How Boing Boing Handled an FBI Subpoena Over Its Tor Exit Node 104
An anonymous reader writes: Cory Doctorow has posted an account of what happened when tech culture blog Boing Boing got a federal subpoena over the Tor exit node the site had been running for years. They received the subpoena in June, and the FBI demanded all logs relating to the exit node: specifically, "subscriber records" and "user information" for everybody associated with the exit node's IP address. They were also asked to testify before a federal grand jury. While they were nervous at first, the story has a happy ending. Their lawyer sent a note back to the FBI agent in charge, explaining that the IP address in question was an exit node. The agent actually looked into Tor, realized no logs were available, and cancelled the request. Doctorow considers this encouraging for anyone who's thinking about opening a new exit node: "I'm not saying that everyone who gets a federal subpoena for running a Tor exit node will have this outcome, but the only Tor legal stories that rise to the public's attention are the horrific ones. Here's a counterexample: Fed asks us for our records, we say we don't have any, fed goes away."
A service to the community: release the text (Score:2, Interesting)
I think it would be a great service to the Tor community to release the text of what Boing Boing sent to the FBI as a shining example of how to handle such requests. It may need to be specifically tailored to the sender, but something to go off of might be of benefit to folks running a node who don't have the funds to see legal help outside of /r/legaladvice [reddit.com].
Re:A service to the community: release the text (Score:5, Informative)
From the article, literally the first link in the summary:
Special Agent XXXXXX.
I represent Boing Boing. I just received a Grand Jury Subpoena to Boing Boing dated June 12, 2015 (see attached).
The Subpoena requests subscriber records and user information related to an IP address. The IP address you cite is a TOR exit node hosted by Boing Boing (please see: http://tor-exit.boingboing.net/). As such, Boing Boing does not have any subscriber records, user information, or any records at all related to the use of that IP address at that time, and thus cannot produce any responsive records.
I would be happy to discuss this further with you if you have any questions.
Re: (Score:2)
Re: (Score:3)
Probably fairly similar. Or at least no worse than it would be otherwise. Most of the times your read about the feds jumping up and down on someone, it's when they decided to be "clever" or belligerent, or similar. Nothing is more likely to get a good response than a calm, respectful response.
and custom license plate GUILTY (Score:2)
> Most of the times your read about the feds jumping up and down on someone, it's when they decided to be "clever" or belligerent, or similar. Nothing is more likely to get a good response than a calm, respectful response.
So true. Most of the time. Of course there are exceptions.
Also, getting a custom license plate that says GUILTY probably doesn't help.
Re: (Score:2)
His license plate is "DRUNK" [boingboing.net]
If your position is that use of Tor is circumstantial evidence that you're trying to evade the law or do something otherwise "shady", I don't think that's a valid assumption.
Re: (Score:2)
No, it was a Kim Dotcom reference. He got the GUILTY license plate. That and similar "rub their nose it" actions didn't help his relationship with law enforcement and the courts.
I WAS not saying that using Tor indicates that one might be doing something shady, but I'll say it now. People using the internet in the clear, not using Tor , are doing something shady maybe 1% of the time. On Tor, maybe 80% of the traffic is shady. So arithmetic tells us that Tor traffic is 80 times more likely to be shady th
Re: (Score:2)
Re: (Score:2, Funny)
If you have the personal cell phones of the EFF's lawyers, you're most likely a thief and in need of some jail time.
Re:A service to the community: release the text (Score:5, Insightful)
Not true, I ran an anonymous service for years. (Long before TOR became popular)
I was visited by the FBI and Secret Service. I was also served warrants and subpoenas.
The truth is, there is no law requiring that you track users or maintain logs of user activity. (In the USA)
If you respond politely that let them know that it is part of an anon service and there are no logs available, they normally drop the request.
Re: (Score:2)
"Chief, the Doctorow subpoena turned up nothing -- he said they have no logs."
"Isn't this like that other one with that guy a while back -- Anon-Admin, was it?"
"Yup, pretty much identical."
"Ok, if this happens again, let me know. We'll kick it back through the law channels and get them forced to keep logs."
"Gotcha. Where do you want to get lunch?"
Re:A service to the community: release the text (Score:4, Insightful)
Note the FBI asked for logs and stuff - they were assuming the IP address in question was loaned out - either they were an ISP, or maybe a VPN provider, or some other thing.
Presumably Boing Boing owns enough IP addresses that they can dedicate it just for TOR exit nodes. And nothing else - I mean, if they had a webserver on it, they presumably they would have logs to hand over.
If it was you or I with a leaf connection to our ISP, then most likely things will not be so easy - since they will go after the ISP, who will happily give up your information. Unless of course, you decide you want to give Comcast more money and buy a connection just to run Tor on.
So the trick may work in the limited case where yes, it's a dedicated Tor exit node and not used for anything else. But if there's a chance it was used for personal reason or there were logs for some other service, then maybe things won't be so good.
