Feds Seek Unfettered GPS Surveillance Power as Location-Tracking Flourishes

The Supreme Court is set to hear historic arguments Tuesday in what perhaps is the most important Fourth Amendment case in a decade — one weighing the collision of privacy, technology and the Constitution.

The question before the justices asks: May the police secretly install a Global Positioning System device on a vehicle without a probable cause warrant issued by a judge in order to track a suspect’s every move?

FBI Vehicle-Tracking Device: The Teardown

Video: The Dissection of an FBI Bumper-Beeper

How to Check Your Car for a GPS Tracker

The last time the justices were confronted with the blending of technology and privacy was a decade ago before the mass proliferation of GPS gadgets. The high court at the time ruled in favor of constitutional protections when it concluded that thermal-imaging devices used to detect marijuana-growing operations inside a house amounted to a search and therefore required a court warrant. Contrast this to a prior ruling in 1983 when the justices said it was okay for the government to use beepers known as “bird dogs” to track a suspect’s vehicle without a warrant.

Technology has advanced since both of these cases, feeding the governments growing hunger for cost-efficient, easy-to-use spy tools, and making the latest debate before the justices seem Orwellian. Today, one’s exact position on Earth can easily be secretly monitored with devices costing less than $200. Add to this the governments argument in court briefs that “a person has no reasonable expectation of privacy in his movements from one place to another,” and you have the makings for widespread, unchecked surveillance.

Behind the scenes of the hotly contested GPS case, which is garnering press attention far and wide, is a fledgling enterprise capitalizing on the appetite for tools to track people by both police and private citizens.

The Justice Department has said that law enforcement agents employ GPS as a crime-fighting tool with “great frequency.”

Staring Down a Rogue Bus: An Introduction to Crowd Control

Occupy Oakland protesters rally in front of the State of California building Wednesday, Nov. 2, 2011, in Oakland, Calif. Oakland's citywide general strike, a hastily planned and ambitious action called by Occupy protesters a day after police forcibly removed their City Hall encampment last week, shut down the Port of Oakland.

On Wednesday afternoon, as my wife and son and I were walking to Occupy Oakland, we saw a bicycle get hit by a bus. The biker wasn’t hit hard, and he didn’t seem hurt.

But we stopped to help him out, in part because the same bus had borne down on us, too, while we’d been walking through the crosswalk. It was one of those classic muscle plays by a driver, intimidating pedestrians and bikes into yielding the right of way. After he hit the bike, the driver tried to pull away — we had to stand in front, the biker and I, to keep him from fleeing the scene. The biker called the police but they never showed.

It became an uncomfortable stalemate. But there was no question about our course of action. We were standing in front of that bus. We weren’t going to let it leave.

Soon, some Occupy protesters intervened — on behalf of the bus. Turns out, the bus was headed to shuttle activists to the port. It was the last in a convoy of charter buses, and none would leave until all the rest could follow, including this one. Eventually, the protesters convinced the biker to let the bus go. He and I had been a crowd of two; but when our crowd got bigger, the perspective changed, and a different group identity formed.

For a feature story in Wired’s January 2012 issue, I’ve spent the past few months thinking about the nature of physical crowds in the digital age. In this series of posts, called “Crowd Control,” I’ll be semi-regularly posting some of my research and observations. Surveying social science on the subject, most of the interesting questions boil down, fundamentally, to this one: *Who* do we become, collectively, when we come together?

As my own, modest example shows, these questions are fundamentally about identity — who (in the moment) is “us,” and what do we think is right? The constantly shifting nature of this question is a large part of why crowd events are hard to understand, and even hard to describe.

Think about that Wednesday in Oakland. In the afternoon, a giant, peaceful crowd of people — including my family and me — marched from downtown Oakland to the city’s port. The mood was relaxed, convivial, almost carnivalesque.

Remember, Remember Anonymous Celebrates the 5th of November

November 5 is a very special day for Anonymous, for this year Guy Fawkes Day and Caturday coincide. Guy Fawkes Day is the British fireworks holiday appropriated by Alan Moore in the 1982 comic V for Vendetta, which was made into a movie in 2006, which in turn inspired the iconic mask used by the group. Caturday is the celebratory day of the lolcat. This is like Kwanzaa, Yom Kippur, Easter, and Arbor Day all rolled into one for the people of lulzy collective.

Anons the world over are celebrating by drinking, watching V for Vendetta, crying over how cute kitten pictures are, and posting pages and pages of famous peoples’ personal data all over the web. On Tumblr, the Anonymous group CabinCr3w released information on a number of public figures including former U.S. Treasury Secretary Larry Summers, noted conservative donors the Koch Brothers, Mayor Michael Bloomberg of New York, Monsanto CEO Hugh Grant, and finally for the lulz, Jesus himself.

While I haven’t had time to review all the material between shots of whiskey and getting my Alan Moore tramp stamp, it seems most of the information released is available through public data sources.

The documents include properties owned by the target; boards the subject sit on; names of associates, family, and friends; items from news reports; and statements made by the subject or others. While being d0xed is likely not comfortable for the target, many of these newsworthy figures have similar profiles written up in media organizations and in the files of beat reporters who cover them. Anonymous has just put them online, sans sources, making it harder but not impossible to verify the data.

Also, the trailer for a new documentary on Anonymous called We Are Legion was posted in time for November 5th:

With a ongoing operations including one chasing child pornographers and debates about going after a Mexican drug cartel happening as Anonymous moves into year four of harassing the Church of Scientology, supports the Occupy Wall Street movement and the ongoing Arab Spring, hacks law enforcement, and as ever, posts funny cat pictures, this next year promises to be interesting times for Anonymous.

This post is part of a special series from Quinn Norton, who is embedding with Occupy protestors and going beyond the headlines with Anonymous for Wired.com. For an introduction to the series, read Quinn’s description of the project.

Photo: Anonymous9000/Flickr

Occupy Oaklands General Strike Veers Between Violence, Generosity

<< Previous|Next >>

The front of the Oakland Whole Foods is attacked by "black bloc anarchists," whose tactics include small scale property damage as a method of societal change.

Photos: Quinn Norton/Wired.com

<< Previous|Next >>View all

OAKLAND, Calif. — The trouble at Oakland’s General Strike on Wednesday started almost immediately.

The General Strike was called by the Occupy Oakland general assembly a week earlier, following a violent police eviction of protestors, in which an Iraq War veteran was critically injured.

Window smashing and graffiti followed the course of protestors around the downtown area. As I arrived at 3 p.m., black bloc anarchists were defacing the front of a Whole Foods, smashing a window and tearing up the fence and cafe area in front. Other protestors stepped in to defend the store, with one man in motorcycle leathers and a bright yellow motorcycle helmet taking on a group of the black bloc-styled vanguard of the protest single-handedly at one point.

Eventually drowned out by cries of “Peaceful Protest!” and pushed by the crowd, the black-clad marchers pushed on towards the lake, and some of the people behind them slowed near the ruined front of Whole Foods to pick up and return chairs and tables. The black-bloc faction smashed the fronts of banks and tagged much of Downtown Oakland with graffiti, while other protestors yelled and fought them.

The march returned to the plaza for a scheduled action at the Port of Oakland, where the mood became lighter and calmer. The black bloc was diluted in a sea of families, union workers, teachers and the supporters of the Oakland Occupation. The plan was to shut down the the port with a march to the port starting at 5 p.m., augmented by eight or nine charter buses arranged for those choosing not to or unable to walk there.

The march to the port was overwhelming, and from the ground, impossible to count. Estimates from the police and Occupy Oakland supporters ranged from 7,000 on the probably-too-small-side to 40,000 on the definitely-too-big-side. More block party than protest, the march was punctuated with dancing and singing, children and pets running underfoot, and even a marching band playing in front of one of the port’s major entrances.

No Duqu zero-day patch yet, but Microsoft offers workaround

Microsoft released a security advisory late Thursday with a workaround for the Windowszero-day vulnerability linked to the Duqu Trojan, but said a Duquzero-day patch wont be ready for next weeks Patch Tuesday release.

It is extremely important thatwhen that patch comes out that every Windows user that has a vulnerable computer apply that patchas quickly as possible... This is not one to mess around with.

Andrew Brandt, Solera Networks

In the advisory,Microsoft said it is investigating a vulnerability in a Windows component, the Win32k TrueType fontparsing engine. Successful exploitation of the vulnerability, according to Microsoft, could allowan attacker to run arbitrary code in kernel mode and then install programs, alter or delete data,or create new accounts with full user rights. For an attack to succeed, the victim must open anemail attachment.

We are aware of targeted attacks that try to use the reported vulnerability; overall, we seelow customer impact at this time, the company said.

The advisory provides a workaround for the Duqu vulnerability, which affects virtually allactively supported versions of Windows. Microsoft released a Fix it program to provide easyinstallation of the workaround.

In a blogpost, Jerry Bryant, group manager of response communications for Microsoft TrustworthyComputing, said Microsofts engineering teams have determined the root cause of the vulnerabilityand are working to produce a high-quality security update to address it. The update wont beready for this months bulletin release, he added, but declined to provide a timetable.

Microsoft also said it provided its Active Protections Program partners with details forbuilding detection into their security products. Antimalware vendors will soon release newsignatures, according to Microsoft, and encouraged customers to make sure to update their antivirusprotection.

Earlier this week, security researchers said they detected an installer for Duqu, a MicrosoftWord document that exploits a kernel-level Windows zero-day vulnerability.

According to security researchers, the Duqu Trojan containssome of the same source code used by the Stuxnet Trojan, which was designed to disruptindustrial processes. Duqu appears to have targeted industry equipment makers in order to collectinformation about their systems and other proprietary data. According to Symantec Corp., the numberof confirmed Duqu infections is limited, with confirmed attacks in eight countries, including Indiaand Iran.

Earlier in the day, security researchers said they didnt expect Microsoft's November 2011 PatchTuesday release to address the Duqu-related zero-day flaw due to the complexity of fixing thekernel-level vulnerability.

