FBI operated 23 Tor-hidden child porn sites, deployed malware from them

http://arstechnica.com/tech-policy/2016/11/fbi-operated-23-tor-hidden-child-porn-sites-deployed-malware-from-them/

by _qik1 • 10 years ago

222 206 10 years ago

arstechnica.com

api• 10 years ago

Doesn't this show that yes you can do police work in the post crypto age?

pmlnr2• 10 years ago

This is not that trivial to answer. In this case, the FBI went against the law by operating these servers - a typical case of "the ends justify the means". Should we allow police work not to play by the rules? That usually doesn't end well.

runn1ng• 10 years ago

I am not sure about the letter of the law, but I think the spirit is clear that the intent matters.

And they didn't operate the servers because they wanted to give platform to child porn users, but because they wanted to catch the users.

Raphmedia3• 10 years ago

They arrested the stupid users. Pedophiles are not known for being among the brightest. Those people downloaded the Tor browser and blindly started browsing on it.

It wouldn't have been so easy to get information on 200 real cyber criminals.

brianwawok2• 10 years ago

That sounds a bit like strawman.

Do you have a citation that a pedo has less IQ than the average member of society?

I think by using Tor that puts them in the top 1% of internet user knowledge, which is against your statement.

Zuider5• 10 years ago

The FBI certainly didn't catch the creators and distributors of the original content because those people operate as professional criminals. The sting may affect their revenue stream by scaring off consumers who were under the illusion that they could make themselves safely anonymous.

throwaway_acas• 10 years ago

Ever heard of Operation Achilles[1]? If pedophiles (and immoral people in general) were all stupid our world would be a much better place.

[1] https://gist.github.com/grugq/7713916

revelation2• 10 years ago

The FBI used a Tor Browser Exploit instead of disclosing it responsibly. If this is police work in the post crypto are, then we are all going to be a lot less secure.

antoineMoPa• 10 years ago

When I have debates about encryption and surveillance, CP & terrorism are arguments that are difficult to address. I think this solves a part of the problem.

draw_down2• 10 years ago

When you gaze long into the abyss, the abyss gazes also into you.

forthwoart• 10 years ago

FBI opreated 23 Tor-hidden child porn sites Uh, what? I don't think the end justifies the means here

foobarbecue3• 10 years ago

You might want to read beyond the clickbait headline.

GrinningFool• 10 years ago

"“I would refer you to public documents on the Playpen investigation, in which we seized and operated a darkweb child pornography site for a period of less than two weeks,”

That reads to me like yes, they were running the fully operational CP sites and allowing it to continue to serve up CP.

The ends do not justify the means.

ANd nobody has raised the question of how this can actually be done legally - under current law is there a way to make the serving up of CP content a sufficiently grey area that it's permissible to do with only judicial approval?

If not, seems to me the individuals managing the site for the window of federal operations have the potential to be in a whole mess of trouble.

If so, that seems a thing that should be fixed.

centizen• 10 years ago

Out of context this sounds much worse than it is - the FBI forcefully took control of a hosting network that included 23 child-porn service sites. They then used it as a platform to serve malware to the visitors of the sites. Within a month, they shut down the websites.

mikeash4• 10 years ago

If the FBI seized a store that sold illegal drugs, and kept operating the stores and selling illegal drugs for a month afterwards, would that be considered OK? I'm not getting hugely up in arms about this, but it doesn't seem right.

danjoc2• 10 years ago

FBI Special Agent Jeff Tarpinian admitted in court that the agency “relocated two servers to an FBI facility here in Omaha and we continued to let those child pornography run"

http://disinfo.com/2016/01/why-did-the-fbi-operate-a-child-p...

In context, it sounds even harder to justify.

ikeboy• 10 years ago

It seems like this was related to their seizure of Freedom Hosting, and that they only hosted them for 30 days or less, reading the linked affidavit.

So they seized an onion hosting provider that had 23 cp sites, they ran those sites for a few weeks, then shut them down.

