Creator Of Silk Road 2.0 Did Double The Business, Sentenced To Only Five Years In Prison

Legal Issues

from the that's-like-three-lifetimes-in-the-US dept

In 2015, the man behind darknet drug marketplace Silk Road, Ross Ulbricht, received two consecutive life sentences from a New York judge. Her rationale was that Ulbricht was no different than a “dangerous Bronx drug dealer.” No leniency was given. The government, which participated in its own share of misconduct during the investigation, argued Ulbricht should be personally financially-responsible for every drug transaction on the Silk Road: a total of $184 million.

The government got its win — all of it. But it was only temporary. Silk Road 2.0 swiftly took the original’s place, run by another young man who knew he was going to be pursued by law enforcement across the world as soon as he fired it up. Long before it was shut down, Silk Road 2.0 was double the size of the original Silk Road, proving once again that sellers and buyers of illicit substances will find each other, no matter how many roadblocks governments erect.

The operator of this marketplace was arrested in San Francisco — just like Albricht was. But that’s where their stories drastically diverge. For one, the person arrested in San Francisco was not the founder of Silk Road 2.0. That title belonged to Dread Pirate Roberts 2 (DPR2). That person, Thomas White, was arrested by the UK’s National Crime Agency.

Unlike Ulbricht’s prosecution — which played out in public thanks to our justice system’s presumption of openness — White’s prosecution occurred in secret, shielded from the public eye by UK law. White was arrested in 2014, but his sentence has only now been handed down. Ulbricht got two life sentences and $184 million in fees from a US court for running the Silk Road. The creator of Silk Road 2.0 — doing double the business of Silk Road 1.0 at its peak — is looking to be out of prison years before his inspiration sees freedom.

[A] court in Liverpool, England, sentenced Thomas White, a technologist and privacy activist, for crimes committed in part while running Silk Road 2 under the DPR2 persona, among other crimes committed under another persona. White pleaded guilty to drug trafficking, money laundering, as well as making indecent images of children, and was sentenced to a total of 5 years and 4 months in prison.

There’s your compare-and-contrast. In the US, drug crimes are the worst crimes. In the UK, crimes are crimes and the rehabilitation prisons can’t provide are recognized and people are sentenced accordingly. I’m sure the DOJ is marveling at this miscarriage of justice and wondering why they bothered pitching in with an investigation that only resulted in a 5-year prison sentence.

And where Ulbricht spent his time locked up pretrial, thanks to the government getting his bail denied because of two murder-for-hire charges it later dropped, Thomas White spent his time out in the open with access to a computer. As Joseph Cox points out, White was pretty well-known in the world of security research, thanks to contributions he made while awaiting trial and sentencing.

On Twitter he mused about security and privacy topics, and has appeared under his own name in articles in Motherboard, Forbes, and more as an expert on Tor and other subjects. He previously ran a website archiving large data breaches that anyone could download, including the MySpace breach, data from hacked affairs website Ashley Madison, and customer information from a Muslim-focused dating site called ‘Muslim Match.’

Our government argues lengthy sentences for drug cases are needed to deter others from drug dealing. Seeing how quickly the new Silk Road replaced Ulbricht’s version makes it clear lengthy sentences aren’t deterring anything. I’m not even sure the DOJ believes its own bullshit at this point. Prison is punishment and our system is set up to provide as much punishment as possible in every case. Other places in the world recognize the limited societal value of taking decades away from people for selling products people want to buy.

Filed Under: dread pirate roberts 2, sentencing, silk road, silk road 2.0, thomas white, uk, us

FBI Cyber Crimes Division Not So Great About Passing Info To Victims Of Cyberattacks

Failures

from the stop-sucking-so-much,-you-expensive-pixel-pushers dept

The FBI wanted in on the cyberwar. The problem was recruits. Years of treating Americans and their rights like garbage have turned the young ones against the feds. The FBI struggled to find enough willing and able youthful whitehats to send to the frontlines of the The Great War (Internet Edition).

