Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Police Return Seized Hardware to Victorious BitTorrent Admin, Trashed

torrentfreak.com

Post reply on HN
Print view View original

31–40 of 44 posts

Re: Police Return Seized Hardware to Victorious BitTorrent Admin, Trashed

#31

Post by rbanffy »

solson wrote: post #28
tptacek wrote: post #25

Earlier quoted context omitted.

Why would it cost him significantly to have it returned? According to US code, a single note is all it takes to force a court procedure where the prosecutor has to demonstrate a nexus between the money and a crime. What would it cost your brother to go to court by himself? What would he have to lose? Look, I see the issue here. Clearly, if the government was randomly taking thousands of dollars from people and forcin…

There is. A kid left the frat and drowned in a river (it was a frat room not a dorm room). Drugs were suspected. I'm not sure why. They executed a warrant and took the money. BTW the autopsy found no drugs in the dead student's system. Anyway, you make this sound so simple, just send a note and go to court. Most people are extremely intimidated by this stuff and they just want it to end. Especially when you've alread…

> In some cases, property has been seized for acts someone other than the owner performed.

My first father in law (that sounds weird) had a SUV stolen. On the same afternoon, it was involved in two robberies - one supermarket, one bank - and one murder (one of the robbers was shot by his colleagues). It took him a while to get the car back.

Note: it happened in Brazil.

Re: Police Return Seized Hardware to Victorious BitTorrent Admin, Trashed

#32

Post by prodigal_erik »

tptacek wrote: post #30
solson wrote: post #28

Earlier quoted context omitted.

There is. A kid left the frat and drowned in a river (it was a frat room not a dorm room). Drugs were suspected. I'm not sure why. They executed a warrant and took the money. BTW the autopsy found no drugs in the dead student's system. Anyway, you make this sound so simple, just send a note and go to court. Most people are extremely intimidated by this stuff and they just want it to end. Especially when you've alread…

Again: that 80% stat? I'm certain it's true, but it's meaningless. The stat you want is, how often are challenges to seizures denied. Because --- and I'm not saying this is what happened with your nephew --- it is very likely the reason that 80% of those seizures don't match up with a conviction is that the people whose assets are seized are in fact criminals. Recognizing that doesn't mean I think civil asset forfeit…

I don't think it matters much whether many challenges are successful. When it takes years and costs more in unrecoverable legal fees (it's a civil court case, not merely a request) than most seized property is actually worth, very few victims are going to bother.

http://www.csmonitor.com/USA/Justice/2009/1209/p02s06-usju.h...

Re: Police Return Seized Hardware to Victorious BitTorrent Admin, Trashed

#33

Post by getsat »

bradleyland wrote: post #26
getsat wrote: post #12

Earlier quoted context omitted.

> * If the systems are turned on, record the datetime and shut them down. Did this ever lock you out of any machines configured to use Whole Disk Encryption or out of encrypted, mounted volumes? You could have dumped the keys out of ram, etc. > we used EnCase Did you ever come across any exotic filesystems that EnCase can't read, like XFS?

> Did this ever lock you out of any machines configured to use Whole Disk Encryption or out of encrypted, mounted volumes? You could have dumped the keys out of ram, etc. At the firm I worked for, preservation was priority #1 any time we were walking in to a case with high trial-risk. In order to discover that the system was encrypted, I would have to use the computer. Using the computer means changing it. Protocol w…

Thanks for the response. I'm not even in my 30s yet, but I feel old when I hear about John the Tripper and l0phtcrack. :)

> Failure to comply means you sit in a jail cell until you cough up the password.

I don't think this has precedent in a US court. The closest I can find is the following. He messed up by being initially cooperative:

http://en.wikipedia.org/wiki/United_States_v._Boucher

http://en.wikipedia.org/wiki/Key_disclosure_law#United_State...

This is also relevant for those interested in disk encryption:

http://news.techworld.com/security/3228701/fbi-hackers-fail-...

Re: Police Return Seized Hardware to Victorious BitTorrent Admin, Trashed

#34

Post by nazgulnarsil »

maeon3 wrote: post #18

Folks we are losing our basic human rights a little bit at a time here. It's like back thousands of years ago where if you wanted to convict someone of a crime you sneak them away in the night, torture them, set their house on fire, attempt to manufacture some evidence, then wreck their life then leave them alone for a little while. Vigilante justice, get 12 men together, and what they want is the law. It seems like…

Populism based jurisprudence will sink to the level of rigor demanded by the populace: not much. It will also be subject to fashionable morality. That is, the courts will tend to favor the party that is more aligned with the ideological winds regardless of the facts of the individual case.

