The Dark Net Archive

A recent article in the Economist magazine “Shedding light on the dark web” brought to light the work of Gwern Branwen (reportedly a pseudonym). Branwen as a researcher decided to collect information on the dark net. According to the article, roughly once a week from December 2013 through July 205 he crawled 90 different Dark net market places (including Agora, Evolution and Silk Road 2) and archived a snapshot of each page.  The Economist reports that the data collection is 1.5 terabytes of data. Included in the various 360,000 sites is information on the items sold, the Bitcoin price of the item, the date of the sale, shipping information, customer ratings and the vendor’s pseudonym.  On his website Gwern says “I scraped/mirrored on a weekly or daily basis all existing English-language DNMs as part of my research into their usage, lifetimes/characteristics, & legal riskiness”.

Dark Archives

Wow, that is a heck of a data set to crawl through.  Anyone investigating crimes on the dark net finally has some historical data with which to do research.  This can provide investigators with some valuable information as to targets and suspects. The article admits that the collection was not everything on those sites and excluded certain data..  Still this is a treasure trove of information not previously available to researchers and law enforcement. Gwern also states on his website that the data set contains various vendor PGP keys, username (even clearnet names), and email addresses.

You can find the complete archive at https://www.gwern.net/Black-market%20archives. Or by going to the ever popular Archive.org where they have a Torrent link to download the data https://archive.org/download/dnmarchives/dnmarchives_archive.torrent

 

“The Government Did Not Need a Warrant….” — In support of NIT’s

WOW, that is all I have to say up front. A federal Judge responding to motions filed in one of the Tor hidden service cases against users of the “Playpen” child pornography site found that the FBI did not need a warrant to use a Network Intrusion Tool (NIT). If you have not read Judge Henry Coke Morgan, Jr’s finding in the Playpen child pornography case you need to, find it here Judge Morgans Ruling.

After you read it come back and let’s chat….

Okay, now that you have done your light reading, let us review a few things.  First, I am a huge proponent of law enforcement use of “Policeware” (for full disclosure my company received a grant from the USDOJ Bureau of Justice Assistance to build a NIT for local law enforcement’s use).  Judge Morgan hpolicewareas done a fine job of recognizing and validating the use of these tools by law enforcement. He commented in his decision, “As noted in Levin, “NITs, while raising serious concerns, are legitimate law enforcement tools.” 2016 WL2596010, at *8.”.  Judge Morgan presents, in his 58-page opinion, several serious points of interest to law enforcement investigators. After reviewing numerous motions before the Court, he concluded “The Court finds that no Fourth Amendment violation occurred here because the Government did not need a warrant to capture Defendant’s IP address,”. This decision alone is significant in that the Court felt that no warrant was needed for the FBI to deploy their Network Intrusion Tool (NIT), even though they had originally obtained one for its use in this case. Partly it was because of the nature of the tools limited identification of information from the target computer. The Defense had said that the original warrant was not specific enough, but the Judge pointed out the FBI was only seeking 7 pieces of information and specified exactly what that information was that they sought.

Judge Morgan supported his opinions with well thought out reasoning. However, this does not mean that everyone agrees. The Judge’s decision has met with much consternation by those viewing this as an overreach by government and an invasion of privacy. Mark Rumold of the Electronic Freedom Foundation complained in a recent blog posting that the decision was “…a dangerously flawed decision …”. Rumold further commented “The implications for the decision, if upheld, are staggering: law enforcement would be free to remotely search and seize information from your computer, without a warrant, without probable cause, or without any suspicion at all.” Well, that is a little bit of an overreach of what the Judge said. In fact, I think the Judge succinctly put that based on the architecture of the Internet and how browsers work the targets of the investigation traveled to Virginia over the Internet. This then gave the Magistrate Judge the authority to issue a warrant because the target had traveled to Virginia to access the Tor Hidden Service.

As anyone knows on the law enforcement side, law enforcement is never free to search anything and this decision did not extend the reach of law enforcement. What it did do, was to help define what technology can be used in a cyber-investigation. It also helped to legitimize law enforcement’s deployment of NIT’s and make them Legitimate law enforcement tools… This is fantastic, it is about time that law enforcement can use the technology available to them in a meaningful way to fight crime online.  Although, the larger media and its audience will not recognize it, this decision is to cyber-crime investigators what the North Hollywood shootout was to patrol officers. Instead of crazies with machine guns and bulletproof vests being fought off by police officers with revolvers, this case has the chance to change cyber investigators still using Window XP into cyber-crime SWAT guys. Special Weapons and Tactics will take on a completely new meaning within the cyber-crime arena. The deployment of NIT’s will change how we collectively seek out those committing crimes on the Internet.