The FBI had the budget, the permission, the power… but not the personnel. It also probably wasn’t the best agency for the job. The FBI knows investigations, but its part in the CyberWar included sharing info with private sector hacking targets. Sharing isn’t in the FBI’s nature. It’s appears to enjoy the sneakier parts of its cyber work, but when it comes to protecting companies and their customers, the FBI apparently isn’t up to the task.

A recently-released Inspector General’s report [PDF] shows the FBI is an unorganized mess when it comes to notifying victims of cyberattacks and data breaches. The FBI’s Cyber Guardian system received a purpose (notifying victims of cyber intrusions) and a nifty logo (a lion wielding a sword), but not much internal guidance or outside assistance.

The FBI is breaking the law by not doing the things it’s supposed to be doing. It’s violating an Executive Order, as well as the DOJ’s own policies on notification. Federal mandate says victims are to be notified. But failure every step of the way is apparently the process.

We found that not all victims were Informed of their rights as required by the AG Guldellnes .• This occurred because: (1) the AG Guidelines are outdated since they do not consider the needs of victims of cybercrlme; (2) there Is no widely accepted definition of what constitutes a victim of cybercrlme; and (3) there Is currently no process for getting cybercrlme victims’ Information from natlonal security cases Into the FBI’s Victim Notification System-the FBI system used to Inform crime victims of their rights.

Laying the groundwork for this compound failure was the system itself which did not demand enough input from agents to generate usable intel that could be passed on to victims. The securing of the homeland and its inhabitants was further held back by the Department of Homeland Security, which wasn’t submitting information it possessed to the FBI’s cybercrime system, resulting in even less usable info. The DHS blamed the system’s user unfriendliness. The FBI agrees to a certain extent and plans to replace all of the stuff that isn’t working with something that might work better sometime this year.

At this point, however, this only means there’s been at least three years of mandated notifications the FBI has failed to handle competently. A little consistency would have gone a long way:

We also found that that the amount of information and instructions for leads, which are used to assign tasks to agents such as victim notifications, varied depending on the author of the leads. Leads that contained little detail often made it difficult for agents conducting the notifications to make useful notifications to victims. Similarly, we found that the timeliness and quality of cyber victim notifications affected victims’ satisfaction with the process. Seven of the 14 victims we met with said that they had received at least 1 notification too late, or without enough detail, to allow any meaningful remediation to be made. At both FBI headquarters and field offices, FBI cyber personnel acknowledged the timeliness of notifications is a problem.

The FBI also manages to get in its own way when actually attempting to deliver info to affected parties.

With regard to quality, due to national security classification, the FBI cannot always share sufficient information to allow victims to take action to defend their networks or systems.

There we go again, sacrificing security for security, which is a really weird tradeoff that does little for the nation being secured. Adding to the insecurity is a lack of best practices, which meant involved agents followed no specific protocol. Some were completely unaware of how the system worked or what effect their contributions (or lack thereof) had on victim notification.

During this audit, we visited six FBI field offices and discussed the victim notification process with cyber squad Special Agents and supervisory Special Agents. In our discussions, we found that 29 of 31 field agents we interviewed do not use the “Victim Notification” lead type when setting leads for victim notification. Five of the agents had not even heard of it.

Without proper flagging, notifications never occurred. The OIG’s examination of records showed only 1% were classified as “victims” in need of notification. The IG’s investigation determined the actual number of victims contained in the files was closer to 30%.

As the report notes, the FBI is doing damage to its relationship with the private sector with this failure to properly handle this crucial part of its cybercrime directive. Delayed or under-informative notifications undermine the FBI’s credibility as a “partner” in the private sector’s own battles with cybercriminals. The FBI thinks it should have the public’s trust, but its track record over the past several decades shows it hasn’t done much to earn it. The agency may be dipping a toe in new waters with its cybercrime initiatives, but it still had a responsibility to handle it with the level of competence one expects from a storied agency with a healthy budget and a wealth of expertise within its ranks.