Re: (Score:3)
"Special Agent XXXXXX.
I represent Boing Boing. I just received a Grand Jury Subpoena to Boing Boing dated June 12, 2015 (see attached).
The Subpoena requests subscriber records and user information related to an IP address. The IP address you cite is a TOR exit node hosted by Boing Boing (please see: http://tor-exit.boingboing.net... [boingboing.net]). As such, Boing Boing does not have any subscriber records, user information, or any records at all related to the use of that IP address at that time, and thus cannot produce
Re:A service to the community: release the text (Score:5, Informative)
I think it would be a great service to the Tor community to release the text of what Boing Boing sent to the FBI as a shining example of how to handle such requests. It may need to be specifically tailored to the sender, but something to go off of might be of benefit to folks running a node who don't have the funds to see legal help outside of /r/legaladvice [reddit.com].
From the article:
We contacted our lawyer, the hard-fightin' cyber-lawyer Lauren Gelman, and she cooled us out. She sent the agent this note:
Special Agent XXXXXX.
I represent Boing Boing. I just received a Grand Jury Subpoena to Boing Boing dated June 12, 2015 (see attached).
The Subpoena requests subscriber records and user information related to an IP address. The IP address you cite is a TOR exit node hosted by Boing Boing (please see: http://tor-exit.boingboing.net... [boingboing.net]). As such, Boing Boing does not have any subscriber records, user information, or any records at all related to the use of that IP address at that time, and thus cannot produce any responsive records.
I would be happy to discuss this further with you if you have any questions.
And that was it.
Re:A service to the community: release the text (Score:5, Funny)
Seems unlikely, considering that it being a single click away was a sufficient deterrent to you reading it.
Re: (Score:2, Interesting)
Re: (Score:2)
The analogy would be a bit different for a TOR exit node, I'd think. You'd be carrying the safe, but as soon as stuff is put in there, you can see what is going in and where it came from. The only thing an exit node can not see is whom it is addressed to. So there is some level of knowledge that an exit node could have, although they can't point a finger to whom is loading it. Then again, whether you choose to log any of it or not is an entirely different matter. You could also rightfully claim to not have
Re: (Score:2)
Re: (Score:2)
What's the reasoning behind not returning confiscated equipment? I mean the legal reasoning, not the "we're the fucking police, so we'll do whatever we want". As far as I know, the UK police are just as bad.
Re: (Score:2)
Re: (Score:2)
Dude, relax. I wasn't commenting at all on what you said about the way authorities handle this. I merely pointed out that exit nodes work in a certain way. I was neither agreeing nor disagreeing with you, and certainly not "assuming" anything.
Re: (Score:2)
More US citizens were killed in conscription to foreign wars than lives destroyed while defending domestic civil rights.
Which would you rather fight for?
Re: (Score:2)
More US citizens were killed in conscription to foreign wars than lives destroyed while defending domestic civil rights.
Which would you rather fight for?
[citation needed]
The US suffered more dead in the civil war than in all other wars combined. Both sides in that war were fighting for domestic civil rights (with wildly differing definitions of what that meant, granted, but that doesn't change the numbers).
Re: (Score:2)
No, it's more likely BoingBoing owns a bunch of IP addresses. They dedicated one of them for a Tor exit node, much like you'd have another for web servers, etc.
As in, that IP address most likely does not belong to a leaf user - it's in Boing Boing's address space, and they simply replied that that server does not keep logs as is the nature of a Tor exit node. And since that machine is only a Tor exit node, that's it. It
Re: (Score:2)
On the virus laden PC thing.... I have a friend who did forensics work on a case that was far more solid (and not CP related) than that and the PC contents were kind of the icing on the cake.
Anyway he got an image of the machine, and tried to go over the evidence where he ran into a snag. The machine was so virus and malware/adware laden that it was barely usable and was generating a near constant stream of network activity, including web requests, all on its own.
Between that and almot losing my shit watchi
Re: (Score:1)
The Tor Project provides plenty of sound advice for folks running Tor relay and exit nodes.
The Legal FAQ for Tor Relay Operators.
https://www.torproject.org/eff/tor-legal-faq.html.en [torproject.org]
Tips for Running an Exit Node with Minimal Harassment
https://blog.torproject.org/blog/tips-running-exit-node-minimal-harassment [torproject.org]
Tor FAQ
https://www.torproject.org/docs/faq.html.en [torproject.org]
Re: (Score:1)
Including plenty of boilerplate.
Tor Abuse Templates
https://trac.torproject.org/projects/tor/wiki/doc/TorAbuseTemplates [torproject.org]
logs? (Score:5, Funny)
would be funny if they sent them literal wood logs
Re: (Score:2)
Re: (Score:2)
Re: (Score:3)
all logs relating to the exit node
Now I'm thinking about building a rack frame out of some thin lodgepole pines...
