The Silk Road statement: Where are the packetlogs?

https://weev.livejournal.com/407404.html

by aburan28 • 12 years ago

82 98 12 years ago

weev.livejournal.com

datr2• 12 years ago

Couldn't the agent be referring to a http header, in which case it doesn't seem that improbable.

I've worked on sites before where if you logged in as the admin it started attaching a header with the ip of the application server responsible for generating that page to help with debugging. It's not outside the realms of possibility that something like that could break and start leaking ips.

revelation• 12 years ago

Well, we should still ask for the evidence.

Steko4• 12 years ago

If by we, you mean Ulbricht's lawyers, I'm sure they're on it since illegal search is basically his only defense.

We, the HN community, could probably find plenty of worthy people to advocate for that don't go around paying for assassinations.

rabite7• 12 years ago

The HTTP header is not in the packet header. It is in the data section of the TCP packet. If so, this calls the federal agent's capacity to serve as an expert witness in question.

hahainternet2• 12 years ago

The TCP packet is not in the 'packet header'. Both the Ethernet and IP frames precede it. How can you possibly suggest that a HTTP header doesn't count, but a TCP packet does?

Weev you are disqualified due to your incorrect assertions from being an expert commentator :D

tveita4• 12 years ago

It seems he was serving an embedded CAPTCHA from his real IP.

http://krebsonsecurity.com/2014/09/dread-pirate-sunk-by-leak...

Maybe he used a CAPTCHA library that generates absolute URLs using the server host name.

mpyne7• 12 years ago

If the agent's claim is true it wouldn't have come from an HTTP header anyways, but instead the IP address was leaked by the captcha part of the SR website, which the agent would have noticed on his wireshark-equivalent dumping TCP logs.

Nanzikambe• 12 years ago

What I'd like to know is if anyone in the public domain has any packet logs from SR?

I find it than incredible that, given SR's notoriety, nobody had ever used tcpdump, an interception proxy or a browser's inspector and noticed this IP before.

mpyne7• 12 years ago

Then again, I found it incredible that HeartBleed hung out in OpenSSL for as long as it did, when you'd think there'd be at least a couple of people in every security group out there reviewing each patch for new vulns.

pandatigox• 12 years ago

Off topic, but I thought OP was still in prison? I can't seem to find any notes of his release on his blog, so could someone please elaborate?

spindritf• 12 years ago

He's out on a technicality but unlikely to go back. https://en.wikipedia.org/wiki/Weev#Conviction_vacated

meowface• 12 years ago

It's a bit unfair to say he was out on a technicality. The appeals judge ruled that the venue was improper, and venue can be extremely important. Not to mention the judge also saw several issues with the original charges.

rms• 12 years ago

the relevant search query was "weev conviction overturned"

http://www.wired.com/2014/04/att-hacker-conviction-vacated/

aburan28• 12 years ago

There was a VPN IP leaked in April-May 2013 for maybe a hour or two but then quickly corrected. That ip belonged to the VPN provider not the server host provider

xorcist12• 12 years ago

The underlying argument here seems to be that if the evindence was procured via unlawful means, then Ulbricht should go free even he is guilty of the crime.

It seems to me as a quaint way to practice justice. What is the rationale behind this? Isn't it the court's job to establish guilt?

This specific case might not be a great example to reason about, but if this was a rapist or killer that should be set free despite being screamingly obvious guilty, just because the cop was a crook too, how could that possibly be morally justified? Two wrongs does not make one right, if you ask me.

Edit: An explanation would be nice, instead of the downvotes. Is it that questions about the justice system is off topic here?

ghshephard2• 12 years ago

See: http://en.wikipedia.org/wiki/Fruit_of_the_poisonous_tree

xorcist12• 12 years ago

I understand how the principle works, in part because of this wikipedia article, but what I don't understand is why such a rule has been implemented.

mikecb2• 12 years ago

The basic rule is http://www.law.cornell.edu/wex/exclusionary_rule

tveita4• 12 years ago

I don't think this evidence would count as fruit of the poisonous tree based on exceptions 1 and 2.