MichaelBurge• 10 years ago

I understand the ban on child porn is justified via the interstate commerce clause:

Federal jurisdiction is implicated if the child pornography offense occurred in interstate or foreign commerce. This includes, for example, using the U.S. Mails or common carriers to transport child pornography across state or international borders. Additionally, federal jurisdiction almost always applies when the Internet is used to commit a child pornography violation. Even if the child pornography image itself did not traveled across state or international borders, federal law may be implicated if the materials, such as the computer used to download the image or the CD Rom used to store the image, originated or previously traveled in interstate or foreign commerce.

https://www.justice.gov/criminal-ceos/citizens-guide-us-fede...

Theoretically, would a general citizen be exempt from the ban if he manufactured his own CD-ROMs, and his own CPUs in-state?

It might be illegal for them to operate the sites for extended periods of time. It doesn't seem illegal for them to deploy malware as part of an investigation. I'm looking at (f) here:

https://www.law.cornell.edu/uscode/text/18/1030

So the worst that could happen is that the evidence gets thrown out. If they weren't going to otherwise be able to nab the person, the worst that could happen is they lose the case.

js_what_• 10 years ago

I would say the worst that could happen is the FBI is knowingly distributing child pornography, providing access to illegal materials and re-victimizing minors.

alexmingoia• 10 years ago

Good idea, but that defense has already been rejected by the Supreme Court twice. Their reason? I kid you not... "the butterfly effect". The Supreme Court considers any activity that doesn't leave the state to possibly affect interstate commerce so they can regulate everything with that clause. See Wickard v. Filburn and most recently Gonzales v. Raich. Prepare to be enraged.

wool_gather• 10 years ago

Enraging indeed.

"Where necessary to make a regulation of interstate commerce effective, Congress may regulate even those intrastate activities that do not themselves substantially affect interstate commerce" [emphasis mine]

-- Justice Antonin Scalia, in the majority opinion for Gonzales v. Raich, using his vaunted legal genius to find a reason, any reason at all, to stop people from doing things that he didn't like.

One of the most influential hypocrites of the new millenium, if not the whole history of the republic.

LeifCarrotson2• 10 years ago

Theoretically, would a general citizen be exempt from the ban if he manufactured his own CD-ROMs, and his own CPUs in-state?

I would be seriously impressed if you could manufacture your own computer capable of accessing the Internet and displaying an image from a single US state. Semiconductor manufacturing, networking software, electronics manufacturing, and so on are thoroughly global industries.

But even if you could, in the end, they're using this clause from the constitution:

To regulate Commerce with foreign Nations, and among the several States, and with the Indian Tribes.

to give them jurisdiction in cases of Internet child pornography.

The entity determining whether or not this jurisdiction is valid is not like a computer program that will look at a homebrew computer, check where all the parts came from, look at the text of the law, and say "Whoops, nothing in this case crossed state lines, we don't have jurisdiction, you're free to go."

I see this attitude on HN way too often.

Instead, remember that it's a bunch of humans who considered the problem of child pornography, chose to fight it, and only then looked for a source of jurisdiction. That source does not actually need to be valid (not that I actually dispute that the FBI should have jurisdiction when US citizens commit crimes using the Internet), but it's important to realize that it only needs to be strong enough to stand up to the political will to oppose it. And there are no prosecutors with a will or the political power to oppose the FBI for going after sexual predators.

This state of affairs probably results in some overreach. But even considering the potential problems with this approach taken to the extreme, I find it extremely hard to align myself against the FBI. What if the FBI operated honeypot sites with zero-day exploits inserted for them by Microsoft, Apple, and Google, hacking modems and demanding ISPs snoop on their users, opposing HTTPS rollout, and generally causing great harm to law-abiding users of the internet? But these actions protected kids? How much harm would it take to shift my allegiance into opposing the FBI? Scary stuff.

pbhjpbhj5• 10 years ago

Instead, remember that it's a bunch of humans who considered the problem of child pornography, chose to fight it, and only then looked for a source of jurisdiction. //

It's not my country but this is the thing that grates most with me, the "act first and try and find legal justification afterwards". Officers of the law should really be seeking to act legally in the first place.

