Feds use malware to ensnare child porn users

WASHINGTON — The user’s online handle was Pewter, and while logged onto a website called Playpen, he allegedly downloaded images of young girls being sexually molested.

Pewter had carefully covered his tracks. To reach the site, he first had to install free software called Tor, the world’s most widely-used tool for giving users anonymity online.

In order to uncover Pewter’s true identity and location, the FBI quietly turned to a technique more typically used by hackers. The agency, with a warrant, surreptitiously placed computer code, or malware, on all computers that logged into the Playpen site. When Pewter connected, the malware exploited a flaw in his browser, forcing his computer to reveal its true Internet protocol address. From there, a subpoena to Comcast yielded his real name and address.

Pewter was unmasked last year as Jay Michaud, a 62-year-old administrator in the Vancouver, Wash., public schools. With a second warrant, agents searched the suspect’s home and found a thumb drive that allegedly contained multiple images of children engaged in sex acts. Last July, Michaud was arrested and charged with possession of child pornography.

Michaud’s is the lead case in a sweeping national investigation into child porn on the so-called dark Web, the universe of sites that are off Google’s radar and where users can operate with anonymity.

As criminals become savvier about using technology such as Tor to hide their tracks, investigators are turning to hacking tools to thwart them. In some cases, law enforcement is placing malware on sites that might have thousands of users. Some privacy advocates and analysts worry that in doing so, investigators may also wind up hacking and identifying the computers of law-abiding people who are seeking to remain anonymous, people who can also include political dissidents and journalists.

“As the hacking techniques become more ambitious, failure in execution can lead to large-scale privacy and civil liberties abuses at home and abroad,” said Ahmed Ghappour, a professor at the University of California Hastings College of Law. “It’s imperative that Congress step in to regulate exactly who and how law enforcement may hack.”

But Justice Department officials said that the government investigates crime based on evidence of illegal activities. “When we obtain a warrant, it’s because we have convinced a judge that there is probable cause that we’ll be able to find evidence in a particular location,” said a senior department official, who spoke on condition of anonymity under ground rules set by the department.

In the Playpen case, the government activated malware on a site with 215,000 members as of last February and obtained Internet protocol addresses of 1,300 computers. Out of that group, the government said it has charged 137 people.

“It’s a lot of people,” said Colin Fieman, a public defender in Tacoma representing Michaud. “There never has been any warrant I’ve seen that allows searches on that scale. It is unprecedented.”

Michaud is arguing that his charges be dismissed on grounds that the government’s use of the tool violated the Fourth Amendment. Fieman argues that some people might have gone to the site seeking to express fantasies, which while repugnant, are legal. The site, he said, doesn’t clearly advertise itself as devoted to child pornogaphy.

He likened the government’s warrant to a “general warrant,” referring to the British practice during the colonial era of allowing government searches without any individualized suspicion.

A judge in the case is scheduled on Friday to hear a defense motion to throw out the charges against Michaud.

“This is a gray area in the law,” said Thomas Brown, a former federal prosecutor in the Southern District of New York who handled cases involving the use of hacking techniques. “It’s another instance where you’ve got technology outstripping the law.”

Fieman also said that rules established by the federal courts, grounded in constitutional principles, require that a warrant be deployed in the district in which it is issued – in this case, the Eastern District of Virginia. Michaud’s computer was in Vancouver.

But prosecutors argue that the technique is lawful and that in general a warrant may be issued even when the location to be searched is unknown, as long as there is probable cause that the search will turn up evidence of a crime.

“The Supreme Court has made clear that the Fourth Amendment … does not preclude use of warrants where the purpose of the search is to discover the location of the place to be searched,” said David Bitkower, then a deputy assistant attorney general, in a Dec. 2014 letter to a federal courts committee weighing changes to the rule that governs how search warrants are issued.

In the Playpen case, the government argued that it had probable cause to search the computers of anyone who navigated to the site – whether one person or 10,000 people – on the grounds that the site was devoted to child porn and anybody who knew how to get to it likely did so with the intent to view the content. The site can’t be found through a Google search and can only be reached by users who know its exact, algorithm-generated Web address and are using special software that connects to the Tor network.

In such a case, “we have an obligation to investigate all 10,000 1/8people3/8, not just one,” prosecutor Keith Becker told Judge Robert J. Bryan of the U.S. District Court at a hearing in the Western District of Washington at Tacoma in December.

The FBI seized Playpen last year, and after operating it for two weeks, shut it down. During those two weeks, according to court documents, it deployed what it obliquely calls a “network investigative technique,” or NIT, to capture the IP address of anyone who logged into the website.

“In general, the constitution doesn’t say that we have to stop investigating just because we need to use a computer technique to identify suspects rather than opening a letter or entering a private house,” said the senior department official. “The law doesn’t give online pedophiles immunity from court-authorized search warrants just because they’re using modern software.”

Fieman also argued that the government itself violated the law when it seized Playpen last year and then rather than shut it down immediately or find ways to reroute visitors, continued to operate the child porn site.

“What the government did is comparable to flooding a neighborhood with heroin in the hope of snaring an assortment of low-level drug users,” Fieman said in a motion to dismiss filed in November.

Justice Department spokesman Peter Carr said that “at no time in an operation like this does the FBI post any images, videos or links to images of child pornography.” Any such postings are done by website users, not the FBI, he said. Also, he said, immediately shutting down a website would prevent law enforcement from identifying the offenders and frustrate efforts to identify and rescue child victims from abuse.

Without using the hacking technique, officials say, it would be very difficult to locate pedophiles who go to great lengths to hide their tracks.