In its November2011 Patch Tuesday Advance Notification issued Thursday, Microsoft said it planned issue foursecurity bulletins Nov. 8, fixing four Windows vulnerabilities. Only one of the bulletins slatedfor release is rated as critical. Two are rated as important and the fourth is rated asmoderate.

Most of the bulletins apply to newer versions of Windows. The critical bulletin, which fixes avulnerability that could lead to remote code injection, affects Vista, Windows 7 and Windows Server2008 and Server 2008 R2. Only the third bulletin, which addresses vulnerabilities that could leadto elevation of privilege, also affects the older Windows XP and Server 2003.

The November 2011 Patch Tuesday will be light, especially for companies that havent yetswitched to Windows 7, said Marcus J. Carey, security researcher at Boston-based vulnerabilitymanagement company Rapid7 LLC.  He said the nature of the Duqu-related flaw means Microsoftcant rush a patch for it.

It just takes a long time to fix kernel-level bugs, he said. The kernel is the core part ofthe operating system, so its a big deal when you have to fix those.

Mike Geide, senior security researcher at Sunnyvale, Calif.-based Web security SaaS providerZscaler Inc., also said fixing the kernel-level vulnerability is a complex process.

Microsoft isnt going to release a patch until after thorough testing to make sure it not onlyfixes the vulnerability but also that it doesnt cause any problems in any of their operating systems, he said. There are quite a number of systems todo stress testing on.

Noting the targeted nature of the Duqu attacks, Carey said average users arent going to beaffected by the malware. At the same time, though, researchers and attackers will be trying touncover this bug until Microsoft patches it, he added.

Andrew Brandt, director of threat research at South Jordan, Utah-based network securityanalytics provider Solera Networks Inc., said it will be critical that businesses and individualusers apply the patch for the kernel-level zero-day vulnerability once Microsoft releases it.

It is extremely important that when that patch comes out that every Windows user that has avulnerable computer apply that patch as quickly as possible, he said. This is not one to messaround with for six months We know just how dangerous it is, and its already been used for somescary stuff.

Once the details of the vulnerability are released, it will just be a matter of time before moremalware that exploits it surfaces, he added. The window of time between distribution of detailsand appearance of more malware that exploits the vulnerability is shorter and shorter. Its gonefrom weeks to days to hoursIt will not just be Duqu in the long run that exploits it.

Duqu installer contains Microsoft Windows zero-day vulnerability

Investigators trying to uncover more information about the Duqu Trojan have discovered theinstaller, yielding new clues as to how systems are infected by the malware.

Instead of speculating, we encourage all professional organizations to enhance the jointprocess of finding a solution, since strong international collaboration will remain to play a keyrole.

Laboratory of Cryptography and System Security (CrySyS)

Researchers at Budapest-based Laboratory of Cryptography and SystemSecurity (CrySyS) detected the installer, a malicious Microsoft Word document, and discoveredthat Duqu contains a dropper file that targets a Microsoft Windowskernel zero-day flaw. When the file is opened, the malicious code executes, quietly installingthe malicious Duqu files.

The discovery is significant as it forces Microsoft to begin developing a patch for the flaw.While no additional workarounds exist, enterprises can bolster defenses by educating end usersabout suspicious attachments. Symantec issued a DuquTrojan status update, explaining how the cybercriminals behind the malware pull off asuccessful attack. The company warns other attack vectors may exist.

The Word document was crafted in such a way as to definitively target the intended receivingorganization, Symantec said. Furthermore, the shell-code ensured Duqu would only be installedduring an eight-day window in August.

Symantec said organizations that consider Duqu a threat should follow best practices and avoiddocuments from unknown parties. Fortunately, most security vendors already detect and block themain Duqu files, thereby preventing the attack, Symantec said.

Symantec issued details about Duqu Oct. 14, describing how the Trojan contains some of the samesource code used by the Stuxnet worm. Duqu contains a different payload. Rather than disruptingindustrial processes, it has been targeted at industrial equipment manufacturers and collectsinformation about the manufacturers systems and other proprietary data. Symantec, which is workingclosely with the CrySyS researchers, warned that Duqu could be a precursor for a much moredangerous attack.

Duqu infections appear to be limited, Symantec said.  Once Duqu infects a system, itattempts to contact a command-and-control server where attackers can install additional malwaredesigned to record data and steal other information. While some infections had the ability toremotely contact a C&C server, Symantec said other infections did not contain thecommunications functionality and instead used a file-sharing protocol to connect to a computer thatcould contact the remote server for instructions.

The Duqu configuration files on these computers were instead configured not to communicatedirectly with the C&C server, but to use a file-sharing C&C protocol with anothercompromised computer that had the ability to connect to the C&C server.

Duqu creates a bridge between the network's internal servers and the C&C server, Symantecsaid. This allowed the attackers to access Duqu infections in secure zones with the help ofcomputers outside the secure zone being used as proxies.

Microsoft has not yet released an advisory indicating when it would have a patch ready to plugthe kernel vulnerability. The software giants next scheduled security updates are scheduled for 1p.m. ET, Nov. 8.

CrySyS, the organization that discovered Duqu and conducted the initial analysis of the malware,said it would continue to investigate the Trojan and release information to the security community.The research team cautioned security vendors to limit speculation.

Instead of speculating, we encourage all professional organizations to enhance the jointprocess of finding a solution, since strong international collaboration will remain to play a keyrole, the research team said on the CrySyS website.

According to Reuters, last week investigators seizedthe computer equipment from a data center in India believed to be linked to the Duqu malware. 

Next generation SIEM could boost network visibility, but platforms must scale, experts say

Enterprises have been using security information and event management (SIEM) systems mainly forcompliance reporting to meet PCI DSS and other mandates, but infrastructure vendors are trying todevelop a new breed of more powerfulSIEM platforms that can enable IT teams to apply analytics to system data.

There is a fundamental change that is occurring in the security world where focus is moving fromindividual point products solving a particular job to something more expansive.

Brendan Hannigan, general manager, Security Systems Division, IBM 

Growing networks have created a larger attack surface for cybercriminals, and while early SIEMdeployments could collect logs from a few appliances, they have grown to support a vast arrayof network devices, said John Kindervag, principal analyst at Cambridge, Mass.-based ForresterResearch Inc. While vendors are betting on more robust SIEMplatforms, whether or not enterprises have the money and expertise to do the kind of powerful eventcorrelation needed to understand the threats on the network is still anyones guess, Kindervagsaid. 

According to a Forrester survey of IT decision makers at 157 organizations, the primary use casein more than 80% of SIEM deployments is for reporting capabilities for compliance mandates. Fewerthan 40% of respondents said their organizations use the technologys event correlationcapabilities.

SIM is a reporting tool driven by PCI compliance and it wouldnt exist if PCI hadnt come out,Kindervag said. People get enamored by event correlation, but thats just not how it works in realworld deployments.

The survey, conducted on behalf of San Jose, Calif.-based log management vendor LogLogic Inc.,found reports generated by the systems are currently serving IT auditors, the CIO and other C-levelexecutives. But the survey report concludes that SIM will become the foundation for comprehensiveIT data analytics.

Brendan Hannigan, CEO of Q1 Labs, is betting his firms customers will want to get more out oftheir SIEM deployment. Hannigan, whose firm was acquiredby IBM recently, is going to lead a new division that brings together all of IBMs securityofferings. With Q1s SIEM platform as the foundation, IBM plans to tie together its databasesecurity, endpoint management, network security and application security offerings and bolster themwith analytics capabilities to get more actionable data out of those systems.

There is a fundamental change that is occurring in the security world where focus is movingfrom individual point products solving a particular job to something more expansive, Hannigansaid.

Firewalls, IPS appliances and database and application servers generate heaps of data that canhelp organizations better understand the threats to their network and ultimately give CISOs theability to make wiser security decisions. Its the need for a more powerful analytical engine toget value out of all that data that is driving large infrastructure vendors such as IBM and HP toacquire SIEM systems, according to analysts.

HP is so bullish on the technology that it shelled out $1.5 billion for ArcSight in 2010,arguably the leader in the space. RSA, the security division of EMC Corp., is merging its EnVisionSIEM system with its newly acquired NetWitness network monitoring platform, which adds networkcontext and analytics to SIEM data.

Analysts agree that many of the early SIM vendors may not be able to handle the processing powerneeded to apply analytics to different data sources. Scalability is turning out to be the one ofthe most important capabilities of SIEM systems, said Mark Nicolett, vice president anddistinguished analyst at Gartner Inc. SIEMplatforms that can support heterogeneous event sources on a broad scale have a betterlikelihood of maintaining a strong market presence, Nicolette said.

Gartner believes SIEM systems should be able to efficiently collect logs andhave real-time monitoring capabilities. If a vendor doesnt have both theyll end up onlybeing marginal in the market, he said.

I dont think the possibility of a singular data repository that collects all relevantinformation critical to security analysis is ever going to exist.

Amit Yoran, senior vice president and general manager, Security Management and ComplianceBusiness, RSA, The Security Division of EMC.

SIEM systems are good at collecting data, but they need tools that help analysts manipulate thedata to uncover various aspects of an incident or find anomalies that raise concern said AmitYoran, senior vice president and general manager of security management and compliance business atRSA, The Security Division of EMC.

With complex attacks and advanced threat actors, your current assessment cant be limited tojust the traffic you are seeing at this moment, Yoran said. An action may not set off alarm bellswhen it is isolated on its own, but when you have it in context, it gets a lot moreinteresting.

The former NetWitness CEO is overseeing the integration of the technology into the RSA EnVisionSIEM platform. EnVision, Yoran said, really shined in efficiently retaining large amounts of dataand also from understanding diverse logging formats and protocols. At the same time, Yoran said heis practical about how powerful a SIEM system can be to an organization.

