FBI Has Tor Mail's Entire Email Database 195
An anonymous reader writes "Tor Mail was an anonymized email service run over Tor. It was operated by a company called Freedom Hosting, which was shut down by the FBI last August. The owner was arrested for 'enabling child porn,' and the Tor Mail servers suddenly began hosting FBI malware that attempted to de-anonymize users. Now, Wired reports on a new court filing which indicates that the FBI was also able to grab Tor Mail's entire email database. 'The filings show the FBI built its case in part by executing a search warrant on a Gmail account used by the counterfeiters, where they found that orders for forged cards were being sent to a TorMail e-mail account: "platplus@tormail.net." Acting on that lead in September, the FBI obtained a search warrant for the TorMail account, and then accessed it from the bureau's own copy of "data and information from the TorMail e-mail server, including the content of TorMail e-mail accounts," according to the complaint (PDF) sworn out by U.S. Postal Inspector Eric Malecki.'"
Wait, WTF? (Score:5, Insightful)
Anyone with an Internet connection is capable of 'enabling child porn'.
Fuck sakes - is CP now the backdoor to the whole US Constitution (not to mention the means by which anyone, anywhere, can be arrested for any reason?)
Someone needs to seriously put a curb on this.
Re:Wait, WTF? (Score:5, Insightful)
Mentioning "child porn" and "backdoor" is probably a poor choice of words when you're logged in and traceable.
BADTHINK MINDCRIME DETECTED! (Score:5, Funny)
Re:BADTHINK MINDCRIME DETECTED! (Score:5, Insightful)
They only think about the children when it fits their agenda.
Re: (Score:1, Funny)
And that's what I call my penis!
Re:BADTHINK MINDCRIME DETECTED! (Score:4, Insightful)
I miss George Carlin [imdb.com] this was part of such a good bit. Too much focus on kids and totally ignoring that adults should think and acting as if children should be infinitely protected.
Re: (Score:1)
So because you're not logged in you're not traceable?
Re:Wait, WTF? (Score:5, Insightful)
Is CP now the backdoor to the whole US Constitution (not to mention the means by which anyone, anywhere, can be arrested for any reason?)
Now? Where have you been for the past 20 years?
Re:Wait, WTF? (Score:5, Informative)
When Slashdot was very young, before we had a mode system, the was an article on "the four horsemen of the internet apocalypse": that our rights online were sure to erode in the name of fighting terrorism, CP, hacking, and/or drug dealing. Wow, that was an amazing prediction - if we include "torrenting ripped media" in hacking, that's been right on target. I hadn't been understanding the "drug dealing" part until the Silk Road bust, but sure enough.
This is why I resist giving the government any special power only to be used in extremes - excuses are so readily available that "extremes" becomes commonplace in a few years. And whatever the real motivation for the various TOR busts, WikiLeaks is effectively dead now as a result, with their TOR service is gone.
You can certainly see the FBI wanting TOR just strong enough to leak information from the Iranian government safely, but not strong enough to leak information about the US government safely. Sad that it seems to have come to that.
Re:Wait, WTF? (Score:5, Insightful)
our rights online were sure to erode in the name of fighting terrorism, CP, hacking, and/or drug dealing. Wow, that was an amazing prediction
No it wasn't. Even before the internet, these things were used violate peoples constitutional rights.
Re:Wait, WTF? (Score:4, Funny)
Hey now, are you saying that the same old thing on the internet isn't new and patent-worthy? Heresy!
Re:Wait, WTF? (Score:5, Interesting)
And don't forget that the range "child porn" materials already includes cartoon drawings, adults who look too young, and images of fully-clothed children. Soon the definition of "child porn" will also be expanded to include pictures of cats and any women who are not wearing full headscarves.
Re:Wait, WTF? (Score:4, Interesting)
It's our own fault for giving them such a powerful weapon. Last week I suggested that possession of child pornography should be decriminalized, i.e. they can confiscate it from you but you can't be charged with a crime or otherwise publicly shamed. There have been a lot of cases in the UK where someone was falsely accused, often after the police bungled some other investigation and were trying to cover themselves by saying "oh, but he was a paedo, so at least we got him".
Of course some idiot immediately accused me of being a paedophile and went on a fairly extensive rant about it. In amongst the raving he made the point that anyone advocating decriminalization for any reason will be subjected to his kind of behaviour by a large proportion of the public, and unfortunately I think he could be right. It's a shame because decriminalization could go a long way to allowing people who do find themselves attracted to children to come forward and get help without fear of public shaming or prosecution, as well as stopping police abuse.
