Last month, the FBI was ordered to reveal the full malware code used to hack visitors of a dark web child pornography site. The judge behind that decision, Robert J. Bryan, said it was a “fair question” to ask how exactly the FBI caught the defendant.
But the agency is pushing back. On Monday, lawyers for the Department of Justice filed a sealed motion asking the judge to reconsider, and also provided a public declaration from an FBI agent involved in the investigation.
Videos by VICE
In short, the FBI agent says that revealing the exploit used to bypass the protections offered by the Tor Browser is not necessary for the defense and their case. The defense, in previous filings, has said they want to determine whether the network investigative technique (NIT)—the FBI’s term for a hacking tool—carried out additional functions beyond those authorised in the warrant.
DoJ attorneys have also asked to submit a filing ex parte and in camera, meaning that only the judge would be presented with evidence under the motion.
“Tsyrklevich claims that he requires access to the government’s ‘exploit’ to determine if the government ‘executed additional functions outside the scope of the NIT warrant,’” Special Agent Daniel Alfin writes. He is referring to Vlad Tsyrklevich, a malware expert held by the defense to analyse the NIT. In January, the defense did receive some of the NIT code, but not sections that would ensure that the identifier issued to the suspect’s NIT-infection was unique, and the exploit used to break into the computer.
This specific case concerns Jay Michaud, a public school administration worker from Vancouver, Washington, who was arrested in July 2015. In February 2015, the FBI seized a dark web child pornography site and ran it from their own servers for 13 days. During this time, the agency deployed a NIT against people who visited specific, child pornography threads, which grabbed their real IP address, among other technical details.
“Knowing how someone unlocked the front door provides no information about what that person did after entering the house.”
Tsyrklevich has written a declaration after analysing the parts of the NIT that have been disclosed, but the full text of that document remains under seal.
“He is wrong,” Alfin continues. “Discovery of the “exploit” would do nothing to help him determine if the government exceeded the scope of the warrant because it would explain how the NIT was deployed to Michaud’s computer, not what it did once deployed.”
Here, Alfin starts an analogy for software vulnerabilities: that of a flaw in a lock.
“In layman’s terms, an ‘exploit’ could be thought of as a defect in a lock that would allow someone with the proper tool to unlock it without possessing the key,” he writes.
“Knowing how someone unlocked the front door provides no information about what that person did after entering the house. Determining whether the government exceeded the scope of the warrant thus requires an analysis of the NIT instructions delivered to Michaud’s computer, not the method by which they were delivered.”
Alfin also claims that the identifiers attached to each NIT-infection, another point of contention for Tsyrklevich, are indeed unique.
“I have reviewed the list of unique identifiers generated during the operation and confirmed that there were in fact no duplicate identifiers generated,” Alfin adds.
NIT code has been disclosed in the past. In a 2012 case, the government provided details of its technique which turned out to involve the hacking-toolkit Metasploit. The FBI used a Flash applet to make a direct connection over the internet, instead of routing the targets’ traffic through Tor.
Peter Carr, a spokesperson for the Department of Justice, told Motherboard in an email “We’ll decline to comment beyond our public filings.”
