10 years ago|reply
> Has there ever been a recorded case where the request was denied, except maybe for even more shady reasons?

Yes. And most are never reported, since law enforcement will either fix what was wrong with their application, pursue a different line of investigation, or drop the investigation.

Perhaps you are thinking of FISA court surveillance requests in the national security arena. Those have been revealed to have an extremely low denial rate. But nonzero. And that's a different space than criminal search warrants.

Perhaps as important as the level of judicial scrutiny of warrants in the first instance, and their denial rate, is subsequent review. An improperly granted warrant is invalid. A party with notice of an invalid warrant can move to quash it. A criminal defendant implicated with evidence from an invalid warrant may be able to have the "fruit of the poisonous tree" suppressed.

Just a few: http://lmgtfy.com/?q=%22in+re+search+warrant%22

Your alternative is ridiculous; saying the police can conduct so many searches without respect as to whether or not there is probable cause that a crime has been committed and that the search will yield evidence of a crime.

The point of the warrant is to force police to show probable cause to a neutral arbiter. That, plus judicial review and the suppression rule, plus federal §1983/Bivens claims, provide a powerful check on arbitrary behavior by law enforcement. Of course most warrants are granted; for the most part police don't waste time going to judges saying outright "Joe Bloggs is suspicious, unlikable, and has a Green Party yard sign. We want to go turn his house over just to harass him with a fishing expedition." If the police are corrupt and abusing warrants, what would their motivation be to use them properly just because they had some arbitrary quota? If they use them properly, what purpose does a quota serve?

The idea that having to show a defensible reason to a judge with a paper trail is worse, betrays a complete ignorance of the legal system, and how much worse it could be in a really authoritarian society that doesn't have meaningful constitutional protections.

[+] HeyLaughingBoy|10 years ago|reply
I just don't see any incentive the judge could have to actually make an informed decision

Some people pride themselves on doing their jobs as well as they know how.

[+] Floegipoky|10 years ago|reply
What he says- "When we get into things like this," he said, "anonymizing stuff, that’s well over my head technologically, then it becomes very murky and hazy."

Or, stated another way- "I'm not qualified to do my job, so I just rubber-stamp it"

Now imagine somebody saying that about a code review.

[+] xbmcuser|10 years ago|reply
That's the risk they are taking for hosting a tor node. What if a tor node user is also browsing child porn. The isp will only see child porn being accesed by the tor node in.
[+] ikeboy|10 years ago|reply
>"It's like raiding the mailman's house for delivering an illegal letter with no return address," said one commenter on the tech website YCombinator.
[+] asrt|10 years ago|reply
Bultmann and Robinson? Do they operate the Tor node on a Bultcave or something?
[+] sickbeard|10 years ago|reply
what difference would it have made if the Judge was told about it?