Re: (Score:2)
Well it looks like they got the jump on you and shutdown your higher brain functions first. And by the way you do not take money away from them you just stop voluntarily giving them money in the first place.
Re: (Score:2)
> is CP now the backdoor to the whole US Constitution
The backdoor? Nah, if it was that simple they wouldn't need terrorism or drugs.
Re: (Score:3)
Fuck sakes - is CP now the backdoor to the whole US Constitution (not to mention the means by which anyone, anywhere, can be arrested for any reason?)
Cheat code in Democracy for Dictator Mode: Up, Up, Down, Down, Left, Right, Left, Right, B, Child Porn Exists
Re: (Score:1)
Re: (Score:3, Informative)
Fuck sakes - is CP now the backdoor to the whole US Constitution[...]?)
Yes.
https://en.wikipedia.org/wiki/Four_Horsemen_of_the_Infocalypse
Re: (Score:1)
True, but the crime isn't being capable of enabling child porn is it?
The person in question was, knowingly, providing services to child pornographers.
Re: (Score:1)
Can you prove that? The whole purpose of Tor is anonymity of users and data. How can you prove that he knew what was going through his email service? That defies the point of secure email.
Why would *we* need to prove this? The government already did. There's thousands of anonymous services out there that are allowed to run perfectly fine. I'm sure the seizure of the emails provided ample evidence to prove he was enabling this to happen. Otherwise they would have prosecuted the individuals or worked with the owner instead.
Re:Wait, WTF? (Score:5, Insightful)
Re: (Score:2)
Re:Wait, WTF? (Score:5, Insightful)
Spiro Agnew must be cackling in his grave.
Same for John Edgar Hoover.
If you're not on their list, it only means they haven't got around to you yet.
everyone is guilty of something, sooner or later
Re:Wait, WTF? (Score:5, Insightful)
So, here's the rub:
When evaluating a hosting company of some flavor, you also have to know if they are hosting anything that could be interpreted as permitting its services to be used for child porn, terrorism, drug talk, insider trading, prostitution, seditious speech, pornography, hate speech, sins against the Father, sins against the President, or campaign finance.
If so, don't depend on that service for any privacy.
Basically, if there's a US nexus, you cannot hire a hosting company and expect any privacy.
The terrorists hate us for our freedoms. Go shopping.
Re: (Score:3, Insightful)
One would expect a 100% anonymous hosting company to not engage in illegal practices which would force their company to be taken down. Unfortunately even the most tech savvy people are dumber than rocks.
No, one would expect a 100% anonymous hosting company to be incapable of knowing whether they are engaged in illegal activity. If the hosting company can tell the difference then they are less than 100% anonymous.
Re: (Score:2)
My answer:
Ready, Aim, Fire.
In short: where's all those guns now that you need 'em?
Re: (Score:2)
Re: (Score:2)
Yes, and every internet enabled user in the US is legally required to take down illegal material if its been detected (I assume through the confiscation of another users' account information).
If you don't follow the laws of the land, don't expect to be protected from its freedoms.
Re: (Score:2)
Re: (Score:2)
I guess you better not write in your diary about that hot dream you had unless you start it off with "I carded her and she was 21" to keep from going to jail,huh?
I tried that, but then the Feds said that it was a fake ID !
They should know - their "stinkin' badges" are fake.
Re: (Score:2)
If you want to prevent child molestation, perhaps one way to accomplish that is to allow people an outlet which in fact, harms no children, such as stories or cartoons. Yeah, it's icky. But then so is murder, and billions of people enjoy fictionalized murder in the most gory ways fictionally possible. Look at murder rates: http://www.disastercenter.com/... [disastercenter.com] (scroll down for the x/100k figure) -- they're the lowest now that they've been in half a century AND our movies and video games are more realistic a
Re: (Score:2)
Who would fight whom?
That's a serious question. What two (or more) large groups of Americans would organize themselves into armies of any respectable amount of strength?
Anyone trying to fight a loyal US military would get squashed faster than you can say "daisy cutter", I don't care how many M-16s and RPGs you have in your basement bunker. Maybe mutiny, turning the US Army into God's Army? Or how about Walmart and Monsanto *really* putting the competition out of business?
The states that keep threatening
Re: (Score:2)
Also, look how much trouble we had policing and 'holding' Iraq, a much smaller country (in terms of both population and geographical area.)