I dont think the possibility of a singular data repository that collects all relevantinformation critical to security analysis is ever going to exist, Yoran said. Thisone-size-fits-all, build something large, doesnt seem to be a practical way for large enterprisesto operate.

Enterprises may start off with compliance mandates in mind, but if there is a choice betweenbuying a SIEM system only strong in log management or a system designed for log management andreal-time monitoring, most organizations will see value in the monitoring unless there is a hugepremium on the price.  Nicollete said he is watching HP ArcSight closely, since HP has leftArcSights core development teams intact, enabling the SIEM vendor to quickly come to market withnew features. Under HP, ArcSighthas done a better job of supporting large deployments, he said.

Tom Reilly, vice president of HP enterprise security and the former CEO of ArcSight said SIEMshould be the integration platform of an enterprises security program. Like RSA and IBM, HP isalso developing tools that give enterprise a better look at network threats by ramping upanalytical capabilities in ArcSights SIEM platform. Its all about network awareness, he said.

If you believe in the tenet that every company has to move to gain security visibility, theyall need to invest in SIM, Reilly said. I hear those complaints around complexity and cost, but Ihear more about successful implementations; better time to value, prebuilt integration and ease ofuse.

HP is striving to make IPS and log collection an out-of-the-box experience, Reilly said. Thegoal is to target companies with limited IT staff and expertise by providing prebuilt interfacesfor integration, he said.

Having out-of-the-box capabilities drove McAfee to acquire NitroSecurity this month and beginmerging the NitroView family of products into the ePolicy Orchestrator suite. McAfee had a closerelationship with NitroSecurity and saw its proprietary database, which provides correlation andprofiling capabilities, as a strong differentiator to other SIEM vendors, said Martin Ward, seniordirector of risk and compliance at McAfee.

Speed with NitroSecurity is over the top, Ward said. Reports that are being run by existingSIEM vendors can take hours and hours, whereas Nitro can do it in minutes.

The future of SIM appears to be data warehousing technology with powerful analytical tools thathelp IT teams crunch a massive amount of data, said Forresters Kindervag.

Its really about making better decisions based on facts, not conjecture, Kindervag said. IfIT departments can take actionable data out of their systems and put it to use, we could see moredecisions that align with the business side and address threats based on their risk impact.

WikiLeaks Founder Loses Appeal in Extradition Hearing

Julian Assange and his lawyer Jennifer Robinson arrive for his extradition hearing at Belmarsh Magistrates' Court in London earlier this year. Matt Dunham/AP

WikiLeaks founder Julian Assange must return to Sweden to face sex-crime allegations in that country, according to an appeals court in the United Kingdom that ruled on his extradition case Wednesday.

Assange was appealing a lower court ruling last February. He will not be immediately extradited, however, and will remain in the UK at least until later this month when he will learn if he can appeal to the Supreme Court.

Assange has not yet been charged with any crimes but is being sought for questioning in Sweden on rape and coercion allegations stemming from sexual relations he had with two women in that country in August 2010. One woman has claimed that Assange pinned her down to have sex with her and intentionally tore a condom he wore. The second woman claims that he had sex with her while she was initially asleep, failing to wear a condom despite repeated requests for him to do so. Assange has disputed their claims.

Assange was arrested in Britain last December, just nine days after WikiLeaks began publishing from its cache of more than 250,000 leaked U.S. State Department diplomatic cables, which were trickling out at a rate of about a hundred a day. Nine days after that, Assange was released from jail on $300,000 bond.

Assange has denied any wrongdoing, asserting that the sex in both cases was consensual.

In its 43-page ruling (.pdf), however, the high court notes that in the case of the second woman, “it is difficult to see how a person could reasonably have believed in consent if the complainant alleges a state of sleep or half-sleep” and that given that the woman had insisted on Assange wearing a condom, “consent would not have been given without a condom.”

Assange has been living under house arrest in the large country estate of Vaughan Smith, whom The Guardian has described as “a former army officer, journalist adventurer and right-wing libertarian.” After the court’s earlier ruling, Assange was allowed to remain free on bond, reporting to police every evening in person and honoring a curfew, while he awaited the outcome of his appeal.

Defense attorneys have claimed that Assange would not get a fair trial in Sweden, because rape trials in that country are sometimes held behind closed doors. They have also argued that Assange could somehow find himself extradited to the United States, where, they theorize, he could face execution for leaking secrets.

In the initial ruling earlier this year, Judge Howard Riddle avoided addressing the larger ramifications of the Assange situation and focused on the defendant’s ability to withstand proceedings in Sweden.

“I have specifically considered whether the physical or mental condition of the defendant is such that it would be unjust or oppressive to extradite him,” Riddle told London’s top-security Belmarsh Magistrates’ Court. “I am satisfied that extradition is compatible with the defendant’s [European] Convention rights; I must order Mr. Assange be extradited to Sweden.”

Copyright Troll Righthaven Teetering on the Brink

A Nevada federal court slapped copyright troll Righthaven with a $63,700 legal-fee tab, and said the U.S. Marshal Service “is authorized to use reasonable force in the execution of this judgement.”

The Tuesday evening order (.pdf) is the latest indication that Righthaven, formed last year with the idea of suing blogs and websites that re-post newspaper articles without permission, is on the brink of shuttering.

Righthaven has vowed to appeal the order requiring it to pay the legal fees in a lawsuit it lost, in which a judge said re-posting an entire article to a message board is fair use. Yet Righthaven missed the deadline last week to lodge its opening brief before the 9th U.S. Circuit Court of Appeals challenging the fee award and fair-use decision.

A clerk for the U.S. District Court of Nevada, meanwhile, signed a so-called writ of execution demanding the litigation factory pay defendant Wayne Hoehn $34,000 in legal fees plus accrued costs for successfully defending himself against Righthaven’s copyright lawsuit. Righthaven asked for a stay, saying it might slip into bankruptcy if forced to pay.

Instead, the court tacked on interest and additional fees — bringing the total to $63,700.

Marc Randazza, Hoehn’s attorney, asked the court to “authorize the U.S. Marshals to execute Hoehns judgment through seizure of Righthavens bank accounts, real and personal property, and intangible intellectual property rights for levy, lien, auction or other treatment appropriate for satisfaction of Hoehns judgment.” (.pdf)

“We do intend to use this, and any resources that we can bring to bear, in order to finally receive justice for our client,” Randazza said in an e-mail. “We certainly do not feel badly about how this might affect them.”

Struggling after several courtroom setbacks, Righthaven has ceased filing new lawsuits pending resolution of the Hoehn case and others on appeal. Righthaven was also hit with an order last week to pay $120,000 in legal fees in another case it had lost. And its opening briefs on its other two appellate cases are due next week.

Righthaven initially was winning and settling dozens of cases as defendants paid a few thousand dollars each to make the cases go away. But Righthaven has never prevailed in a case that was defended in court. Its sole remaining client is the Las Vegas-Review Journal, the flagship paper of Stephens Media. MediaNews Group of Denver, which owns the Denver Post, dropped Righthaven in September.

The U.S. Copyright Act allows damages of up to $150,000 per infringement, but also grants legal fees and costs to the “prevailing party” in lawsuits. More fee awards against Righthaven are expected.

Steve Gibson, Righthaven’s chief executive, did not immediately respond for comment.

Illustration: Vectorportal/Flickr

Feds Drop Plan to Lie in Public-Record Act Requests

Bowing to political pressure, the Justice Department abruptly dropped proposed revisions to Freedom of Information Act rules Thursday that would have authorized the government to inform the public that requested records do not exist even if they do.

The proposal would have granted the government a new option to state that documents relevant to a FOIA request did not exist. According to the Justice Departments proposal, if the government believes records should be withheld, the government agency to which the request was made “will respond to the request as if the excluded records did not exist.”

Under normal practice, which seems Orwellian enough, the government may assert that it can neither confirm nor deny that relevant records exist if the matter involves national security.

Civil rights groups, and a host of lawmakers from both sides of the spectrum, had blasted the Justice Department’s original proposal.

“For five decades, the Freedom of Information Act has given life to the American value that in an open society, it is essential to carefully balance the public’s right to know and government’s need to keep some information secret,” said Senate Judiciary Chairman Patrick Leahy (D-Vermont.) “The Justice Department’s decision to withdraw this proposal acknowledges and honors that careful balance, and will help ensure that the American people have confidence in the process for seeking information from their government.”

The American Civil Liberties Union, OpentheGovernment.org and Citizens for Responsibility and Ethics in Washington lobbied against the proposal, which the Justice Department said Thursday “falls short” in balancing openness with national security.

“Putting an end to lies about the mere existence of documents is one step toward restoring Americans’ trust in their government,” said Laura W. Murphy, the ACLU’s Washington, D.C. legislative director.

Still, the government has embraced lying even without FOIA being altered. And judges aren’t very tough on the government when it does lie in FOIA cases.

Last month, for example, a federal judge decided not to hold the CIA in contempt for destroying videotapes of detainee interrogations that included the use of a torture technique known as waterboarding, ruling instead that the spy agency merely committed “transgressions” for its failure to abide by his court order to produce them in a FOIA case brought by the ACLU.

Photo: Leonieke Aalders/Flickr

Teen Murderer Undone by World of Warcraft Confession and Trail of Digital Evidence

When Kruse Wellwood, a 16-year-old in British Columbia, raped and murdered a classmate who jilted him, he attempted to set up a digital alibi by sending an instant message to the missing girl asking why she never showed up to meet him.

But the disturbed teen, ironically the son of a convicted murderer who’s serving a life sentence for murdering a different 16-year-old girl, left loads of other digital evidence pointing to his crime – including a text message he sent from the site where he and a teen accomplice dumped the body of their victim, Kim Proctor.

Investigators with the local Tech Crimes Unit amassed the equivalent of 1.4 billion sheets of paper evidence, including a printout of an instant message Kruse sent a friend after he and his accomplice raped and tortured Proctor and stuffed her body into a freezer in Kruse’s garage. The friend messaged Kruse while he was in the midst of the crime, and Kruse took a while to respond, annoying his friend. When Kruse finally replied, he apologized for the delay, writing, Sorry, the freezer was jumping around.

