If You Used TorMail, the FBI Has Your Inbox

http://www.wired.com/threatlevel/2014/01/tormail/

by barkingbad • 12 years ago

215 141 12 years ago

f_salmon• 12 years ago

While investigating a hosting company known for sheltering child porn last year the FBI incidentally seized the entire e-mail database of a popular anonymous webmail service called TorMail.

Now the FBI is tapping that vast trove of e-mail in unrelated investigations.

That says pretty much all about their methods.

retube• 12 years ago

That they'll share data across investigations? Why wouldn't they? Wouldn't it be utterly remiss not to?

dredmorbius13• 12 years ago

Due process. Fifth amendment. Unclean hands.

Any evidence derived from or linked to this trove can AND SHOULD be tossed out of court.

zvanness• 12 years ago

It sometimes amazes me how naive people are. The reality is that since the patriot act, the entire intelligence community has had access to any information they need. One needs to be delusional to think that they do not already have access to your emails, browsing history, phone call conversations in both audio and text versions, mapping points of where you have been throughout the day. They collect a very wide net of data that they can later scan through for any reason. And no, that data isn't deleted after a certain time frame.

Why are articles like this so shocking?

Have any of you guys had IQT reach out to you, the CIA's investment ARM? They are very active in finding tech companies that can decipher this data, profile everyone automatically, categorize people, and try to predict their next behaviors.

DanBC• 12 years ago

{EDIT: I really hope people were risk assessing and choosing an appropriate provider. Sadly, many people weren't and were choosing what they thought was secure. This is why the newer crypto tools get a lot of hostile scrutiny. Not because people don't want them, but because they have to operate in a hostile environment and consequences of failure can be severe. If prison is a risk you need have a lot to learn about encryption and privacy.}

There should be legal controls over what information is seized. Requests should need a warrant, signed by a judge. "Accidental" seizures of too much information should be reported to the body who provides scrutiny and oversight.

Some of those accidental seizures should be criminal offences and lead to punishments for the agencies involved. (Or the individuals).

While the UK has a lousy record on this (with bizarre interpretations of law so spies can say they obey the law) the reports from the scrutineers are interesting reading.

http://iocco-uk.info/

Here's a PDF of the latest report: http://iocco-uk.info/docs/2012%20Annual%20Report%20of%20the%...

Some parts of the UK government use statistics carefully and they have real statisticians available to produce and review the charts. This document? I'm not so sure. While the raw data can be trusted the use of pie-charts is usually a flag for me, and this document does include a few of them.

Thiz• 12 years ago

If you used ANY webmail site, the FBI has your inbox.

FTFY.

chacham15• 12 years ago

If you used ANY webmail site, the NSA has your inbox.

FTFY.

aaronem• 12 years ago

If you use email, the Black Chamber can have your inbox if it wants.

FTFY.

malka• 12 years ago

NEVER EVER trust the pipes. If you want your communication to be safe, encrypt it yourself.

ElongatedTowel• 12 years ago

Excuse my lack of knowledge in terms of mail encryption, but wouldn't the knowledge of communication be enough to warrant further investigation, even if the text itself is encrypted?

crpatino• 12 years ago

Well, yes... but then, by openly encrypting your traffic, you would be stating that you are a law-abiding, technically sophisticated citizen, willing to provide decryption keys to legitimated law enforcement officials with an appropriate order.

People with real secrets to hide ought to escalate to steganography + subliminal channel communications.

imdsm• 12 years ago

Is anything safe anymore?

GunlogAlm• 12 years ago

Was anything ever?

midas0072• 12 years ago

Another reason to use end-to-end encryption (like gpg with in-person signed keys) where possible and not worry as much.

scrabble• 12 years ago

According to the article they did not look at the other data in the database until they had a warrant to do so. And they didn't obtain a warrant until a different investigation pointed at a tormail account.

That honestly doesn't sound too ridiculous.

fnordfnordfnord• 12 years ago

It is ridiculous to take them at their word.

lostcolony• 12 years ago

Surreptitiously mine database for incriminating information.

Build case. Apply for warrant.

Oh look, surprise surprise, the warrant turned up something.