What you propose, companies creating a system of open reporting is fine by me, but doing it covertly is not. Enact laws allowing it and tell the public it's happening. That's the democratic way.

15155• 10 years ago

The wheat you grow for your family affects the market which is in another state - your family no longer buys wheat, reducing demand.

aezell• 10 years ago

This is the same as cops offering to sell drugs or sex and then busting the buyers.

mikeash4• 10 years ago

Except that when the cops run drug or prostitution stings, they don't actually provide drugs or sex, do they? I thought they offered without actually having the product, then nail the buyer based on their intent to buy.

Actually providing the sting targets with illegal material seems a lot shadier.

wavefunction• 10 years ago

Pandering, or "offering or promoting prostitution" is still a crime.

stray8• 10 years ago

How are you suppose to do a pornography bust on the internet without actually providing some product?

Alex39172• 10 years ago

In some states the cops are legally allowed to rape people. C.f.:

http://time.com/38444/hawaii-police-prostitutes-sex/

MaxfordAndSons• 10 years ago

I was under the impression, at least in the case of drugs, that they do actually provide them. Although maybe that's only in cases of deep cover infiltration, rather than the eventual sting per se.

foobarbecue3• 10 years ago

It's a little bit like that in certain ways, but it's certainly not the same. They simply didn't turn off the servers immediately after gaining control of them.

namecast• 10 years ago

That depends: do they typically bust the buyers after they've bought real drugs and already used them? It's all fake bags of white powder that never get used, yeah?

For me this sort of hinges on whether actual child pornography was distributed (and then, i imagine, consumed and re-distributed by pedophiles) in the name of making a bust.

Bartweiss4• 10 years ago

I mean, I think some real drugs get sold, but usually its selling stuff from the evidence locker and busting buyers before they can use it. There's no real equivalent to "after the sale, before the harm is done" in a case like this.

unethical_ban• 10 years ago

My example of an analogy would be like taking over a drug house and putting GPS in each shipment, but still allowing the drugs to get sold and consumed.

I'm not sure whether this is OK or not.

75j7• 10 years ago

Here's mine...

The FBI discovers a child prostitution ring and infiltrates it, but keeps running it and forces the children to have sex for a month to ensnare more customers.

If one accepts the idea of re-victimization, then I'm not sure how what the FBI did here can be considered acceptable, or any different than the analogy above.

tdb78932• 10 years ago

I think the idea in this case is that there isn't re-victimization. The point of these sting operations is to lead to less victims overall.

jakewins• 10 years ago

As noted elsewhere in the thread - FBI did not continue to serve child porn off of those sites, it swapped it to an error message that served malware targeting the TOR browser.

75j7• 10 years ago

Source? This Reason article says differently:

"Operation Pacifier is reminiscent of reverse drug stings in which cops pose as dealers to catch retail buyers, except that in this case the FBI actually disseminated contraband. It did not merely pose as a distributor of child pornography; it was a distributor of child pornography. During the two weeks the FBI was running The Playpen, about 100,000 people visited the site, accessing at least 48,000 photos, 200 videos, and 13,000 links. In fact, the FBI seems to have made The Playpen a lot more popular by making it faster and more accessible."

http://reason.com/blog/2016/08/31/the-fbi-distributes-child-...

Miner49er2• 10 years ago

Then how could they press charges against the people visiting the site? I'm no lawyer. Is there a difference between trying to do something illegal and actually doing something illegal in the eyes of the law?

cookiecaper• 10 years ago

It feels like a pretty typical sting-style operation to me. Undercover ops usually require some degree of temporary cooperation with the illegal activity in order to shut it down permanently.

agumonkey• 10 years ago

I'm pro depending on the context, gravity and overall plan. If a gov operates a drug house for some time in order to shut down 50% of the market for 30x that time (one month of bad for 3 years of massive improvement) then I'd accept.

ajross• 10 years ago

This runs afoul of drug legalization morality. Drug trade may be bad for society, but to lots of people it's not a unambiguous universal evil.

