FBI and DARKNET (a.k.a Deep Web)- Virtual Case Note

The last two decades have created a new crime scene unlike any other: the internet.

Instead of knives and firearms, 21st-century criminals are wielding laptops, mobile devices, and malware. And instead of using DNA and fingerprints to solves crimes, modern law enforcement is using IP addresses and geotags to find criminals who use proxies and fake user accounts in the place of ski masks and gloves.

For many, this unique underground of cybercrime is a bizarre new frontier, but for those in my millennial generation, who could click a mouse before they could ride a bike, hearing about another hacking or online predation is just as commonplace as hearing about a real-world robbery or kidnapping.

However, even for those of us who grew up with the internet at our fingertips, the continuing evolution of the online word—and the crimes that go with it—can be both staggering and fascinating.

Each week, I will be discussing a new case that highlights the relationship between the internet and crime, whether it be an “old fashioned” crime recolored by the internet’s influence or a new type of crime that’s only possible to commit within the confines of the virtual world.

This week we will be looking at the Michaud case—an interesting example of a part of the web many have never even heard of, and how law enforcement entities are dealing with the criminals who dwell in the internet’s deepest abyss.

To better understand the case and the technology surrounding it, I spoke with cybersecurity expert Jeffrey Lipson. Lipson is the executive director of Layer 8 security, a cybersecurity consultancy firm in Pennsylvania—he is also a reserve marine colonel with 25 years of military service, including with the Marine Corps Forces Cyber Command and National Security Agency. He currently serves on the board of directors for Immaculata University’s cybersecurity program.

The Michaud case begins with an unseen section of the internet known as the “dark web.”

“The dark web sounds a lot more mysterious and cooler than it really is,” Lipson explained.

“When you normally go to the web and you go to a website, it’s indexed by all the search engines so Google and Yahoo and all the other search engines can point to it,” Lipson said. “When you have a dark website, it’s not published—they deliberately keep it private. And they also make it so that you need special credentials to log in.”

The dark web can only be accessed through special browsers, the most well-known being Tor, which is free to download.

“You may have heard Tor called ‘the onion router,’ because there’s multiple layers, kind of like an onion,” Lipson said. He explained that the Tor browser bounces a user’s communications across a number of routers—the layers—in order to hide the user’s IP address, and therefore keep the user anonymous.

When using the Tor browser, “you can surf the web or go into the dark web with high confidence that no one will know who you are,” Lipson said.

This was exactly the confidence Vancouver, Washington teacher Jay Michaud had when he logged into a dark web child pornography site, the FBI alleged, when they arrested him in 2015, as reported by the Associated Press.

Michaud was one of 137 charged after the FBI first arrested the operator of the child porn website, called the Playpen, which had more than 150,000 users at the time of the bust. Once the operator was apprehended, the FBI used the website, which was still up on the darknet, as a “honeypot” to continue to draw in pedophiles and collect as much information about them as possible. Lipson compared the tactic to that of the show “To Catch a Predator,” in which men who had sexual conversations with underage web personas (actually adult decoys) were arrested when they showed up to have sex with the minors they were grooming.

“They were doing the same thing—they were creating a site that child pornographers would go to and then they would use some sources and methods to be able to eliminate some of the anonymity and get a better sense of who these folks are,” Lipson said.

Unsurprisingly, the FBI’s decision to keep a site containing child pornography online wasn’t without controversy.

“It’s not something that is very tasteful,” Lipson stated, noting his own work catching child pornographers. He mentioned that attorneys in the case were “outraged” by the FBI’s tactic. “It’s not pleasant, but it’s necessary if you will. If they had shut down the site, they might not have been able to find out who some of these folks are.

“We call it whack-a-mole in the intelligence community—if you whack one, it’ll spring up in a couple weeks in another place,” he said.

The case became even more shocking, however, when the FBI made a second controversial decision—they dropped all charges against Michaud on March 6, 2017 after a judge ruled the FBI must reveal the “network investigative technique code” it used to find him if the case were to continue, according to the Associated Press.

The idea of letting an alleged pedophile go free for any reason is certainly enough to make spines tingle—technology website Gizmodo reported on the story with the headline “FBI Drops All Charges in Child Porn Case to Keep Sketchy Spying Methods Secret.” According to Gizmodo, the code used by the FBI is a type of malware and may violate search and seizure laws, in the opinion of some lawyers.

In Lipson’s opinion, the FBI’s decision was “all about protecting their sources and methods” and letting go of a minnow in order to continue catching bigger fish.

“If the bad guys know how the government is finding them, they’ll find ways around it,” he said. “It’s kind of this arms race between law enforcement and criminals. The criminals are trying to find ways to hide themselves and the law enforcement folks are trying to find ways to find them, and each side is upping their technology game.”

To avoid losing the race, while still keeping as many “fish” in their net as possible, the government will “be smart the next time in how to put the case together against these perpetrators,” according to Lipson.

“There’s plenty of folks that engage in this illicit activity,” Lipson said, “and although they had to let this particular individual off, it’s more important for (the FBI) to protect the technology, the way they were able to find out who the people were, than it was to continue to try to prosecute this one person.”

Courtesy: Forensic Megazine