Then you could take the frame apart and FedEX it to them as...
wait for it...
Support Logs!
Re: (Score:2, Funny)
You just gave me the idea of a nerd costume party outfit...
A guy with shirt that says "cron" who is holding a big log and looking at his watch, when it hits the minute mark he rotates the log and then goes back to looking at the watch waiting for the next minute.
The right people would laugh their ass off...
Re: (Score:2)
Those on the RAM disk of course, unfortunately we had a power failure.
Re:logs? (Score:5, Informative)
This is the kind of "clever" response that gets contempt charges.
When dealing with a subpena, don't be clever. Don't be witty. Don't be funny. Don't ignore it (like lavalbit did). Just comply or fight it. Cause you are allowed to fight them. You just have to do so within a certain framework.
Re: (Score:2)
Just comply or fight it. Cause you are allowed to fight them. You just have to do so within a certain framework.
How does this work, then?
The subpoena said they must appear to testify AND they must provide logs.
Their lawyer responded, "there are no logs, kthxbye" and Corey is like, "ya, we won!".
How do they get out of travelling cross-country to be compelled to testify again?
Re: (Score:2)
The testimony was about the logs. No logs, no testimony.
No, very importantly, their lawyer said "there are no logs, can we help explain/help more?" and the agent said "oh, kthxbye" You want them to walk away from the conversation first.
Re: (Score:2)
You just have to do so within a certain framework.
Perhaps a framework constructed from ... support logs?
Re:logs? (Score:5, Informative)
A very similar thing happened to USU. We received a summons from Homeland/ICE to produce 3 months of records (plus identifying info) for an IP that was one of our TOR exit nodes.
I eventually managed to contact the Special Agent in charge of the investigation. He turned out to be a reasonable person. I explained that the requested info was for an extremely active TOR exit node. I said that we had extracted and filtered the requested data, it was 90 4 gig files (for a total of 360 gigs of log files) or about 3.2 billion log entries. I asked him how he wanted us to send the info. He replied that all he needed to know was that it was a TOR exit node. I then asked again if he wanted the data. He said something like: "Oh God no! Somebody would have to examine it. It won't tell us anything. It would greatly increase our expenditures. Thanks anyway."
And that was the end of it.
YMMV. All Rights Reserved. Not Available In All States. It helps if your institution has it's own Police, Lawyers, and (an extremely active and effective) department of Journalism. And, it doesn't hurt if it is cheaper (and easier) for you to respond to the summons/subpoena, than it is for the Authority to issue it and deal with the result.
"Here's a counterexample" (Score:2)
Re: (Score:2)
what do you mean tomorrow? that's already the assumption for private ip's.
the only reason they didn't come busting in and sorting the mess later was that it was a company ip address.
so yeah, great - not so great if you plan on running a tor exit node from your home network. which might be a bad idea anyways for other reasons as well but hey..
There's a lot of fantasy in that last line... (Score:5, Interesting)
"Fed asks us for our records, we say we don't have any, fed goes away"
Normally the response is "Fed finds some way to screw with you until you cry uncle, end up in Club Fed, or both".
Federal prosecutors don't enjoy a conviction rate higher than the Spanish Inquisition because they're reasonable.
Re: (Score:3)
If subscriber records at both ends can be presented thats great for parallel construction in open court.
The "who" is hard to find as a user at first, but working out when, how much data and the entire onion routing path is not hard.
So watch the first hop, the exit node and
Metadata and time is another key. Watch the user go online and appear on the other end of onion routin
Re: (Score:2, Informative)
Except that in EVERY case where a tor related "takedown" occurred, it only occurred because some aspect of basic operational security was neglected.
OPSEC fucking matters, above all else.
Ummm, kinda the opposite (Score:3, Insightful)
The reason they have a high conviction rate is because they very rarely go to court frivolously. They go in ready. They are methodical about their evidence collection and they make sure they have someone 100% before they indict. A friend sat on a federal grand jury and he was stunned by the amount of evidence they presented. This was just a grand jury, the standard is much, much lower than trial but it didn't matter, they went in fully prepared all the time.
That's a good thing. A low conviction rate is not
Re: (Score:1)
.. it helps to have a corrupt/sloppy evidence lab that will return 'helpful' results to use at trial.
see: http://www.washingtonpost.com/local/crime/fbi-overstated-forensic-hair-matches-in-nearly-all-criminal-trials-for-decades/2015/04/18/39c8d8c6-e515-11e4-b510-962fcfabc310_story.html
and: https://www.google.ca/search?q=fbi+evidence+lab&rlz=1C1VFKB_enCA652CA652&oq=fbi+evidence+lab#q=fbi+evidence+lab+scandal
Re: (Score:3, Interesting)
If they got less than 80 it would be a sign that they were generally taking cases to court with insufficient evidence. More than 80 meant they were being too cautious.