Filed Under: cybercrime, fbi, sharing, victims

Court Says Virginia PD's Use Of Automatic Plate Readers Violates State's Data Privacy Law

Privacy

from the why-no-officer-wants-to-be-an-expert-on-relevant-statutes dept

The ACLU has secured a win for privacy in Virginia after taking on the state law enforcement and their many, many automatic license plate readers.

The state’s ALPR track record isn’t great. Law enforcement and other government agencies love the tech, even if they have a considerable amount of trouble showing that plate readers do anything more useful than catch property tax cheats. Law enforcement agencies have turned their plate readers on political rally attendees, raising First Amendment issues along with the usual privacy concerns.

The ACLU attacked the state’s use of plate readers using one of the state’s own laws. According to the “Government Data Collection and Dissemination Act,” the long-term collection of untargeted plate data was illegal. The state’s attorney general even issued an official opinion to this end, pointing out that active collections seeking targeted plates was permissible, but passive collections with no end date and unrelated to ongoing investigations wasn’t.

That opinion — issued in 2013 — did nothing to alter law enforcement ALPR operations. A lawsuit followed when records requests showed plenty of passive collection was still taking place. The ACLU pointed out (again) these collections violated state law. Fairfax County Circuit Court judge Robert J. Smith agreed.

In his 5-page opinion [PDF] granting the ACLU an injunction blocking the Fairfax County Police Department from engaging in passive, untargeted collections, the County Court agrees with the state Supreme Court’s findings: the ALPRs are subject to the state data privacy law and the ALPRs — despite law enforcement protests to the contrary — collect protected personal info.

The FCPD argued the passive license plate collection did not automatically connect plates to car owners. The additional steps officers needed to perform somehow exempted this collection from the state’s data privacy law. The court disagrees, pointing to the part of the state law the FCPD decided to ignore when crafting its argument.

If the only issue before the Court was whether the link must be automatic to be found invalid, the defendant’s position might well carry the day. However, the Data Act defines “information system” as:

The total components and operations of a record-keeping process, including information collected or managed by means of computer networks and the Internet, whether automated or manual, containing personal information and the name, personal number, or other identifying particulars of a data subject. Va. Code §2.2-3801 (emphasis added).

The methodology here requires no less than two computer programs and three passwords. Such requirements, while perhaps cumbersome, do not necessarily preclude an establishment of a sufficient link under the Supreme Court’s analysis and the Data Act.

According to the court, these steps link the mass collections to individual people. While the plate readers may only collect plate and location info, the fact that this database is tied to others containing identifying info is enough to make the collection subject to privacy protections guaranteed by the state.

After reviewing the evidence presented at trial, I find that the ALPR system provides a means through which a link to the identity of a vehicle’s owner can be readily made. The Police Department’s “passive use” of the ALPR system therefore violates the Data Act. Accordingly, the petition for injunction is granted.

This may only prevent the FCPD from passive ALPR collections but the state Supreme Court’s ruling should have some effect on law enforcement’s use of the tech across the state. No one else has been blocked from letting their ALPRs run day-and-night with no nexus to ongoing investigations, but that day will be coming. It might take a lawsuit to force the issue, but unless law enforcement lobbyists can pressure legislators into rolling back these privacy protections, the courts have made it clear ALPRs collect personal data in an indiscriminate fashion.

Filed Under: alpr, data protection, license plates, privacy, virginia

Former Police Chief Says Conviction Requirement For Forfeitures Makes It Too Hard To Take Cash From People

Legal Issues

from the can't-have-us-police-doing-actual-police-work dept

One of the worst defenses of civil asset forfeiture has been penned by retired police chief Robert Stevenson for the Michigan news site, the Bridge. It’s written in response to two things: pending forfeiture reform bills in the state legislature and the Supreme Court’s Timbs decision, which indicated forfeiture may fall on the wrong side of the 8th and 14th Amendments.

Michigan definitely needs to overhaul its forfeiture laws. Law enforcement claims it’s dismantling drug cartels, but a look at the state’s forfeiture stats shows cops are just piling up low ball seizures to create a suitably impressive total. Cash seizures are routinely below $1,000. Vehicle seizures are also popular with Michigan cops, but the average value of vehicles taken from alleged drug dealers also falls below the $1,000 mark.