Yes, if we trust law enforcement, blah blah blah. The point of having checks on government authority is so you don't HAVE to trust government. Government is not to be trusted; it is to be kept in check. Your safety, your rights, should not be contingent upon trustworthy official.

higherpurpose• 12 years ago

Now the FBI is tapping that vast trove of e-mail in unrelated investigations.

Wait - can they do that? Why can they do that?! Isn't that like a fishing expedition? Now they're just looking for crimes from that database trove? I've never used TorMail but screw everything about that!

This is why we need to pass some strict laws against mass collection of data, and against using data in "unrelated investigations".

nly• 12 years ago

Who goes to the hassle of using Tormail and then doesn't use PGP? Tormail only kills off metadata.

dredmorbius13• 12 years ago

Getting people to use PGP properly is ... hard.

I've been called out by no less than a Linux evangelist, working at Google, for being so rude as to PGP-encrypt my email to him "because it was such a hassle to open".

When the ICIJ was doing its extensive collaborative investigation of offshore banking, the team evaluated using PGP, but ultimately abandoned it:

The project team’s attempts to use encrypted e-mail systems such as PGP (“Pretty Good Privacy”) were abandoned because of complexity and unreliability that slowed down information sharing. Studies have shown that police and government agents – and even terrorists – also struggle to use secure e-mail systems effectively. Other complex cryptographic systems popular with computer hackers were not considered for the same reasons. While many team members had sophisticated computer knowledge and could use such tools well, many more did not.

http://www.icij.org/offshore/how-icijs-project-team-analyzed...

It's little use if I have and use PGP if I can't convince my counterparties to do so.

Sad, too.

drdaeman• 12 years ago

I don't get it.

What's hard about GPG or S/MIME-encrypted mail? You set up the thing to integrate with the MUA once (in GPG's case, S/MIME are supported out-of-the-box with most common desktop MUAs), then the only hassle is to enter password on startup or when reading the first message. And lock the computer properly when you're getting away.

Write a message, tick "encrypt" (or don't untick it), send, done. Receive a message, see a badge "encrypted, verified", type a password (if key's not cached before), read it as usual, done. I fail to see how anything can be easier and less obstructive than this.

At least, my only problem with encrypting email is that practically no one of my peers have keys published. This could be easily solved if mail client software vendors could make their products ask user to generate and backup a keypair on install.

Oh, right, encryption has problems with webmail. Extension/userscript kludges are insecure (unless they open separate window/tab for anything private) and break with every other update.

dictum• 12 years ago

working at Google

Maybe he has a vested interest in not protecting people's privacy (or just a cavalier attitude towards privacy).

skwirl• 12 years ago

I don't really see what there is to be upset about in this particular case. This is how investigations are supposed to be done, by the book.

The FBI has copies of the servers TorMail ran on that they legitimately seized in an unrelated investigation (the servers were also hosting child pornography websites).

In the course of another investigation, the FBI found that orders for forged credit cards were being sent to a TorMail account.

The FBI obtained a search warrant for that specific account and then accessed it from their own copy.

This is not trolling the seized database for anything and everything that might be illegal. This is finding probable cause from another source and obtaining a specific search warrant. This is how it is supposed to be done. Why would you expect anything less from competent law enforcement?

The FBI is not the NSA. FBI cases have to hold up in the light of open court.

If you are upset about the fact that TorMail was not in fact secure, well, that's on the TorMail operators and on the users for trusting the entity that controlled TorMail while knowing absolutely nothing about them. Remember, TorMail has nothing to do with the Tor protocol, and is just the name someone gave their supposedly secure and anonymous e-mail service that they hosted on the deep web. For all anyone knew, the FBI could have been running TorMail all along.

Navarr2• 12 years ago

I was ready to be super upset when I started reading, especially about indicting someone on an unrelated case from the data - but then I read that they got a warrant and did everything the right way and I was completely surprised that we have competent law enforcement that does things the right way.

That shouldn't have been a surprise, that should have been expected.

davidw• 12 years ago

I was completely surprised that we have competent law enforcement that does things the right way

Probably because the stories that make sites like HN are all the 'outrage stories' where things have gone off the rails.

dredmorbius13• 12 years ago

How is getting a warrant which includes all users of an email service, AND those who corresponded with them "limited"?