That was their reasoning anyway. 100% was explicitly not their aim.
Re: (Score:2)
Re: (Score:2)
Innocent isn't the same thing as not guilty.
Re: (Score:2)
There are two applicable definitions of "innocent" here: didn't commit the crime, and can't be proven to have committed the crime. You're mixing them up.
Not buying it (Score:2)
Re: (Score:2)
Swartz was not in fact innocent. He covertly used another institution's connections in a way that harmed people, due to his high access rate. I'd have a much higher opinion of him if he'd put as much thought and energy into not harming people as he did to not being caught. The fact that he was doing something he considered right doesn't absolve him of that; morally, it's on a par with making a human chain around an abortion clinic because you think abortion is murder.
Moreover, he wasn't the first pers
Re: (Score:2)
He has more talent than the "editors" who run this site. They can't even figure out how to write a simple filter.
Re: (Score:2)
So Occam's razor says he is an editor.
Re: (Score:1)
While it might make conspiracy nuts sad (Score:5, Interesting)
That is actually how it works. The FBI it not, by and large, dumb about investigations. They are arguably one of the best in the business. Part of that is they know that you can't always get the evidence you want. So they'll subpoena records, but so long as you make a good faith effort to comply, they tend to be happy.
At work (a university) we get FBI subpoenas once and awhile. Quite often it is for shit that we don't have, like someone's e-mail from a long time ago. We look, see if we have a backup, and if not let them know. They are then on their way.
When people get in trouble is when they try to jam them up or break their own rules. Like if you have a company rule that says you keep all documents of X type for Y years, and they are asking for something that is Y-3 years old, they may well get miffed and go after you if you don't have it. However if you do not retain document type X, and there is no law requiring it, simply letting them know that will make them happy.
This isn't to say nobody ever gets a bad/vindictive/whatever agent that tries to create problems, but if you were to do a study, I bet you'd find that most of the interactions are very professional and they are perfectly understanding if you don't have the information they want. In the cases where a hissing match started it was because someone had the information and refused (or made it sound like that) or otherwise jammed them up.
Re: While it might make conspiracy nuts sad (Score:3, Insightful)
And this, kiddies, is why we don't keep records any longer than we have to. Not keeping them at all is even better.
And if you're not BoingBoing? (Score:3)
It's amazing that Doctorow is so thick as to not understand his privilege.
The FBI agent probably dropped it as soon as he realized who Boing Boing was.
Your average home user or small business running a tor exit node is not going to be treated with anywhere near that kind of kindness.
Re:And if you're not BoingBoing? (Score:4, Interesting)
I have received a scary call from a random police department investigating a case of a guy blackmailing an underage girl for nude pictures, connected with my Tor exit node. I explained to the guy what Tor is, he researched it, they said thanks that's all.
I immediately contacted the EFF after they called me and they said if anything more came up they'd be happy to help me out. It's not just Doctorow.
Re: (Score:1)
Just to be clear, I run a Tor exit off of a dedicated IP, on a dedicated server in a datacenter, with proper reverse DNS and all that, not from my home IP. Doing the latter is just a bad idea.
Re: (Score:3)
Are you kidding me? Hell, I don't know who Boing Boing is. No, seriously, I'd heard the name mentioned once or twice, but I had no idea what it was until I just now took a quick peek at the site. And I still don't know exactly what it is.
I'd also bet the vast majority of US citizens have never heard of Boing Boing.
Re: (Score:1)
It's amazing that Doctorow is so thick as to not understand his privilege.
The FBI agent probably dropped it as soon as he realized who Boing Boing was.
Your average home user or small business running a tor exit node is not going to be treated with anywhere near that kind of kindness.
Wouldn't the average agent be more likely to say "what the fuck is boing boing?"
I mean it gets mentioned on slashdot every now and then, so I know the name and have occasionally followed links to it, but it's not like it's in the Facebook league for universal brand recognition.
This only works for larger companies. (Score:5, Insightful)
It's not subpoenas that worry node operators. A company gets subpoenas. An individual gets a squad arriving to smash the door down, throw everyone in the house to the floor and confiscate anything with a battery. All done for very good reason: If a suspect had any warning they may use that time to destroy evidence. Still disruptive enough to discourage operating an exit node.
Re: (Score:2)
Do you have any citations or links to what you are referring to?
Has nobody watched The Wire? (Score:1)
Don't log or track too much in general (Score:3)
Are we capable of logging information at our workplace that would give concrete answers about some legal issues that could arise? Yes.
Do we do it? Oh, hell no.
We log some stuff, but we're careful not to do too much as we don't want to be accused as being "responsible" for the behaviour of some idiot or jerk because "we should have known what was happening".
A desire to nail someone for being naughty could be one of your own undoing.