Slashdot Log In
Too slow! FBI Shuts Down Hosting Service
Posted by
timothy
on Tue Feb 24, 2004 07:34 AM
from the shades-of-steve-jackson dept.
from the shades-of-steve-jackson dept.
Chope writes "If FBI agents showed up at your data center bearing a warrant, would you be able to provide them prompt access to customer data?
BZZZZT! I'm sorry, but you've taken too long to answer. We'll be confiscating all the hardware you use, er, used to use, to run your business. But we'll get it back to you 'real soon now.' Thank you for playing. CarrierHotels.com is carrying the story of a FBI raid on a web hosting company. When the hosting company didn't and/or couldn't provide the information the FBI was looking from its several terabytes of data within "several hours", the FBI decided it was more "efficient" to seize all the web servers and customer data as part of the FBI's investigation of a hacking incident."
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
All Your Rights Are Belong To Ashcroft (Score:5, Funny)
Re:All Your Rights Are Belong To Ashcroft (Score:5, Funny)
Parent
Re:All Your Rights Are Belong To Ashcroft (Score:5, Insightful)
The FBI will attempt to work with any provider in order to get the data they need to investigate a crime. If that is impossible to do in a 'reasonable amount of time' they have little choice but to confiscate the equipment in order to copy the existing data from the machines to conduct a forensic investigation. A reasonable amount of time is generally a couple of hours to a day. Believe me, the last thing some poor special agent wants to do is sift through TBs of customer crap and put a company out of business or under financial hardship.
Parent
Re:All Your Rights Are Belong To Ashcroft (Score:5, Informative)
Doing some simple math, with a decentish disk controller, it will take 3 hours just to stream 1TB from disk to /dev/null. That assumes that the data is perfectly sequential and that no 'analysis' (such as accessing in a filewise manner, looking for a particular name of other data within the stream, etc).
Touching the data at all will easily double that to 6 hours. Add in more time because the volume is probably archival (read slower) rather than being set up as an enterprise DB system. Add even more since the server has other things to do running the business.
Most likely, what they were after was logs. Logs tend to be optimized to be stored quickly rather than for fast access. After all, logs are being stored constantly, but unless something unexplained is going wrong, they aren't analyzed at all. When they are analyzed, it's usually one of a handful of standard reports (such as logins, changes to suid, etc) and is only done over a reletivly short span of time.
Given the above, and that there were multiple TB of data to sift, it is not even vaguely reasonable to expect a complete result in less than several days.
If this report is even vaguely factual, I sincerely hope the person who made the decision to sieze is forced to spend the remaining years of his career in the basement sifting through endless lines of:
1337 d00d> D000dZ! I R s0 1337!
To the best of my knowledge, there is no posibility of an all encompassing regular expression that can translate 1337 to english.
Parent
Poor hosting company (Score:5, Interesting)
If nothing is found, will they have any recourse against the FBI or are they screwed?
Re:Poor hosting company (Score:5, Interesting)
Law always beats a ToS. If the FBI comes with a warrant for a piece of customer data, you've got to turn it over even if your ToS/Privacy Policy says you won't. To avoid getting caught in this jam, include a statement saying you'll turn over anything to any authority who presents a proper warrant.
If their business was based on not turning anything over to the spooks, well, so much for that idea.
Parent
Re:Poor hosting company (Score:5, Insightful)
I think the parent was probably referring to uptime guarantees, which the confiscation of equipment has caused the ISP to fail on, rather than anything to do with data privacy.
Parent
I wonder... (Score:5, Insightful)
script kiddy and spam proxy heaven (Score:5, Informative)
This is about the last data center on earth where script-kiddies can get free shell accounts.
This is a case were many servers got caught in the crossfire aginst the script kiddies and spamers.
There's gotta be more to this (Score:5, Insightful)
There has to be more to this story. From what the article says, the FBI just walked in and shut them down. While that might have happened this story seems to be extremely one sided and a little short on the detail.