He later confessed to murdering Proctor in a World of Warcraft chat session.

With Kims death consuming the town and the local news, Kruse became increasingly paranoid about leaving any more evidence online. But he couldnt resist the urge to share his story with someone he trusted. He was afraid of using MSN, but he thought the chat logs in World of Warcraft were less likely to be saved. On March 23, five days after Kims murder, he told his gamer girlfriend in Halifax on MSN that he had something urgent to tell her, but that he wanted to do it over World of Warcraft chat instead. Once inside World of Warcraft, he confessed to the crime. Back on MSN, he sent her links to the news reports as backup. The girl was shocked, but she eventually replied in the way he no doubt expected. Ill always be here, no matter what you do, she wrote.

Wellwood and his accomplice pleaded guilty to first-degree murder and indignity to human remains and were sentenced to life imprisonment with no possibility of parole for 10 years.

Vanity Fair has the complete account of the sad, sordid tale.

Feds Use of Fake Cell Tower: Did it Constitute a Search?

Federal authorities used a fake Verizon cellphone tower to zero in on a suspect’s wireless card, and say they were perfectly within their rights to do so, even without a warrant.

But the feds don’t seem to want that legal logic challenged in court by the alleged identity thief they nabbed using the spoofing device, known generically as a stingray. So the government is telling a court for the first time that spoofing a legitimate wireless tower in order to conduct surveillance could be considered a search under the Fourth Amendment in this particular case, and that its use was legal, thanks to a court order and warrant that investigators used to get similar location data from Verizon’s own towers.

The government is likely using the argument to avoid a court showdown that might reveal how stingrays work and open debate into the tool’s legality.

Stingrays spoof a legitimate cellphone tower in order to trick nearby cellphones and other wireless communication devices into connecting to the tower, as they would to a real cellphone tower. When devices connect, stingrays can see and record their unique ID numbers and traffic data, as well as information that points to a device’s location. To prevent detection by suspects, the stingray sends the data to a real tower so that traffic continues to flow.

By gathering the wireless device’s signal strength from various locations, authorities can pinpoint where the device is being used with much more precision than they can get through data obtained from the mobile network provider’s fixed tower location.

According to an affidavit submitted to the court (.pdf) by the chief of the FBI’s Tracking Technology Unit, the stingray is designed to capture only the equivalent of header information — such as the phone or account number assigned to the aircard as well as dialing, routing and address information involved in the communication. As such, the government has maintained that the device is the equivalent of devices designed to capture routing and header data on e-mail and other internet communications, and therefore does not require a search warrant.

The device, however, doesn’t just capture information related to a targeted phone. It captures data from “all wireless devices in the immediate area of the FBI device that subscribe to a particular provider” — including data of innocent people who are not the target of the investigation, according to the affidavit. FBI policy requires agents purge all data stored in the surveillance tool at the conclusion of an operation, so that the FBI is not collecting “information about individuals who are not the subject of criminal or national security investigations,” the affidavit added.

The device in this case was used to track an aircard allegedly used by Daniel David Rigmaiden, a 30-year-old self-described hacker suspected of being the ringleader of an identity theft group that stole millions of dollars by filing bogus tax returns under the names and Social Security numbers of other people.

The thieves operated their scheme for at least three years from January 2005 to April 2008, allegedly filing more than 1,900 fraudulent tax returns involving about $4 million in refunds. The conspirators used more than 175 different IP addresses around the U.S. to file the fake returns.

According to court documents, authorities used a variety of other avenues to track Rigmaiden, including obtaining video footage taken at a Verizon payment kiosk in San Francisco. This presumably was to help identify who had paid in person for an account belonging to a person named Travis Rupard — one of the identities Rigmaiden allegedly used during his crime spree.

Investigators used the stingray to trace the aircard to an apartment complex in Santa Clara, California, according to the FBI affidavit. Court documents indicate the device led investigators “to the general proximity of defendant’s usage of the aircard,” allowing authorities to narrow the air card’s location to three or four apartments in a residential complex.

Rigmaiden has been in custody since May 2008 and is representing himself at the U.S. District Court of Arizona, after dismissing multiple attorneys. The government’s assertion about the spy tool comes in response to a motion for discovery that Rigmaiden filed requesting, in part, details of how authorities tracked him.

The government has so far refused to provide information about how the device worked or the techniques they used to monitor the air card, calling such “sensitive investigative techniques” privileged information.

Until now, the U.S. government has asserted that the use of stingray devices does not violate Fourth Amendment rights, and Americans don’t have a legitimate expectation of privacy for data sent from their mobile phones and other wireless devices to a cell tower.

But authorities changed their tone in the Rigmaiden case after the defendant argued that using the device to locate a wireless aircard inside an apartment constituted a search, and therefore required a valid search warrant, which he asserts authorities didn’t have.

After the judge indicated he’d seek more information about the device, prosecutors conceded that in this case its use could be considered a search. They also argued that its use was covered by a court order and a warrant that authorities used to obtain near real-time tracking information directly from Verizon Wireless. A separate tracking warrant, prosecutors say, wasn’t necessary for its fake tower.

Despite the apparent shift in the government’s argument in this specific case, it still maintains that stingray devices do not violate American’s privacy, since the target doesn’t “have a reasonable expectation of privacy in his general location or in the cell site records he transmitted wirelessly to Verizon.”

The Metropolitan police in London have used similar technology which takes the surveillance a bit further, according to a recent story in the Guardian. The British device can be used to identify all mobile phones in a given area, capture and record the content of calls and remotely disable phones.

Photo: Keith Survell / Flickr

NetFlow analyzer improves security, network capacity management

An expanded wireless LAN caused network traffic at Fitchburg State University to explode. Toimprove network visibility and maintain network securitywith all the additional traffic, the network management team installeda NetFlow analyzer.

The networking team at the Massachusetts university selected Lancope StealthWatch as a NetFlowanalyzer, and set its Enterasys Networks routers to publish NetFlowrecords to the appliance. The school also installed multiple StealthWatch FlowSensors aroundcampus to gain visibility into infrastructure that does not natively support NetFlow. FlowSensor isan appliance that collects data from hosts and other devices on the network and converts it intoNetFlow data. A virtual edition installed on a virtual host can produce NetFlow records forindividual vitual machines.

We have sensors installed on all our virtual boxes and a sensor appliance that is mirroring outtraffic from our SAN, our server VLAN and our DMZ, said Tony Chila, the universitys networkmanager. Were able to dig deeper into that traffic and analyzer up to Layer 4 in the stack, sowere seeing basically a breakdown of all traffic on the network -- the particular services, portsused, locations and that type of information.

Expanded wireless LAN coverage was inevitable

Getting a better handle on network traffic became critical when Fitchburg went from having Wi-Fiin common areas and academic buildings to providing 100% wireless in all residence hall areas usinga campus-wide802.11n Enterasys network.

Our incoming students had never even seen an Ethernet cord, said Jamie Roger, the universitysdirector of auxiliary services. It became painfully apparent that this incoming generation expectswireless to be everywhere.

With the upgrade, students started connecting more than just their laptop to the network.Suddenly smartphones, tablets and gaming systems were also adding to the traffic onslaught, Rogersaid. As a result, a network that once had 3,000 to 3,500 devices connected at any one time was nowexceeding 7,000. Suddenly network capacity management was critical.

NetFlow analyzer helps with capacity management

The traffic visibility afforded by StealthWatch has streamlined the universitys approach tonetwork capacity management and has helped the school avoid a costly and unnecessary infrastructureupgrade.

The NetFlow analyzers daily dashboard reports opened up visibility into our network right upto the CIO level, Roger said. In the past, if we were reaching our bandwidth maximum, I wouldhave to go begging and pleading to get additional money to increase bandwidth. Now with all thisreporting going up to our CIO, he could see our bandwidth growth over the last several months andhe came to me and said, Hey, get a price on increasing bandwidth. It made my fight for funding awhole lot easier.

And when users at a remote building more than a mile off campus started complaining about thepoor performance of the 54 Mbps, site-to-site Wi-Fi connection that connected them to the maincampus, the IT organization was able to use the NetFlow analyzer to avoid a costly upgrade.

The university had been considering a new $500,000 fiber connection to correct the issue, butRoger and his staff used StealthWatch to establish that the point-to-point Wi-Fi link wasntsaturated, so they needed to do a little detective work. Ultimately they determined that trees wereinterrupting the signal of the wireless connection.

When you looked at the wireless connection it looked fine, Roger added. But depending on howthe wind blew, it affected the data.

The improved visibility has also helped the IT organization respondto service problems.

We can see total internal traffic broken down by protocol and application, Chila said. If wesee spikes with a large amount of traffic, we can drill into those areas and find out who isbasically utilizing this additional bandwidth.

That means no more placing blanket blame on the network.

This product allows us to see server response time, network response time, round-trip time andidentify where the latency is actually happening. I have a server group of two individuals, sochasing around problems that dont exist -- we just dont have time for that, Roger said.

NetFlow analyzer strengthens PCI compliance, roots out P2P traffic

The StealthWatch NetFlow analyzer has beefed up the universitys compliance efforts,particularly its policies against illicit, peer-to-peer (P2P)file sharing and its audits for the credit card industrys PCI DSS requirements.

More on NetFlow analyzers and network monitoring

If NetFlowv9 is so powerful, why arent more enterprises using it?

NetFlowanalyzers are now collecting native NetFlow and IPFix data from firewalls

NetFlowanalyzers can catch simple mistakes by IT staff

The school blocks all P2P traffic coming in or out of the campus at the Internet circuit via anHPTippingPoint intrusion protection system (IPS), Roger said. The NetFlow analyzer  givesnetwork managers a view into internal P2P traffic.

We have detected [internal P2P traffic] but were not currently acting on it, Roger said. Wehavent used the StealthWatch product to proactively do anything with P2P, other than try to get ahandle on how much its happening. Weve only had the product for five months.

