FBI and Next-Gen P2P Monitoring

AHuxley writes "Can the FBI get funding to create a next-generation network monitoring and database system for P2P networks, web sites, and chat rooms? Could the FBI's Regional Information Sharing Systems (RISS) network be opened to more law enforcement agents across the USA? Will the tracking of p2p users via 'unique serial numbers' generated from a person's computer be expanded from its first use in late 2005? Is your p2p application or plug-in sending back your MAC address, firmware revision, manufacture date, GUID or other details?" Could this story submitter pose any more questions in his submission? Won't someone please think of the ... oh, never mind.

For child porn?

[MR.Mic]

Riiiight...

This is one hell of a slippery slope, my friends.

Manufactured Evidence

[conureman]

In the olden days, when I was a kid, we happened into dealing with the F.B.I. Subsequently, I know to engage a large supply of salt anytime I read about any investigation that has been tainted by their crime lab. Think of the children and send more money. Yeah. Knowing their proclivity to abuse/disregard the law, I don't really see the upside to this.

Let's hope so

[77Punker]

Maybe if they do start monitoring all that traffic, people will get a clue and start using Tor for all their internet traffic. Especially their plaintext passwords. Dangerous business, letting the FBI know where those plaintext passwords are going. Better encrypt them with Tor!

Anyone wonder how many exit nodes the NSA already runs? That'd be a far better(easier?) approach than monitoring "normal" traffic since I suppose the interesting stuff is already going through Tor, though in a typical hour-long scan I can't find any really "interesting" unencrypted web traffic at my exit node.

Folks surfing porn? Plenty. Plenty of Chinese blogs with plaintext passwords, too. But even those Chinese blogs are benign and not something that would be censored by their gov't (I think). Based on the pictures and my basic proficiency with Chinese, it's either folks just fooling around with Tor or it's steganographic.

Re:Does F/OSS help?

[26199]

I think any of those would be quite hard to inject into open source code.

After all, in a p2p app the traffic is the most important thing ... and is going to be watched very closely. Patches that modify what go over the wire will be under considerable scrutiny.

And how are you going to collect those details once they're transmitted? By their nature p2p apps are hard to keep track of.

Not to say it couldn't happen. But I don't think it's much of a risk compared to the simple fact that your IP address is very visible when using a p2p app...

Re:All Fear, No Facts

[I(rispee_I(reme]

"It only takes one to raise a stink about it.", goes the popular reasoning.

This is why OSS is important!

[mich.linux.guy]

Is your p2p application or plug in sending back your MAC address, firmware revision, manufacture date, GUID or other details?"

This is exactly why Open Source Software is so important. Even though the average user may not have the skill to examine the code for breaches of trust, there are many in the community that can and do. These breaches are fixed or made public and public opinion will decide whether or not the P2P application is trustworthy.
Closed source applications from companies like M$ can't be trusted in this way.

FBI Sofware Projects are Notorious for Failures

[CodeBuster]

The last time the FBI tried to build a large piece of custom software, a case-file management system [cnn.com], they ended up spending 170 MILLION dollars over 3+ years for software which basically did nothing useful (a complete failure). The only way that this will work is if the FBI contracts someone else to build it for them and even then the chances of failure are high unless they are willing to deal with criminals (i.e. Russian hackers who write the software for worms and spammers) to get it done which will happen about the same time that hell freezes over. The one good thing about governments when it comes to controlling the populace is that they are inefficient. If the government spent our tax money efficiently and effectively on surveillence and authoritarian enforcement actions then we would already be living in 1984 [wikipedia.org].

Re:Are MAC addresses globally unique?

[mrvan]

I think they are globally unique, and since they are 6 bytes long the supply is practically infinite (256^6 = 216x10^12, ie every person can have something like 30,000 mac addresses)

Come to think of it, it's a bit silly that they used 4 bytes for the address that has to be globally unique and 6 bytes for the one that only has to be locally unique...

Re:All Fear, No Facts

[Robocoastie]

It's just the typical Democratic party cry wolf "we gotta do something!!!!" syndrome again. In this case it's also putting Sen. Biden back in the spotlight after his poor performance in the Iowa caucus. Political moves aside though let's think about what they are really asking. What is child porn? The government even lacks a definition of "porn" much less child. I have a serious problem believing that "child porn" is an epidemic requireing the black helecoptors so to speak. What likely is popular though is teen-fascination which psychiatry has an entirely different definition for. Our society in fact is geared toward that even between cheerleaders and dancers being just short of being nude, Disney channel turning tweens into glamored up pop stars, and shows like Dawson's Creek, Gossip Girls and the like having more adult themes than Desperate Housewives. This is nothing new though; in fact society used to marry their women off between 14 and 17 anyway. My point is I really wonder if real child porn actually is as bad as the fear mongers claim or if people's collective conscious is simply equating teen-fascination with it when they hear of those cases (which has increasingly been from female teacher - male student lately). The result of which is the "we gotta do something!!!" panic which then grants the government sweeping powers to do all kinds of spying with a fictional and ultimately false pretense.

Re:All Fear, No Facts

[dgatwood]

All it takes is indirection to make it so that it does, though. Make the P2P client randomly choose whether to look locally or ask its neighbors. Make it lie randomly and say "I don't have it" at all times to mask the ability to use probability to determine whether you are serving locally-stored data or just passing on the request even with knowledge of how many peers your node has and generating hundreds of requests using a modified client. If nobody is doing that already, color me surprised....

Re:FBI Sofware Projects are Notorious for Failures

[iminplaya]

...unless they are willing to deal with criminals...

The authorities use criminals all the time to catch other criminals. Most snitches are criminals themselves looking for a way to stay out of prison. It shouldn't surprise you at all if they employ Russian/Chinese hackers. And I consider their surveillance and authoritarian enforcement actions to be pretty efficient. If you want to break them down, you need to get the authoritarians to go after each other. Use the same methods that work so well on us.