Re:NO, no no! (Score:4, Informative)
"I seriously, seriously doubt soldiers would follow orders that result in the slaughter (and it would be slaughter) of thousands of Americans. "
You mean like in the Civil War?
Re: (Score:2)
In other words, fighting an opposing ARMY is probably quite a bit different than fighting CIVILIANS -- and only a sociopath would think it appropriate to use the same level of force in both situations. Doubly so against your own country.
Re: (Score:2)
Think of something more like the Arab Spring vs the Civil War. Maybe i'm being optimistic, but I can't see the US army rolling tanks through the streets to quash widespread revolt. In the US. Killing US civilians.
Arab spring is civil war. It's just named differently since it was backed by the west
Re:NO, no no! (Score:5, Insightful)
Good question. If only there was a modern day precedent for the US Military having a difficult time overcoming a vastly inferior enemy of insurgents.
Re: (Score:2)
The government = zombies (Score:4, Insightful)
In those zombie movies, no matter how well the humans are barricaded in a place, eventually the slow-witted zombies will always break in. They have all the numbers and time required.
Re: (Score:3)
I'm not sure your analogy really works here.
If the humans were well baricaded in a place and they remained safe there from the zombies ever after ... it wouldn't be a very entertaining movie.
Re: (Score:2)
I mean no matter how innovative or cunning the group of humans is in trying to protect themselves, they can at best hope to stay one step ahead of the zombies
Re: (Score:1)
No. People in Zombie movies are stupid, and make non-sensible decisions., It's the only way for Zombies to be a threat. Anyone who thinks for a minute can avoid zombies.
Re: (Score:2)
What are you doing out here Fred?!
And nothing illegal was ever sent.. (Score:1)
..from a gmail address, or what?
notwithstanding, they doubtless have access to the entire gmail dbase anyway.
Re: (Score:1)
Re: (Score:1)
Just get the secret rubberstamp court to retroactively make it legal. Problem solved.
Tor is a honeypot (Score:3)
I don't know if it was designed for that purpose, but in practice Tor is a honeypot. Encryption too? (though not by design). Maybe it's time to consider steganography more, though it has its limits in terms of bandwidth, and if encryption isn't widely used, steganography certainly won't be.
I2P is a better alternative (Score:2)
Its based on P2P principles (i.e. users contributing bandwidth) and the result is much less centralized than Tor.
There is also a DHT (distributed) email system that runs over I2P, although it is not the default I2P email yet. This new email system has no servers to raid; it is all distributed P2P.
Re: (Score:2)
No, it's just that people don't understand what Tor does and does not do.
TorMail was pretty much like any other mail service. The mail was not encrypted, it was sent plaintext over the internet to users of other services. All TorMail did was provide anonymous access to a mailbox, and it was up to the user to make sure they didn't reveal anything that would give clues to their identity. Clearly sending an email to someone is a pretty big clue that you are somehow associated with them, but generally speaking
Re: (Score:1)
If you're attempting to participate in multiple threads, even while logged in, you will still get a stupid wait time (Slow down, cowboy! The Dice CEO hasn't gotten laid since the last time you posted, better wait awhile). If any of your recent logged-in posts have been modded down, you can still get the Pink Page of Death.
really? (Score:5, Insightful)
i don't understand why people think that the FBI and NSA and CIA are just going to stand by and allow criminal activity when informants (no doubt where law enforcement gets 90% of its info) tell them how and where it's happening.
technology may slow them down a bit, but people are foolish if you think your VPN and Tor browser is going to protect you for long *if* a three-letter agency really decides to getya.
Amen Brother! (Score:3)
It's like expecting your dog to ignore the roast you left on the counter while you went to work. Sure, it could happen, but there's no reason an intelligent person would expect it to happen.
Re:really? (Score:5, Insightful)
The point of this article is not that the FBI went into a companies email server and collected the emails of some criminals. The point of the article is that the FBI declared the entire email service criminal, collected its entire contents, and kept it for their own and then started advertizing it as a legitimate service. This is clearly, without a doubt, unconstitutional. Not only are they violating all the innocent people who were using the services rights, they are violating the CRIMINALS rights as well! They've jeopardized their own convictions and the only 2 outcomes of this are:
1. The convictions stand, and the US continues down this totalitarian surveillance state road.
or
2. The SCOTUS finally gets off their collective asses and declares this unconstitutional... unwinding decades worth of convictions based on illegal evidence and releasing tens of thousands of some of the worst criminals we have back on the streets.