The NetFlow analyzer also gives Fitchburg State an added layer of PCI compliance assurance,according to Chila.

We set up a trap [with StealthWatch] where if we see traffic that traverses to that [PCI]network from a subnet or device that is unauthorized, then we get alerted, Chila said.  Wehave access lists which clearly define who can get in and who cant. This is a way to monitor it,if for any reason someone is able to traverse those lines. It shouldnt happen and it hasnthappened.

 

Let us know what you think about the story; email: Shamus McGillicuddy, News Director.

 

Feds Use of Fake Cell Phone Tower Turns on Whether it Constituted a Search

Federal authorities used a fake Verizon cell phone tower to zero in on a suspect’s wireless card, and say they were perfectly within their rights to do so, even without a warrant.

But the feds don’t seem to want that legal logic challenged in court by the alleged identity thief they nabbed using the spoofing device, known generically as a stingray. So the government is telling a court for the first time that spoofing a legitimate wireless tower in order to conduct surveillance could be considered a search under the Fourth Amendment in this particular case, and that its use was legal, thanks to a court order and warrant that investigators used to get similar location data from Verizon’s own towers.

The government is likely using the argument to avoid a court showdown that might reveal how stingrays work and open debate into the tool’s legality.

Stingrays spoof a legitimate cell phone tower in order to trick nearby cell phones and other wireless communicated devices into connecting to the tower, as they would to a real cell phone tower. When devices connect, stingrays can see and record their unique ID numbers and traffic data, as well as information that points to a device’s location. To prevent detection by suspects, the stingray sends the data to a real tower so that traffic continues to flow.

By gathering the wireless device’s signal strength from various locations, authorities can pinpoint where the device is being used with much more precision than they can get through data obtained from the mobile network provider’s fixed tower location.

According to an affidavit submitted to the court (.pdf) by the chief of the FBI’s Tracking Technology Unit, the stingray is designed to capture only the equivalent of header information – such as the phone/account number assigned to the aircard as well as dialing, routing and address information involved in the communication. As such, the government has maintained that the device is the equivalent of devices designed to capture routing and header data on email and other internet communications, and therefore does not require a search warrant.

The device, however, doesn’t just capture information related to a targeted phone. It captures data from “all wireless devices in the immediate area of the FBI device that subscribe to a particular provider” – including data of innocent people who are not the target of the investigation, according to the affidavit. FBI policy requires agents purge all data stored in the surveillance tool at the conclusion of an operation, so that the FBI is not collecting “information about individuals who are not the subject of criminal or national security investigations,” the affidavit added.

The device in this case was used to track an aircard allegedly used by Daniel David Rigmaiden, a 30-year-old self-described hacker suspected of being the ringleader of an identity theft group that stole millions of dollars by filing bogus tax returns under the names and Social Security numbers of other people.

The thieves operated their scheme for at least three years from January 2005 to April 2008, allegedly filing more than 1,900 fraudulent tax returns involving about $4 million in refunds. The conspirators used more than 175 different IP addresses around the U.S. to file the fake returns.

According to court documents, authorities used a variety of other avenues to track Rigmaiden, including obtaining video footage taken at a Verizon payment kiosk in San Francisco. This presumably was to help identify who had paid in person for an account belonging to a person named Travis Rupard – one of the identities Rigmaiden allegedly used during his crime spree.

Investigators used the stingray to trace the aircard to an apartment complex in Santa Clara, California, according to the FBI affidavit. Court documents indicate the device led investigators “to the general proximity of defendant’s usage of the aircard,” allowing authorities to narrow the air card’s location to three or four apartments in a residential complex.

Rigmaiden has been in custody since May 2008 and is representing himself at the U.S. District Court of Arizona, after dismissing multiple attorneys. The government’s assertion about the spy tool comes in response to a motion for discovery that Rigmaiden filed requesting, in part, details of how authorities tracked him.

The government has so far refused to provide information about how the device worked or the techniques they used to monitor the air card, calling such “sensitive investigative techniques” privileged information.

Until now, the U.S. government has asserted that the use of stingray devices does not violate Fourth Amendment rights, and Americans don’t have a legitimate expectation of privacy for data sent from their mobile phones and other wireless devices to a cell tower.

But authorities changed their tone in the Rigmaiden case after the defendant argued that using the device to locate a wireless aircard inside an apartment constituted a search, and therefore required a valid search warrant, which he asserts authorities didn’t have.

After the judge indicated he’d seek more information about the device, prosecutors conceded that in this case its use could be considered a search. They also argued that its use was covered by a court order and a warrant that authorities used to obtain near real-time tracking information directly from Verizon Wireless. A separate tracking warrant, prosecutors say, wasn’t necessary for its fake tower.

Despite the apparent shift in the government’s argument in this specific case, it still maintains that stingray devices do not violate American’s privacy, since the target doesn’t “have a reasonable expectation of privacy in his general location or in the cell site records he transmitted wirelessly to Verizon.”

The Metropolitan police in London have used similar technology which takes the surveillance a bit further, according to a recent story in the Guardian. The British device can be used to identify all mobile phones in a given area, capture and record the content of calls and remotely disable phones.

Photo: Keith Survell / Flickr

Feds Drop Plan to Lie in Public-Record Act Requests

Bowing to political pressure, the Justice Department abruptly dropped proposed revisions to Freedom of Information Act rules Thursday that would have authorized the government to inform the public that requested records do not exist even if they do.

The proposal would have granted the government a new option to state that documents relevant to a FOIA request did not exist. According to Justice Departments proposal, if the government believes records should be withheld, the government agency to which the request was made “will respond to the request as if the excluded records did not exist.”

Under normal practice, which seems Orwellian enough, the government may assert that it can neither confirm nor deny that relevant records exist if the matter involves national security.

Civil rights groups, and a host of lawmakers from both sides of the spectrum, had blasted the Justice Department’s original proposal.

“For five decades, the Freedom of Information Act has given life to the American value that in an open society, it is essential to carefully balance the public’s right to know and government’s need to keep some information secret,” said Senate Judiciary Chairman Patrick Leahy (D-Vermont.) “The Justice Department’s decision to withdraw this proposal acknowledges and honors that careful balance, and will help ensure that the American people have confidence in the process for seeking information from their government.”

The American Civil Liberties Union, OpentheGovernment.org and Citizens for Responsibility and Ethics in Washington lobbied against the proposal, which the Justice Department said Thursday “falls short “in balancing openness with national security.

“Putting an end to lies about the mere existence of documents is one step toward restoring Americans’ trust in their government,” said Laura W. Murphy, the ACLU’s Washington, D.C., legislative director.

Still, the government has embraced lying even without FOIA being altered. And judges aren’t very tough on the government when it does lie in FOIA cases.

Last month, for example, a federal judge decided not to hold the CIA in contempt for destroying videotapes of detainee interrogations that included the use of a torture technique known as waterboarding, ruling instead that the spy agency merely committed “transgressions” for its failure to abide by his court order to produce them in a FOIA case brought by the ACLU.

Photo: Leonieke Aalders/Flickr

Teen Murderer Undone by World of Warcraft Confession and Trail of Digital Evidence

When Kruse Wellwood, a 16-year-old in British Columbia, raped and murdered a classmate who jilted him, he attempted to set up a digital alibi by texting the missing girl asking why she never showed up to meet him.

But the disturbed teen, ironically the son of a convicted murderer who’s serving a life sentence for murdering a different 16-year-old girl, left loads of other digital evidence pointing to his crime – including a text message he sent from the site where he and a teen accomplice dumped the body of their victim, Kim Proctor.

Investigators with the local Tech Crimes Unit amassed the equivalent of 1.4 billion sheets of paper evidence, including a printout of an instant message Kruse sent a friend after he and his accomplice raped and tortured Proctor and stuffed her body into a freezer in Kruse’s garage. The friend messaged Kruse while he was in the midst of the crime, and Kruse took a while to respond, annoying his friend. When Kruse finally replied, he apologized for the delay, writing, Sorry, the freezer was jumping around.

He later confessed to murdering Proctor in a World of Warcraft chat session.

With Kims death consuming the town and the local news, Kruse became increasingly paranoid about leaving any more evidence online. But he couldnt resist the urge to share his story with someone he trusted. He was afraid of using MSN, but he thought the chat logs in World of Warcraft were less likely to be saved. On March 23, five days after Kims murder, he told his gamer girlfriend in Halifax on MSN that he had something urgent to tell her, but that he wanted to do it over World of Warcraft chat instead. Once inside World of Warcraft, he confessed to the crime. Back on MSN, he sent her links to the news reports as backup. The girl was shocked, but she eventually replied in the way he no doubt expected. Ill always be here, no matter what you do, she wrote.

Wellwood and his accomplice pleaded guilty to first-degree murder and indignity to human remains and were sentenced to life imprisonment with no possibility of parole for 10 years.

Vanity Fair has the complete account of the sad, sordid tale.

Copyright Troll Righthaven Teetering on the Brink

A Nevada federal court slapped copyright troll Righthaven with a $63,700 legal-fee tab, and said the U.S. Marshal Service “is authorized to use reasonable force in the execution of this judgement.”

The Tuesday evening order (.pdf) is the latest indication that Righthaven, formed last year with the idea of suing blogs and websites that re-post newspaper articles without permission, is on the brink of shuttering.

Righthaven has vowed to appeal the order requiring it to pay the legal fees in a lawsuit it lost, in which a judge said re-posting an entire article to a message board is fair use. Yet Righthaven missed the deadline last week to lodge its opening brief before the 9th U.S. Circuit Court of Appeals challenging the fee award and fair-use decision.

A clerk for the U.S. District Court of Nevada, meanwhile, signed a so-called writ of execution demanding the litigation factory pay defendant Wayne Hoehn $34,000 in legal fees plus accrued costs for successfully defending himself against Righthaven copyright’s lawsuit. Righthaven asked for a stay, saying it might slip into bankruptcy if forced to pay.