Here's a better one: Fighting sex trafficking by abducting and selling children, but training them to rat on their captors first. I think that better captures the disaster that this is.

Not that it matters at this point. The new administration is going to give these folks a medal.

sschueller• 10 years ago

Isn't the whole issue the exploitation of children? As in the FBI should be going after the creators and distributors not become a distributor.

stephengillie• 10 years ago

It's the "War On Drugs" model, where they chase the end-users and end-distributors, but don't stop the problem at the source. Occasionally, they hit a big target and make a big show of it, but most of what they do is police the populace.

awqrre• 10 years ago

If they would stop the problem at the source, they might be out of work... but anyways I think that it is not a good idea to become an outlaw to catch other outlaws...

vilhelm_s• 10 years ago

This is about the Freedom Hosting hack in 2013. In 2013 Wired wrote

On August 4, all the sites hosted by Freedom Hosting — some with no connection to child porn — began serving an error message with hidden code embedded in the page. Security researchers dissected the code and found it exploited a security hole in Firefox to identify users of the Tor Browser Bundle [https://www.wired.com/2013/09/freedom-hosting-fbi/]

However, as far as we know, unlike the more recent Playpen thing, in the Freedom hosting case the FBI did not actually serve child pornography, they just displayed an error message. I don't see anything in this article that suggests otherwise.

tombrossman• 10 years ago

That's correct, the FBI hosted error messages and exploits after taking over, and supposedly did not distribute images of abuse. This point is conspicuously absent from the Ars story.

Motherboard passed on this story but it appears it was too sensationalist for Ars to resist. See thread here for more info: https://twitter.com/josephfcox/status/797070958205038592

uniclaude3• 10 years ago

a Tor exploit of some kind to force the browser to return the user’s actual IP address, operating system, MAC address, and other data. As part of the operation that took down Playpen, the FBI was then able to identify and arrest the nearly 200 child porn suspects.

So, is getting someone arrested as easy as spoofing their network information and visiting those sites? I can already imagine trolls using this to have people swatted.

openasocket11• 10 years ago

It would be really difficult to spoof the IP address and create valid TCP connections. Plus, your method would only work if you knew in advance that certain sites were currently being used in a sting operation. If you could figure that out, that kind of defeats the purpose of a sting operation.

solotronics• 10 years ago

it would be trivial to hack their wifi or insert a rogue device into their home network

uniclaude3• 10 years ago

Security researcher Sarah Jamie Lewis told Ars that “it’s a pretty reasonable assumption” that at one point the FBI was running roughly half of the known child porn sites hosted on Tor-hidden servers.

We're talking about a very large sting operation, just browse a few of those, I guess?

eeZah7Ux• 10 years ago

50 comments and nobody pointed out that the honeypot sites would attack visitors regardless of their citizenship.

Given that 95% of people in the world are not from US, how many visitors were police officers from other countries, conducting their own investigation?

clarry• 10 years ago

And how many people were not visiting these sites to obtain child porn?

Quite recently, I ended up on an image board [whose name suggested to me it's got to do with topics such as freedom of speech] I hadn't heard of before, with sections whose short names meant nothing to me. So out of curiosity, I opened the first one.

Well, that board is no more.

Miner49er2• 10 years ago

In that case it would certainly be entrapment wouldn't it? How do they intend to prove whether this was entrapment or not?

draw_down2• 10 years ago

Hmm, my concern is more that the US government actively peddled CP, rather than some non-American CP users getting owned.

revelation2• 10 years ago

Not to mention that they would attack visitors regardless of the existence of any search warrant.

Zuider5• 10 years ago

This is less like a drug or prostitution sting where the mark is arrested before the contraband can be consumed, and more like a hired hitman sting where the victim is actually murdered.

From a moral point of view, Child pornography is de-ontologically wrong. Nothing can justify its existence. Even if such a sting managed to shut down the entire industry, it would be moot to attempt to argue for its moral goodness in consequentialist terms.