LoganCale• 12 years ago

They didn't get a warrant for all the users whose data they seized.

wavefunction3• 12 years ago

People are upset because of this new standard of "grab everything, put it in a 'secure' location and mine it in the future for past crimes."

The main concern is that something you did today may become a crime tomorrow, so now entire populations are apparently in the situation of Schrodinger's cat: we are both criminals and not criminals, and only the indistinct future will determine where we end up.

If you want a society where an individual is free to pursue their interests as long as they don't hurt anyone, it makes a lot of sense to have a transparent set of rules that are applied equitably to every citizen, regardless of their demographics or background.

If you want a society where the individual is completely at the whims of mysterious and unknown forces that can destroy their life utterly for no apparent reason at all, well then carve out special exceptions for some while reserving harsh punishments for others. Introduce secret courts, evidence and trials... Institute a "permanent record" of someone's behavior that can be used to manipulate them as desired. Break the well-thought out control systems that help avoid abuses all to make "LEO easier."

I'm assuming every experience you've ever had with law enforcement is positive?

eurleif• 12 years ago

The main concern is that something you did today may become a crime tomorrow

Ex post facto laws are unconstitutional in the US.

mox12• 12 years ago

I understand people who have an issue with the "grab everything" mentality. But, from a technology point of view, how else do you do it?

Imagine your the FBI IT guy. How long do you think it would take YOU to walk into an unknown datacenter, locate the specific computer / IP address referenced in the warrant, connect to that computer and copy just the minimum amount of data necessary to prosecute said bad guy (just his e-mail .mbox file? or is this a windows shop..grab the pst? What about backups? What about his contact list? All this just for e-mail!)

Often times he probably doesn't even know the specifics of the case. Maybe just let the local DataCenter guy copy the data off for you right? Well hopefully hes honest and not involved in the crime.

The fact of the matter is, it is 100x easier to walk in, grab the servers of interest and walk out. If the FBI IT guy is smart and prepared he just brings tools to remove the hard drives from the server, copy them and put them back. BUT, if theres child porn, contraband, etc. the FBI is NOT giving that computer back any time soon. Doesn't matter who owns it.

diydsp2• 12 years ago

The main concern

What you have said above is correct, however it is not the "main" concern. There are numerous concerns. That is one key one. Since I have not seen others post other key concerns, I will also contribute an additional concern:

Sensitive data left lying around are/is very tempting to use for illegal economic and blackmail gains. The FBI in particular has a pattern of getting indicted for re-selling sensitive data, even before massive amounts of "seize now, convict later" was taking place.

hawkharris• 12 years ago

it makes a lot of sense to have a transparent set of rules that are applied equitably to every citizen, regardless of their demographics or background.

It sounds like your response is based on broad ideological convictions that have little to do with the commenter's argument. He or she is arguing that the NSA is not equivalent to the FBI because the FBI, in this case, did follow established procedures to obtain a conviction.

In order for this comment to be relevant, you'll have to establish how it relates to the details of this case.

diminoten4• 12 years ago

Has that ever actually happened? Person did X, X later became illegal, and Person was prosecuted for doing X because of a digital footprint left behind while doing X?

tommo123• 12 years ago

The issue I have with this is that there's no such thing as "by the book" Federal investigations anymore. Snowden showed us that US intelligence agencies are using illicit, warrantless means of obtaining information and then providing that information to law enforcement agencies. Those agencies then go to judges and request warrants, and they can prove that the warrant is justified because they already have the damning evidence that they're legally supposed to require the warrant to get. Which renders them meaningless on a federal level.

vezzy-fnord• 12 years ago

The FBI is not the NSA. FBI cases have to hold up in the light of open court.

https://en.wikipedia.org/wiki/COINTELPRO

Not necessarily.

gloverkcn• 12 years ago

If they are using it with warrants only then I agree there is nothing wrong as long as they can't keep the data permanently. There needs to be a reasonable point at which the data is destroyed. My other expectation is that the data is not available through a network and is in an evidence room that requires two people to access.

My primary concern is the now known strategy of parallel construction. The FBI could be trolling the emails for crimes then using that illegal evidence to find ways to get a warrant to allow the previously illegal evidence into the case.