It’s these tiny seizures — the ones not worth fighting in court — that the state legislature is trying to curb. It’s hoping to implement a conviction requirement for any forfeiture under $50,000. Chief Stevenson says this would let the drug dealers win. But beyond using some florid language to flesh out a tiny parade of horribles, Stevenson cannot actually say why this conviction requirement would harm drug enforcement efforts. He tries. Lord, how he tries. But there’s nothing coherent in his defense of cops taking property from citizens just because.

First, Stevenson argues that cops should be able to take money they feel deeply in their hearts is derived from drug dealing even if it can’t find any evidence linking the person carrying it to a crime.

Law enforcement will be severely handicapped if state lawmakers succumb to the misconception that no forfeiture should take place without a conviction on proceeds under $50,000. It is a dramatic misunderstanding that a conviction can be obtained in all drug cases. Drugs and proceeds are not always discovered together which makes obtaining criminal convictions in certain instances impossible. Linking civil asset forfeiture to a criminal conviction allows drug dealers to continue profiting from dealing death in our communities.

In the eyes of LEOs like Stevenson, cash being carried by people stopped by officers can only be the product of illegal activity. It’s simply inconceivable anyone would carry cash in this day and age, apparently. This isn’t conjecture on my part. Stevenson actually states that people carrying cash are legally obligated to explain its origin to cops.

That part comes in his second argument for forfeiture — one that says even if cops have all the evidence they need to push for a conviction, they still should just be able to take the cash instead.

The $50,000 threshold found in this legislation simply means that drug dealers will transport money in sums of less than $50,000. The scenarios I fear involve finding suspects in a house or a car in possession of $49,000 in cash with no valid explanation.

There are two mind-blowing statements in this paragraph and they’re both worth singling out.

Stevenson says people should have to explain their cash to cops. That’s a really weird statement to make, considering previous forfeiture reform efforts raised the burden of proof for the state, not for the public. The public doesn’t owe law enforcement a “valid explanation” for cash (and other property) it possesses. This is completely the wrong way around and it explains law enforcement’s inherent resistance to conviction requirements. Cops want the cash, but they don’t want to put in the work needed to link seizures to illegal activity. They want the burden of proof to rest most heavily on those whose property has been taken.

Then Stevenson says cops shouldn’t have to pursue convictions to take cash even when they have enough evidence to support a conviction. These sentences resist parsing:

Drugs may not be present, but everything else confirms and indicates drug trafficking, i.e., ledger books, scales, pre-recorded narcotics buy funds and packaging materials. In this particular scenario, as well as a multitude of others, the police and prosecutors could not establish a case to seize anything if Michigan adopts the $50,000 threshold.

The proposed law would just determine which case needs to be established first. If cops have enough to establish a case for prosecution, it can move forward with trying to seize the cash. The only possible way this argument makes sense is if Michigan law enforcement is so inept it can’t cobble together a prosecution using a shitload of evidence. If that’s the case, Michigan law enforcement definitely needs to have convictionless seizures because that’s the only way it’s ever going to take possession of all this “unexplained” cash.

I’m sure Stevenson felt pretty self-righteous (and regular righteous, to be fair) handing this op-ed in. But the lack of logic displayed by his spirited, but incoherent, defense of the state’s long-running “free money for cops” programs made more of case for reform than if he’d simply said nothing at all.

Filed Under: asset forfeiture, civil asset forfeiture, michigan, police, robert stevenson

DHS Thinks Homeland Will Be More Secure If Two Federal Agencies Ignore Domestic Terrorists

Legal Issues

from the all-threats,-but-really-just-the-foreign-ones dept

The Department of Homeland Security isn’t all that interested in securing the homeland, it appears.

The Department of Homeland Security has disbanded a group of intelligence analysts who focused on domestic terrorism, The Daily Beast has learned. Numerous current and former DHS officials say they find the development concerning, as the threat of homegrown terrorism—including white supremacist terrorism—is growing.