The FBI could have used other means to establish criminal intent in the visitors to the websites along with the fact that they had used Tor to search out and visit those websites in the first place. They could have made prospective viewers engage in a series of incriminating acts such as requiring them follow a series of links with the promise of finding the material, or making them refresh the page. There was no need to provide the actual offensive material in order to make a solid case.

corecoder• 10 years ago

They could have made prospective viewers engage in a series of incriminating acts such as requiring them follow a series of links with the promise of finding the material, or making them refresh the page.

I find this part very interesting: is this well established, that is, is it clear before the law which acts are surely incriminating? Is clicking on a link enough to establish intent?

adventured• 10 years ago

Is clicking on a link enough to establish intent?

Legally no it's not, that's a very weak binding and they know it. That's why any type of sting - whether cp or other - will attempt to get the user to sign-up, view content, or otherwise willfully provide personal information (eg a credit card).

Zuider5• 10 years ago

I wonder how one would establish a calculus of intent in such a situation?

It would have to be established that the accused was fully intent on the end goal and was of the belief that the steps taken would facilitate achieving that end goal. It seems intuitive that each successive deliberate step would compound, and even double the certainty of guilt. More steps, more certainty.

In this context, the first three steps would already have been taken. Firstly to acquire the Tor browser in order to hide one's identity, secondly, to learn how to search the darknet, thirdly, to have searched out and visited such sites. At this stage, the FBI apparently short circuited the process by providing the actual material, the viewing of which is a crime in itself.

Further steps could consist of following clearly labeled links, clicking on thumbnail images whose import was clear, even if they were blurred. This would show knowledge, and to a lesser degree, intent. Intent could be established by sending the perpetrator on a fool's errand of repeatedly following links and thumbnails without ever achieving their goal.

hx872• 10 years ago

From a moral point of view, Child pornography is de-ontologically wrong.

From your point of view. You can't make an argument by just rejecting an entire perspective in moral philosophy. Otherwise I'd be equally right in flat out rejecting deontology.

Zuider5• 10 years ago

I don't reject the consequentialist perspective. I believe that de-ontological and consequentialist positions can be both validly used, and even that if they clash in their implications, one perspective can take precedence over the other.

For instance, although Kant held that lying is wrong from a de-ontological perspective, telling a lie would certainly be the right thing to do to protect someone from being murdered. Consequentialist reasoning prevails here.

The moral question here is whether the FBI did the right thing in allowing the compromised websites to continue in operation. There has been some interesting discussion on this point. I think that they shouldn't have, and furthermore, that they did not even need to do so in order to achieve a conviction.

rm_-rf_slash• 10 years ago

Somehow in the context of the surveillance state I find myself arguing in favor of the FBI, but here goes:

Child abuse is the least defensible crime that could exist. As such, CP rings tend to be understandably paranoid and risk-averse. If anything appears to give the impression that they are being monitored, you can say goodbye to the arrest of another monster lurking in the shadows. That's why it's necessary to sting as many people at a time when the authorities get their chance, because once the window closes, anyone who gets away can either go off the grid or distribute in another ring, perpetuating their crime and thereby increasing demand for CP.

It's pretty ugly to think about a federal agency knowingly distributing child pornography. I often wonder what kinds of psychological effects it has on the Bureau's agents. But child abuse is a horrible thing, and it is difficult to consider anything but the swift and absolute elimination (arrest and elimination from the network, not execution) of producers, distributors, and the abusers themselves.

zaroth• 10 years ago

I think the clear differential here is that compromising the server and tracking its users while it was in operation by Freedom Hosting would perhaps be "OK" but confiscating the server, moving it to HQ, and then operating the site themselves is decidedly not.

Keep in mind, you can't just pause the site and expect your targets not to notice, they had to actively maintain the site (and consider what that means) to keep their targets coming back. It's disgusting and disturbing. And if it's what we know about it, it's also just the tip of the iceberg.