Neither on of those options are very palatable and I'd prefer the FBI gets back to investigating rather than spying to do their jobs.
Promises of anonymity are greatly exagerated (Score:5, Insightful)
When you trust a third party, with whom you have no actual connection, to keep your data private, you are pretty much asking to have it compromised. The best encryption and anonymity schemes in the world are useless in the face of a court order or questionable system administration. Did you really think some anonymous person was willing to go to jail for your privacy? You're both silly and naive if you think so.
+1 Insightful (Score:2)
Re: (Score:1)
Because he is a bad pet owner?
Re:Promises of anonymity are greatly exagerated (Score:5, Informative)
Lavabit was willing to take the sword and went out of business.
Re: (Score:2)
Lavabit was willing to take the sword and went out of business.
Yup, hence suggesting that over the long-term the only viable privacy supporting email servers will be ones that don't actually maintain privacy. Just artificial selection at work...
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
On the contrary, I2P's DHT-based email uses no servers. Its all P2P-distributed, as is the underlying anonymous network protocol. No single court order or raid can acquire its data since that data only exists on the endpoint email clients.
Re: (Score:2)
Trust that at your peril. If you think the people who tracked down Osama bin Laden and killed him in his bedroom can't get ahold of your email, I'd like to make sure I'm not near you when the inevitable very bad thing happens. Too often bystanders are considered acceptable casualties.
Re: (Score:2)
If hundreds of millions of people switched to I2P to render *easy* mass surveillance impossible (thereby making mass surveillance very expensive), how does your narrative fit into that at all? You might as well claim that people will become drone targets because they own handguns; That's just a teabagger's fantasy.
The thing you may be missing from the whole privacy discussion is that it is generally considered a detriment to the public when society has been turned into a panopticon... sooner or later even t
Re: (Score:2)
Now you're not trusting a single third party, you're trusting -every- third party. That's just begging to be compromised. If secrecy is important to you, take steps to make sure nobody realizes you're communicating. Eliminate or reduce the ability of outsiders to figure out who you're communicating with, because that can be just as damning as having them intercept the communication (e.g. the phone meta data that the phone company must maintain in order to do business). Don't use untrusted third parties
Presumed guilty (Score:5, Insightful)
Re: (Score:1)
Re: (Score:2)
Re: (Score:1)
Not only that, but from the sounds of it the FBI needed a warrant to access/use the information they already held. So they applied for one, and it was granted by a court.
From what I can tell, it's all according to due process. The traditional kind, not the m
Presumed Complicit. (Score:5, Insightful)
See, that's the thing. They weren't providing hosting services SPECIFICALLY to child pornographers. They were providing services to ANYONE. Anyone at all. No questions asked.
Some of those people happened to be child pornographers. The vast majority of them were not.
You're arguing it's reasonable to presume that any user of a service that is ALSO used by criminals should reasonably be treated as suspect? Oh, child. You don't think there's child pornographers on GMail? Using EC2? With Instagram accounts? What service that's open to all ISN'T "a crime ridden neighborhood" in your example?
Re: (Score:2)
Re:Presumed guilty (Score:4, Informative)
Legally, they should delete all of the tormail data since it wan't relevant to their search.
Re: (Score:2)
Wrong country for hosting (Score:3)
If you care about your privacy or want that your data is still yours, don't host it there, even encryption can be surpassed if you can control the hardware that decrypts it. UK, Australia, Israel, and others allies in the intelligence operations should be avoided too. And is not just for privacy paranoids only, companies should be worried too [slashdot.org], and is not limited to just IP, managing data that can get you sued if disclosed will make you liable.
Wonder what countries with strong citizens privacy laws will require to any company that want to work there.
Re: (Score:2)
Just go in a gay porn chatroom, that will reduce the odds of someone monitoring live in they have the wrong supervisor.
The signal-to-noise ratio will be better than steganography anyway.
Daft (Score:2)
You have to be daft to consider email over the public internet to be private. It never has been and never will be.
Wrong technology to use in carrying out any kind of sensitive communications of any sort.
Re:Daft (Score:5, Funny)
Phone lines, but only if you speak in Navajo.
Codetalkers (Score:2)
Phone lines, but only if you speak in Navajo.
