U.S. v. Ross Ulbricht: Declaration of Joshua J. Horowitz [pdf] • Hacker News Board

Re: U.S. v. Ross Ulbricht: Declaration of Joshua J. Horowitz [pdf]

#61

Post by [deleted] » Thu, Oct 02, 2014, 6:37 PM UTC

tomp wrote: post #19

btouellette wrote: post #14

It was pretty obvious that the FBI was lying (or misrepresenting or whatever weasel word you want to use) in their original claims. The real question in my mind, which still remains unanswered, is why? The most optimistic explanation is that they just botched the investigation and then spectacularly confused the prosecution as they were preparing their claims. I'd rather not think too hard about the most pessimistic…

Isn't it obvious? They wanted him gone. This is just like what happened to Kim Dotcom - the US government/elite wanted him gone, so they used whatever methods they wanted, executed by the Law Enforcement, to try and remove him. Sure, they might lose in court now, but most of the damage is done - Megavideo is gone, Silk Road is gone - just what they wanted. EDIT: I guess the biggest problem here is that the people res…

[deleted]

Re: U.S. v. Ross Ulbricht: Declaration of Joshua J. Horowitz [pdf]

#62

Post by wahern » Thu, Oct 02, 2014, 6:39 PM UTC

I'm not a lawyer, but AFAIU the defense has an affirmative burden to prove impropriety. Simply casting doubt isn't enough. They're unlikely to ever get this evidence suppressed on 4th Amendment grounds, so at best it's a tactical maneuver for negotiating a plea deal.

In fact, it's probably not even enough if they prove something as shocking as the NSA helping them. The NSA could always say that they stumbled upon Silk Road in the course of their anti-terrorism operations. And then instructed the FBI to hide the origins of the tip. We know for a fact that this happens regularly, and AFAIK nobody has ever been punished.

A court could technically toss the evidence as a way to punish the government for not playing fair, even if the law doesn't require it to be suppressed. That provides leverage for bargaining with the government. But evidence as central as this, in such a high-profile case where the defendant was clearly guilty, means that's unlikely. It's more likely for a smaller case where a court wants to rap the government on the knuckles without letting a really bad guy (from their perspective) go free.

Re: U.S. v. Ross Ulbricht: Declaration of Joshua J. Horowitz [pdf]

#63

Post by nobodysfool » Thu, Oct 02, 2014, 6:44 PM UTC

cyphunk wrote: post #34

btouellette wrote: post #14

It was pretty obvious that the FBI was lying (or misrepresenting or whatever weasel word you want to use) in their original claims. The real question in my mind, which still remains unanswered, is why? The most optimistic explanation is that they just botched the investigation and then spectacularly confused the prosecution as they were preparing their claims. I'd rather not think too hard about the most pessimistic…

I find it plausible that the NSA, DHS may have assisted. During the same time of the rise of Silkroad we have the NSA in full cowboy mode. A reading of the xkeyscorerules100.txt[1] leak shows this, among other things. Looking to Tor as a potential tool for terrorism, if not now than in the future, they would turn to Silkroad as the only interesting target for them to train their teeth on. I just know that if I were i…

It's called "Parallel construction"... http://en.wikipedia.org/wiki/Parallel_construction

Most likely, the NSA got the information around May, tipped off the FBI and the FBI started working on their "PC" story. Unfortunately, Ross was moving his servers and reconfiguring them during this time, making the PC story a bit more difficult to get.

Re: U.S. v. Ross Ulbricht: Declaration of Joshua J. Horowitz [pdf]

#64

Post by 300bps » Thu, Oct 02, 2014, 6:55 PM UTC

PeterWhittaker wrote: post #8

Quite an interesting read. Summary? Silk Road used a pair of nginx servers, one as front-end, one as back-end. The server images (captured forensically) show that the then-in-place configuration made it impossible for the FBI agent to do what he claims, that is, connect to the back-end by using the server's IP address (the allow/deny settings forbade this). The log files on the servers lack entries to support FBI cla…

...with the implication being that the U.S. Government discovered the identity of the operator of Silk Road through means that would either not be admissible in court or that would anger the public. They then engaged in acts of "parallel construction" to contrive lawful means that they discovered his identity using the foreknowledge of who he was via unlawful means.

http://freeross.org/ulbricht-defense-calls-for-evidentiary-h...

Re: U.S. v. Ross Ulbricht: Declaration of Joshua J. Horowitz [pdf]

#65

Post by daveloyall » Thu, Oct 02, 2014, 7:02 PM UTC

This is in response to various comments to the effect of "I can't believe they didn't log, image, etc properly".

