The FBI took -- and mysteriously returned -- their server. Here's their story

  • Posted on: 11 May 2012
  • By: worker

<table><tr><td>From <a href="

This is a video of FBI caught on camera that goes with the story:

Ever wonder what it's like to have FBI agents knock on your door? Or to have them walk into your business unannounced and walk away with your computer? Jamie McClelland and Alfredo Lopez can tell you.

Their recent run-in with the men in black – the result of a spate of email bomb threats to the University of Pittsburgh -- offers a rare glimpse into the collision between free speech rights and the benefits of anonymity on one side with the needs of law enforcement to act quickly in the face of real threats on the other.

Their tale ends with an odd twist: FBI agents, caught on video, returning the server only four days after it was seized from a co-location facility in New York City. At the moment, no one knows why the FBI would take that unusual step. FBI Special Agent Bill Crowley said the agency wouldn't comment on either the seizure or the return of the server.</td><td><img title="Because they are nice" src=""></td></tr...
Federal investigators and local officials in Pittsburgh were scrambling last month as bomb threats targeting the University of Pittsburgh piled up. Within days, 46 such threats were logged, causing massive disruption as students and teachers were continually evacuated from building after building. Parents and school officials pressured law enforcement to solve the case. For some reason, the FBI thought a server in a small facility in New York City might contain a crucial clue.
McClelland and Lopez run a progressive Internet organization called MayFirst/PeopleLink, which helps democracy-seeking groups around the world use the Web to organize. Together with sister organization RiseUp, MayFirst/PeopleLink offers email services, mailing list support and other Web tools. But their services make a promise that's critical to people fighting oppressive regimes: All data is encrypted, guaranteeing total anonymity to those who need it.

McClelland was on a conference call in MayFirst/PeopleLink's Brooklyn office -- which is in the same building where Lopez and his wife live -- on April 11 when he saw two men in suits standing at the door.
"I thought they were Jehovah’s Witnesses, but I joked with people on the call that it was the FBI," he said. Moments later, it was no joke.
The agents flashed their badges and asked if they could come in; McClelland refused. They asked if they could step into the vestibule. He refused again.

