FBI Affidavit in Harvard Bomb Hoax [pdf]

http://cbsboston.files.wordpress.com/2013/12/kimeldoharvard.pdf

by daughart • 13 years ago

29 50 13 years ago

cbsboston.files.wordpress.com

vilhelm_s• 13 years ago

I wonder how exactly they tracked that he was using Tor at the time---does Harvard specifically log connections to the Tor network? Or do they log every outbound TCP connection?

brajkovic• 13 years ago

My guess is they have logs of every outbound TCP connection—it's not like Tor is the only protocol that can be used for evil.

daughart4• 13 years ago

The Harvard (non-guest) network is secure - you must connect to it using your Harvard web ID login information. Harvard can then uniquely identify all of your traffic. (http://www.fas-it.fas.harvard.edu/node/189)

I guess I should have written a paragraph's worth of inane blog spam to get my submission title used? I was trying to make this exact point in my original title. The title my submission was assigned is not the real title of the PDF either... seems very arbitrary.

jauer• 13 years ago

Many institutions & providers gather Netflow data (source, dest IP+Port, number of bits, flow duration) and store for a period of time to use in detecting DDoS, performance monitoring, and planning transit/peering. Correlating that with access to known tor nodes and you're done.

hrrsn• 13 years ago

By and large, if he tethered his cellphone and used Tor that way (or sit outside a coffee shop, etc), he wouldn't have been caught?

pwnna• 13 years ago

Tethered cellphone probably will be identified, though that would be slower as it needs to go through the ISP.

Coffeeshop will make it even harder, but may still have issues like identifying the computer, etc. etc.

jrockway3• 13 years ago

Oh man. Never confess to a federal crime without at least getting some sort of deal worked out.

Also: everyone should be required to fail a couple classes sometime in their life. It's not nearly as bad as you'd imagine. (Hint: after high school, nobody cares about your grades anymore.)

smtddr• 13 years ago

>(Hint: after high school, nobody cares about your grades anymore.)

True for software developers nowadays, but some other disciplines like maybe scoring an accounting job at Charles Schwab I bet still checks that GPA.

Ya know what I want HN to do for a poll? GPA at school! Mine is awful, couldn't pay attention.

Crito2• 13 years ago

Even if they check your GPA, that isn't the same as checking all of your grades. A single failure really should not do all that much damage to your GPA.

(I bet my GPA is worse ;)

yeukhon• 13 years ago

There is no way to get this deal worked out. They have the evidence they need and this is a serious issue. he will definitely face academic discipline charge against him from Harvard, most likely expel from Harvard University. Furthermore, there is no use of him for the FBI; when you when a deal you want to get some information out of him, or to make the processing faster. In this case, they have the evidence and they don't have to wait.

If he really wanted the exam to be rescheduled, the dumbest thing he could do is either break his own arm or pull the fire alarm somehow, or throw some stink bombs everywhere in the classroom. Those along probably will only cause suspension and minor criminal charge at worst. Though he'd be very careful with fire alarm...Now he probably can't get back to Harvard, after several years of stressful preparation to get into Harvard...

And for most jobs out there grades do matter, especially if you plan to go to graduate school.

daughart4• 13 years ago

I got a C and two B- in college. Currently in grad school at Harvard. One or two bad grades shouldn't hold you back. Given the recent grade inflation scandal (http://www.thecrimson.com/article/2013/12/3/grade-inflation-...), it seems like even very poor work at Harvard is graded at C or better (this was certainly the case for my C; I probably deserved to fail).

MichaelGG5• 13 years ago

There may have been a way. We don't know what evidence the FBI had. It might just have been a list from Harvard of which network nodes appeared to have connected to Tor at certain times.

For all we know, they might have just talked to everyone that had used Tor that day. They might not have had any solid evidence about him until he confessed.

knieveltech2• 13 years ago

"And for most jobs out there grades do matter"

Not even a little bit. What, you think a hiring manager is going to try to track down your college transcript?

Edit: here's now little grades matter as a developer: I have a GED and five college credits (two of which were archery) and I've been happily employed as a developer for the last six years.

jrockway3• 13 years ago

Not correct; another reason the deals are made is to save the state the cost of a trial. And if they won't give you a deal, go to trial and get some expert witnesses to say it was impossible to tell that it was you. The government has to prove you guilty beyond a reasonable doubt and get 12 random people on the street to agree. That's risky. Hence plea bargains.

tedunangst• 13 years ago

I've never seen a grad school application that didn't ask about GPA.

chimeracoder• 13 years ago

Also: everyone should be required to fail a couple classes sometime in their life. It's not nearly as bad as you'd imagine. (Hint: after high school, nobody cares about your grades anymore.)

At least for prestigious schools (like Harvard), this is completely true, even outside engineering disciplines.

A friend of mine who went to Columbia got a D on one of her language classes. At Columbia, a D isn't even a passing grade - you don't receive credit for the course, and have to retake it.

That didn't stop her from receiving the highly-competitive Fulbright scholarship[0] to study at the graduate level in that very language.

If she had done badly in three or four of those language classes, that'd have been a problem. But students almost always overestimate the importance of a single course grade as opposed to a pattern of grades. (And even the latter can be accounted for otherwise, though it is admittedly an uphill battle).

I wholeheartedly agree that everyone should fail a class or two at some point in their lives. It teaches you a very good lesson: don't sweat the small stuff, even when that small stuff seems like really big stuff.