If this was Fed Ex distribution center that had been seized it would have been treated very differently. They would collected the mail pertinent to the case and rest would have gone away. If they were to confiscate the whole building holding all of the mail for a later time in case they needed it there would be a huge back lash. But because it was email and we haven't set ground rules most people don't bat an eye, even if it's their mail that's been taken.

As a parent it's really difficult not to be supportive anywhere child porn is involved. It's an issue that is so emotional for me that my first instinct is that I would give up everyone's privacy in the hopes of putting a dent in the abuse of children. Even if it only saved one child, emotionally, it would be worth it to me. Logically I realize that once these systems are in place there is no stopping them, and they will be used for everyone else's emotional/political hot button. I only bring this up because having the reaction I do allows me to understand what other people are feeling when the issue is around terrorists/hackers/fraud/whatever.

judk2• 12 years ago

The govt does scan copy massive amounts of paper mail, also.

robryk• 12 years ago

How do we know that this is what has really happened? On the surface this seems to be possibly a case of parallel construction, in which FBI found the emails on TorMail first and then asked for a warrant for the GMail mailbox to get enough evidence to get a warrant for the TorMail one. Is there a reason why this is impossible or improbable?

egocodedinsol• 12 years ago

You don't have to be upset to think that this is interesting! Indeed, it's a very different face of "data changes law enforcement" than the NSA story. Whereas NSA has a specific mandate, FBI can use anything seized for a broad variety of uses. This may always have been true, but the scope of the seizures has increased now that they can include entire server copies, which host many different services. It's a dramatic increase in prosecutorial power (which may or may not be a good thing, I'm not making a case either way).

It's also not clear to me (maybe it is to others) where the limit on seizures is. In the extreme case, AWS is used for all kinds of criminal activities. Can FBI seize copies of AWS, and then with warrant go back and get evidence for other investigations? I doubt they would try, but somewhere between this extreme and the child porn server extreme is some sort of inflection point, both practically and legally.

eyeareque• 12 years ago

Step 1: Plant illegal material on a shared server that also contains a site the FBI wants access to but doesn't have a warrant for.

Step 2: Seize entire server.

afhsfsfdsss88• 12 years ago

Seize it all now and justify it[or not] later. Makes sense. Maybe we should all just go to jail now and wait to see if the government finds a 'lawful' reason later for us to be there.

"Strength through unity. Unity through faith."

jobigoud• 12 years ago

Surely if you use TorMail you are also the type to encrypt your messages, right? Right ?

belorn• 12 years ago

Email is one of the really worst security risk regarding exposure to false accusations. Its even worse if you consider prosecutors who is more interested in statistics and carer than justice and truth.

Almost everyone has hundred thousands of emails laying around. All in your name, all forever stored, all with a legal signature on them binding you, and each with a short text message with no context. It is very often used as evidence, attached with a conjecture provided by the prosecutor. The defended is then forced to try defend themselves both regarding the conjecture, but also having to remember and explain the original context.

It has been used in a profile case to "prove" conspiracy, and has also been used by prosecutors to move public opinion by providing snippets (official sanctioned leaking) to media.

This is why I view running a email server without full disk encryption to be negligence, and that everyone should have their own mail server. Until the legal system have caught up with technology, its not much more one can do.

mbq• 12 years ago

E-mail was actually designed to just copy a message file from the sender's computer to the receiver's one; it is sad how it evolved into a plaintext database of private stuff hosted by third parties.

sdfjkl2• 12 years ago

This post (and article) really need to have "TorMail" in the title.

kristiandupont• 12 years ago

Indeed. Though of course, that would cost them all the clicks of users of other services, curious to see if they are in danger.

sdfjkl2• 12 years ago

If they keep doing it, it'll cost them everything. Such shortsightedness is the downfall of many a business these days.

mfisher872• 12 years ago

"...we had to oppose their application to preserve our own ability to protect our own games.  Otherwise, it would be much easier for future copycats to argue that use of the word “Saga” when related to games, was fair play."