Initially, I don't like the sound of it at all given that I host several domains and don't want the FBI coming in and taking all of my servers. But, we don't know what led up to the seizure....maybe it was a legitimate action? We shouldn't judge too harshly until we have all the information. I'm trying to play devil's advocate here.
Re:There's gotta be more to this (Score:5, Informative)
Rumors have ben flying for quite awhile that Paul (the owner) was either involved or turned a blind eye to DDoS drones on his network. Some rumors stated that he's DDoS competitors to prove the superiority of CITHosting's DDoS hardened servers.
Seeing as this "data center" seems to have been his basement, I'd bet his (lack of) logs, records, and monitoring left the FBI little choice but to seize the whole thing. And, we can assume he was uncooperative as he may have been involved or at least knoweledgeable.
The general reputation of Foonet also seemed to be a bit on the black hat side. No doubt there may have been some legitimate customers as well, but they seem to be known more for their spammers and script kiddies (and cheap shell accounts) than for their legitimate webhosting.
All in all, it looks to me like the FBI did what it had to do to effectively process the warrant. They were evidently going after a network, not a specific machine. Unfortunately, some legitimate customers got caught up in it.
It looks like CTIHosting was recently sold, and is being moved to a new data center in Chicago. Let's hope that it comes back as a legitimate business this time. They've already stated that IRC will be down indefinitely, so that's a good sign.
Parent
What kind of sick joke is this? (Score:5, Funny)
um... (Score:5, Insightful)
Will they delete the 'copied' data after they have finished, keeping only the information that they originally wanted, please this is v bad...
Thank God i dont live in the US
Full Text (Score:5, Informative)
By Rich Miller
Carrier Hotels Editor
Posted Feb 19, 2004
If FBI agents showed up at your data center bearing a warrant, would you be able to provide them prompt access to customer data? How long would it take?
That's an important question in the wake of an FBI raid of Columbus, Ohio hosting company CIT Hosting last Saturday. Federal agents wound up shutting down the entire operation, seizing all the company's web servers and all customer data as part of its investigation of a hacking incident.
CIT Hosting, also known as FooNet, markets itself as "the leader in the IRC and DDoS protection business for the last 5 years." The company posted a web page informing customers that its data center was shut down, and instructing customers to contact the FBI if they needed access to their files.
"The FBI executed a search warrant issued by the United States District Court for the Southern District of Ohio regarding the IRC network that we host," the company said in its statement.
IRC (Internet Relay Chat) is a live chat system that allows users to create private discussion rooms. While IRC has a lengthy history of legitimate use, it is also a medium for discreet communication between hackers. CIT said the FBI was "investigating whether someone hosted on our network hacked and attacked someone else."
"After several hours of attempting to track down, inspect and audit the terabytes of data that we host, the FBI determined that it was more efficient (from their point of view) to remove all of our servers and transport them to the FBI local laboratories for inspection," the statement continued. "The FBI has assured us that as soon as the data has been safely copied and inspected, the equipment will be promptly returned. Unfortunately, the FBI has not been able to tell us when they will be completed with their inspection."
The seizure isn't standard procedure, and there's no way to know exactly what prompted it. CIT's account suggests the FBI may have lost patience with the process. The IRC-focused nature of CIT's business may also have been a factor.
But if you're a data center operator, you want to avoid any scenario in which the FBI gets impatient and starts hauling away your servers. Just one more item on the contingency planning checklist for the times in which we live.
more important (?) how much customer data stored? (Score:5, Interesting)
Perhaps just as important, or more important, are you storing customer data that could/should be regularly deleted? Not that burning everything when the FBI shows up is the best option, but having a sensible scheme for what needs to be stored, and what would be better deleted and overwritten, seems to me to be important...
Look! I'm whoring! (Score:5, Informative)
From their site - don't forget to let the FBI know what you think! rwhite3@leo.gov
02/23/2004 CIT re-establishes service.