The issue, said Ghappour, the law professor, is not the use of the malware per se, but “whether hacking warrants are written narrowly enough to guarantee that only those culpable set the trigger 1/8to launch the NIT3/8, and consequently get hacked,” he said. “Given the scale of these operations, the smallest mistake could result in hundreds, if not thousands, of privacy violations.”

Privacy advocates concerned about the government doing mass hacks point to the case of TorMail, an anonymous email service, now shuttered. TorMail, which despite the name is not affiliated with the group behind Tor, was used by a range of people, from criminals to dissidents and journalists.

In the summer of 2013, reports surfaced of people trying to log in to TorMail and finding a Down for Maintenance message instead, and finding suspicious-looking code included in the TorMail Web page. Security researchers who analyzed the code concluded that it was likely placed there by the FBI.

At the time, the government would not confirm that the bureau was behind the hack. This week, people familiar with the investigation confirmed the FBI had used an NIT on TorMail. But, they said, the bureau obtained a warrant that listed specific email accounts within TorMail for which there was probable cause to believe the true user was engaged in illicit child pornography activities. In that way, the sources said, only suspects whose accounts had in some way been linked to involvement in child porn would have their computers infected.

An FBI official said the bureau recognizes that the use of the NIT is “intrusive” and should only be used “in the most serious cases.” He said the FBI uses the tool only against offenders who are “the worst of the worst.”

Talk to us

> Give us your news tips.

> Send us a letter to the editor.

> More Herald contact information.

More in Local News

A firefighter stands in silence before a panel bearing the names of L. John Regelbrugge and Kris Regelbrugge during the ten-year remembrance of the Oso landslide on Friday, March 22, 2024, at the Oso Landslide Memorial in Oso, Washington. (Ryan Berry / The Herald)
‘Flood of emotions’ as Oso Landslide Memorial opens on 10th anniversary

Friends, family and first responders held a moment of silence at 10:37 a.m. at the new 2-acre memorial off Highway 530.

Julie Petersen poses for a photo with images of her sister Christina Jefferds and Jefferds’ grand daughter Sanoah Violet Huestis next to a memorial for Sanoah at her home on March 20, 2024 in Arlington, Washington. Peterson wears her sister’s favorite color and one of her bangles. (Annie Barker / The Herald)
‘It just all came down’: An oral history of the Oso mudslide

Ten years later, The Daily Herald spoke with dozens of people — first responders, family, survivors — touched by the deadliest slide in U.S. history.

Victims of the Oso mudslide on March 22, 2014. (Courtesy photos)
Remembering the 43 lives lost in the Oso mudslide

The slide wiped out a neighborhood along Highway 530 in 2014. “Even though you feel like you’re alone in your grief, you’re really not.”

Director Lucia Schmit, right, and Deputy Director Dara Salmon inside the Snohomish County Department of Emergency Management on Friday, March 8, 2024, in Everett, Washington. (Ryan Berry / The Herald)
How Oso slide changed local emergency response ‘on virtually every level’

“In a decade, we have just really, really advanced,” through hard-earned lessons applied to the pandemic, floods and opioids.

Ron and Gail Thompson at their home on Monday, March 4, 2024 in Oso, Washington. (Olivia Vanni / The Herald)
In shadow of scarred Oso hillside, mudslide’s wounds still feel fresh

Locals reflected on living with grief and finding meaning in the wake of a catastrophe “nothing like you can ever imagine” in 2014.

Everett mall renderings from Brixton Capital. (Photo provided by the City of Everett)
Topgolf at the Everett Mall? Mayor’s hint still unconfirmed

After Cassie Franklin’s annual address, rumors circled about what “top” entertainment tenant could be landing at Everett Mall.

Everett
Everett man sentenced to 3 years of probation for mutilating animals

In 2022, neighbors reported Blayne Perez, 35, was shooting and torturing wildlife in north Everett.

Dorothy Crossman rides up on her bike to turn in her ballot  on Tuesday, Aug. 1, 2023 in Everett, Washington. (Olivia Vanni / The Herald)
Everett leaders plan to ask voters for property tax increase

City officials will spend weeks hammering out details of a ballot measure, as Everett faces a $12.6 million deficit.

Starbucks employee Zach Gabelein outside of the Mill Creek location where he works on Friday, Feb. 23, 2024 in Mill Creek, Washington. (Olivia Vanni / The Herald)
Mill Creek Starbucks votes 21-1 to form union

“We obviously are kind of on the high of that win,” store bargaining delegate Zach Gabelein said.

Lynnwood police respond to a collision on highway 99 at 176 street SW. (Photo provided by Lynnwood Police)
Police: Teen in stolen car flees cops, causes crash in Lynnwood

The crash blocked traffic for over an hour at 176th Street SW. The boy, 16, was arrested on felony warrants.

The view of Mountain Loop Mine out the window of a second floor classroom at Fairmount Elementary on Wednesday, Jan. 10, 2024 in Everett, Washington. (Olivia Vanni / The Herald)
County: Everett mining yard violated order to halt work next to school

At least 10 reports accused OMA Construction of violating a stop-work order next to Fairmount Elementary. A judge will hear the case.

Imagine Children's Museum's incoming CEO, Elizabeth "Elee" Wood. (Photo provided by Imagine Children's Museum)
Imagine Children’s Museum in Everett to welcome new CEO

Nancy Johnson, who has led Imagine Children’s Museum in Everett for 25 years, will retire in June.

Support local journalism

If you value local news, make a gift now to support the trusted journalism you get in The Daily Herald. Donations processed in this system are not tax deductible.