1. This investigation couldn't have been the result of other, illegally obtained evidence. It started from the publicly known Silk Road site, and didn't rely on previously known information about DPRs identity, nor on any "lucky coincidences" that could be set up using other information.

2. The vulnerability was easy to encounter even by accident. Unless it took a very large number of login attempts to activate the CAPTCHA, any serious investigation would hit upon this.

The only way I can see the evidence being bad is if they made it up completely. That is unlikely since Silk Road has had similar exposures in the past (http://www.reddit.com/r/SilkRoad/comments/1dmznd/should_we_b..., http://www.reddit.com/r/SilkRoad/comments/1b1lvy/warning_the...)

If they really had his info from an illegal search, they could make a better story without forging evidence by using parallel construction, e.g. claim that they investigated him based on his Stack Overflow posts.

spacehome3• 12 years ago

It's to discourage police from overstepping their bounds. In any particular case you might figure that it's in the public's interest to just put these people away regardless of how the evidence was procured, but the people who designed the system saw government overreach as an existential threat in a way that no small-time criminal attacking individuals one-at-a-time could be.

xorcist12• 12 years ago

Bad cops are kept from overstepping their bounds by bringing them to justice, not by letting criminals walk free.

rabite7• 12 years ago

So by your logic if police obtain from beating and torturing people, it should still be admissible?

xorcist12• 12 years ago

Not a confession for example, because such evidence is not trustworthy. Not because it was procured illegally. Those are two very separate questions.

If a police tortured someone, he or she should be brought to justice and possibly jailed for the crime. But indenpendently of that, if that produced absolutely irrefutable evidence of another crime, then that evicence should be allowed to stand on its own. It is what the word evidence means (a mathematical evidence, for example, is just as valid no matter how it was procured).

And it's not "my" logic. I'd venture a guess that it is the most common way to practice justice in the world: That the purpose of a court is to establish guilt.

DanBC2• 12 years ago

Different countries have different attitudes.

In England evidence from an illegal phone tap could be used to convict someone, but the people doing the tapping would also face prosecution for that criminal offence.

In the US there is the concept of "fruit of the poisoned tree" - http://en.m.wikipedia.org/wiki/Fruit_of_the_poisonous_tree

sixothree• 12 years ago

Is that prosecution automatic?

timdev2• 12 years ago

What is the rationale behind this?

The general idea is that the integrity of the criminal justice system is at least an order of magnitude more important than the outcome of any particular case.

Isn't it the court's job to establish guilt?

No, that's the prosecutors' job.

The Court's job is ensure that the defendant receives due process.

It's arguably impossible to have a perfect justice system. So, you have to try to construct the best one you can.

While the exclusionary rule does allow guilty people to go free, that negative is arguably overwhelmingly outweighed by keeping innocent people out of prison, providing equal protection to all, and maintaining public faith in the criminal justice system.

One can argue that the system as implemented doesn't do such a good job of providing those three outcomes, but if we assume it does, wouldn't you agree maintaining such a system is more important than ensuring every last (actual) criminal who makes it to trial is convicted?

roghummal• 12 years ago

While the exclusionary rule does allow guilty people to go free, that negative is arguably overwhelmingly outweighed by keeping innocent people out of prison, providing equal protection to all, and maintaining public faith in the criminal justice system.

But should we be letting guilty people go free? It's not like they'll ever come after me.

xorcist12• 12 years ago

> Isn't it the court's job to establish guilt?
The Court's job is ensure that the defendant receives due process.

Thank you for being the first commenter to give an answer to the actual question.

However, I do not think it really holds water. It does not seem to be the case that the prosecutor is the one to actually establish guilt. The guilty verdict is reached by a jury and a judge.

These get to value evidence according to a multitude of reasons, one of which is if it was acquired legally.

wouldn't you agree maintaining such a system is more important than ensuring every last (actual) criminal who makes it to trial is convicted?