We have restored service at Equinix's Chicago Data Centers. We are in the same facilities as MSN and many fortune 500 companies. The facility has multi OC192 connections to the backbone.
The FBI has begun retuning equipment to CIT which is being shipped to our new facilities in Chicago.
At this time CIT will continue to provide dedicated DDOS Protected web hosting only.
CIT provides reliable and scalable solutions for customers of all sizes and services. Located in Equinix's Chicago Data Centers , CIT has access to all the major carriers without the need for local loop circuits.
Our Chicago staff is focused first and foremost on customer satisfaction, and will take every action necessary to accommodate each customer. Unlike many large ISPs, CIT prides itself in its ability to provide personalized service to each customer - if a customer calls twice for assistance, they can usually speak to the same representative. Our sales and support teams are allowed a great deal of flexibility to work together to resolve each customer's needs on an individual basis. Our success and rapid growth can be attributed to the satisfaction of our customers - word-of-mouth referrals account for a large portion of the new business we receive each month.
The IRC Network will remain down until further notice.
02/14/2004 FBI Confiscates all servers
Dear Customers of FOONET/CIT:
We regret to inform you that on Saturday February 14, 2004 at approximately 8:35 am EST, FOONET/CIT's data center in Columbus, Ohio temporarily ceased operations.
Here are the facts of what occurred:
The FBI executed a search warrant issued by the United States District Court for the Southern District of Ohio regarding the IRC network that we host. According to the warrant, it appears that the Bureau is investigating whether someone hosted on our network hacked and attacked someone else.
After several hours of attempting to track down, inspect and audit the terabytes of data that we host, the FBI determined that it was more efficient (from their point of view) to remove all of our servers and transport them to the FBI local laboratories for inspection. This was completed at 7:00 pm EST same day.
The FBI has assured us that as soon as the data has been safely copied and inspected, the equipment will be promptly returned. Unfortunately, the FBI has not been able to tell us when they will be completed with their inspection.
We have been told by the Special Agent in charge of the investigation that If you need access to your data you are asked to please contact the Bureau via email to rwhite3@leo.gov. Make sure to include in your email your name, mailing address, and telephone number with area code.
Since we wish to focus 100% of our efforts on restoring services, we would appreciate it very much if you do not attempt to contact us directly. Please rest assured that we are doing everything possible to restore service to you as quickly as possible.
To the many who have inquired, Paul and family are OK, although shaken by these events. They are at home and awaiting the blessed event of their new child's birth. We thank you for your good wishes and prayers.
Please check back here often. Through this site, we will keep you informed of ongoing developments as we know them.
Thanks again for your understanding.
The FBI is already returning some equipment... (Score:5, Interesting)
The only thing I find a bit odd about this whole thing is that it looks like they too the opportunity to relocate their data center to Chicago (it was previously in Cleveland). According to their news,
Wouldn't that unnecessarily delay the process of restoring service to their customers? Was the move already planned, or did they suddenly decide that they needed a different data center? Is it possible they're blowing the seize out of proportion in order to cover outages due to their move? Or did the seizure even actually happen?
Yes the police can seize things with a warrant (Score:5, Insightful)
Wether you find this acceptable depends I guess on wether you find it acceptable that the police can investigate crimes beyond posting a little poster asking criminals to please come to the station and answer their questions and to bring in any evidence on their own.
Normal search warrants on an office mean that the FBI and police storm the building and everyone inside is ordered to stop doing anything. No more accessing PC's no shredding of documents no phone calls no nothing. The reason is simple to prevent evidence from being destroyed.
I am frankly amazed that they even allowed the company to provide the info this shows that they probably don't suspect the company but rather that they hope to find evidence against someone else on their systems.
There was a rather nasty ddos attack on mircx and aniverse. The FBI seems to be investigating wether the IRC network hosted by this company was used in the attack. There seems to be a lot of hints as to the person who was behind the attack but sadly in america you need that silly evidence stuff (at least for use against americans).