"I had had some rudimentary training,” he said. “It certainly had occurred to us that we might some day get a visit from the FBI given the nature of what we do. But this wasn't what I expected. I was surprised at how easy it was to say ‘no’ to them...There was no intimidation, none of that. The agent appeared more nervous than me, and I was pretty nervous."
Standing outside, the agents then showed printouts of a few emails with full headers to him, saying they were related to the Pittsburgh bomb threats. At that point, McClelland hadn’t heard about the threats, so he said he didn't know anything about them. They asked if he knew anything about, a server which appeared in the e-mail headers. Again, he said “no,” truthfully.
"I asked if I could have copies of the emails. The agents said “no.” But I then asked if I could get pen and paper and write down details of what we were looking at. They let me do that," McClelland said. "I then asked them if they thought our server was compromised. But they couldn’t tell me anything. So I asked for their business card and told them we would research it."
The agents left, but McClelland’s day had only just begun. What was Why did the agents show up unannounced? And most important, what would happen next? He was sure that wasn't the end of it.
"When you are visited by the FBI, even when it goes relatively easy like it did, your entire life gets put on hold as you deal with all the implications," he said. McClelland called Lopez and other leadership team members, and then called the Electronic Frontier Foundation for legal help.
“There were three hours of calls to run through things and make sure we had everything covered," he said.
Initially, Lopez and McClelland assumed that one of their members had been hacked, and the account used for illegal purposes. Simply patching whatever security hole existed could end the problem. But a visit to indicated there was a much more complex issue.
ECN stands for the European Counter Network, an independent Internet service provider in Europe. It shares much the same mission as MayFirst/PeopleLink. On, the provider offers anonymous email services through a service called "Mixmaster." Using Mixmaster, email users can achieve nearly undefeatable anonymity -- multiple servers pass messages from one to the other, each time stripping out header information and replacing it with false data, making it nearly impossible for investigators to "trace" the message to the original sender.
ECN had subcontracted space on RiseUp's New York City server; RiseUp had in turn subcontracted that space from MayFirst/PeopleLink. It now appeared that the FBI believed someone connected to the Pittsburgh bomb threats had used ECN's anonymous email capabilities, which led to FBI agents knocking on the door at Alfredo Lopez's home office.
"If you had asked me before this happened if one of our members ran an anonymous remailer, I would have said, 'probably,' " said McClelland. "That's exactly the kind of thing we want to support and we want to protect."
When correctly configured, anonymous remailers leave no trace at all. There are no log files to check, no other server "fingerprints." After making sure the server was running properly, McClelland called the FBI agent on the business card and told him all he knew about ECN, which essentially was nothing.
"We told him we suspected there was an anonymous remailer, there's nothing else we can tell you," he said. "We decided that was our best strategy ... to minimize disruption to our members. We didn't want to risk going to the next level of escalation."
The strategy failed. The next day, MayFirst/People Link received a subpoena demanding that the organization answer a series of questions about its server. With help from the EFF lawyer, they sent the responses on Monday, April 16.
"At that point, we thought everything was OK, that we were done, and ready to move on," he said.
Then on Wednesday, April 18, at around 6 p.m., things took a turn for the worse.
"I got a call from a tech who said, 'Jamie, the server isn't responding.' So he went to look for it in the rack and found that it was gone," McClelland said.
Later, Lopez and McClelland would learn that the FBI had produced a search warrant when it showed up at the XO Communications Manhattan server farm, where the MayFirst/PeopleLink server was housed, which gave agents the right to take the box. But at the time, they could only guess what happened.
"We filled out a help ticket that said, 'Our server is missing.' We've never done that before," McClelland said. "I can't emphasize enough that we received no communication from the FBI. From a human point of view, that is atrocious. But from a legal point of view, they don't have to do any more."
The impact was immediate, and devastating, for both MayFirst/PeopleLink and RiseUp. Hundreds of mailing lists, websites and email accounts were immediately knocked offline.
“The FBI is using a sledgehammer approach, shutting down service to hundreds of users due to the actions of one anonymous person,” Devin Theriot-Orr, a spokesperson for RiseUp, said in a statement at the time. “This is particularly misguided because there is unlikely to be any information on the server regarding the source of the threatening emails.”
While Lopez was scrambling to find a way to get the organizations back online, a camera with motion detection capabilities was installed at the server facility by an assistant.
"We thought it was a little like shutting the barn door after the horse ran out, but we did it anyway," he said McClelland said.
Generally, when FBI agents seize computers as part of an investigation, they're not returned for months, or even years. But within a week, a worker in the server room noticed that the motion detector camera had been activated on April 23. When he looked at the video, the tale took an even more unusual turn.
The video shows two men in suits -- apparently FBI agents -- placing the server back in its rack. But the box isn't merely dropped off. The two appear to be plugging it in, and then watching the machine for a few minutes, perhaps looking to see if it is operating correctly.
Why would they do that? The FBI refused to answer a question about that.
But Lopez has a theory. There's only one way to defeat most anonymous email services: to compromise the computer that processes the emails with special software -- a virus -- that could defeat the anonymizing software.
"There was not even a scintilla of expectation that this server would return to our rack. It's the most amazing thing," Lopez said. "It's possible they put device on it or a virus or Trojan of some kind."
MayFirst/PeopleLink later posted the FBI agent video online. The agency hasn't commented on it.
The server has not been returned to service; the organization is currently auditing the machine to see if it has been tampered with.
"I can tell you that's the burning question in my mind. We are planning on doing a full diagnostic on server to see if we detect anything on server," McClelland said.
But even if it hasn't been tampered with, Lopez said he's outraged that U.S. federal agents would compromise Internet access for global groups fighting for democratic rights while hunting for evidence that doesn’t exist.
"Look at the atrocity of them going in and taking a computer ... and disrupting all this information, and potentially getting all this information from hundreds of people not even accused of a crime," Lopez said. "This is serious … for people all over the world who depend on this stuff for their day to day work. To have it taken away by some other government, it's really unfair to them in every conceivable way."
The MixMaster service was uninterrupted by the server seizure; anonymous messages were simply routed through other servers.
MayFirst/PeopleLink and RiseUp both told their members that no identities were compromised during the FBI seizure -- all data on the server is encrypted and there's no reason to believe the encryption was compromised. Still, U.S. government action against anonymous Web services could have a dangerous chilling effect, fretted Lopez.
"In some parts of the world, privacy and anonymity are a matter of life or death," he said. "These services are used for important work, and in many countries, they are the only way to communicate without putting yourself in serious danger."
The Electronic Frontier Foundation issued a statement last week accusing the FBI of "overreaching."
"The fact that the FBI's investigation led them to an anonymous remailer should have been the end of the story. It should have been obvious that digging deeper wouldn't lead to helpful information because anonymous remailers don't always leave paper trails," wrote Hanni Fakhoury. "So enough is enough. The government's ability to search a person and their property -- and in this case, shut down speech -- is an extraordinary power that can easily be abused. Law enforcement needs to do its research before resorting to an extremely intrusive search warrant that intrudes on innocent people's privacy, causes significant disruption to harmless activity, and silences speech. And as we've argued before, search warrants for electronic devices shouldn't be limitless."
Lopez, who has two children in their 30s, said he understands why parents in Pittsburgh were concerned for their children's safety during the repeated bomb scares. But he warned that repression often begins with "people who mean well."
"These people making the threats, these are jerks, nobody wants to protect them," he said. "But what do you give up when you give up freedom in exchange for the illusory feeling of security? You can't trample people's rights because when you do, the terrorists have won."
The Pittsburgh bomb threats stopped on April 21. No bombs were found. There have been arrests in connection with the incidents, but authorities are still investigating.

