Tag Archives: DOJ

DOJ defends new cyber snooping regulations

digital_fingerprintThe Department of Justice calls them procedural changes that will help the government to pursue child pornographers who use cybertechnology to conceal their identities. Opponents say they are substantive and troubling changes that will vastly expand the government’s ability to spy on innocent Americans.

The changes in question are amendments to Rule 41 of the Federal Rules of Criminal Procedure, which deals with the issuance of warrants and protocols for searches and seizures. Barring congressional action, the amendments take effect on Dec. 1.

The amendments have been under debate for the past three years and are designed to address the thorny question of which court has jurisdiction to issue warrants in cases where suspected cybercriminals are using tools such as Tor or virtual private networks to conceal their identities and locations. Journalists, human rights activists and law enforcement officials also use such tools for legal purposes.

The amendments would allow the issuance of a single warrant to potentially search millions of computers suspected of being infected by botnet malware.

The Justice Department has been posting a series of blogs in support of the new rules.

“When a child abuser has successfully anonymized their identity and location online, investigators do not know where the abuser’s computer is located,” Assistant Attorney General Leslie Caldwell wrote in a recent blog post. “So in those cases, the [existing] rules do not clearly identify which court the investigators should bring their warrant application to.”

In another post, Caldwell argued for using a single warrant to search multiple computers in different locations that are suspected of being infected by a botnet.

“The Rules [of criminal procedure] as currently written (and as conceived in 1917) would require the investigators to apply simultaneously for identical warrants in all 94 judicial districts in America — a severe impracticality if not impossibility,” he wrote.

Privacy advocates and some lawmakers are trying to block what they see as a green light to access the personal devices of millions of Americans on the mere suspicion that they are infected with botnets.

In October, a bipartisan group of 23 members of Congress signed a letter to the attorney general asking for clarification on how the Justice Department will notify individuals whose computers are infected with botnet malware, how it will conduct searches or “clean” such computers without collateral damage and how the principle of probable cause will be applied to “justify the remote search of tens of thousands of devices.”

The Electronic Frontier Foundation also has been a vocal opponent of the changes. “The amendment to Rule 41 isn’t procedural at all,” EFF Activism Director Rainey Reitman wrote earlier this year. “It creates new avenues for government hacking that were never approved by Congress…. Congress should reject the proposal completely.”

The Justice Department released another blog post on Nov. 28 to respond to criticisms of the amendments.

“The pending amendments do not authorize the government to undertake any search or seizure or use any remote search technique that is not already permitted under the Fourth Amendment,” the post states. “The amendments neither endorse particular searches as reasonable, nor do they in any way change the traditional constitutional, statutory, and prudential factors the department relies on to determine whether to seek a warrant. They simply identify the appropriate court to ask.”

But that response has not satisfied critics, including Sen. Ron Wyden (D-Ore.), who co-sponsored legislation that would block the Rule 41 amendments from going into effect. Although his office acknowledges it is an uphill battle to pass any legislation before the rules take effect, he and others remain committed to blocking or amending the changes.

In a recent statement, Wyden said Justice officials have failed to provide details on how they intend to hack potentially millions of devices under a single warrant.

“[That] should be a big blinking warning sign about whether the government can be trusted to carry out these hacks without harming the security and privacy of innocent Americans’ phones, computers and other devices,” he said.

1-800 FLOWERS warns that hacker may have stolen customers’ personal info

Online florist failed to nip hackers in the bud


1-800 FLOWERS has begun sending out data breach letters notifying customers that a hacker might have stolen their personal information.

In a letter sent by the New York-based flower and gift retailer to the California Department of Justice, 1-800 FLOWERS explains that it was first alerted to the incident back in February when customers began complaining of an issue on its website.

“Our customer service team received reports on Feb. 15, 2016 from several customers indicating that they were unable to complete their online orders. Our operations team initiated an investigation and identified signs of unauthorized access to the network that operates our e-commerce platform.”

Bibi Brown, vice president of customer experience for 1-800 FLOWERS goes on to explain the team has since determined that during a 33-hour period between February 15 and February 17, an unauthorized third party might have gained access to customers’ orders, which commonly include their personal information such as their name, address, email address, and payment card data.


