FBI Agent: Connection Logs Show Suspect's MAC Address, So Look For Apple Hardware
from the this-is-where-he-keeps-his-creative-work...-note-the-'IP'-address dept
The Smoking Gun recently covered the arrest of a 19-year-old college student for allegedly sending threats to a 14-year-old ask.fm user. The arrestee apparently sent a string of horrific messages filled with sexually violent imagery back in October, prompting her parents to contact authorities.
A routine investigation soon commenced, culminating in the student’s (Rishi Ragsdale) arrest.
Investigators tracked the threatening posts back to Ragsdale through an IP address provided by Ask.fm. An analysis of subpoenaed University of Wisconsin records indicated that the IP address was assigned to Ragsdale’s student account, and that the “rragsdale” account accessed the girl’s Ask.fm profile page on the evening the threats were sent…
The affidavit sworn by FBI Agent Malia Pereira alleges that Ragsdale sent the teen a series of violent and sexually graphic messages. The victim’s parents, Pereira added, were particularly concerned since the girl’s Ask.fm account was linked to her Facebook and Twitter profiles, leaving her identifiable.
Reading through the affidavit isn’t much fun, especially once you get to the messages Ragsdale allegedly sent. But eagle-eyed Techdirt reader Justin Johnson spotted something on page 5 of the sworn document that would move even the most ardent FBI defender’s palm towards their face… or their head towards their desk.
Prior to executing the search warrant, FBI SA Nicol told me that, during execution of the warrant, I should look for a Mac computer, because the network connection logs provided by Jeffrey Savoy showed a Mac address, indicating some type of Mac/Apple computer or hardware was used.
This immediately follows a paragraph detailing the seizure of Ragsdale’s Mac laptop (and cellphone). Case closed!
No one expects every agent in the FBI to be thoroughly versed in network terminology but a MAC address is one of the basics any agent seeking to extract personal info using nothing but IP addresses and subpoenas should know. If these basics aren’t nailed down, agents lacking this crucial knowledge will be stymied by their own ignorance. They won’t know what they’re looking for or how to get it. Their subpoena and warrant requests risk being laughed out of the judge’s chambers. The worst case scenario is that someone dangerous eludes arrest because the pursuing agent(s) is tangled in terminology he or she doesn’t understand. Actually, the real worst case scenario is someone innocent being tossed into the gears of the judicial system because an agent had no idea what he or she was looking at — or looking for.
Kudos, I guess, to Agent Pereira for getting her man, despite the “help” offered by SA Nicol, whose name is all over this affidavit. But one wonders what would have happened if Ragsdale’s computer happened to be a PC. My guess? Additional charges under the CFAA for “spoofing a ‘Mac’ address.”