So what does this mean going forward? It means law enforcement can actually catch more bad guys committing crimes on the Internet. It means cyber-crime investigators can come Snip from orderout of the dark and become aggressive members of the law enforcement establishment.   According to Judge Morgan “The Government’s efforts to contain child pornographers, terrorists and the like cannot remain frozen in time; the Government must be allowed to utilize its own advanced technology to keep pace with our world’s ever-advancing technology and novel criminal methods.”

Thank you Judge Morgan for understanding the technology, and making sense of the Internet policing front line. Sadly, at this time this is only a single Judges ruling. We can only hope that our well-reasoned and intelligent Judiciary will understand the technology and come up with similar findings in other cases.

Use of Policeware on the Rise

Policetape.image

The challenge for law enforcement and intelligence agencies investigating Internet crimes are those users who hide themselves using various “anonymization” techniques. Internet anonymization techniques allow targets of criminal and terrorist investigations to hide themselves from other Internet users. In normal circumstances, this can be a privacy concept employed to prevent others from identifying a user in legitimate situations. The issue for law enforcement investigators and the intelligence community becomes when criminals and terrorists use this same technology to prevent their victims or government from identifying who they are and hiding their location.

The misuse of Internet anonymization poses unique investigative challenges. However, criminals and terrorist can be identified given certain circumstances and the appropriate application of social engineering skills and investigative tools and techniques. The challenge is; 1) knowing that there are methods to employ; and, 2) obtaining training regarding employing those methods.

In recent years, a new category of computer coding for government agencies has developed and are referred to as “policeware” or “govware”.  The recent exposure of one of the companies involved in this industry “HackingTeam”, from Italy, has shed light on these tools’ use by law enforcement and the intelligence community. HackingTeam’s company servers were broken into by as yet unknown hackers and their company and client information exposed to the world.  Retaliatory strikes by the hacking community, purportedly as supporters of freedom and protecting the innocent, is nothing new. Just a few years ago Gamma Group from Germany, another large company in the Policeware industry, also was hacked and had internal material and code exposed.

What both of these incidents revealed to the world the extent to which the law enforcement community (mainly at an involved county’s  National level) and the intelligence community’s efforts are to identify investigative targets. It also shows that there are a series of tools available that can further investigations into anonymous users.  Generally, most investigators are unaware that there are several categories of tools to assist in the investigation of anonymous users. These can include: Server side scripting, Target side scripting, and Total device compromise (complete takeover of a machine). Other traditional methods of evidence collection against targets can include general Network surveillance (sniffing your network for clues), Physical access compromise and Lawful interception techniques like a traditional wiretap but of a computer).  These varied investigative techniques require additional training and education for the law enforcement community. This training and education not only includes the technical aspects of the tool deployment but also the legal implications of employing these techniques against a criminal target. Unfortunately, this information is currently not generally available. Law enforcement should look to a broader acceptance of these more offensive techniques to continue their efforts in protecting their communities. Certainly, the U.S. federal law enforcement agencies are using these techniques. In his recent comments to the House Intelligence Committee hearing on cybersecurity, FBI Director James Comey said about criminals using the Darknet that if they “use the onion router to hide their communications.. They think that if they go to the dark web… that they can hide from us.” But, he says: “They’re kidding themselves, because of the effort that’s been put in by all of us in the government over the last five years or so, that they are out of our view.” The methods and techniques to reveal criminals online is diverse.  Law enforcement investigators are beginning to employ a variety of methods that will further their investigations and catch criminals who thought they were untouchable.

The Silk Road, Federal law enforcement and who’s watching the Undercover Agent!

The week’s arrests of former Federal Agents Carl Mark Force IV and Shaun Bridges is more than just an embarrassment to the agencies involved.  It is another indicator of the managers’ lack of understanding of their agents’ Internet investigations work.  Much to the chagrin of some of our book, Investigating Internet Crimes, readers, we devoted considerable space to discussing investigative policy. Gee, I wonder why? The Silk Road investigation has provided an example, and not a good one for law enforcement managers to have policy and understand what their investigators are doing online.