Instead, the court tacked on interest and additional fees — bringing the total to $63,700.

Marc Randazza, Hoehn’s attorney, asked the court to “authorize the U.S. Marshals to execute Hoehns judgment through seizure of Righthavens bank accounts, real and personal property, and intangible intellectual property rights for levy, lien, auction or other treatment appropriate for satisfaction of Hoehns judgment.” (.pdf)

“We do intend to use this, and any resources that we can bring to bear, in order to finally receive justice for our client,” Randazza said in an e-mail. “We certainly do not feel badly about how this might affect them.”

Struggling after several courtroom setbacks, Righthaven has ceased filing new lawsuits pending resolution of the Hoehn case and others on appeal. Righthaven was also hit with an order last week to pay $120,000 in legal fees in another case it had lost. And its opening briefs on its other two appellate cases are due next week.

Righthaven initially was winning and settling dozens of cases as defendants paid a few thousand dollars each to make the cases go away. But Rigthaven has never prevailed in a case that was defended in court. Its sole remaining client is the Las Vegas-Review Journal, the flagship paper of Stephens Media. MediaNews Group of Denver, which owns the Denver Post, dropped Righthaven in September.

The U.S. Copyright Act allows damages of up to $150,000 per infringement, but also grants legal fees and costs to the “prevailing party” in lawsuits. More fee awards against Righthaven are expected.

Steve Gibson, Righthaven’s chief executive, did not immediately respond for comment.

Illustration: Vectorportal/Flickr

WikiLeaks Founder Loses Appeal in Extradition Hearing

Julian Assange and his lawyer Jennifer Robinson arrive for his extradition hearing at Belmarsh Magistrates' Court in London earlier this year. Matt Dunham/AP

WikiLeaks founder Julian Assange must return to Sweden to face sex-crime allegations in that country, according to an appeals court in the United Kingdom that ruled on his expedition case Wednesday.

Assange was appealing a lower court ruling last February that ordered him to be extradited to Sweden. He will not be immediately extradited, however, and will remain in the UK at least until later this month when he will learn if he can appeal to the Supreme Court.

Assange has not yet been charged with any crimes but is being sought for questioning in Sweden on rape and coercion allegations stemming from sexual relations he had with two women in that country in August 2010. One woman has claimed that Assange pinned her down to have sex with her and intentionally tore a condom he wore. The second woman claims that he had sex with her while she was initially asleep, failing to wear a condom despite repeated requests for him to do so. Assange has disputed their claims.

Assange was arrested in Britain last December, just nine days after WikiLeaks began publishing from its cache of more than 250,000 leaked U.S. State Department diplomatic cables, which were trickling out at a rate of about a hundred a day. Nine days after that, Assange was released from jail on $300,000 bond.

Assange has denied any wrongdoing, asserting that the sex in both cases was consensual.

In its 43-page ruling (.pdf), however, the high court notes that in the case of the second woman, “it is difficult to see how a person could reasonably have believed in consent if the complainant alleges a state of sleep or half-sleep” and that given that the woman had insisted on Assange wearing a condom, “consent would not have been given without a condom.”

Assange has been living under house arrest in the large country estate of Vaughan Smith, whom The Guardian has described as “a former army officer, journalist adventurer and right-wing libertarian.” After the court’s earlier ruling, Assange was allowed to remain free on bond, reporting to police every evening in person and honoring a curfew, while he awaited the outcome of his appeal.

Defense attorneys have claimed that Assange would not get a fair trial in Sweden, because rape trials in that country are sometimes held behind closed doors. They have also argued that Assange could somehow find himself extradited to the United States, where, they theorize, he could face execution for leaking secrets.

In the initial ruling earlier this year, Judge Howard Riddle avoided addressing the larger ramifications of the Assange situation and focused on the defendant’s ability to withstand proceedings in Sweden.

“I have specifically considered whether the physical or mental condition of the defendant is such that it would be unjust or oppressive to extradite him,” Riddle told London’s top-security Belmarsh Magistrates’ Court. “I am satisfied that extradition is compatible with the defendant’s [European] Convention rights; I must order Mr. Assange be extradited to Sweden.”

Occupy Round Up: Oakland General Strike, Virginia Bulldozers, and Court Victory

Occupy Oakland re-occupied their original sites after being evicted last Tuesday, and at this General Assembly that day, they voted for a Nov. 2 general strike in Oakland.

Occupy Oakland, now completely re-established in its original plaza as well as nearby Snow Park, has called for a general strike for Wednesday, Nov. 2nd in Oakland.

Occupy’s General Assembly, a meeting open to all that requires consensus for decisions, approved the call last Wednesday, the day after the now infamous Occupy Oakland eviction that lead to the use of tear gas and rubber bullets on protestors, resulting in a critical head injury of Marine vet Scott Olsen. According to the occupation’s website, the strike passed after around 1,600 people voted during the GA. Since then, the general strike has been endorsed to various degrees by teacher’s associations in Berkeley and Oakland, and SEIU Local 1021, among others.

Perhaps the most intriguing response to the strike comes from theOakland Police in an open letter to the people of Oakland. The Oakland Police Officers’ Association (OPOA) letter expresses with the Mayor’s office for ordering the eviction last Tuesday, then allowing the occupation back in the next day.

The letter pointed out that the reversal meant that the $1,000,000 police operationserved no purpose at all — except spawningan investigation of OPD, as well as making Oakland the object of national and international criticism. The Association also notes that the city is giving most city employees the day off to support the strike, while requiring all of the PD to work that day, ostensibly to police the march. In addition to being confused, the police are obviously angry at Mayor Quan and feel that they are being blamed for her office’s political mistakes. How this plays out for tomorrow’s general strike is unpredictable.

Meanwhile, evictions and actions continue around the country. Police cleared theOccupy Richmond in Virginia with bulldozers and dump trucks,resulting in nine arrests on Monday morning. One of the occupiers gave a detailed first person account of negotiating with police to remove camp materials before the trucks were brought in.

On Saturday, police arrested 15 Occupy Denver protestors, and used pepper balls and mace on the crowd in response to occupiers setting up tents in the state capitol/civic center area of Denver. Snow and subzero temperatures are already hitting Denver, but the occupiers have promised to stay despite the weather.

In Tennessee, police began arresting Occupy Nashville protesters on Thursday last week, only to see them return every day to be arrested again. Now the ACLU has obtained a restraining order against police, forbidding them to keep arresting Occupy Nashville participants who defy the recently created curfew on Legislative Plaza in Nashville. The judge called the curfew a “clear prior restraint on free speech rights,” putting the act of occupying on well-tested First Amendment grounds.

To date, all occupations have returned after eviction, generally holding a General Assembly within 24 hours.

The #occupywallstreet movement as a whole has gotten behind the idea of “Bank Transfer Day,” which calls for people to close their accounts at for-profitcommercialbanks and transfer to credit unions by November 5th, Guy Fawkesday. Now one credit union, Trumark, is capitalizing on the action, offering transfer customers a $50 gift certificate if they open their account by Saturday. They’ve gone so far as to put the iconic Guy Fawkes mask on their front page.

Photo: Quinn Norton/Wired

Supreme Court Plays Hooky, Leaves Student Online Free Speech Rights Murky

The U.S. Supreme Court is declining to review a former Connecticut high-school student’s punishment for calling the school’s administrators “douchebags” on her LiveJournal blog.

Thehigh court’s inaction Monday means the justices have never squarely addressed the parameters of off-campus, online student speech. So far, lower courts appear to be guided by a 1969 high court ruling saying student expression may not be suppressed unless school officials reasonably conclude that it will “materially and substantially disrupt the work and discipline of the school.”

In that landmark case, the Supreme Court said students had a First Amendment right to wear black armbands to protest the Vietnam War. But that precedent, which addressed on-campus speech, is now being applied to students’ online, off-campus speech four decades later.

The case the justices rejected concerned a Connecticutschool district’s discipline of banning a then high-school junior from running for school office because of the 2007 vulgar blog post.

Dozens of similar cases across the nation have had varying results.

One case the lower courts decided last year went against a 14-year-old Pennsylvania junior high student, who was suspended for 10 days in 2007. She mocked her principal with a fake MySpace profile that insinuated the principal was a sex addict and pedophile.

Another case last year favored student speech of a Pennsylvania senior, who was suspended 10 days after creating a mock MySpace profile of his principal.

The profile said the principal took drugs and kept beer at his desk. The courts ruled the fake profile did not create a “substantial disruption” at school.

Thousands Petition Obama to Block E-Parasites Act

Net users angry at the introduction of the Stop Online Piracy Act, also known as the “E-Parasites Act,” are attempting to force the White House to oppose the bill, which would boost the governments authority to disrupt and shutter alleged trademark- and copyright-infringingwebsites.

And by the early results, it looks like they might at least force the administration to respond.

The petitioners are taking advantage of the newly created White House petition site, which promises Americans it will respond to grievances if the government gets 25,000 signatures in a month’s time. Though it was created only Monday, the petition has been signed by more than 4,400 citizens as of Tuesday morning Pacific Standard Time. The “Stop the E-Parasites Act” petition has until Nov. 30. to get the necessary support.

The petition says, “This Bill would allow essentially allow (sic) A great Firewall of America and would be a shameful desecration of free speech and any sort of reasonable copyright law.”

The legislation at issue was introduced last week by Rep. Lamar Smith (R-Texas). The measure grants private parties the right to cut off ad dollars to sites they say host pirated or trademarked content. Among other things, it also empowers the government to order search engines and ISPs to make it impossible for users to reach blacklisted sites.

But it’s unclear how honestly the administration would respond if the necessary signatures are gathered. The White House has come under attack for issuing bland and canned responses to petitions.

There’s even a different petition that expires Nov. 27 asking the administration to “Actually take these petitions seriously instead of just using them as an excuse to pretend you are listening.”