Oh, absolutely. The question is why principle would help? To put it very blunt, "if we let a few criminals loose then the police will stop breaking the law" does simply not make sense to me.

The widespread idea in the comments below that police somehow "profits" when someone is convicted does not make sense to me either.

a3n2• 12 years ago

The general idea is that the integrity of the criminal justice system is at least an order of magnitude more important than the outcome of any particular case.

If for some reason only one lesson on civics were taught in 12 years of schooling, this would be a top candidate for that lesson.

InclinedPlane• 12 years ago

As another poster pointed out, it is that the purity of the criminal justice system is more important than any given case.

In any case there is more than just the accused on trial. Always and ever the system is on trial as well. If it were not then there would be insufficient checks and balances. Most importantly, putting the system on trial routinely is necessary, because while one man (one murderer, one rapist, one thief) can do a considerable amount of harm to others and society if set free in error the system is capable of doing much, much more damage if it is allowed to become corrupt, abused, misused, etc.

One serial killer might kill hundreds. A corrupt system can kill thousands, or millions.

knocte• 12 years ago

The underlying argument here seems to be that if the evindence was procured via unlawful means, then Ulbricht should go free even he is guilty of the crime.

If they don't provide the packetlogs, it's not that the evidence is procured via unlawful means, it's that there's no evidence!

And if there's no evidence, why would you claim that Ross is guilty of the crime?

snsr• 12 years ago

Is it that questions about the justice system is off topic here?

Protecting constitutional rights is not "quaint".

http://en.wikipedia.org/wiki/Exclusionary_rule

xorcist12• 12 years ago

Constitutional rights are not quaint. Protecting them is not quaint. The idea that letting some criminals walk free would be a good way to deter police from breaking these laws seems very much so, at least to an outsider. That is why I asked.

tzs• 12 years ago

You are being down voted because there are people here who cannot conceive that there might be people here from other countries that have working, fair, justice systems built on different rules than the US justice system, and so that take different approaches to things, and so the US way of handling something might seem strange to such a person.

Rapzid3• 12 years ago

I'm not sure they(FBI) are under any obligation to even make packet logs? Are there laws dictating this? I would think they would have just made note of the IP and the circumstances of uncovering it on paper with pen and then called it a day. Maybe save out a few raw packets. The IP address isn't the evidence against him, it was just their initial lead on the physical server...

f3llowtraveler• 12 years ago

I don't see how they could admit it into evidence without the packet logs. The defense would have no opportunity to examine the same evidence.

ynniv4• 12 years ago

A footnote in the Agent's declaration even suggests Parallel Construction:

After Ulbricht’s arrest, evidence was discovered on his computer reflecting that IP address leaks were a recurring problem for him.

It continues on to specify specific instances of leaked IP information, which is completely irrelevant hearsay if the stated means of discovery were supported by properly documented evidence. Instead it provides circumstance in which it seems likely that the server could have been discovered through such a leak. If the server were discovered through illegal means, this information would have been useful in the construction of a technically plausible sounding alternative means.

I'm not claiming that the discovery was illegal, but weev is spot on in his demand for evidence.

Rapzid3• 12 years ago

It's not really the Agent's job to make such legal determinations? If I was doing forensic analysis on a server under such circumstances I would have made note and reference to that as well. Again, the IP address leak isn't the real evidence anyway and I don't see how the FBI is on the hook to prove beyond a shadow of a doubt that they got the IP address the way they said they did. His attorneys are spinning a yarn and poking the FBI's story because it's their job, but I think we should not be suggesting the FBI is guilty of something and must be required to prove their innocence. If the FBI have the logs they should answer in kind, however I don't believe the absence of such logs is going to or should help his case any.

ynniv4• 12 years ago

That's a lot of different things. Perhaps you could focus on one and try again.

If I was doing forensic analysis on a server under such circumstances I would have made note and reference to that as well.