At this time, the floral retailer has not provided information on how the attacker might have succeeded in breaching its system. 1-800 FLOWERS has also not confirmed that any specific order information was affected.

There’s cause for some optimism, however.

Joseph Pititto, the company’s senior vice president, investor relations, told SCMagazine.com in an email that he has received no reports that any of the affected information has been incorporated into any sort of attack or other malicious campaign.

In this particular incident, it appears the worst case scenario would involve some compromised payment cards.

With that in mind, if you attempted to make a purchase with 1-800 FLOWERS during the affected 33-hour period, please take care to watch your credit transaction history carefully.

If you spot any suspicious charges, you should notify your bank or your card provider immediately. They can help you contest the charges, and in incidents such as these, they will be happy to send you a new card.

This is What the Public Really Thinks About FBI vs. Apple


DOJ v. Data Encryption – Public Perception and Communications Lessons

The heated dispute between Apple and the U.S. Department of Justice (DOJ) over the iPhone used by Syed Rizwan Farook before the San Bernardino, California, mass shooting has captured attention across America and the world. While this debate now focuses on one company’s decision, the implications go well beyond the mobile sector and even the whole technology industry. Companies and other organizations of all kinds responsible for managing personal data are concerned and need to be prepared to deal with the controversy’s impact.

To help deepen understanding about this complex issue, Burson-Marsteller, with their sister research firm Penn Schoen Berland, conducted a national opinion survey from February 23-24, 2016. The survey polled 500 General Population respondents (including 230 iPhone users) and 100 National Elites (individuals earning more than $100,000 per year who have college degrees and follow the news), and the results reveal critical communications issues around the fundamental conflict between privacy on the one hand and national security and safety on the other. Here are the key takeaways:

  • Overall awareness is high. Eighty-two percent of the General Population and 88 percent of National Elites have heard about the dispute. The news has gone viral, with people tweeting and posting on Facebook about it and commenting extensively online about news articles.
  •  The FBI should have access to one phone, not all phones. Respondents say the government should not be given a tool that potentially gives it access to all iPhones. Sixty-three percent of the General Population and 57 percent of National Elites say Apple should only provide the FBI with the data from the phone in question, and the tools to do it should never leave Apple’s premises. It is clear the public wants this decided on a case-by-case basis, and respondents do not trust law enforcement and national security agencies to self-police and protect privacy.
  •  The public expects companies to push back if there is the potential to violate privacy. Respondents say they want companies to protect the privacy of their data fully, even when the government is requesting data in the name of law enforcement or national security. A majority (64 percent of the General Population and 59 percent of Elites) says a company’s top obligation is to protect its customers’ data rather than cooperating with law enforcement or national security interests. However, most (69 percent of the General Population and 63 percent of Elites) see the need to compromise on privacy when terrorist threats are involved.
  • How the issue is framed determines public opinion. If the issue is framed as the FBI asking for access to this one phone, 63 percent of the General Population and 57 percent of Elites agree with the FBI position. If the issue is framed as potentially giving the FBI and other government agencies access to all iPhones, Apple’s position prevails overwhelmingly; 83 percent of the General Population and 78 percent of Elites agree Apple should either only grant access to the particular iPhone or refuse the request entirely.
  • Current laws are outdated. This situation reflects a much broader debate about privacy and security that will need to be resolved. About half (46 percent of the General Population and 52 percent of Elites) say current laws are outdated and need to be revised to reflect the changing role of technology in today’s society.

Regardless of the outcome of this current dispute, there is no question it is raising alarms about the state of data privacy. In the aftermath, companies will have to pay increasing attention to the expectations of their customers and consumers. The survey showed people are overwhelmingly concerned with the security and privacy of their digital data, with 90 percent of the General Population and 96 percent of National Elites saying they are very or somewhat concerned about the security and privacy of their personal information online or on their personal electronic devices. The Apple/DOJ dispute appears to be a turning point for all organizations trying to balance the demands of data privacy with national security and law enforcement considerations. The pressures on them are only going to grow.


Apple IOS Forensic Primer

iPhoneThe Operating System that Apple licenses to its users is IOS. It is resident and runs on their mobile devices (like the IPOD, IPhone and the IPAD). Legally, Apple specifically states it retains ownership of the IOS. There is legal precedent being argued (by the US DOJ) that will hold Apple to its continued ownership interest in IOS. This means the company can potentially be subpoenaed to assist Law Enforcement in exploitation of software on a target phone (which runs the IOS) in the execution of a search warrant.