At least with Fast & Furious I think it was real criminals running the guns and just a failure to intervene. I think a failure to intervene here would be seen as unacceptable as well. But here we have way more than failure to intervene, they effectively provided the guns and helped run them across the border.

smaili• 10 years ago

That NIT, which many security experts have dubbed as malware, used a Tor exploit of some kind to force the browser to return the user’s actual IP address, operating system, MAC address, and other data.

That's quite the exploit.

klodolph3• 10 years ago

I feel like people are getting mad at the FBI for not pulling the trolley car lever in the right way, which is a valid thing to be mad about, but I believe the FBI made the right choice.

First, let's not rely too heavily the analogies with drugs or prostitution. The differences between CP and drugs / prostitution are too large to ignore anyway.

CP consumers are often producers as well. That's a fact—you want CP, so you make some yourself and swap it with others to get more. This isn't universal but it's common enough that you should know about it. So the visitors to the CP web site are not all just consumers of CP but many of them are producers as well. This is relevant because you have to weigh the damage of distributing CP against the benefit of catching people who produce CP. People have stated that distribution revictimizes the children, but I would weigh that against the ability to catch people who were either producing their own or at least supporting other producers of CP.

So the FBI discovers this server, operates it for less than 30 days with a Tor exploit, and catches 200 people using the site. Yes, the FBI was complicit in the distribution of CP, but rephrased as a trolley car problem, this is basically like not pulling the lever, allowing the distribution to continue for a short time, and using that to catch 200 consumers—and how many of them are producers? You can pull the lever now and stop the distribution of CP, or you can let the trolley barrel down the tracks for a short time and save all these people somewhere else.

(People are saying that the exploit may have done damage to other police investigations from other countries—I don't see any evidence that the exploit damaged the computer, merely that it leaked information about the computer.)

voxic11• 10 years ago

I think maybe your argument about consumers also being producers made more sense in the pre internet age when distribution of the content was very hard. I would be rather surprised if they was still true today. After all I presume the FBI didn't create their own content...

openasocket11• 10 years ago

Look at the affidavit: https://www.documentcloud.org/documents/3216737-Freedom-Host...

I only skimmed, but at least 1 of the Websites required users to upload their own CP, to be approved by the admins, before they could download any.

TaylorAlexander• 10 years ago

It makes sense to me that, while some number of people would want to consume CP, only a very small fraction of them would be willing and able to secure a child to photograph. I imagine much less than 1% of the people who are involved with CP do more than consume it online.

Do you have a source for your information regarding the prevalence of production?

klodolph3• 10 years ago

Apparently one of the websites required users to submit CP in order to access content.

You can imagine all you like, but this hasn't radically changed just because we have the internet.

dogma11386• 10 years ago

In the west maybe, but they can always travel to South America or Asia and get it there.

Eastern Europe and Russia also used to be a hot spot for these productions but they cracked pretty hard on that.

He is correct that most CP these days is traded, large scale productions are too risky since even 3rd world countries have been stepping up Anti-CP enforcement.

If you are a middle aged men traveling to Thailand a lot for no apparent reason don't be surprised if they flag you at the airport and search you.

RIMR• 10 years ago

IIRC, a lot of these site require that you share a unique photo or video (something they don't have in their library already) as a condition of membership. This ensures that only the most serious users even get a chance to view the forums.

These communities would have a lot more producers in them than your run-of-the-mill CP imageboards, as they have to fulfill a barrier to entry that only a seasoned CP consumer or producer would be able to meet.

So, once the FBI have control of the site, they can sort out all the lurkers who are consuming but not actively participating (probably uncommon, given that these sites also require you to remain active to keep your membership) and get damning information about people who are mass-distributing/selling and/or producing child pornography.

jobigoud• 10 years ago

Would you be OK if they filmed new material of one of the existing victim?

I think the entire debate relies on the re-victimization aspect. If we accept it, and they do, then it's decidely not a trolley car lever conundrum.

clifanatic2• 10 years ago

Interesting point... it seems to me that they ought to at least find the victims and secure their blessing to be used this way.