The footnote is not forensic, and not evidence, and there's no good reason for it to be there. I doubt you are a forensic investigator so it isn't relevant what you think you would have done, but if you were a good one I suspect you would have kept packet logs of everything you saw.

nitrogen• 12 years ago

I don't see how the FBI is on the hook to prove beyond a shadow of a doubt that they got the IP address the way they said they did.

That seems kind of important to protect against illegal methods of obtaining evidence. It's not enough to say the evidence could have been obtained legally; it must actually have been obtained legally.

mpyne7• 12 years ago

I don't see how you read Parallel Construction from there.

Instead the amended declaration is responding to the claim from the defense that "there's no way FBI could have found our boy's IP address without NSA hax!!!!1"

The reply to that can be direct: "DPR configured his captcha wrong, it was actually pretty easy...". This is all that's strictly needed, which is why the rest is in a footnote.

But the footnote isn't unimportant: It explains further that it's not that unlikely (again, as the defense had been claiming) for DPR to have leaked IP addresses, as the evidence on SR's own logs showed in retrospect DPR had been having difficulty with that.

This further undermines the defense claims that only mysterious NSA de-anonymity programs, but it doesn't need or even require parallel construction, as the agent clearly explained how he actually found the IP address: from the captcha routine.

ynniv4• 12 years ago

This is all that's strictly needed, which is why the rest is in a footnote.

I'm not sure of the legal requirements, or if there even are any.

But I know that I've filed irrelevant bugs with better documentation than the event which is claimed to be the seminal moment when an extremely high profile prosecution was suddenly possible. If for nothing else, whoever saw this packet should have documented it for bragging rights. It should be printed on the back of their business card, the byline to the rest of their career.

Instead they said "this totes happens all the time, trust us".

Bragging rights aside, this packet is the basis of a high profile international search warrant. Visiting the IP and receiving the same page is circumstantial... Anyone could be serving that same page. I'm sure you'll find plenty of them by Googling for whatever text was on the page, but you won't get a search warrant like that. It is the original packet from the source that points to that page which makes that IP crucial. It should be properly documented.

gamblor956• 12 years ago

I was initially going to downvote you but after analysis you're correct.

It continues on to specify specific instances of leaked IP information, which is completely irrelevant hearsay if the stated means of discovery were supported by properly documented evidence.

Hearsay is, literally, an "out of court statement offered to prove the truth of the matter asserted [in the statement]". Hearsay must be (1) a statement (2) by a person and (3) offered to prove that something else happened. A log of IP addresses generated outside of the courtroom to prove that a defendant visited those computers/sites/addresses would normally be hearsay. However, in the US, hearsay specifically excludes records of regularly conducted activity. (See Federal Rule of Evidence 803). Internet access is a regularly conducted activity, so IP logs, like phone records and GPS addresses, have been deemed by the courts not to be hearsay.

But all of this is irrelevant. Weev's demand is asinine and shows that he (still) doesn't understand the law. In order to use the IP logs in court, the prosecution must turn over the IP logs, and all evidence collected with respect to those logs, to the defense during the discovery phase prior to trial. The defense will get their opportunity to investigate those logs. As other commenters have already pointed out, there isn't likely to be anything in the IP logs that would substantiate the NSA theory over the far more likely scenario of RU having borked his server configuration.

dllthomas2• 12 years ago

My understanding is that frequently the records must be regularly collected; it might not suffice that the activity is regularly conducted. I wouldn't hope to rely on this in your defense without talking to a lawyer first, but it's a good thing to keep in mind to stress the importance of (for instance) regularly keeping meeting minutes and such which might wind up needing to be exculpatory evidence at some point.

maxerickson• 12 years ago

Where it says (the “June 12 Request”), I guess that is referring to a document included with the statement (or otherwise available to the participants in the case). Anybody manage to find it?

yohanatan• 12 years ago

It is several orders of magnitude more difficult to fake packetlogs of network traffic which include a protocol as complex as Tor.