[0]http://en.wikipedia.org/wiki/Fulbright_Program

auctiontheory• 13 years ago

Hint: after high school, nobody cares about your grades anymore.

This is actually not true, especially when applying to Google and a lot of tech, Wall Street, and other blue chip companies - or of course to grad school, law school, or med school.

Which is no reason to call in a bomb threat.

ohyes2• 13 years ago

Only for a first job, or for more school, yes. But seriously, it isn't important.

For any job, it is much more important to have some sort of positive personal connection. (Worked with someone there before, a professor recommends you as talented, an internship).

Which is why people pay big bucks to go to Harvard/MIT/Yale? Correct? The objective is rubbing elbows with the elite and making connections. Presumably I can get a similar education elsewhere for less money.

jrockway3• 13 years ago

I've worked at Wall Street firms and Google, and nobody has ever asked me for my grades :)

bhickey• 13 years ago

Not that failing is really a winning strategy, but even George Church got kicked out of Duke: http://arep.med.harvard.edu/gmc/F.jpg

MichaelGG5• 13 years ago

The affidavit is a bit light, I suppose because the guy confessed so there's no need for more details.

It suggests that they merely correlated Tor (not TOR) activity and then showed up and confronted the kid.

If there were not many Tor users during that time window, they simply might have interviewed everyone. Since the kid wasn't really planning a violent act just wanted out of an exam he probably folded immediately.

Unfortunately, given this information, it's unlikely we'll find out any more about the FBI's capabilities. I can't imagine the kid doing anything but pleading out.

ArcticCelt• 13 years ago

Use tor, use Guerrilla Mail then use his own wifi account. Why are people so dense? I am happy whit him being caught because of what he did but why don't people who do that kind of things use some internet cafe free wifi?

swalkergibson3• 13 years ago

Here is the statute under which he is being charged.

http://www.law.cornell.edu/uscode/text/18/1038

Looks like he has a really heavy fine and up to 5 years in jail coming his way. It's a shame, really. Just take your lumps on the exam, it's certainly better than this.

MichaelGG5• 13 years ago

Sure it's better than this. But most likely, he didn't think they'd correlate his Tor activity so it may have been "better" for him personally if he had gotten away with it.

swalkergibson3• 13 years ago

It seems as though he was not thinking rationally. He used both Tor and Guerrilla Mail, but did not consider sending the messages from a public WiFi hotspot? Seems like a really rookie mistake to make if you are going to commit a federal offense.

daughart4• 13 years ago

Was this a genuinely dumb oversight on the student's part? Harvard WiFi requires students to log in with unique IDs to gain access (http://www.fas-it.fas.harvard.edu/node/189), so Harvard can monitor and log all of your traffic.

Does this mean Harvard could in theory have this transmission recorded as it goes in to the TOR network? Would something as simple as going across the street to Panera Bread have thwarted this kind of investigation?

I'm really curious if the flaw in this kid's plan was that obvious.

belluchan2• 13 years ago

I'm sure the manual part of logging in with his identification only happens once and is stored by his computer which automates the identification in the future so he may have forgotten this.

daughart4• 13 years ago

It's unfortunate that I seem to remember this fact every time I watch porn on said network. :-s

fru2013• 13 years ago

Does this mean Harvard could in theory have this transmission recorded as it goes in to the TOR network?

They would not be able to decrypt the traffic, but they would be able to tell that it is traffic going through the TOR network.

Would something as simple as going across the street to Panera Bread have thwarted this kind of investigation?

Probably, though they may have figured him out through different means.

smrtinsert• 13 years ago

Somewhere a tiger parent breathed a sigh a huge relief when their child didn't have to ruin their Harvard gpa.

8ig8• 13 years ago

I feel bad for this kid. It was obviously a bad decision.

We all make bad decisions. Some haunt us longer than others. I know this was very wrong, but I wish the kid got a do over.

moeedm• 13 years ago

Harvard huh? You'd think he'd be smarter than this.

beedogs• 13 years ago

To be fair, he's Harvard Business. Sort of the meathead division of Harvard, compared to their law school.

aioprisan• 13 years ago

Since Harvard's WiFi requires you to login with your HUID and password, it would be trivial to look at all the internet traffic from campus at the period before the threat and see who was using Tor, and investigate those specific connections, since Harvard logs every outbound TCP connection..

stefan_kendall• 13 years ago

So we're armchairing how this should have gone, right?

1.) Buy a burner laptop on the street, in cash, then wait a while.

2.) From an open wireless connection, where you're far enough away to not be on any security cameras, use Tor, then VPN tunnel through a high traffic public server in China or Russia. You want to make sure you're not driving out of your way to be at a place at a time, in case the IP gets traced back for whatever reason.

3.) Prepare an elaborate email. Make it good.

3.) Setup an online meeting with someone. Play a video game online, start a skype chat, or otherwise create an alibi for how you couldn't be writing emails.

4.) Send the email through an anonymous email service.

5.) Destroy the laptop as far from campus as possible.

Did I miss anything?

In the end "Chinese hackers" get blamed for the email, and the media attention fizzles.

ohyes2• 13 years ago

Could have spent all of this time studying, would have gotten a decent grade on the exam.

FBI Affidavit in Harvard Bomb Hoax [pdf]

Related Stories