Smith’s bill is slated to be heard in the House Judiciary Committee on Nov. 16.

Next generation SIEM could boost network visibility, but platforms must scale, experts say

Enterprises have been using security information and event management (SIEM) systems mainly forcompliance reporting to meet PCI DSS and other mandates, but infrastructure vendors are trying todevelop a new breed of more powerfulSIEM platforms that can enable IT teams to apply analytics to system data.

There is a fundamental change that is occurring in the security world where focus is moving fromindividual point products solving a particular job to something more expansive.

Brendan Hannigan, general manager, Security Systems Division, IBM 

Growing networks have created a larger attack surface for cybercriminals, and while early SIEMdeployments could collect logs from a few appliances, they have grown to support a vast arrayof network devices, said John Kindervag, principal analyst at Cambridge, Mass.-based ForresterResearch Inc. While vendors are betting on more robust SIEMplatforms, whether or not enterprises have the money and expertise to do the kind of powerful eventcorrelation needed to understand the threats on the network is still anyones guess, Kindervagsaid. 

According to a Forrester survey of IT decision makers at 157 organizations, the primary use casein more than 80% of SIEM deployments is for reporting capabilities for compliance mandates. Fewerthan 40% of respondents said their organizations use the technologys event correlationcapabilities.

SIM is a reporting tool driven by PCI compliance and it wouldnt exist if PCI hadnt come out,Kindervag said. People get enamored by event correlation, but thats just not how it works in realworld deployments.

The survey, conducted on behalf of San Jose, Calif.-based log management vendor LogLogic Inc.,found reports generated by the systems are currently serving IT auditors, the CIO and other C-levelexecutives. But the survey report concludes that SIM will become the foundation for comprehensiveIT data analytics.

Brendan Hannigan, CEO of Q1 Labs, is betting his firms customers will want to get more out oftheir SIEM deployment. Hannigan, whose firm was acquiredby IBM recently, is going to lead a new division that brings together all of IBMs securityofferings. With Q1s SIEM platform as the foundation, IBM plans to tie together its databasesecurity, endpoint management, network security and application security offerings and bolster themwith analytics capabilities to get more actionable data out of those systems.

There is a fundamental change that is occurring in the security world where focus is movingfrom individual point products solving a particular job to something more expansive, Hannigansaid.

Firewalls, IPS appliances and database and application servers generate heaps of data that canhelp organizations better understand the threats to their network and ultimately give CISOs theability to make wiser security decisions. Its the need for a more powerful analytical engine toget value out of all that data that is driving large infrastructure vendors such as IBM and HP toacquire SIEM systems, according to analysts.

HP is so bullish on the technology that it shelled out $1.5 billion for ArcSight in 2010,arguably the leader in the space. RSA, the security division of EMC Corp., is merging its EnVisionSIEM system with its newly acquired NetWitness network monitoring platform, which adds networkcontext and analytics to SIEM data.

Analysts agree that many of the early SIM vendors may not be able to handle the processing powerneeded to apply analytics to different data sources. Scalability is turning out to be the one ofthe most important capabilities of SIEM systems, said Mark Nicolett, vice president anddistinguished analyst at Gartner Inc. SIEMplatforms that can support heterogeneous event sources on a broad scale have a betterlikelihood of maintaining a strong market presence, Nicolette said.

Gartner believes SIEM systems should be able to efficiently collect logs andhave real-time monitoring capabilities. If a vendor doesnt have both theyll end up onlybeing marginal in the market, he said.

I dont think the possibility of a singular data repository that collects all relevantinformation critical to security analysis is ever going to exist.

Amit Yoran, senior vice president and general manager, Security Management and ComplianceBusiness, RSA, The Security Division of EMC.

SIEM systems are good at collecting data, but they need tools that help analysts manipulate thedata to uncover various aspects of an incident or find anomalies that raise concern said AmitYoran, senior vice president and general manager of security management and compliance business atRSA, The Security Division of EMC.

With complex attacks and advanced threat actors, your current assessment cant be limited tojust the traffic you are seeing at this moment, Yoran said. An action may not set off alarm bellswhen it is isolated on its own, but when you have it in context, it gets a lot moreinteresting.

The former NetWitness CEO is overseeing the integration of the technology into the RSA EnVisionSIEM platform. EnVision, Yoran said, really shined in efficiently retaining large amounts of dataand also from understanding diverse logging formats and protocols. At the same time, Yoran said heis practical about how powerful a SIEM system can be to an organization.

I dont think the possibility of a singular data repository that collects all relevantinformation critical to security analysis is ever going to exist, Yoran said. Thisone-size-fits-all, build something large, doesnt seem to be a practical way for large enterprisesto operate.

Enterprises may start off with compliance mandates in mind, but if there is a choice betweenbuying a SIEM system only strong in log management or a system designed for log management andreal-time monitoring, most organizations will see value in the monitoring unless there is a hugepremium on the price.  Nicollete said he is watching HP ArcSight closely, since HP has leftArcSights core development teams intact, enabling the SIEM vendor to quickly come to market withnew features. Under HP, ArcSighthas done a better job of supporting large deployments, he said.

Tom Reilly, vice president of HP enterprise security and the former CEO of ArcSight said SIEMshould be the integration platform of an enterprises security program. Like RSA and IBM, HP isalso developing tools that give enterprise a better look at network threats by ramping upanalytical capabilities in ArcSights SIEM platform. Its all about network awareness, he said.

If you believe in the tenet that every company has to move to gain security visibility, theyall need to invest in SIM, Reilly said. I hear those complaints around complexity and cost, but Ihear more about successful implementations; better time to value, prebuilt integration and ease ofuse.

HP is striving to make IPS and log collection an out-of-the-box experience, Reilly said. Thegoal is to target companies with limited IT staff and expertise by providing prebuilt interfacesfor integration, he said.

Having out-of-the-box capabilities drove McAfee to acquire NitroSecurity this month and beginmerging the NitroView family of products into the ePolicy Orchestrator suite. McAfee had a closerelationship with NitroSecurity and saw its proprietary database, which provides correlation andprofiling capabilities, as a strong differentiator to other SIEM vendors, said Martin Ward, seniordirector of risk and compliance at McAfee.

Speed with NitroSecurity is over the top, Ward said. Reports that are being run by existingSIEM vendors can take hours and hours, whereas Nitro can do it in minutes.

The future of SIM appears to be data warehousing technology with powerful analytical tools thathelp IT teams crunch a massive amount of data, said Forresters Kindervag.

Its really about making better decisions based on facts, not conjecture, Kindervag said. IfIT departments can take actionable data out of their systems and put it to use, we could see moredecisions that align with the business side and address threats based on their risk impact.

Streaming Movie Service Zediva Pays Hollywood $1.8M, Shuts Down

Score another win for big content against online innovation.

Last Friday, the Motion Picture Association of America announced that the spunky streaming movie startup Zediva agreed to close down permanently and to pay the studios $1.8 million and end its court battle with Hollywood.

Zedivas service, which debuted to the public in March, let users watch recently released DVDs over the internet for $2, by renting out a DVD and a DVD player (installed in Zedivas server room) controlled by a customers computer. The service had its public debut in March, and was sued by the studios in April.

Zediva struck no content deals with Hollywood, arguing it was more like a traditional video rental store like Blockbuster, which needs no licensing agreement to rent movies, than a video-on-demand service like Netflix, which must sign deals to stream movies to subscribers. Zediva can only rent out DVDs to one customer at a time, and makes no copies of the DVDs.

But in August, Zediva shut off its service, thanks to a preliminary injunction issued by U..S. District Court Judge John Walter who made it clear which side of the “Is Zediva Legal?” battle he was on. Walter wrote, As the copyright holders, Plaintiffs have the exclusive right to decide when, where, to whom, and for how much they will authorize transmission of their Copyrighted Works to the public.

Zediva argued that its more like a traditional video rental store like Blockbuster, which needs no licensing agreement to rent movies, than a video-on-demand service like Netflix, which must sign deals to stream movies to subscribers. Zediva can only rent out DVDs to one customer at a time, and makes no copies of the DVDs.

The MPAA, by contrast, argued that any streaming of a DVD or movie was illegal without their permission, and called the final shutdown a win for the movie industry.

“This result sends a strong message to those who would exploit the studios works in violation of copyright law, on the Internet or elsewhere, and it is an important victory for the more than two million American men and women whose livelihoods depend on a thriving film and television industry,” said MPAA Senior Vice President and Associate General Counsel Dan Robbins in a release (.pdf).

Zediva, a start-up, likely faced a bleak, long legal battle, without the benefit of any revenue coming in due to the injunction. Given the tone of Judge’s Walter’s tone in early rulings, Zediva’s best chance of resuming operations would have been to get the U.S. 9th Circuit Court of Appeals to take their case after losing the initial case, and then, if the 9th indeed reinstated their operation, hoping to survive a probable visit to the Supreme Court. All while trying to run a start-up.

The MPAA made no statement about whether it would refund money to Zediva customers who pre-paid to watch movies, but I’m not banking on getting my 8 dollars back from Hollywood anytime soon.

UK Cops Using Fake Mobile Phone Tower to Intercept Calls, Shut Off Phones

Britain’s largest police force has been using covert surveillance technology that can masquerade as a mobile phone network to intercept communications and unique IDs from phones or even transmit a signal to shut off phones remotely, according to the Guardian.

The system, made by Datong in the United Kingdom, was purchased by the London Metropolitan police, which paid $230,000 to Datong for “ICT hardware” in 2008 and 2009.

The portable device, which is the size of a suitcase, pretends to be a legitimate cell phone tower that emits a signal to dupe thousands of mobile phones in a targeted area. Authorities can then intercept SMS messages, phone calls and phone data, such as unique IMSI and IMEI identity codes that allow authorities to track phone users’ movements in real-time, without having to request location data from a mobile phone carrier.

In the case of intercepted communications, it is not clear whether the network works as a blackhole where intercepted messages go to die, or whether it works as a proper man-in-the-middle attack, by which the fake tower forwards the data to a real tower to provide uninterrupted service for the user.