<object width="420" height="245" id="msnbc84284d" classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase=" name="movie" value="" /><param name="FlashVars" value="launch=47385785&amp;width=420&amp;height=245" /><param name="allowScriptAccess" value="always" /><param name="allowFullScreen" value="true" /><param name="wmode" value="transparent" /><embed name="msnbc84284d" src="" width="420" height="245" FlashVars="launch=47385785&amp;width=420&amp;height=245" allowscriptaccess="always" allowFullScreen="true" wmode="transparent" type="application/x-shockwave-flash" pluginspage="


The FBI took and mysteriously returned a week later, my alligator dildo.

that is, my dildo shaped like an alligator.

hope it hasn't been tampered with!

no shit - I'd smash that fucking server and throw the parts into a smelting vat

real talk

was talking about the alligator dildo...

"These people making the threats, these are jerks, nobody wants to protect them,"

Fuck that. Liberal bullshit between what is right and wrong, and apparently these otherwise decent tech folks think disrupting a university for months is 'wrong'. Fuck that. Solidarity with all those who placed the threats and with anyone accused.


Fucking university DESERVE to be disrupted. May it be through student strike or any other means. Although a student strike's still the best way.

Check that server, make sure that spyware or malware hasn't been added. With luck backups have been kept, so you can wipe the old hard drives, overwrite with randoms and zeroes three times, and restore from backups ... also look at sectors where no one usually goes - something might be hiding...

and it may be that they just copied the info for data mining purposes - and maybe in a couple of months or so they'll be back, rinse, wash, repeat ad infinitum. Too bad the hard drives weren't encrypted.

>Too bad the hard drives weren't encrypted.
... except the article mentions multiple times that they were

If the drives were encrypted with a good chaining scheme (and implementation), writing anything to them would be almost impossible. The only place they could put anything would be the unencrypted boot sector, assuming the encryption was full disk (which it had damn well better be), and yeah that needs to be thoroughly checked. My concern would be more in hardware modification, for example putting a tap in the nic to record all traffic, or even worse, something that can do Van Eck phreaking. It's known that the military has them, so it's only a matter of time before law enforcement starts using them. Strictly speaking Van Eck is only for monitors, but the same principle could probably be used for ethernet or even processing. If they designed one small enough to fit inside a server, you would have to look *everywhere* inside and outside the case for it, presumably for something that looks innocuous, like an RFID sticker or USB drive, or hell, even a microSD card. But if they're capable of that, I'm not sure what we can do.

But the bigger issue here is: The FBI should *NOT* have been able to fucking get access to these servers while they were running. That is a gaping security hole that should have never occurred. If the feds knew what the fuck they were doing, they would have grabbed the encryption keys or drive content on site (e.g. through a cold boot attack, or just plugging in a mouse keyboard and monitor and seeing what's on the drives). That encryption wasn't broken is simply a matter of luck on the operator's part and incompetence on the attacker's. Some sort of fail-safe to prevent anyone without permission from getting access to a powered machine should have been implemented, and seeing as they were able to put the machine back in and power it on it seems like they STILL haven't dealt with it. Fuck, put a pad lock on the god damned rack door and just run to the building's circuit breakers when the shit hits the fan at least, ANYTHING other than letting anyone waltz in and have a field day with operating "secure" servers.