Several clear things have appeared in this case. Early on the lack of documentation exploded when the former FBI Agent Tarbell wrote in an affidavit that he failed to document his actions when he found the Silk Road server. I had previously defended the FBI and publically stating that we needed to wait until all the facts (and testimony) were in. Well at Ross Ulbricht’s trial it never came in and we have just found out why some things were never discussed. Agents Carl Mark Force IV and Shaun Bridges were under investigation and the defense was prevented from disclosing anything about their conduct.  Now, I am not an attorney and cannot discuss how those motions were or should have been handled, but I can discuss the disclosures recently made and how poorly it appears the Federal supervisors acted.

Supervising people undercover has been a long standing supervision intensive problem. Long ago working vice I remember a supervisor criticizing my performance after the fact. However, that supervisor was right there, listening to the wire and gave me immediate feedback. I would not be making that mistake again.  Internet investigations have changed what it means to be undercover (UC).  When we first started doing UC on the Internet in the late 1990’s to document what we did and the chat’s we had included a video camera over our shoulder. At that point there was not much else we could do.  As investigative techniques continued, law enforcement found tools to assist them in their documentation. Screen captures and video recordings were accomplished with tools like Techsmiths Snagit and Camtasia which were adopted for this new purpose. Later tools like WebCase were designed specifically for treating information on the Internet as evidence.

Collection of evidence from the Internet is a unique and specific problem which I wrote about years ago in a whitepaper Collecting Legally Defensible Online Evidence.  Not collecting Internet evidence properly is just the beginning of the Federal Managers supervision problems in this case. The next issue was the fact that they were not supervising their undercover agents. We do know that some recordings were made, but who looked at them.  Was anyone looking at the UC’s actions online? Was anyone review the recordings being made? Was anyone supervising the agents? Apparently not,  because the criminal investigation of the agents found the use of one of the unauthorized accounts in one of the UC recordings. No supervisor was looking or if they were they didn’t know what they were looking at. Agent  Gambaryan reviewed the case file of Force and found “…several DVDs of video taken with FORCE’s official DEA laptop with a screen-recording program…”.

Image one

Gambaryan found the reference to an account that Force used that was not mentioned in the reports. But it was in the undercover video’s. What supervisor was reviewing his actions.  Again,  apparently no one.

Another indicator  the supervisors should have seen with Agent Force as UC was the encrypted communication.  Everyone should have known he was using encrypted communications with DPR (Ross Ulbricht). In fact in Agent  Gambaryan’s affidavit he comments on the prosecutors continual mentioning of providing all of the encrypted communications.

Image two

Agent  Gambaryan also, although probably not intentionally, puts the issue of undercover Agent supervision squarely on the managers feet when he surmises Force’s failure to provide the encryption keys to his managers.

 Image three

If the supervisors/managers were, doing their job this would not have been an issue. They should have known and would have obtained the keys. But they didn’t.

Okay, back to our book. As a former law enforcement supervisor I have recognized for years that supervision, management of undercover officers and policy go hand in hand.  Previous to writing our book, I wrote the first published model policy on using social media by law enforcement because I saw the need. We included much of this in our book, including ethics discussions and these model policy’s for law enforcement conducting Internet investigations. We did so, because it has not been discussed and needs to be understood. Law enforcement managers at all levels (local, State and Federal) need to understand that undercover work on the Internet has just as many supervision issues as undercover work in the real world. Some of the issues are the same and some are different. But, supervision and management must still occur regardless of the case.

 

Just when you think, it cannot get any more bizarre

Okay, I am mystified here; in fact, I just want to scream, “Are you really that stupid?” Apparently, the two agents instrumental in the investigation of Ross Ulbricht and the original Silk Road Tor market place were. From Wired magazine today, “DEA special agent Carl Force and Secret Service special agent Shaun Bridges were arrested Monday and charged with wire fraud and money laundering. “ If you have not already read the Affidavit of Special Agent Tigran Gambaryan  in Support of the Criminal Complaint filed in the Northern District of California against them, I encourage you to do so. If for nothing else, you will get a good laugh.