This is devastating to the economy, as contract law relies on consistency. If parties can't expect predictable/neutral arbitration this greatly raises the costs/risks of investment.

This is devastating to personal justice, as minorities (ideologically, culturally, ethnically, etc.) face an uphill battle instead of neutral arbitration.

Re: Police Return Seized Hardware to Victorious BitTorrent Admin, Trashed

#35

Post by getsat »

getsat wrote: post #33
bradleyland wrote: post #26

Earlier quoted context omitted.

> Did this ever lock you out of any machines configured to use Whole Disk Encryption or out of encrypted, mounted volumes? You could have dumped the keys out of ram, etc. At the firm I worked for, preservation was priority #1 any time we were walking in to a case with high trial-risk. In order to discover that the system was encrypted, I would have to use the computer. Using the computer means changing it. Protocol w…

Thanks for the response. I'm not even in my 30s yet, but I feel old when I hear about John the Tripper and l0phtcrack. :) > Failure to comply means you sit in a jail cell until you cough up the password. I don't think this has precedent in a US court. The closest I can find is the following. He messed up by being initially cooperative: http://en.wikipedia.org/wiki/United_States_v._Boucher http://en.wikipedia.org/wiki…

Er, that should be John the RIPPER, not Tripper. Can't edit, sorry. :(

Re: Police Return Seized Hardware to Victorious BitTorrent Admin, Trashed

#36

Post by ErrantX »

bradleyland wrote: post #8
martincmartin wrote: post #3

"It almost appears as if a frustrated FACT employee trashed the hardware on purpose before it was sent back. How else could it turn into such a mess, and why take the computers apart piece by piece in the first place? What were they looking for? Warez?" I suspect that the cops are worried that, if they boot up the computer, it'll have a program which notices something is wrong and wipes the hard drive. So I'd guess t…

EDIT: I just realized that this case was in the UK. I don't know how much of what I'm about to say applies to their judicial system, but I'm going to leave it here anyway for those familiar with the UK to comment on. I did computer forensic work for the US Trustee system. Chain of evidence and the whole deal, because occasionally, our evidence would be handed over to law enforcement and used in criminal cases. I can…

I just realized that this case was in the UK. I don't know how much of what I'm about to say applies to their judicial system, but I'm going to leave it here anyway for those familiar with the UK to comment on.

Yep, the process is pretty much the same here.

The bottom line is that with the sheer amount of hardware going through youi do end up with some small damages (scratched cases, a few dead disks), but nothing on this scale.

It makes me mad, actually, to see this, and if he wants a hand finding out who to blame I'd be very happy to help with that. It gives my profession a bad name to see someone showing so little respect to someone else's kit :(

Re: Police Return Seized Hardware to Victorious BitTorrent Admin, Trashed

#37

Post by ErrantX »

getsat wrote: post #12
bradleyland wrote: post #8

Earlier quoted context omitted.

EDIT: I just realized that this case was in the UK. I don't know how much of what I'm about to say applies to their judicial system, but I'm going to leave it here anyway for those familiar with the UK to comment on. I did computer forensic work for the US Trustee system. Chain of evidence and the whole deal, because occasionally, our evidence would be handed over to law enforcement and used in criminal cases. I can…

> * If the systems are turned on, record the datetime and shut them down. Did this ever lock you out of any machines configured to use Whole Disk Encryption or out of encrypted, mounted volumes? You could have dumped the keys out of ram, etc. > we used EnCase Did you ever come across any exotic filesystems that EnCase can't read, like XFS?

I work on criminal cases, so have a slightly different perspective to bradleyland.

> Did you ever come across any exotic filesystems that EnCase can't read, like XFS?

I've come across something "obscure" only once or twice (in several hundred cases). The bottom line is that most computer crime isn't conducted by technically adept people, but by normal people. i.e. Windows is by far the most common system, with Mac a distant (thought growing) second :)

> Did this ever lock you out of any machines configured to use Whole Disk Encryption or out of encrypted, mounted volumes? You could have dumped the keys out of ram, etc.

There are all sorts of ways (as bradleyland explained) to get around this issue. The problem is that most material is siezed by a normal police officer - so there is simply no way you can let them do a live acquisition :D (or indeed no way they would know they had to).