Then being able to plug a machine in is pretty much just as bad. Seriously, how were they physically allowed to do that? Could I just walk in an plug in a keylogger right now? I appreciate what these people are doing, but ffs, can you get your shit together?

The machine can never be used in the organization again. It is tainted.

Hidden BOIS changes, chip swaps, imbedded listening devices somewhere under some heat shrink tube.

The really eye opening thing is that it was done without the owners being told. Given the FBI take of GPS trackers, I wouldn't be surprised at all if there were thousands of logging devices spread around colos.

Which gets to the funny part. Quite possibly this collection of the hardware was to done to remove evidence of a tap/bug/listening device, not to install one.

Server is now a bug

The sudden return of the server should be considered an attempt by the FBI to get more information from it, especially if any encrypted disks are present. They cannot break encryption with a strong, especially a long and random passphrase, except by planting a keylogger and returning the machine hoping to recover it later. Get rid of it, and in a highly public manner. If it's encrypted, change the encryption passphrase when you replace the server, just in case someone got lucky or the passphrase was weak.

I had an encrypted machine stolen by the pigs in a raid on my house, and I won't take it back. This server must never be booted again, nor should any electronic part from it be salvaged. All of it must be discarded after an examination for what exactly the pigs did to it by someone who is an expert in computers. If you can't get a TRUSTED computer expert, just destroy everything. Here's how I would go about the examination:

First, dissassemble it for a physical examination to see if any hardware had been added or replaced. Any unknown or suspicious devices should be photographed from all angles prior to destruction.

Every digital electronic component should be presumed to have been reflashed with malicious firmware. This is especially true if there are one or more encrypted partitions on any disk that the FBI might not have been able to penetrate. In that case, the motherboard BIOS is presumed certain to have been replaced with a keylogging varient (the "evil cook" attack on encryption, preparing for a second raid). The network card could have malicious firmware added to try and log IP addresses or similar data and send it to the FBI. On a server, a network card bug is far more useful that logging a keyboard that might never even be connected.

I would consider carrying out a forensic examination of the hard drives, on a old and expendable machine with no hard drives installed, running from a live CD/DVD with a security Linux distro like Backtrack on it. This gives you a read-only operating system that malware can't change so far as subsequent boots are concerned. I still would not trust the examining machine's BIOS after this job, it would have to be reflashed at least or discarded at worst.

Use images of the disks, the disks themselves could have anything hidden in nooks and crannies and need to be treated as audio microphones and GPS bugs until disposed of, like everything else in the machine. Do the imaging some place you don't mind the pigs knowing was used for this job. One option is to do this in public to embarass the FBI. The images of the drives, being only data, can contain only software attacks, not GPS or audio bugs.

Running Foremost and Photorec data recovery would find anything they did and "deleted." Most malicious software won't even have been deleted, it will just try to hide behind an innocuous filename or that of another file. Do NOT bet on trying to find it all, you are just looking for evidence of ANY writes to the disks during the time they was in Enemy hands. ALL such writes can be treated as malicious. Tip: a foremost run for deleted software is very time-consuming and in this case the least important part of the job. Getting all write times from the disk is the most important, though a capable opponent can change write times if they think their "work" will ever be subject to a forensic examination.

If any evidence of hardware bugs or malware is found in the server that was just "returned," publishing the offending code would help others defend their hardware and shine a very unpleasant spotlight on the FBI.

After a forensic examination to find whatever bugs and malicious software the pigs planted, make sure to totally destroy all the hardware. You could make thousands auctioning hardware other than disk drives and network cards on Ebay, but at an unknown risk to the buyer. You could sell the bare case and power suppy at a hamfest, again at unknown risk to the buyer(full disclosure mandatory!) I recommend a highly public ceremony of destruction so any planned second seizures aimed at exploiting a key or network logger get cancelled. How about "the FBI's malicious returned server today, the NCIC computer center tomorrow" as a theme?

Why do the polls always redirect me here?

Add new comment

Filtered HTML

  • Web page addresses and e-mail addresses turn into links automatically.
  • Allowed HTML tags: <a> <em> <strong> <cite> <blockquote> <code> <ul> <ol> <li> <dl> <dt> <dd>
  • Lines and paragraphs break automatically.

Plain text

  • No HTML tags allowed.
  • Web page addresses and e-mail addresses turn into links automatically.
  • Lines and paragraphs break automatically.
To prevent automated spam submissions leave this field empty.
Enter the code without spaces.