So the FBI asked and got a search warrant. They then gave the company time to hand over the data but they couldn't. So the FBI used the law and did what we expect them to do. Secure any evidence by removing access to it. They are even giving the hardware back. They waited wich they don't have to and give the hardware back after copying data wich they don't have to do. Frankly I think they went way beyond what they needed to do to minimize damage.
Quit frankly the original poster seems to be one of those people that want the police to disappear. That line about wich coorperate master they offended is clear bullshit. mircx and aniverse are hardly the powers that be.
In any society that doesn't chose to be an anarchy you have to give some powers to the police to investigate crimes. Search warrants are pretty common in all democracys and also work pretty much the same way. If you get one it sucks but so far noone has come up with a better alternative except to just allow criminals free reign.
You know... (Score:5, Informative)
It's not like I agree with this, if indeed things happened as the article state... but a quick google [google.com] on FooNet (AKA / DBA CIT [cithosting.com]) turns up some VERY interesting results.
I google'd quickly [google.com] on a hunch, and sure enough I got some [ahbl.org] rather [completewhois.com] interesting [webhostingtalk.com] hits.
I claim to know nothing about SPEWS and how they go about adding to the blacklists, but they apparently are no stranger to it.
Furthermore, it seems that this IS NOT the first run-in with the FBI that FooNet/CIT has had: from here [blogspot.com], if you scroll down a bit, you'll see the following text: The FBI executed a search warrant issued by the United States District Court for the Southern District of Ohio regarding the IRC network that we host # We regret to inform you that on Saturday February 14, 2004 at approximately 8:35 am EST, FOONET/CIT's data center in Columbus, Ohio temporarily ceased operations. And this was from Feb. 14 ...
Another incident was reported out here [aginet.com] on 07/12/03 (search the page for "foonet") ... seems that 84898 spams swamped a box, and follow-up by FooNet sucked - e.g. they turned a blind eye.
There are far too many hits to return ... if you're interested in more, you can always head here [google.com]. For now, I'll close with this: I do not agree with the methods used, if they were as described ... however, FooNet/CIT is no stranger to the FBI, and perhaps this is all rolled in to the Feb. 14th notice ... maybe the FBI actually gave them 10 days to comply... I'd really like to see how this ends.
And the moral of the story is (Score:5, Informative)
Re:More to the story (Score:5, Insightful)
Parent
Other reports (Score:5, Informative)
I do wonder how cooperative CIT was. After several hours of requests for the info (with a warrent) the FBI must have been riled to say "F-this-S, haul it away!". Think about how much extra work that must have been. There's more to this story, pity no news service has looked into it yet.
Parent
Re:More to the story (Score:5, Informative)
Maybe you looked at the wrong sources
Parent
Re:More to the story (Score:5, Informative)
Parent
Re:More to the story (Score:5, Interesting)
(from here [york.ac.uk] )
Parent
Re:More to the story (Score:5, Informative)
Parent
Re:More to the story (Score:5, Insightful)
To get a search warrent you have to have something to go on already.
Parent
Re:More to the story (Score:5, Insightful)
We keep hearing about liberal judges this and liberal judges that in the media, but there are just as many conservative judges giving law enforcement rubber stamps on warrants.
Parent
Re:More to the story (Score:5, Insightful)
Moderators: I know this may be redundant but I was responding to his comment. He obviously didn't read the 50 posts in front of this one.
Parent
Re:Over the top anyone? (Score:5, Funny)
Parent
Re:How about the sustained financial damage? (Score:5, Insightful)
Parent
Re:How about the sustained financial damage? (Score:5, Insightful)
Parent
They had good reasons to shut them down, indeed : (Score:5, Interesting)
I can't get access to the article, but I guess that the story is about the shutdown of FooNet. FooNet isn't a "real" hosting solution ; it's a cheap shell provider for script kiddies who want to have their own ircd. They might also provide "serious" hosting services ; but as soon as one provides shell services for such a targetted audience, she knows that she will have to handle some specific problems - DDOS, flood, etc.
