Tradeoffs: Facebook Helping The FBI Hack Tails To Track Down A Truly Awful Child Predator Raises Many Questions

from the icky-in-many-ways dept

Last week, Lorenzo Franceschi-Bicchierai at Vice had a bombshell of a story about Facebook helping the FBI track down a horrible, horrible person by paying a cybersecurity firm to build a zero-day attack on Tails, the secure operating system setup that is recommended by many, including Ed Snowden, for people who want to keep secrets away from the prying eyes of the government.

The story should make you uncomfortable on multiple levels — starting with the fact that the person at the center of the story, Buster Hernandez, is way up there on the list of truly terrible people, and there’s simply no reason to feel bad that this person is now locked up:

The crimes Buster Hernandez committed were heinous. The FBI’s indictment is a nauseating read. He messaged underage girls on Facebook and said something like ?Hi, I have to ask you something. Kinda important. How many guys have you sent dirty pics to cause I have some of you?,? according to court records.

When a victim responded, he would then demand that she send sexually explicit videos and photos of herself, otherwise he would send the nude photos he already had to her friends and family (in reality, he didn?t have any nude photos). Then, and in some cases over the course of months or years, he would continue to terrorize his victims by threatening to make the photos and videos public. He would send victims long and graphic rape threats. He sent specific threats to attack and kill victims? families, as well as shoot up or bomb their schools if they didn?t continue to send sexually explicit images and videos. In some cases, he told victims that if they killed themselves, he would post their nude photos on memorial pages for them.

And it gets worse from there. It’s good that the FBI tracked him down.

But, from there, you suddenly start to run into a bunch of other uncomfortable questions regarding Facebook’s involvement here. And each of those questions helps demonstrate the many tradeoffs that a company like Facebook (or lots of other internet companies) face in dealing with awful people online. And to be clear there is no “good” answer here. Every approach has some good elements (getting a horrible person away from continuing to terrorize young girls) and some not so great elements (helping the FBI hack Tails, which is used by journalists, whistleblowers, and dissidents around the globe).

The article notes that there was a vigorous debate within Facebook about this decision, but the folks in charge decided that tracking this person down outweighed the concerns on the other side:

?The only acceptable outcome to us was Buster Hernandez facing accountability for his abuse of young girls,? a Facebook spokesperson said. ?This was a unique case, because he was using such sophisticated methods to hide his identity, that we took the extraordinary steps of working with security experts to help the FBI bring him to justice.?

Former employees at Facebook who are familiar with the situation told Motherboard that Hernandez’s actions were so extreme that the company believed it had been backed into a corner and had to act.

?In this case, there was absolutely no risk to users other than this one person for which there was much more than probable cause. We never would have made a change that affected anybody else, like an encryption backdoor,? said a former Facebook employee with knowledge of the case. ?Since there were no other privacy risks, and the human impact was so large, I don?t feel like we had another choice.?

That does sound like a balancing of the risk/rewards here, but the idea that handing over a backdoor to the FBI puts no one else’s privacy at risk may raise some eyebrows. The description of the zero day certainly sounds like it could be used against others:

Facebook hired a cybersecurity consulting firm to develop a hacking tool, which cost six figures. Our sources described the tool as a zero-day exploit, which refers to a vulnerability in software that is unknown to the software developers. The firm worked with a Facebook engineer and wrote a program that would attach an exploit taking advantage of a flaw in Tails? video player to reveal the real IP address of the person viewing the video. Finally, Facebook gave it to an intermediary who handed the tool to the feds, according to three current and former employees who have knowledge of the events.

And while the Facebook spokesperson tried to play down the idea that this was setting an expectation, it’s not really clear that’s true:

Facebook told Motherboard that it does not specialize in developing hacking exploits and did not want to set the expectation with law enforcement that this is something it would do regularly. Facebook says that it identified the approach that would be used but did not develop the specific exploit, and only pursued the hacking option after exhausting all other options.

But this may be hard to swallow, given that this is the very same FBI that has been pushing tech companies to develop backdoors to encryption for years, and in the famous San Bernardino case, tried to use the All Writs Act to force Apple to create a type of backdoor on iOS to break into a phone.

And obviously, cooperating one time doesn’t mean you need to cooperate every time, but it will at least raise questions. Especially at a time when Facebook is supposedly moving all of its messaging systems to fully encrypted. Can the setup there be fully trusted after this story?