This shift of focus away from a growing problem was a move made by the Trump administration. The head of this department, David Glawe, dissolved the branch handling domestic terrorism, even as acts of domestic terrorism continued to increase. The DHS likes securing the homeland, but only if it involves targeting people from other countries. The war at home can continue to be waged as far as its concerned.

The DHS apparently feels the FBI should handle the problem of securing the homeland against domestic threats.

Two former DHS officials, speaking anonymously because their current employers did not authorize them to speak to the press, said this change eliminates redundancy in the government. These officials argued that the responsibility for preventing domestic terrorism lies with the FBI, rather than with DHS.

This is as much the FBI’s fault as anyone’s. The FBI declared long ago it was now a counterterrorism agency, rather than a law enforcement agency. The problem with leaving this up to the FBI is the FBI is no more interested in combating domestic terrorism than the DHS.

[T]he FBI claimed for several years that far-right violence, though the most lethal, was not the top domestic terrorism threat. From 2004 through 2008, the FBI designated “eco-terrorism” the number one threat within the United States, despite not a single fatality attributed to environmental activists. The FBI still devotes substantial counterterrorism resources to tracking political activists protesting oil and gas pipelines at Standing Rock and elsewhere, and even harassing the lawyers that assist them. In 2017, FBI agents raided two animal sanctuaries as part of a multi-state investigation to locate two piglets rescued from a factory farm, reportedly cutting off a piece of one piglet’s ear to obtain DNA samples for testing. This seems a questionable use of resources, particularly when thousands of violent hate crimes against human beings are going unaddressed.

In another instance of taking its eye off the ball, weeks before the deadly white nationalist riot at Charlottesville, the FBI issued an assessment warning police that black activists protesting police violence posed a threat to them. It even invented a term for it — the “Black Identity Extremist” movement — to justify increasing scrutiny. Its first attempted prosecution of a prominent member of the Huey P. Newton Gun Club, an armed black self-defense group in Dallas, Texas, failed. The FBI continues to monitor and harass Black Lives Matter activists, visiting their homes in advance of protests, potentially chilling their participation.

The FBI’s favored counterterrorism efforts are sting operations that utilize undercover informants to radicalize an assortment of weak and helpless people before handing them over to federal prosecutors. The FBI has probably created far more would-be terrorists during its counterterrorism efforts than social media. When the FBI deigns to examine domestic terrorism, it decides to go after people who threaten established industries or the justice system’s status quo.

The FBI knows the domestic problem is growing:

Internal FBI figures reviewed by the paper show more domestic terror suspects were arrested in 2018 than “those allegedly inspired by international terror groups.”

According to FBI data, 150 Americans were arrested for planning to engage in acts of domestic terrorism in 2017, compared to 110 international suspects; in 2018, the ratio was 120 to 100.

Like many federal government agencies — especially those tied to law enforcement — the FBI and DHS have allowed terrorism to become an eye-of-the-beholder sort of thing. The DHS throws time and money at border security and hassling travelers at international airports. The FBI focuses on ISIS-inspired terrorism, conveniently forgetting plenty of other belief systems are capable of producing violent acolytes.

There’s really only one conclusion to draw from this: domestic terrorism is ignored because it usually involves Good Americans™ with white skin and American flag bumper stickers. Foreign terrorism involves brown people of indeterminate origin. This may not necessarily indicate the agencies are filled with racists, but this selective distribution of talent and resources doesn’t encourage many alternate theories.

These agencies are supposed to defend us from all threats foreign and domestic. It’s just not happening. This is a continuation of the proud American tradition of implicitly viewing foreigners as a threat and white, male citizens as the personification of patriotic virtue. The world may have changed radically over the past several decades, but one narrative — foreign threats — still plays better to the home crowd than the idea their friends and neighbors may be planning to shoot up a mosque or drive a vehicle into a crowd of protesters. It’s depressing enough that a significant percentage of the US population thinks only people who don’t look like them can be dangerous. It’s morally repugnant federal agencies reflect this mindset in their priorities.