Every organization is made out of people. Each person grew up somewhere, had interests, went to school, etc before joining the organization.

Some organizations attract some types of people more than other types of people.

Do you think the FBI attracts the sort of people who stayed home in front of their computers on most Friday nights during the best years of their lives?

...

Said differently: you're better at computers than you realize. Shh.

Re: U.S. v. Ross Ulbricht: Declaration of Joshua J. Horowitz [pdf]

#66

Post by chatmasta » Thu, Oct 02, 2014, 7:29 PM UTC

opendais wrote: post #46

chatmasta wrote: post #29

Earlier quoted context omitted.

They changed their story because the truth is that they violated the 4th amendement rights of anyone who browsed Silk Road for a period of time. They executed drive-by Javascript code on the computers of hundreds of unknowing silk road users, without a warrant. At worst, that's extremely illegal, and at best, it's in a definite gray area. I don't blame the FBI for trying to cover it up. (Citation -- wired article I r…

You are confusing this with Freedom Hosting. http://www.wired.com/2013/09/freedom-hosting-fbi/

Ah, my mistake. You're right. Although I would not be surprised if they used a similar technique once they had access to SR servers.

Re: U.S. v. Ross Ulbricht: Declaration of Joshua J. Horowitz [pdf]

#67

Post by tzs » Thu, Oct 02, 2014, 7:45 PM UTC

btouellette wrote: post #57

tzs wrote: post #50

Earlier quoted context omitted.

> "[...]For instance, former SA Tarbell asserts that, “[w]hen I typed the Subject IP Address into an ordinary (non-Tor) web browser, a part of the Silk Road login screen (the CAPTCHA prompt) appeared.” Tarbell Decl. at ¶ 8. As explained below, based upon the Nginx server configuration files provided in discovery, that was not possible. " I've not been following this closely, so the following question is based just on…

The mtime attribute on the configuration files from the server image as explained in the brief. "The mtime for the live-ssl configuration file provided in Item 1 of discovery is June 7, 2013, and the phpmyadmin configuration is July 6, 2013"

That wouldn't always work on my server. When testing a new config, I often mv the old config out of the way, then put in the new one. If the new one doesn't work, I mv the old one back.

I'm not consistent on this. Sometimes I just make a backup with cp, cp the new one in, and cp the backup back if the new one doesn't work.

I honestly have no idea why I mv sometimes and cp sometimes.

Re: U.S. v. Ross Ulbricht: Declaration of Joshua J. Horowitz [pdf]

#68

Post by ac29 » Thu, Oct 02, 2014, 8:18 PM UTC

I have limited experience with nginx, but I believe points 12+13 are technically incorrect -- sites/virtual hosts can be configured in the /etc/nginx/conf.d directory or directly in the main nginx.conf file, not only in the sites-available/sites-enabled directories, as is implied. This makes the conclusions of point 19 and others incorrect.

I don't think it necessarily disproves the conclusions of the document, but it calls into question if the author knows nginx as well as he claims to. Id be happy to be corrected if I'm wrong.

Re: U.S. v. Ross Ulbricht: Declaration of Joshua J. Horowitz [pdf]

#69

Post by opendais » Thu, Oct 02, 2014, 9:52 PM UTC

chatmasta wrote: post #66

opendais wrote: post #46

Earlier quoted context omitted.

You are confusing this with Freedom Hosting. http://www.wired.com/2013/09/freedom-hosting-fbi/

Ah, my mistake. You're right. Although I would not be surprised if they used a similar technique once they had access to SR servers.

Someone admitted I'm right in HN. I should go out and buy a lottery ticket. ;)

We all are wrong sometimes. Shit happens. :)

Re: U.S. v. Ross Ulbricht: Declaration of Joshua J. Horowitz [pdf]

#70

Post by wahern » Thu, Oct 02, 2014, 10:17 PM UTC

sarciszewski wrote: post #53

wahern wrote: post #49

Earlier quoted context omitted.

You could just make it an HTML meta tag which specifies trusted keys. And add an attribute to the script tag which contains the signature. Might need to disable inline JavaScript, though. And double-check that meta tags are only meaningful when located in their proper place in the head tag. I don't like the HTTP header idea, 'cause it precludes static content unless you modify the web server. And I don't like externa…

If you're pulling the public key from the document to use it to verify the document, you've already lost.

You're using it to verify JavaScript code, not the document. Presuming you also disabled inline JavaScript, you've just shutdown cross-site scripting (XSS) attacks.