WingNews logo WingNews GitHub [2]
top | item 2153681

How the FBI raided Anonymous

144 points| abraham | 15 years ago |arstechnica.com | reply

155 comments

order
[+] kotrin|15 years ago|reply
"We have noted that similar attacks have also been carried out against Wikileaks itself, yet so far, nobody has been arrested in connection with these attacks, nor are there even any signs of an investigation into this issue at all,"

I think that is one of the most important points of this article.

[+] ZachPruckowski|15 years ago|reply
For a law enforcement agency to investigate the Wikileaks would require Wikileaks to turn over their server access logs, including every visitor to the site for the period of time in question. They would be basically finished in terms of getting dissidents to visit the site or hand over information if they're seen as turning over any sort of visitor-identifying info to any sort of law enforcement agency.
[+] ghurlman|15 years ago|reply
Where were Wikileaks' servers hosted at the time? The US cops are going to go after the crimes against US businesses on US soil first.
[+] eli|15 years ago|reply
Oh, please. What exactly are you suggesting? Do you think Wikileaks reported any crimes or turned over firewall logs to the FBI?
[+] jacquesm|15 years ago|reply
Somehow I don't think the protection of Wikileaks' servers figured very high on the priority lists.
[+] damoncali|15 years ago|reply
Does the FBI even investigate this sort of thing internationally? Does anyone?
[+] sliverstorm|15 years ago|reply
TWO %REAL% GUNS POINTED AT ME

I love this part. It's obvious that, for the first time in the lives of these Anons, sh%t actually got real.

(I don't mind any downvotes you see fit to give me, I have always found it laughable when Anons expect to break the law and suffer no consequences. Whether or not it is a good law has no bearing, that's not how civil disobedience works.)

[+] sesqu|15 years ago|reply
I'm not a fan. These are guns we are talking about, not paperwork. Paperwork is the shit that's real, guns are just there to make you feel helpless. And also to kill you.
[+] nanonymous|15 years ago|reply
I find it laughable that the cops felt the need to use real guns against a "Low Orbit Ion Cannon". Guns against unarmed kids (criminal or not) - that's not how jurisdiction should work.
[+] mahmud|15 years ago|reply
I think you got downvotted my MS-DOS fans. You turned a shell variable into your own regex glob :-/
[+] inafewwords|15 years ago|reply
It's like the war on drugs. It's the small fish that get fried.

But it tends to be the small fry that make up the bulk "opposition"

[+] AndrewMoffat|15 years ago|reply
I thought it was funny that he needed to emphasize or even say "real." You either have a gun pointed at you or you don't. Does the FBI sometimes burst in with water pistols?
[+] lukeschlather|15 years ago|reply
>The FBI yesterday reminded the public that "facilitating or conducting a DDoS attack is illegal, punishable by up to 10 years in prison, as well as exposing participants to significant civil liability."

What exactly is the relevant statute? As the other Ars article on the subject states, it's the digital equivalent of a sit-in.

[+] skymt|15 years ago|reply
Wikipedia suggests 18 U.S.C. § 1030, the Computer Fraud and Abuse Act[0]. Here's the relevant part:

> Whoever ... knowingly causes the transmission of a program, information, code, or command, and as a result of such conduct, intentionally causes damage without authorization, to a protected computer ... shall be punished as provided in subsection (c) of this section.

> As used in this section ... the term “protected computer” means a computer ... which is used in or affecting interstate or foreign commerce or communication...

By my (not a lawyer) reading, the only real question is whether being overwhelmed with traffic can be called "damage".

[0]: http://www.law.cornell.edu/uscode/18/1030.html

[+] InclinedPlane|15 years ago|reply
It's silly to pretend that a DDoS attack is the same as a sit-in, such a contention is intellectually and morally bankrupt.

Moreover, sit-ins are not legal either. If you choose to attempt to disrupt a place of business and you refuse to leave private property when asked to do so you can be arrested.

[+] monochromatic|15 years ago|reply
What's the justification for no-knock raids here?
[+] cagenut|15 years ago|reply
Whole drive encryption. I've seen docu-drama's where they actually break in when they know the suspect has gotten up to go the the bathroom/kitchen so that he can't reboot the computer.

Then, like all things with a shred of reasonableness too them, they become an awesome "check this box every single time" way of doing business for the guys who get their thrills kicking in doors.

[+] tptacek|15 years ago|reply
The immense likelihood of attempts to quickly destroy evidence.
[+] forensic|15 years ago|reply
no-knocks pretty much don't need justification anymore

The laws are so vague and the precedents are so sweeping when it comes to no-knock raids.

[+] gojomo|15 years ago|reply
Only one of the reports suggests a door 'busted down'; is that nym known to give reliable, non-embellished testimony? (I can believe that some of the searches might be unnecessarily done that way, but also that there could be exaggeration in pseudonymous reports.)
[+] kevingadd|15 years ago|reply
They're DDOSing websites run by big corporations, so they're obviously terrorists, which means you need to arrest them at gunpoint early in the morning so that you can be sure they won't have time to detonate a suitcase nuke before you can cuff them and get them into the back of the cop car.
[+] f1gm3nt|15 years ago|reply
"...and the first FBI agent in the door could be heard yelling 'FIRST'!..."
[+] jtchang|15 years ago|reply
My tax dollars are going to this. I feel robbed.
[+] fleitz|15 years ago|reply
Thats why taxes like robbery is done by threat of force. Otherwise no one would hand their money over to be wasted.
[+] ergo98|15 years ago|reply
DDOS attacks are attacks on the very fabric of the internet. If you believe in the internet, you will not support those sorts of activities. This has a very real ramification for much of the subject matter of HN: The investment community needs to know that any iCompany can't be destroyed by some teenagers with a downloaded tool.