In addition to intercepting calls and messages, the system can be used to effectively cut off phone communication, such as in a war zone where phones might be used as a trigger for an explosive device, or for crowd control during demonstrations and riots where participants use phones to organize.

The Met police would not provide details to the Guardian about where or when its technology had been used.

According to the company’s web site, Datong “develops intelligence solutions for international military, law enforcement and intelligence agencies for use in all operating environments,” and sells its products in the U.S. as well.

Between 2004 and 2009, Datong won over $1.6 million in contracts with the U.S. Secret Service, Special Operations Command, the Bureau of Immigration and Customs Enforcement and other agencies. In February 2010, the company won a $1.2 million contract to supply tracking and location technology to the U.S. defense industry. It also sells technology to regimes in the Middle East.

A spokesman for the U.S. Secret Service verified to CNET that the agency has done business with Datong, but would not say what sort of technology it bought from the company.

The FBI is known to use a similar technology called Triggerfish, which also pretends to be a legitimate cell tower base station to trick mobile phones into connecting to it. The Triggerfish system, however, collects only location and other identifying information, and does not intercept phone calls, text messages, and other data.

Last year at the DefCon hacker conference in Las Vegas, security researcher Chris Paget demonstrated a low-cost, home-brewed device that mimics the IMSI catchers that U.S. law enforcement agencies use.

The device spoofs a legitimate GSM tower and emits a signal thats stronger than legitimate towers in the area to entice cell phones to route their outbound calls through the spoofed tower, allowing an attacker to intercept and record calls before theyre routed on their proper way through voice-over-IP.

Photo: zoonabar / Flickr

Anonymous Skeptical of Proposed Attack on Zetas Drug Cartel

OpCartel, an announced Anonymous operation to take on the Mexican drug cartel known as the Zetas, seems like it might be in line with Anonymous’s recent shift away from pursuing lulz in favor of morals-motivated attacks against pedophiles, misbehaving corporations and repressive regimes.

But despite the press that the announcement garnered, there seems to be little support among Anonymous for the action — and there’s hints that the announcement is meant to bring into being the very attack it’s actually threatening to carry out.

Anonymous has launched a number of campaigns in the last year. Operation Payback was launched against major copyright holders after an anti-piracy firm was caught using blackhat tactics against file sharers; Operation Avenge Assange targeted financial institutions that refused to allow donations to Wikileaks; and anonshave been involvedwith#occupywallstreet. While not completely jettisoning the lulz, the operations have clearly taken Anonymous in the direction of taking a side in contentious societal issues.

The move to take on a murderous cartel also fits with Anonymous’ history of bold, apparently fearless actions of #antisec against anyone they deem target-worthy, whether the target carries guns or not.

Still everyone, Anonymous and not, seems to agree that going after the Zetas, who are known for hanging people by their own intestines, would be a new level of ambitious, and might even be the point where Anonymous would bite off more than they could chew.

But there’s some nagging problems with the video that proposes the op.

It makes claims about a kidnapping, but has no clear details. It claims the victim of the kidnapping had been part of a paperstorm op — meaning an action where posters are plastered around an area — but, there’s no link anywhere that shows that happened. Most troublesome of all, the Mexican Anons seem to want nothing to do with it, as Global Voices details.

It’s useless to ask whether OpCartel is a fraud; wherever it came from, if it picks up steam it will be an Anonymous operation. If, as many anons I talked with have said, no one will touch it with a 10-foot pole, it simply never will become one, regardless of its origin.

OpCartel looks like a perfect example of “Let’s you and him go fight,” a set-up where a third party gets the first two parties into a conflict for their own aims.

This post is part of a special series from Quinn Norton, who is embedding with Occupy protestors and going beyond the headlines with Anonymous for Wired.com. For an introduction to the series, read Quinn’s description of the project.

Venture Capitalists Join Internet Blacklist Bill Backlash

Fred Wilson

It’s no surprise that the proposal by Rep. Lamar Smith (R-Texas) to boost the government’s authority to disrupt and shutter websites that hawk or host trademark- and copyright-infringing products would draw a harsh reaction from interest groups like Public Knowledge and the Electronic Frontier Foundation.

Rep. Zoe Lofgren (D-California), whose district includes the headquarters of Google, Facebook and Apple, blasted last week’s proposal, too, saying if the measure passed, “this would mean the end of the internet as we know it.”

That’s not surprising, given the bill allows private parties,without a hearing from a judge, to cut off ad dollars to sites they say host pirated or trademarked content; lets the government order search engines and ISPs to make it impossible for users to reach blacklisted sites; and criminalizes technology that would get around the blacklist.

However, we didn’t expect to see venture capitalists staking out a position so soon.

Mike Masnick over at techdirt directs our attention toan open a letter to Christopher Dodd, the Motion Picture Association of America’s chief executive, and huge supporter of Smith’s legislation.

Signing onto the letter, which asks Dodd to end support for the Stop Online Piracy Act, are some venture capitalists like Brad Burnham and Fred Wilson of Union Square Ventures, which has invested in Twitter, Etsy, Kickstarter, DuckDuckgo, and Tumblr, among other companies.

A bill like SOPA creates so much liability that it would be impossible for two engineers in a garage to build the next great startup unless they also had a dozen lawyers sitting with them. We can’t help the artists and creators who were in our group with the new platforms they rely on, if these new innovative startups don’t even bother starting.

We can’t help the users and participants who want new and convenient and legitimate access to content, as well as ways to make their own content. At the end of the day, both Silicon Valley and Hollywood work best when we focus on creating and providing what our consumers want.

Smith’s legislation is expected to clear the House Judiciary Committee, which Smith heads, on November 16. It has an uncertain fate on the House floor and in the Senate, where similar legislation has stalled.

Photo: joi/Flickr

Confessed Miley Cyrus Hacker Sentenced to Three Years Probation

Self-proclaimed Miley Cyrus hacker Josh Holly was sentenced on Monday to three years probation for computer crimes — though not for the Cyrus hack that was his claim to fame.

Holly, 22, pleaded guilty last April to possessing about 200 stolen credit card numbers, and to breaching celebrity MySpace pages in a spamming scheme that earned him at least $100,000.

Holly was sentenced in Tennessee and was spared jail time, even though he apparently violated his pre-sentencing terms that banned him from accessing the Internet. In a July 4 post to Facebook, Holly allegedly wrote, “Im having these strong urges to start playing around and hacking shit again, theres so much new stuff on the net. I cant stop these urges. Am I a bad person?

In October, Hollys attorney argued against jail time, asserting that his client should get credit for cooperating with the FBI by providing information about others that he was aware were involved in illegal computer-related activities.

He also argued that probation would be “sufficiently onerous punishment for a first-time offender of immature mental age”, and asserted that the youth should be spared prison because of his diminutive height. Holly stands 5′ 6″.

Prosecutors responded that they would not challenge the assertions about Hollys youth, mental and emotional issues and physical stature, but noted that Assistant U.S. Attorney Hilliard Hester was the same height as Holly, and therefore Holly was not so remarkably short” that his height should be a factor for leniency.

Holly boasted in 2008 that he was responsible for stealing and posting provocative pictures stolen from Miley Cyrus Gmail.

He has never been charged with hacking Cyruss e-mail account, however, but after bragging online about this and other activity, and taunting authorities that they would never find him, his apartment in Murfreesboro, Tennessee, was raided in October 2008, at which point authorities found evidence of the cards and spamming scheme.

Holly, who went by the screen names TrainReq, Rockz and h4x, told Threat Level in 2008 that he had gained access to a Gmail account Cyrus had used (messagemebaby@gmail.com) and found images the Hannah Montana actress had purportedly sent to singer Nick Jonas of the Jonas Brothers.

He claimed that he tried to sell the pictures to TMZ.com and other celebrity outlets, but no one would buy them, given the illegal manner by which hed obtained them. He then posted some of them online at digitalgangster.com, after which numerous gossip and celebrity websites published them for free. More photos followed thereafter.

The images showed the then-15-year-old Cyrus in a wet T-shirt in the shower, baring her midriff while blowing a kiss to a mirror, and posing seductively in her underwear and bathing suit.

Holly told Threat Level he got access to Cyruss Gmail account after obtaining unauthorized access to a MySpace administrative panel where he found passwords for MySpace accounts stored in cleartext. Holly said he obtained access to the administrative panel by social engineering a MySpace employee. Once inside the panel, he found the password Cyrus used for her MySpace account Loco92 and tried it on a Gmail account she was known to use.

In addition to stealing Cyruss password, he reset MySpace account passwords for a number of other celebrity MySpace users, then used their accounts for a spamming scheme that he said netted him about $50,000.

According to an affidavit, Holly admitted to the FBI that beginning in 2005 he had hijacked numerous celebrity internet accounts to conduct spamming. An investigation of his bank records showed that between November 2007 and July 2008, he received more than $110,000 from companies for spamming on their behalf. Holly told Threat Level that half of his illicit income went to an accomplice in Israel who used the online nickname elul21 (Elul is the Hebrew name of a month on the Jewish calendar).

Holly also said that the celebrity MySpace accounts he accessed to conduct his spamming activity belonged mainly to recording artists and groups Chris Brown, Rihanna, Linkin Park, Fall Out Boy. He accessed about 20 accounts. Once he had passwords to the accounts, he used the accounts to send bulletins to all of the friends on the MySpace accounts advertising a ringtone or call service for the recording artist. For example, hed send out a bulletin from Fall Out Boys MySpace account telling fans that the band would call their phone and send them a ringtone if they clicked on a link and entered their details.

Holly said the advertising affiliates he worked for paid him between $5 and $12 per person who responded to the ad. The affiliates didnt know he was spamming customers, he said, and, when they found out, they terminated their work with him and refused to pay him outstanding earnings.

Photo: Mug shot of Josh Holly courtesy of The Smoking Gun