I would be careful with that. It's not as difficult to fake as you might think. And a statement like this puts you entirely at the mercy of someone who is capable of faking it.

rabite7• 12 years ago

honestly, there would be so many gaping flaws in a faked pcap. there are a thousand ways to go wrong. it is much harder than forging a document, but will still trust documented evidence in a court.

here though, the FBI is basically saying "the document said this, but we don't have it anymore for some reason."

Patrick_Devine2• 12 years ago

This really reminds me of when Hans Reiser was on trial. I remember a lot of people in the tech community tried explaining away things like him removing the (presumably bloody) seat from his car, washing out the carpet of his car with a hose, buying books on how to commit a murder, and finding Nina's cel phone with the battery popped out in her abandoned car.

Each of those things was explained away by the tech community. The seat was taken out and the floor was cleaned with a hose because Hans was broke and wanted to live in the car. He bought the books because he knew he was being followed and was curious about the process. The cel phone battery was popped out because of the real perp had done it, or maybe it was something Nina had done.

The point is none of that shit matters. The finer points of TCP are going to be lost on a jury and debating the academic points of packetlogs is fruitless. I've served on a jury before where not even a single other member could parse the most basic of logical statements. Our judicial system is based on story telling; each side tells their story and the person with the best story wins. The feds do this shit all the time, so they're probably going to have a pretty damn good story.

granfalloon2• 12 years ago

I wouldn't trust a jury on this stuff, either, but it's going to be a judge deciding these issues, and they usually at least TRY to get this stuff right (though some are much better at it than others).

tedivm• 12 years ago

There's a major difference between this and the Reiser case. As you mentioned, with Reiser people were really practicing wishful thinking in order to save a hero of theirs. In this case people are trying to follow the case because there's a huge and reasonable chance that the FBI did not act above board in following US law.

I don't think anyone things DPR is innocent, or that he's going to some how get away with this. However, people are concerned that the methods used to find him were not constitutional. This has more to do with keeping the government in check than it does with anything else.

Patrick_Devine2• 12 years ago

That's a fair point. I think you articulated better what I was feeling than I had expressed, which is that it felt like wishful thinking on the part of the OP.

There does feel like there is hero worship going on with DPR "standing up to the man" though, regardless of whether people feel he's guilty or not. That's particularly so with people who feel services like the Silk Road only came about as a result of the prohibition of narcotics.

Regardless though, the unsavoury nature of Ulbricht's actions unfortunately taint the constitutionality issue.

mpyne7• 12 years ago

However, people are concerned that the methods used to find him were not constitutional.

However, people are expressing this concern independent of evidence to support this concern. Even if you're of the school of thought that the FBI has no extra "public authority" power to do their statutory job whatsoever, it's not illegal for anyone to go to the SR website on Tor, and to see what IP addresses the website instructs your web browser to hit in the process.

So there's a perfectly reasonable (and likely, IMHO) explanation on the record that supports the FBI position, and against the FBI position, there's only a lot of rather painful wishful thinking (as you say). So I'm not sure how the situation is that different, at least until more substantive evidence against the FBI's claims are presented.

clamprecht• 12 years ago

I believe that if the evidence were found to be false or otherwise inadmissible, then a jury would never see it.

lolwutf• 12 years ago

More importantly... weev still uses LiveJournal?!

ageisp0lis• 12 years ago

weev is right! https://blog.ageispolis.net/speculating-fbi-silk-road-unmask...

Bob1• 12 years ago

Old joke in defense work:

Q: What does the government call an illegal wiretap? A: "The anonymous informant".

Whoever below pointed out that a jury of 12 morons will NOT be persuaded by some turgid debate over the minutiae of packets is 100% correct. You can always spot someone naive about how the legal system actually works based on just how loftily ideological their narratives and 'theories' are.

Nevertheless, this is relevant from a procedure standpoint as if the defense can demonstrate malfeasance on the part of the FBI using computer forensics, they can have certain evidence dismissed.

The Silk Road statement: Where are the packetlogs?

Related Stories