But there are all manner of ways to figure out, or sometimes crack, the encryption key and away you go :)

The times I've come across WDE I've managed to get round it fairly quickly, mostly due to "user error".

Re: Police Return Seized Hardware to Victorious BitTorrent Admin, Trashed

#38

Post by Tuna-Fish »

derefr wrote: post #27
bradleyland wrote: post #26

Earlier quoted context omitted.

> Did this ever lock you out of any machines configured to use Whole Disk Encryption or out of encrypted, mounted volumes? You could have dumped the keys out of ram, etc. At the firm I worked for, preservation was priority #1 any time we were walking in to a case with high trial-risk. In order to discover that the system was encrypted, I would have to use the computer. Using the computer means changing it. Protocol w…

> Failure to comply means you sit in a jail cell until you cough up the password. So, keyfiles on easily-destroyable thumbdrives, then? If they say the only copy of the key (that they're aware of) was destroyed, that's basically equivalent to saying they wiped the disk; you can't really hold them expecting them to magically recreate it, right?

"Tampering with evidence is the knowing and intentional physical manipulation, altering or destruction or falsification of evidence relevant to a criminal case or investigation. It is important to note that tampering is not the accidental destruction or modification of evidence, it is only if the individual had reason to believe the material or item was part of an investigation."

Evidence tampering often carries much harsher penalties than the crime in question -- if a company is in trusteeship, wiping the disk (or doing the equivalent) can quite possibly be the dumbest possible thing you can do.

Re: Police Return Seized Hardware to Victorious BitTorrent Admin, Trashed

#39

Post by bradleyland »

patrickaljord wrote: post #17
getsat wrote: post #12

Earlier quoted context omitted.

> * If the systems are turned on, record the datetime and shut them down. Did this ever lock you out of any machines configured to use Whole Disk Encryption or out of encrypted, mounted volumes? You could have dumped the keys out of ram, etc. > we used EnCase Did you ever come across any exotic filesystems that EnCase can't read, like XFS?

> Did this ever lock you out of any machines configured to use Whole Disk Encryption or out of encrypted, mounted volumes? That read weird to me too. My file system is totally encrypted and the easiest way to get a copy of it is to not turn the machine off but make a copy of the mounted hard disks first. That's true for any encrypted file system, sounds like a pretty big faux pas in the procedure.

From a technical perspective, there are definitely better ways to go about acquisition. It can be very hard for technical people to work in computer forensics because many technically attractive strategies are off-limits to you due to constraints that are wholly non-technical.

Think of it like this. Police would probably find a lot more evidence if they were able to search your car/property without consent, but they don't because that would violate your civil rights. The acquisition situation is a little bit different, because it's not strictly a matter of civil rights. It's more subtle. We have the right to examine the computer, but the process has to:

1) Hold up in a court as irrefutable and demonstrate a process that is inherently resistant to tampering.

2) Discover the evidence required to execute the legal strategy.

All the evidence in the world won't convict someone if the defense can take the position that evidence was tampered with. Using the computer prior to examination is akin to taking a gun used in a murder to the gun range before checking it in as evidence. Simply testifying that you didn't tamper with it doesn't do the trick. It very quickly becomes a chicken and the egg problem.

Re: Police Return Seized Hardware to Victorious BitTorrent Admin, Trashed

#40

Post by bradleyland »

getsat wrote: post #33
bradleyland wrote: post #26

Earlier quoted context omitted.

> Did this ever lock you out of any machines configured to use Whole Disk Encryption or out of encrypted, mounted volumes? You could have dumped the keys out of ram, etc. At the firm I worked for, preservation was priority #1 any time we were walking in to a case with high trial-risk. In order to discover that the system was encrypted, I would have to use the computer. Using the computer means changing it. Protocol w…

Thanks for the response. I'm not even in my 30s yet, but I feel old when I hear about John the Tripper and l0phtcrack. :) > Failure to comply means you sit in a jail cell until you cough up the password. I don't think this has precedent in a US court. The closest I can find is the following. He messed up by being initially cooperative: http://en.wikipedia.org/wiki/United_States_v._Boucher http://en.wikipedia.org/wiki…

That certainly didn't stop the trustee from threatening with motion to compel orders in just about every case we worked. IANAL, so I have no idea what the enforceability is. Every law enforcement/trustee's worst nightmare is a well-informed suspect/debtor.
Post reply on HN