Agent's Testimony Shows FBI Not All That Interested In Ensuring The Integrity Of Its Forensic Evidence

Say That Again

from the bad-things-are-good-if-done-for-the-'right'-reasons dept

Security researcher Jonathan Zdziarski has been picking apart the FBI’s oral testimony on the NIT it deployed in the Matish/Playpen case. The judge presiding over that case denied Matish’s suppression request for a number of reasons — including the fact that Matish’s residence in Virginia meant that Rule 41 jurisdiction rules weren’t violated by the FBI’s NIT warrant. Judge Morgan Jr. then went off script and suggested the FBI didn’t even need to obtain a warrant to deploy a hacking tool that exposed end user computer info because computers get hacked all the time.

He equated this to police peering through broken blinds and seeing something illegal inside a house, while failing to recognize that his analogy meant the FBI could let themselves inside the house first to break the blinds, then peer in from the outside and claim “plain sight.”

The oral arguments [PDF] — using FBI Special Agent Daniel Alfin’s testimony — were submitted in yet another case tied to the seizure of a child porn website, this one also taking place in Virginia and where the presiding judge has similarly denied the defendant’s motion to suppress. The DOJ has added the transcript of the agent’s oral testimony in the Matish prosecution as an exhibit to this case, presumably to help thwart the defendant’s motion to compel the FBI to turn over the NIT’s source code.

Many assertions are made by Agent Alfin in support of the FBI’s claim that its hacking tool — which strips away any anonymity-protecting efforts put into place by the end user and sends this information to a remote computer — is not malware. And many of them verge on laughable. Or would be laughable, if Alfin wasn’t in the position of collecting and submitting forensic evidence.

There’s so much wrong in here, it’s probably best to just start at the top.

1. A MAC address is a unique identifier that can never be altered.

THE WITNESS: Yes, Your Honor. MAC is an acronym that stands for media address control.

THE COURT: Is that different than IP address?

THE WITNESS: Yes, Your Honor. A MAC address is unique and does not change. So you can look at the MAC address in the matter at hand from Mr. Matish’s computer, and that MAC address is always the same. It is the one that was identified by the government. It was also the one that was seized by the government. A MAC address is hard-wired or burned into the card.

[Compared with this, from the same agent, roughly 30 pages later…]

Q. Are any of those items — I believe you testified to the MAC address. Can that be changed?

A. It can be —

2. The FBI didn’t need to encrypt the data collected by the NIT because, hey, Tor is secure and can’t be compromised.

Q: In one of the declarations that was submitted on behalf of Mr. Matish by Dr. Soghoian, it is alleged that because the NIT sent data over the regular Internet and not encrypted that the authenticity of the data could not be verified.

A: This is incorrect. It also fails to acknowledge that the NIT was, in fact, sent to Mr. Matish’s computer over the Tor network, which is encrypted.

3. Encryption would ruin the integrity of the collected evidence.

Q. Would encryption of the data as it was transmitted from the computer to the government — what effect, if any, would that have had on the utility of the data going forward?

A. It would have not completely made the network data useless, but it would have hurt it from an evidentiary standpoint. Because the FBI collected the data in a clear text, unencrypted format, it shows the communication directly from Mr. Matish’s computer to the government. It can be read; it can be analyzed. It was collected and provided to defense today, and they can review exactly what the FBI collected.

Had it been encrypted, it would not have been of the same value, because the encrypted data stream itself could not be read. In order to read that encrypted data stream, it would have to first be decrypted by the government, which would fundamentally alter the data. It would still be valid, it still would have been accurate data; however, it would not have been as forensically sound as being able to turn over exactly what the government collected.

4. The FBI’s malware is not malware because “mal” means “bad” and “FBI” means “good.”

Q. And, finally, would you describe the NIT as malware?

A. No. The declaration of Dr. Soghoian disputes my point from my declaration that I do not believe the NIT should be considered malware, but he fails to address the important word that makes up malware, which is “malicious.”

“Malicious” in criminal proceedings and in the legal world has very direct implications, and a reasonable person or society would not interpret the actions taken by a law enforcement officer pursuant to a court order to be malicious. And for that reason I do not believe that the NIT utilized in this case pursuant to a court order should be considered to be malware.

5. The defense has all the data it needs to examine the FBI’s NIT.

Q. Okay. And you’re aware that the first time that the government agreed to produce that particular data was in its response to this motion to compel?

A. I assume that’s the case. I don’t know exactly what date it was provided on, but I know it was turned over.

Q. And then you talked about a data stream being made available, right?

A. Yes.

Q: And you’re aware that the first time that the government agreed to produce that data was in its surreply to the motion to compel.

A. I don’t recall the first time that that data was made available, but I know it has been made available and has been turned over.

Q. As of —

A. As of today.

Q. — 20 minutes ago, correct?

A. Yes. To the best of my knowledge, it was not turned over prior to that.

7. The NIT is like a set of burglar’s tools…

Q. You say the exploit would shed no light on what the government did. The government deployed this exploit, correct?

A. The government used the exploit to deploy the NIT.

Q. And I believe you used the analogy that this exploit is like a way of picking a lock, right?

8. … except that sounds really bad and not something the “good” FBI should be doing. So, now it’s an open window.

A. Yes. A more accurate analogy may be going in through an open window. As I’ve stated in my declaration, there was a vulnerability on Mr. Matish’s computer. The FBI did not create that vulnerability. That vulnerability can be thought of as an open window. So we went in through that open window, the NIT collected evidence, and then left. We made no change to the window.

There’s plenty more to read through and Zdziarski’s Twitter stream contains several highlights and some incisive analysis. Matish’s lawyer also makes a very good point about the problems with using insecure data — transmitted in unencrypted form — as forensic evidence.

To prevent tampering with the evidence. I mean, this is analogous to — I mean, there’s a crime scene. Certain evidence is collected, and rather than bagging and labeling it and following established techniques for how evidence is to be collected and transferred back to, you know, the server, which is like an evidence locker, they just threw everything in the back seat of the cruiser and drove back. Oh, and, by the way, they won’t tell us whether on the way back they also picked up someone else who rode in the back of the cruiser.

Or as Zdziarski puts it:

He also points out that the FBI’s refusal to allow Matish to examine the NIT is not at all aligned with normal evidentiary practices.

We’ve set out through our expert declarations exactly why this information is critical, and the government is saying, no, we’ve looked at it, we’ve analyzed it; our experts say you wouldn’t be able to make a meaningful trial defense based on this information. But in some ways, Your Honor, that’s the same as saying, we’re not telling you who our confidential informant is. You don’t need to talk to him, because we’re telling you he’s believable and everything he’s saying is true. You don’t need to look at the DNA tests from the lab, because we’re telling you it’s a match, and we’re telling you the tests were fine.

Despite this, the court decided to deny the motion to suppress and Matish will be dealing with the evidence collected against him. According to this testimony, it isn’t much — some images found in unallocated space, suggesting they had been deleted. That’s not much but it may be enough to secure a conviction.

But the testimony gives us greater insight into the FBI’s handling of forensic evidence and its perception of the exploits at its disposal. And what’s on display here is far from encouraging.

Filed Under: evidence, fbi, malware, nit