And according to what I know about the FooNet shutdown (if that's the same story), there was thousands of DDOS "drones" located at the datacenter, and the staff of the datacenter failed to shut them down. That sounds very dubious to me, but you might want to check this [ahbl.org] for another side of the story ...
Quoting :
PS: if the shutdown mentionned isn't the FooNet one, ignore this post :-)
Parent
Re:They had good reasons to shut them down, indeed (Score:5, Interesting)
Parent
Foonet/Creative Internet Technologies (Score:5, Informative)
Parent
Re:How about the sustained financial damage? (Score:5, Informative)
Of course, that was a long time ago, these days they would probably just have sent anyone suspected of having a copy of Illuminati to Guantanamo.
Parent
Re:and....Absentee landlords. (Score:5, Insightful)
Anyway this incident illustrates why the citizentry needs to be active in government instead of reactionary and "woe is me" after the fact. The government isn't very good at self-disciplining. That's our job. An absentee citizentry breds the results you see. Get out and vote in 2004. Get involved in local and national politics. Stop being a wallflower.
Parent
Re:and....Absentee landlords. (Score:5, Insightful)
Parent
Re:and....Absentee landlords. (Score:5, Insightful)
The democrats and republicans use rhetoric to convince the less intelligent that there's actually a difference between the two, assuring that almost everyone votes democrat to vote AGAINST the republican, or republican to vote AGAINST the democrat.
Unfortunately, there's no appreciable difference betwixt the two, so we're condemned to continue down the slippery slope.
Parent
Re:In response to a hacking incident? (Score:5, Insightful)
The fact is, this story is old because the FBI has already started returning the equipment back as of yesterday. The FBI confiscated everything on the 14th. CIT's web site says:
02/23/2004 CIT re-establishes service.
We have restored service at Equinix's Chicago Data Centers. We are in the same facilities as MSN and many fortune 500 companies. The facility has multi OC192 connections to the backbone.
The FBI has begun retuning equipment to CIT which is being shipped to our new facilities in Chicago.
At this time CIT will continue to provide dedicated DDOS Protected web hosting only.
Yes, the FBI overstepped they're bounds and yes it's frightening to think of this happening...but let's not get the facts wrong. The story here on Slashdot made is seem like the equipment was seized and the FBI probably won't be returning it, which isn't the case.
When reporting the crap that the US Gov throws at us, don't embelish...just report what is known and not a lot of speculation.
Parent
Re:In response to a hacking incident? (Score:5, Insightful)
Parent
Re:In response to a hacking incident? (Score:5, Insightful)
Bullshit - it reported about another step towards the police state in the US - nobody said anything about not getting it back. But by previous accounts they never care much about getting it back.
Parent
Re:In response to a hacking incident? (Score:5, Informative)
Parent
Re:In response to a hacking incident? (Score:5, Informative)
02/23/2004 CIT re-establishes service.
Hey, look, I tried my best, by submitting this three days ago:
2004-02-21 09:18:16 FBI confisticates (sic) ISP's servers: "more efficie (articles,usa) (rejected)
and it was rejected in about thirty minutes.
Maybe I should write more sensationalistic submissions?
But seriously folks, yeah, the FBI is returning the equipment now, but how much damage was done to an innocent ISP just because the FBI couldn't figure out how to do on-site data mining?
And if searching for evidence on a computer requires the FBI to physically cart the equipment to some distant lab, I guess we just write off any expectation that they'll be able to find data quickly in an emergency -- like, just off the top of my head here, for instance, wholly unlikely I'm sure, an imminent terrorist act?
Well, maybe a business got ruined, maybe the FBI can't scan data quickly enough to stop a terrorist crime in progress, but at least we all feel safer now that arch-criminal Tommy Chong is in jail.