Pica_soO2• 10 years ago

Would it be okay, to upload the security camera footage of the beating up of a minor in a sweat shop that produces cheap shoes or phones? Would buying those shoes, then make you a co-producer?

bobwaycott• 10 years ago

and how many of them are producers?

Your argument really hinges on this point. So, what's the answer? Out of the 200, how many are proven producers?

lomnakkus• 10 years ago

How much of this is backed up by evidence? (Being a little facetious, I suspect very little.)

EDIT: Not to mention; the logic behind possession of CP being illegal is completely defeated by this enforcement strategy. (That's not to say I'll actually defend possession of CP, but I think it's very troubling that law enforcement and the judiciary are this out of sync.)

jshevek• 10 years ago

Facetious? Being flippant about a serious subject?

drvdevd2• 10 years ago

No one seems to remember rule 41 in this thread. Did it get tossed out already?

We can all look at this and assume the FBI made a good choice here, even if they broke the law in the process.

But.. what about those of us who use Tor to browse perfectly legal content in order to simply attain added privacy from the prying eyes of our local ISPs? Or to host SSH via a hidden service? Etc.

You may not know it yet, but you need tor or you will need it sooner or later. Or you will need something else like it.

drvdevd2• 10 years ago

Let me add to that: the FBI themselves and various Police forces will also need Tor, or something like it, as well.

SN76477• 10 years ago

I think that this is the morale hairs that have to be split. I would disagree, and that they are being in violation of the law to uphold the law. Which I think is much more dangerous for everyone. This isnt to say that CP isnt dangerous, or take away its magnitude. I am saying that there should never be a situation where those that uphold the law should be allowed to break the law.

cloudjacker• 10 years ago

Forget the Firefox Tor browser, use Whonix

Two Virtual Machines, the one you actually use for browsing and stuff only connects through the gateway virtual machine.

If an exploit breaks out the firefox skin, it is just in the host VM, if it somehow breaks out of the host VM it is in the gateway VM.

We could keep going down possibilities, but we are far removed from attack vectors that actually exist.

dsfyu404ed• 10 years ago

Shit, if they keep going at this rate pretty soon they're gonna need to start worrying about ant-trust laws.

omribahumi3• 10 years ago

I once experimented with a Tor router on a VM that isolated another VM's internet connectivity.

The idea was |Stealth VM| --> |Tor router VM| --> |Virtual Box NAT|

The Tor router VM was running redsocks[0] to route all TCP traffic through tor's socks proxy interface. The stealth VM also used tor's DNS service.

That way, even if the stealth VM is compromised, it can't access the internet directly.

[0] http://darkk.net.ru/redsocks/

omribahumi3• 10 years ago

Why is this being downvoted? The topic might as well be tor user exposure with malware. I'm not trying to encourage CP consumption.

zizzles• 10 years ago

How is this different than Whonix?

https://en.wikipedia.org/wiki/Whonix

omribahumi3• 10 years ago

From reading it, looks like it's the same concept.

Thanks. Didn't know about it.

lightedman• 10 years ago

IOW the FBI is directly responsible for the spread and proliferation of child pornography. They've hurt more people than they've rescued.

Time to charge the FBI with aiding and abetting. Period. Equal treatment under the law. Period.

ethanbond3• 10 years ago

They've hurt more people than they've rescued

source?

CurtMonash2• 10 years ago

I think there's a rather extreme hierarchy of wrongs here.

1. The crime that utterly dwarfs all others is involving children in the making of child porn.

2. After that, the crimes that dwarf all the rest are those that provide financial or practical support to child porn makers. Consuming child porn is generally regarded as one of those, and I'm fine with that categorization.

3. I'm sorry, but violating a victim's theoretical privacy by distributing the images a little further doesn't seem to be nearly as big a deal as helping to prevent the next live video of child porn from being made.

I'm usually regarded as being pro-privacy, but privacy is not something to be a rabid extremist about. Preventing physical sexual abuse of children, on the other hand, is a fine area for extremism.