As Bruce Schneier rightfully points out, it’s fine for the FBI to figure out how to use lawful hacking to track down Hernandez. That is it’s job. It’s much less clear, though, that Facebook should be handing that info over to the FBI which could then use it elsewhere as well. It certainly does not appear that the FBI or Facebook revealed to the developers of Tails that their system had this vulnerability. Indeed, Tails only found out about it from the Vice story:

A spokesperson for Tails said in an email that the project?s developers ?didn’t know about the story of Hernandez until now and we are not aware of which vulnerability was used to deanonymize him.? The spokesperson called this “new and possibly sensitive information,” and said that the exploit was never explained to the Tails development team.

So… that’s a problem. The FBI, under the Vulnerabilities Equities Program, is supposed to reveal these kinds of vulnerabilities — though it frequently does not (or hangs on to them for a long time before sharing). At the very least, this confirms lots of people’s suspicions that the Trump administration’s updating of the VEP process was little more than window dressing.

Senator Ron Wyden — who is often the only one in Congress paying attention to these things — also seemed quite concerned about how this all went down:

?Did the FBI re-use it in other cases? Did it share the vulnerability with other agencies? Did it submit the zero-day for review by the inter-agency Vulnerabilities Equity Process?? Wyden said in a statement, referring to the government process that is supposed to establish whether a zero-day vulnerability should be disclosed to the developers of the software where the vulnerability is found. ?It?s clear there needs to be much more sunlight on how the government uses hacking tools, and whether the rules in place provide adequate guardrails.?

And thus, we’re all left in an uncomfortable place. It’s good that the FBI was able to trackdown and find Hernandez, and stop him from preying on any more victims. But, Facebook’s direct involvement raises tons of uncomfortable questions, as does the FBI’s decision to keep this vulnerability a secret (at the very least, it seems like Facebook maybe should have tipped off the Tails folks as well, once the FBI nabbed Hernandez). In an ideal world, the FBI would have figured out how to track down Hernandez without Facebook paying a firm to build the zero-day attack — and then the FBI would have notified Tails’ developers of the vulnerability. But, of course, that’s not what happened.

Filed Under: , , , , , , ,
Companies: facebook

Rate this comment as insightful
Rate this comment as funny
You have rated this comment as insightful
You have rated this comment as funny
Flag this comment as abusive/trolling/spam
You have flagged this comment
The first word has already been claimed
The last word has already been claimed
Insightful Lightbulb icon Funny Laughing icon Abusive/trolling/spam Flag icon Insightful badge Lightbulb icon Funny badge Laughing icon Comments icon

Comments on “Tradeoffs: Facebook Helping The FBI Hack Tails To Track Down A Truly Awful Child Predator Raises Many Questions”

Subscribe: RSS Leave a comment

This comment has been flagged by the community. Click here to show it.

Koby (profile) says:

Outsourcing Responsibility

A fascinating case where a government agency outsources at least a portion of a hacking operation. The FBI didn’t write the exploit. It didn’t even buy it itself. If you have concerns about what happened, well, now the line has blurred between corporate action and law enforcement.

Fortunately for the FBI, the perp in this case is very well disliked by everyone. But next time, the perp will probably be a "political dissenter". This sort of blurring of responsibility is precisely why I distrust both the FBI and corporations.

Ehud Gavron (profile) says:

There's no winning here...

Either FB could say "We have no way of doing this", or the FBI could say "We have no way of doing this" but nobody thought to make that six-figure payout go from the lawful agency investigating the issue to the security researcher.

FB failed us. I will never trust them, and I don’t violate and threaten young girls like this piece of >>>>. Of course we have to say that because the cases that make the news are the heinous ones where the defendant is socially indefensible.

The FBI failed us. They used the tool, but did not participate in open disclosure, leaving the TAILS team to figure out "wut?"

Yes, a piece of >>>> was arrested, plead guilty to 41 charges, and will likely spend 2-5 years in prison thinking on his next scheme. In the meantime BILLIONS of FB users now should be wondering when FB will "decide on its own" their privacy is worth just about nothing.

The "tradeoff" between "security" and "privacy" and "obeying the law [in the jurisdiction where you are]" are not absolute. FB has now made this even murkier.

See you later, and not on FB, ever.


This comment has been deemed insightful by the community.
Upstream (profile) says:

Another notch on the ratchet

This is standard practice, to use a particularly heinous case with a particularly despicable villain to justify actions that would otherwise be (and should always be) considered out of the question. This moves the Overton Window on what is justifiable in terms of violating everyone’s privacy and security in the wrong direction. We must resist the "OK, but just this once" response, no matter the circumstances of the particular case at hand.