While authorities wait for the decision on this particular legal argument, IOS forensics is necessary if the Apple device (in question) has been used in or found to be evidence in a crime. While the DOJ argues the precedent that “a product’s continued ownership interest in a product after it is sold obliges the company to act as an agent of the state”, the administrator needs to be able to pull data off of that device immediately during the conduct of an investigation. Even if an administrator is just trying to see if the user is violating (or has violated) company policy, there is a need to be able to access the data on the device.

There is a lot of data that gets stored on IPhones. Some people have more data on their IPhone than they have on their computers. If you browse the phones hard drive (typically this is done with a phone disk tool) you will not be able to see the full file system but, if you could see it, it bears a strong resemblance to the “MAC OS”. The MAC OS x” is built on a core called “Darwin” and the IPhone has all of the directory structure that the Mac operating system has.

For example, the maximum number of allocation blocks per volume that File Manager can access on a Mac OS system is 65,535. The IOS is basically a “MAC OS” system that has been tuned and tailored to operate on the smaller mobile devices which have different processors in them.

As we examine the directories and analyze their subdirectories, we see what is available as we dig down inside the device. The “DCIM” directory holds the “100 Apple” directory which will show the administrator where all of the pictures are. We also have a downloads directory (which holds all downloads), an iTunes directory (which holds all mp3 files), etc. The significance is that all of these directories give you the ability to see user data on a particular system.

Another place you can go looking for system information is in a terminal window. The terminal window gives an administrator the ability to use the command line interface to examine the device and the device data. Complete device access can be obtained when the “sudo” super user command is invoked. You will type;

$sudo su clyde (The user becomes a super user)

$cd (change directory)

$pwd (Here, we print the working directory)

$/user/clyde (This is our current directory)

The terminal window gives us the ability to examine the data inside the device as a super user (which gives us complete access to the system). When we look inside a device as a super user we know we will have the ability to access all additional files in the system. Instead of looking at the phone itself with different tools, you can analyze the system through a terminal command line.

$cd Library/ (change directory to the Library)
#cd ApplicationSupport/ (Change directory to the ApplicationSupport directory)

$ls (we list the contents of the directory, while we look for the MobileSync directory)

An administrator can examine and analyze the device’s “mobile sync” in relation to the computer the device has been syncing with.

$cd MobileSync (change directory to the MobileSync directory)

$ls (list the contents of the directory)

Backup (this is the contents of the directory)

$cd Backup (Change directory to the backup directory)

$ls (This will list all of the backups in the backup directory)

This is significant because in addition to examining the device data, I can pull up all of the “Backups” and select one of the backups. There is a lot of data stored in the backups. These files are just the backup information that has been stored on the hard drive. When the connected device (whether it is an IPad or IPhone) has its data copied onto the computer, in addition to being able to look at the directory on the phone itself using a utility like “Phone disk”, an administrator could also analyze the data in the backup. If you don’t have the phone but you have the computer, you may have almost as good a set of information as if you did have the phone because the backup stores a lot of information. It has to store all of the information you would need to restore the phone. The backup has got to store everything about your phone that you had previously.

If you have a user’s computer and you find the IPhone backups, you have the information that was stored on the phone. There are utilities that can be used to analyze these IPhone backups which have the ability to extract information from them. This will give an administrator the ability to examine all of the data that was captured in the scheduled backups.

When you are performing IOS forensics, there is not only the question of looking at the phones data because; sometimes an administrator won’t be able to obtain access to the data if the phone has a “Pass Code”. However, if you have access to the backup directory on the computer that the phone “syncs” with, you may have a better chance of getting the data from that device and doing your forensic analysis on the phone while you are actually working on the computer where the backups are stored. This is what eliminates IOS’s ability to thwart administrators and Law Enforcement from performing a forensic analysis.

Read more: Apple IOS Forensic Primer http://www.sooperarticles.com/technology-articles/mobile-computing-articles/apple-ios-forensic-primer-1453263.html#ixzz40dsmaebc
Follow us: @SooperArticles on Twitter | SooperArticles on Facebook