We have talked about supporting the federal agencies involved in this case and waiting until the facts are in before determining guilt. Well, the facts are in, the charts laid out and the Bitcoins spent. These two idiots, who held themselves out as experts in online investigations, certainly had no idea how to be successful criminals.  Both of them need to go back to school on that topic. In reading the affidavit, it is clear that the two of them thought they were smarter than their counterparts. Special Agent Gambaryan does a masterful job laying out his investigation into former agents Force and Bridges trip through stupidcriminalville. Force and Bridges, like the person they arrested for Silk Road, failed to use some of the basic online security procedures. Neither apparently had worked any major international fraud cases (if they had they didn’t use anything they learned) because they had no idea how to hide and move large amounts of money without using their own names and bank accounts.

Okay, back to the basics here…If you are an undercover officer, don’t commit crimes while undercover. Oops, they must have been absent that day in the basic undercover agent course.

United States Attorney’s Office – 1/Ross Ulbricht – 0

Ross Ulbricht, 30, was found guilty by a Manhattan federal jury on all seven counts in the indictment he was charged.  He was convicted as the mastermind behind the original version of the Tor Hidden Service known as the Silk Road. The pundits have already begun to take apart the prosecution’s case saying it was unfair. The maligning of Judge Forrest’s handling of the case before and during the trial has begun in earnest. Even Ulbricht’s attorney, Joshua Dratel, is being questioned publically for his apparent lack of a real defense.  Some explaining he simply set the stage for the inevitable appeal.

silk_road01 Guilty

So what happens next?  Well Ross still has a pending indictment for the murder-for-hire plot in the Maryland District. Whether or not he will go to trial on that charge is unknown at this time. But, a betting man might consider that will be a slam dunk too based on the evidence presented in New York.

So how was Ross convicted when he wasn’t guilty according to his defense? What I have said before is exactly what the U.S. Attorney’s office presented; they put on a typical drug trial. Ross Ulbricht was convicted because of the drug case not because of his inventive method of using Tor as a “Social Experiment”. The Tor Hidden Service was only the vehicle by which the drug conspiracy was conducted. The Assistant United States Attorney (AUSA) Serrin Turner put the pieces together one by one and connected the face of Ross Ulbricht to the online persona Dread Pirate Roberts (DPR). They moved the evidence collected from the real world through the medium of communication, which just happened to be Tor. The AUSA used cooperating witnesses to explain the drug trade and like in any good drug trial followed the money straight back to Ross Ulbricht. Never mind that the money was in what the jury probably thought was some obscure online money trading system. Money for drugs is just that, money for drugs.  Ross Ulbricht is now, not just a famous drug King pin, but a convicted one.

Wow, the FBI can’t investigate Cybercrime: What do We do now?

The tech headlines since September have included how the FBI is so incompetent that it can’t investigate Cyber crime. Many articles have even insisted that they have lied about how they investigated certain cyber crimes. Some online are saying the Silk Road 1 arrest of Ross Ulbricht, whose trial starts this week, could not have happened without a grand conspiracy with the CIA. The investigation of the attack on Sony did not happen the way the FBI said because, well, apparently they are too slow to know how it was done The tech headlines since September have concluded the FBI is incompetent and can’t investigate cyber crime properly. The  “FBI Lied About How it Obtained Silk Road Server Location Says Security Expert” and “The FBI May Have Made An Embarrassing Mistake While Investigating The Sony Hack” or “Some Experts Still Aren’t Convinced That North Korea Hacked Sony

I guess the FBI’s work  and arrest of Blake Benthall during the Silk Road 2 investigation was not real nor was the malware arrest under operation Blackshades. What I think is happening to the FBI is a broader reactionary response to law enforcement by some.  The current tech industry attitude being espoused concerning the FBI is a similar distrustful reaction that some are having towards U.S. law enforcement in general after the recent police shootings.

In the Tech industry it appears that every so called “Cyber Security” firm that wants its fifteen minutes of fame has come out saying the FBI is wrong. At this point, the problem is no one outside of these investigations has any idea what the evidence is or is not in these cases.  Sony brought in Mandiant to assist in their investigation.  Even Kevin Mandia, CEO of Mandiant, in a letter to Sony’s Michael Lynton states that the attack was unprecedented.

2015-01-05_12-56-22

Now this certainly does not say that the attack was done as the FBI claim by the North Koreans, but it certainly does support the fact that there is much we have yet to understand about the case.

I understand the FBI’s position and that external criticism is part of law enforcement. What I do not understand is the huge amount of discord without knowing the facts.  Okay, maybe the FBI is wrong, but the only people that know the facts are the FBI, the victims and the perpetrators. External analysis is always good in a free society, but let us be careful when we call the ones we enlist to help us liars without the benefit of all the facts.