Filed Under: dhs, doj, domestic terrorism, fbi, hate groups

ACLU Asks CBP Why It's Threatening US Citizens With Arrest For Refusing Invasive Device Searches

Legal Issues

from the I-assume-'because-fuck-you,-that's-why'-is-the-answer-we'll-be-g dept

Just a reminder this is the sort of thing that is happening at our borders with exponentially-increasing frequency.

The agents proceeded to search my belongings and demanded that I unlock my smartphone and laptop. This was rather concerning for me. My phone and laptop are property of my employer and contain unreleased software and proprietary information. I’ve signed a non-disclosure agreement promising not to give anyone access.

Because I was uncertain about my legal responsibilities to my employer, I asked the agents if I could speak to my employer or an attorney before unlocking my devices. This request seemed to aggravate the customs officers. They informed me that I had no right to speak to an attorney at the border despite being a U.S. citizen, and threatened me that failure to immediately comply with their demand is a violation of federal criminal code 18 USC 111.

Those are the words of Andreas Gal, Apple engineer and outspoken defender of online privacy. Gal is a US citizen, not that you’d know that from the treatment he received from the CBP. Gal also has “Global Entry” status, which provides “expedited clearance for pre-approved, low-risk travelers upon arrival in the United States.”

Global Entry is the CBP’s version of the TSA’s Precheck program. In both cases, the federal government is willing to respect a bit more of your rights in exchange for a lot of personal info and a bit of cash. You can see how well that’s working out for Gal, who was told he could not speak to an attorney and would be arrested if he did not allow agents to search his devices. In addition, he was told his Global Entry status would be revoked and was only allowed to exit the CBP’s custody by leaving his devices behind so the CBP could search them at its leisure.

The ACLU has lodged a formal complaint [PDF] with the CBP, demanding answers for its refusal to treat an American citizen like an American citizen.

CBP must ensure that its officers comply with the U.S. Constitution. Even at the border, the search of an electronic device is governed by the Fourth Amendment. To satisfy Ninth Circuit and Supreme Court law concerning electronic searches, any such search should be based on a warrant and be limited in scope to information relevant to the agency’s legitimate purpose in conducting the search. The attempted unconstitutional search of Dr. Gal’s devices illustrates that CBP’s policies do not in fact include the requirements necessary to safeguard the constitutional rights of people at the border.

The CBP has been given a lot of latitude to perform extensive searches at the border. But officers still need reasonable suspicion to demand US citizens unlock their devices for examination. Sadly, there’s still no warrant requirement at the border, even after the Supreme Court’s Riley decision. Multiple courts have held that securing our borders from threats like privacy advocates and Apple engineers is more important than respecting the rights the Founding Fathers said we were guaranteed.

The ACLU’s complaint letter suggests another complaint is on its way to a federal court.

There was no basis for Dr. Gal to be detained and interrogated by “TTRT” officers with special training in “counterterrorism response.” Dr. Gal entered the United States as a holder of Global Entry status, available only to “low-risk” individuals. And Dr. Gal has been an entrepreneur, technologist, and public figure for decades. Designating Dr. Gal for interrogation by “TTRT” indicates that Dr. Gal was targeted because of his exercise of his First Amendment rights in expressing viewpoints that may be disfavored by the federal government.

Compounding violations is never a smart move, but courts have handed so much Constitutional slack to border agencies, it will be tough to step over the pile of ignored rights to secure a victory. But every challenge edges us closer to a decision that may finally find the federal government isn’t free to ignore rights its supposed to be protecting just because there’s a border involved.

(Hat tip to Techdirt Insider Jeffrey Nonken who dropped a link related to this story into our Insider Chat. And a hat tip to all the Insiders in the chat who are always dropping useful and interesting links into the sidebar of this site!)

Filed Under: andreas gal, cbp, civil liberties, device searches, global entry, privacy, rights
Companies: aclu, apple