Parent
Re:Seems to blow a hole in the theory.. (Score:5, Insightful)
This is all just speculation, naturally, but such a scenario would be very similar to other fourth amendment workarounds--perform broad, illegal searches (e.g. infrared through walls, which is inadmissible in the U.S. without a warrant) to target homes for additional surveillance. From the results of that illegal search, "happen to" notice something "on routine patrol," then get a warrant, and voila`--untainted evidence usable in court.
Parent
No you just aren't thinking (Score:5, Insightful)
You are a cop and arrive at a murder scene with a dozen doctors standing around the corpse. Would you really allow any of these medical experts to assist you with determining the cause of death?
A shutdown machine cannot erase data and the fbi got the tools to simply copy data from HD's without the computer it was in being involved. This prevents any chance of the data being destroyed.
Saying they replug them back in at the fbi shows you have no idea of what is involved in this kind of investigation. They copy the HD's directly and completly by taking them out and putting them in their own hardware.
How the fbi does this kinda stuff has been discussed often enough on /.
This is nothing else then the police sealing of a crime scene. Any inconvenience is considered though luck. It really is no different from streets being closed off to allow marathons or demonstrations or repairs. Yes they do attempt to minimize damage but the investigation comes first.
But lets turn it around. If the FBI raids a place like enron would you find it acceptable if the bosses were allowed to keep making phone calls and keep working on their pc's and play with their shredders as they could loose money if the police removed access and took everything away?
Of course not. Just because this is a small hosting company doesn't change the law.
Parent
Re:Not fast enough (Score:5, Informative)
Never. Hard drives are forensically examined by being removed from their machines and duplicated (usually using dd). No investigator would ever boot a machine which is the subject of an investigation - auto-deletion scripts are just too easy to write.
Parent
Electronic Evidence Gathering (Score:5, Informative)
The FBI cart equipment away to their premises in order to duplicate the systems and environments. If ever you get into information systems forensics, they would at least perform 2 copies. One is kept as an exact duplicate (to keep for their investigation records) and at least another to actually run analysis against (since searching on an active system can change the data stored in it).
It also makes it easier to catalog what they are working with, and prevents any interference from the outside.
Parent
Kinda (Score:5, Insightful)
the guy behind it seems to have been boosting about about a 200k botnet. 200.000 machines under his control. I think this is no longer some harmless hacking. This is stuff the fbi needs to investigate cause quit frankly nobody else seems able to stop this.
So unless you believe the net should be total anarachy ruled by those with the most bots then this kinda off stuff is sadly needed. To bad for those caught in the crossfire but that is live. Nothing really different from when all trains are disrupted because someone jumped in front of one. A marathon closing off all the streets despite the fact you hate sports. A demonstration causing massive gridlock despite the fact that only 200 people in a million people city are taking part.
Live sucks at times. Really this story shows that /. is getting more and more tabloid. A serious tech site would have asked what the fbi was investigating and wether the hosting company was hosting the person investigated or had servers wich were hacked or was simply a place where the hacker might have left evidence.
Parent
Re:Seizing an entire data center (Score:5, Insightful)
Foonet was the blackest of the black hat networks in existance. They hosted spammers, carders (credit card theives), DDoS drones, floodnets, and various other illegal activities and blindly turned the opposite way and let it happen.
Foonet was based out of the basement of the owners' house. There was no actual 'data center'. They had a T3 and a few T1s - nowhere near the OC-X level they were claiming.
They got tossed off of GBLX about a week before they were raided, and were humping the light at Qwest right before they got pulled.
I knew about this right after it happened.
Foonet will not be coming back, so get over it kiddies. Your DDoS drones are gone. Spammers, your mail servers are gone. Go run and hide under another rock.
A little hint for all of you who can't figure it out - the FBI doesn't usually seize all equipment if its something small. If they took all of the equipment, there is a good reason why they did (not that foonet was acting 'too slow').
I have a list of stuff about foonet on the AHBL page here [ahbl.org].
Parent