Historical trivia -- the Navajo codetalkers didn't just speak in the Navajo language, they spoke in a strange code that used Navajo vocabulary. So instead of simply translating the word abreast for so many people walking shoulder-to-shoulder, they would encode that first as ant breast, and then translate that into the corresponding Navajo, probably wóláchíí be’. More here [wikipedia.org]. Other Navajo speakers who hadn't been trained in the code wouldn't understand what was being said. The Jap
Re: (Score:2)
Re: (Score:2)
Sounds flatulent. Perhaps it's the code word for politician? :-P
Cheers,
Re: (Score:2)
PGP with keys exchanged at a signing party, then applied to said emails?
I would love to do that but try and convince the every none geek to take the five minutes to install PGP and set up Pidgin and Thunderbird...
Yes it is dead simple to do,
Yes it would lock the NSA out tomorrow.
Yes it is free.
The problem is normal people are lazy apathetic, stupid and slaves of habbit and unwilling to help themselves if it means one more click before they click send it is to much for them.
Well there's your problem. (Score:2)
"the TorMail e-mail server"
The server. Singular. Did TorMail's creators and users skip class the day they explained how Tor worked?
But...but.... (Score:1)
What does all that have to do with national security?
Re: (Score:2)
...except when they change their mission statement to focus on national security [slashdot.org].
This is Torrible News! (Score:1)
It's old hat by now that Constitutional protections don't seem to apply to the Internet, because when it's computers, it's somehow different.
But the FBI's actions here seem to be a step beyond that: this was computers on a different kind of network, and therefore, virgin legal territory.
It's not that I'm upset that the FBI tried to catch a specific criminal, mind you. But running malware programs and taking all the data they can physically get their hands on? That's not just retrieving evidence for court ca
problems (Score:1)
Re: (Score:3)
What kind of pron is it? A girl of 17 years, 364 days, looking "provocative"? I better check the pics on my computer. Somewhere I probably have one of my young daughter eating a pickle or something. Those perverts get off on anything. Does it matter if the pickle is half sour or full sour?
Re: (Score:1)
Re:Child porn, think of the children, blah blah bl (Score:5, Insightful)
What kind of pron is it? A girl of 17 years, 364 days, looking "provocative"?
No. Next question?
Re: (Score:1)
It matters if you are shoving the pickle up her ass.
Now do you see the difference?
Re: (Score:1)
Great. Now I can't get the image of sweet & sour pickle child porn out of my head.
Zeno's consent (Score:2)
The original formulation of Zeno's paradoxes concerned hair-splitting the age of consent, but posterity abstracted the quivering quibbling to better suit the Victoria era.
Re: (Score:2)
Of course. Never mind that she was probably a great mom. In this day and age she'd probably be sent to prison (possibly with a reduced sentence because she's a women) and CPS would have abducted you and your brother. Be grateful you weren't born later.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
http://www.independent.co.uk/news/julia-somerville-defends-innocent-family-photos-1538516.html (there have been other cases too)
Re:Child porn, think of the children, blah blah bl (Score:4, Insightful)
Considering that the official definition of "Child Porn" includes cartoons, and has been in the past used to arrest people for the possession of cartoons of "apparently underage" (don't remember the rest, sorry), I'm not willing to accept ANYTHING they say about the child porn problem.
Enforce the laws that already exist against violence and abuse. Do that and the entire problem goes away. (And if people want to see provocative cartoons, so what. It doesn't hurt anybody, and if you don't like it, just don't watch it.)
FWIW, given the prevalence of anime, I'd say that there's a huge market for cartoon child porn, given a strict enough definition of porn. And so what! It just doesn't matter. Enforce the laws against violence and abuse, and the problem goes away.
P.S.: Before this became an issue, it was, or appeared to be, much less of a problem. Most parents had explicit photographs of their children. And I just don't see that as a problem.
Re: (Score:2)
Before this became an issue, it was, or appeared to be, much less of a problem. Most parents had explicit photographs of their children. And I just don't see that as a problem.
At my sons' 21st birthdays, among the many photos shown, were several of them in the bath, or in the backyard under a sprinkler, with genitalia showing. They were 1 or 2 at the time. These were shown simply to amuse the crowd. My sons were certainly not upset, I doubt anyone in the crowd was upset. I would bet serious money that no one present felt these photos were pornographic in any way.
Two bricks to the testicles of paedophiles would not upset me. Innocent photos of my kids being labelled as pornographi
Re: (Score:2)
That isn't THE official definition. It may well be so in some jurisdictions.
In mine, as far as I can tell, it is an explicitly sexual image of an identifiable female known to be under 18 at the time. I wouldn't bet that every prosecutor in the region would abide by that, but it appears to be the law.
Re: (Score:1)
Re: (Score:1)
It is if you do it right. [gnupg.org]