And, no, this may not be a good answer, since it might delay the catching of a dangerous predator, but it is the right answer. It is the answer we must insist on giving.

Fortunately, the TAILS folks seem to be pretty good about updates.

Kitsune106 says:

This could be bad news if not handeled right

Since the exploit was not handed over. Also, given the current protests and the fact that the FBI and DOJ are getting involved, well, its going to be hard on Facebook to prove it did not help the FBI on protestors, or took the steps to make sure it could not redeploy the exploit. as given the gag orders, well, its going to be difficult to not keep people from assuming the worst. Especially given how the administration has moved before.

Anonymous Anonymous Coward (profile) says:

Re: This could be bad news if not handeled right

It’s not possible to prove a negative, though I am sure Facebook will try, and even if actually innocent of any other similar action they will not be successful. The tricky part will be coming up with some ‘evidence’ to initiate the charges. Of course these could be made up by anyone as the way ‘evidence works these days the mere charge will be enough.

bobob says:

The encryption issue aside, there really is a fairly good way to address this that is practiced in several countries. Anytime a wiretap or surveillance is ordered, the person being surveilled is assigned an attorney (without the person knowing this, obviously) to represent him/her during the surveillance to ensure the surveillance is carried out as required by law. This also applies to the types of warrants in those countries analogous to those issued by our FISA court, in which case the attorneys have the required security clearances.

This seems like a very easy solution to implement and addresses a lot of issues with respect to things like parallel construction and other abuses.

Upstream (profile) says:

Re: Re:

With secret courts issuing secret warrants and secret attorneys supposedly standing up for our rights (are rights even a thing in this scenario?), and maybe making secret objections, which would be heard by the secret courts, in secret sessions, of course, I don’t see how this helps the situation any. Or is that a secret, too?

R.H. (profile) says:

Re: Re: Re:

In countries that use that method to maintain an adversarial system, I’d guess that the secret proceedings would be revealed to the defendant once he or she is actually charged with a crime. That way, if something dirty happened in the process of getting the secret warrant in the first place, it could be appealed by their attorney at that point.

Rishpwd (user link) says:

virgo woman signs she likes you

4 Useful online dating Tips To Make Your Date Successful

Online can be diverse from it is off line, There is an element of trust that you need to have going in. Can you believe whatever you read in a profile or that you hear on the phone before your first date. Trust is a big factor if you’re considering online dating.

Here are some online dating tips to keep in mind as you get to the person you may soon be dating.

This is a must when you are internet dating. You can not get to know them if you have trouble carrying on a interaction. Be yourself and ask them questions to get the conversation started. Also be prepared to answer some questions regarding yourself. as a result the conversation will flow easily. This is also a good way to find out what you want to know about them to see if you want to date them in the future.

  1. don’t Afraid To Flirt A Little

This may appear a little crazy at first, But it is recommended when you are dating online. It is also much easier online than it is in person with someone. enjoy the fun with it. Flirting is a section of the dating game both online or off. Plus flirting creates a curiosity about each other that makes you want to get to know them better.

  1. It All gets underway with Your Profile Online.

The screen name and profile that you put [url= to tell if a chinese woman likes you[/url] online in your profile tells people about you. The more tips that you give them the more others will know about you. You can deal in generalities without divulging to much special info at first.

Your profile should be written to accentuate your positives. This is what people use to decide if many people date you.

4: You Are what you really

Be yourself regardless of what. This is one of the most basic things that you can do. you are not trying to impress anyone. You are interested in online dating to find that special person that you want to be with. Don’t lie or feel self conscious about online dating since there are people wanting to find you as much as you want to find them.

These are just a few useful online dating tips that you want to use when you are searching for someone special. Be yourself and trust your instincts and it’s easy to be on a date.

Add Your Comment

Your email address will not be published. Required fields are marked *

Have a Techdirt Account? Sign in now. Want one? Register here

Comment Options:

Make this the or (get credits or sign in to see balance) what's this?

What's this?

Techdirt community members with Techdirt Credits can spotlight a comment as either the "First Word" or "Last Word" on a particular comment thread. Credits can be purchased at the Techdirt Insider Shop »

Follow Techdirt

Techdirt Daily Newsletter

Techdirt Deals
Techdirt Insider Discord
The latest chatter on the Techdirt Insider Discord channel...