YPCrumble• 10 years ago

People who question what the FBI is doing are not "rabid extremist". That combines an ad-hominem and a straw man fallacy in the same line.

You then claim that preventing child abuse is a fine area for extremism. That's an appeal to emotion and also a fallacy.

Perhaps we could debate whether extremism is justified but let's do it without all the nonsense you wrap around your argument to cloud the real question. You say that extremism is justified but all of the reasons your posit as justification are fallacies.

Bjartr2• 10 years ago

Screw chilling effects, I'm going to ask this anyway because being afraid of having these discussions is detrimental to making real progress as a society.

Making the assumption* that some decent fraction of those who consume such media would be sated if they could get it and not move on to actually hurting children. Then couldn't a preventative measure be to take all the existing child porn and make it available to them?

Though I guess that risks normalizing the condition and could lead to it being more commonplace (certainly it would appear so as those who successfully suppress it would hide it less) and if it's more commonplace than the fraction that does still act harmfully upon the impulse could, in absolute numbers, exceed those that do today. Figuring out how things fall would first require a good understanding of the numbers.

*I don't know if this is true or false and would be interested to know if there is existing general consensus on the evolution of seeking out fantasy fulfillment over time in general and how it's affected by free access v. restricted access to related material.

Latty• 10 years ago

Arguably we are at a point where good (here meaning effective) CG or Art should be able to replace such a thing without any real child being abused or having their privacy invaded, which would be preferable.

Of course, in some countries, that too is illegal, for some reason.

jcbrand• 10 years ago

Then couldn't a preventative measure be to take all the existing child porn and make it available to them?

What about the victims' right not to have their privacy and dignity violated by the continuing consumption of the material?

ScottBurson3• 10 years ago

There seems to be some evidence to support your assumption. I saw something somewhere that claimed that the frequency of rape has actually fallen over the last 15 years and noted that that correlated with the expanding availability of Internet porn.

That's weak evidence, but at least it doesn't contradict the hypothesis.

Someone should try giving some pedophiles access to a generous supply of computer-generated CP and seeing what happens.

openasocket11• 10 years ago

Regarding your assumption: I have a family member who's a child psychologist specializing in abuse cases, and according to her the vast majority of those who consume CP have abused children. Hard numbers are hard to come by because of the illicit nature of pedophilia, but studies involving anonymous surveys (in which the individual's name is withheld and their answers can't be used against them by law enforcement) supports that.

greendragon• 10 years ago

I like to tell this to people when they start gushing about Japan because of their cleanliness or law and order or whatever, but they didn't make private possession illegal until a couple years ago. Before then it was just production or possession with commercial intent that was illegal. And the new law still doesn't apply to manga/anime. Is Japan a hell-hole? Are Japan's children all psychologically ruined or at a much higher threat of abuse because of the prevalence of anime/manga porn? (Some quick googling on opened investigations suggests a mere 0.0075% of Japan's children are affected per year.) To me Japan seems fine. (Another odd behavior is that daughters bathe with their fathers, sometimes (like 6-10%) all the way up to high school age.)

bertiewhykovich• 10 years ago

The notion that pornographic content does not produce desire for the acts depicted is on its face ludicrous and should be clearly false to anyone who has ever consumed pornography.

ball_of_lint• 10 years ago

The thing is that it's not really about what's right or best, it's about what's lawful.

It is definitely good that this happened and that the people using the sites for CP were identified and caught.

It is scary for the FBI, an agency that upholds the law, to break the law, even if it is for good reason.

stewartjarod• 10 years ago

I read this title and said 'What the fuck'

chickenbane• 10 years ago

I have no love for those who visit child porn on Tor, but in general I am now very wary of the FBI. I can't help but feel it's a powerful organization that's slowly turning into a dark oppressive one. The power grab from the CIA for the Petraeus affair. Using the sensitive nerve of terrorism to demand Apple unlock a phone. Throwing a last-minute wrench in the Clinton campaign. This is not going to end, especially under Trump.

nameisu• 10 years ago

GREAT MOVE