Recall that the last freedom exercise was to try to suppress Gene Simmons' right to free speech (however stupid his opinions might be) by a DDOS on his servers, with all of the collateral damage that entails.

[+] x09|15 years ago|reply

[deleted]

[+] Jach|15 years ago|reply
I'm concerned about the knock-down approach by the FBI.

Say I live in a state which allows one to kill home intruders on sight, could I not legally set up an alarm system that sprays some bullets in the direction of the door if it's opened without being disabled? By knocking I can disable it and let them in instead of having a few dead FBI agents on my doorstep.

[+] dpatru|15 years ago|reply
One of the first cases in a law school tort class is Katko v Briney (http://en.wikipedia.org/wiki/Katko_v._Briney). Briney was a farmer fed up with a break-ins of an abandoned house that he owned. He set up a shotgun to shoot at an intruder's knees if and when the intruder forced the door. Katko, a trespasser, broke in and was shot and injured, sued and won. The quote I remember is (I had to look it up):

‘The value of human life and limb, not only to the individual concerned but also to society, so outweights the interest of a possessor of land in excluding from it those whom he is not willing to admit thereto that a possessor of land has . . . no privilege to use force intended or likely to cause death or serious harm against another whom the possessor sees about to enter his premises or meddle with his chattel, unless the intrusion threatens death or serious bodily harm to the occupiers or users of the premises.

[+] mquander|15 years ago|reply
Of course you couldn't legally set that up, are you insane? On what planet would that be justifiable? Even in Texas, you need to demonstrate a reasonable belief that you were in imminent danger of being robbed or attacked before you are permitted to use deadly force on an intruder in your home.
[+] InclinedPlane|15 years ago|reply
No, you cannot legally create lethal booby traps, in any state in the US.
[+] a904guy|15 years ago|reply
Reminds me a moment from the movie Hackers.

"You hacked a bank across state lines from your house?"

"...Stupid..."

[+] jrockway|15 years ago|reply
It's funny that Mastercard can't defend against an attack that my home router is capable of defending against. (A big limit on connections per /24 per minute should solve this problem. So will using a smart webserver or frontend proxy that doesn't care how many idle connections there are. Then all you have to worry about is bandwidth saturation rather than your servers crashing.)

But the lesson here is, when you visit a web page, a line in a log that identifies you is generated. Generate too many of these lines, and, one line of Perl later, the cops are going to be asking you some questions. Don't participate in a DDoS attack unless you're absolutely sure that nobody is logging your traffic. And that is something that's impossible to be sure of these days.

[+] aphyr|15 years ago|reply
It seems like it would be trivial to get someone's door busted down by running LOIC aggressively on their computer. I wonder--at what point can the FBI's enthusiastic enforcement be directed, in some sense, as a weapon?

Edit: I've watched Anonymous (insert typical disclaimer about the membership of a heterogenous group of net users) attack more than one of my boxes. DDOS's have been traditionally been the regime of surreptitious botnets, not voluntary ones. I'll bet you some unsuspecting soccer mom (or someone who pisses off Anon) gets nabbed at some point.

[+] axod|15 years ago|reply
You can get people to participate in DDoS attacks with a malicious website though.

Just use some JS to create image elements, script tags, iframes etc all with sources pointing at the target, should be able to do a few hundred a second at least.

Even trivial to get people to participate without using javascript. Just pop in a hidden iframe with a million <img> tags in the source.

As things move on, I don't think individuals who happen to fire off a few hundred requests at a website should be investigated/prosecuted/etc. Website owners just need to get better at protecting their systems.

[+] JoachimSchipper|15 years ago|reply
Come on, quite a few home routers can't even handle an aggressive Bittorrent client. Yes, DDoS can be defended against, and the fact that the LOIC is pretty primitive helps, but it's not that trivial.
[+] tomelders|15 years ago|reply
It won't be long before someone get's shot over all this, and it'll be the "powers that be" that drive the escalation.

Petty, fearful little people.

[+] starpilot|15 years ago|reply
I love the first quote: I'm not retarded ... Yes, I'm fking dumb.
[+] borism|15 years ago|reply
Let me get this straight. All this fanfare, and all they got was a bunch of teenagers (who most likely are not even legally liable) + their moms?
[+] tptacek|15 years ago|reply
What does being a teenager have to do with being liable? If they're criminally liable, they'll be tried by a juvenile court. If they're civilly liable, their parents will face civil suits.
[+] forensic|15 years ago|reply
Their goal is to deter the behaviour by making examples of out people.

I think they achieved this.

[+] kmfrk|15 years ago|reply
With it being Anonymous, I wouldn't be surprised that the main demographic were indeed teenagers. At least those of them who didn't cover their tracks.
[+] epochwolf|15 years ago|reply
I would be willing to bet the teenagers are either most of anonymous or anonymous's cannon fodder. I'm leaning towards the second because it's so much cooler. :)