That's disgusting. "We use the word saga in more than one of our games, therefore it's our game word and it's unfair if other people steal that word from us." ...

mintplant• 12 years ago

Wrong article?

mfisher872• 12 years ago

Apparently so. Fucked that one up.

nullc• 12 years ago

I never used TorMail, but people who emailed me did. So they have private email from me even though I never used the service.

autonomy77• 12 years ago

That's an accurate comment to make, yes. They know that you correspond with people who use Tor. See how this can escalate? I think we are (hopefully) all agreed that chasing down people who use the web for wrongdoing is acceptable for the govt to do - but the collateral damage is where the problems can lie - the potential for "guilt by association" here is monumental.

dkokelley• 12 years ago

OT: Let me propose that link titles now replace link-baity parts (i.e. "This Secure Webmail Site") with specific data where available (i.e. "TorMail").

aronvox• 12 years ago

use https://www.t3mpmail.com

nraynaud• 12 years ago

If the French hosting service was really OVH, it would be quite strange that a Polish refugee fleeing for political reasons take part in a large-scale spying operation. But since they are now operating in the US, I guess they have no choice than look like nice little soldiers.

interstitial• 12 years ago

If HN is going to be a nexus of discussion on the FBI and NSA, it needs to understand the "social engineering" programs going on, and take steps to out astroturfing.

htns• 12 years ago

The site was heavily associated with small time trading of drugs and weapons and what not. While US law might be overly harsh on the criminals, I can't really bring myself to feel bad for the half a dozen people who had any substantial legitimate traffic on the server.

john_b3• 12 years ago

So having the private communications of innocent people compromised as collateral damage to an investigation of a few bad people is ok now? They have servers full of communication logs and only a handful of people have been charged with crimes based on that information.

midas0072• 12 years ago

Privacy as a Service with centralized servers isn't "swat proof."

atmosx• 12 years ago

People who used tormail with their real name and/or without PGP are naive and have clearly no idea in what they were into. If the NSA has a huge amount of PGP's well... who cares? :-)

sprash• 12 years ago

So bitmessage it is then...

codys• 12 years ago

Parallel Construction, anyone? They just happened to be executing a search of his gmail account and certainly hadn't looked over this trove of emails from people trying to be secretive?

hendersoon• 12 years ago

Unless I missed it, the FBI still hasn't disclosed how they tracked down the physical server. The FBI said was it was "located in a country with an arrangement with the US, who gave us access", but remained intentionally vague and said nothing more. Can they really use that data without disclosing how they got it?

ergoproxy• 12 years ago

The key sentence from this article: "the FBI is adapting to the age of big-data with an NSA-style collect-everything approach."

NZ PM John Key famously said: "If you don't want to be spied on, hide under a blanket." http://www.thecivilian.co.nz/if-you-dont-want-to-be-spied-on...

Actually, hiding under a blanket won't help. I don't think Americans get it yet, so let me shout it: YOUR GOV'T IS SPYING ON EVERYTHING YOU DO!

They don't wait for you to commit a crime and then get a warrant: They collect everything!

And not only the US government, but governments all around the world. In fact, the British government spied on users of Angry Birds, along with the NSA. Source: http://www.nytimes.com/2014/01/28/world/spy-agencies-scour-p...

And this is nothing new: "In 1862, Lincoln authorized sweeping control over the American telegraph infrastructure for Edwin Stanton, his secretary of war. Telegraphs were re-routed through his office, and Stanton used his power to spy on Americans, arrest journalists, and even control what was or wasn't sent." Source: http://www.theverge.com/2013/7/6/4499636/how-lincoln-used-te...

There you have it: The US government has been using NSA-style electronic surveillance to spy on its citizens since at least 1862. So do you really think anything's going to change now all of a sudden?

herrschindler• 12 years ago

As long as people think the issue is technical only, they'll keep choosing providers that cannot hold the promise they make. Legislation and local provisions should be very high on your list. So far, Switzerland seems like the best legislation of choice according to this article: http://arstechnica.com/tech-policy/2013/12/switzerland-wont-...

Of course the author seems to disagree, especially when you look at the title, but that seems only because of some odd fascination with gag orders which seem largely irrelevant in real life as several comments have pointed out.

If You Used TorMail, the FBI Has Your Inbox

Related Stories