[ISN] FBI Subpoenas

[InfoSec News]

---------- Forwarded message ----------
From: Fyodor <fyodor at insecure.org>
To: nmap-hackers at insecure.org
Subject: FBI Subpoenas
Date: Tue, 23 Nov 2004 17:41:49 -0800

Dear Nmap hackers,

Let me first wish you Americans a happy Thanksgiving.  Meanwhile, I'm
hard at work on a holiday Nmap version which should be available by
Christmas.

But enough pleasantries -- I want to discuss a sobering topic.  With
increasing regularity this year, FBI agents from all over the country
have contacted me demanding webserver log data from Insecure.Org. They
don't give me reasons, but they generally seem to be investigating a
specific attacker who they think may have visited the Nmap page at a
certain time.  If they see that an attacker ran the command "wget
http://download.insecure.org/nmap/dist/nmap-3.77.tgz" from a
compromised host, they assume that she might have obtained that URL by
visiting the Nmap download page from her home computer.  So far, I
have never given them anything.  In some cases, they asked too late
and data had already been purged through our data retention policy.  
In other cases, they failed to serve the subpoena properly. Sometimes
they try asking without a subpoena and give up when I demand one.

One can argue whether helping the FBI is good or bad.  Remember that
they might be going after spammers, cyber-extortionists, DDOS kiddies,
etc.  In this, I wish them the best.  Nmap was designed to help
security -- the criminals and spammers put my work to shame!  But the
desirability of helping the FBI is immaterial -- I may be forced by
law to comply with legal, properly served subpoenas.  At the same
time, I'll try to fight anything too broad (like if they ask for
weblogs for a whole month).  Protecting your privacy is important to
me, but Nmap users should be savvy enough to know that all of your
network activity leave traces.  I'm not the only one who gets these
subpoenas -- large ISPs and webmail providers receive them daily. Most
other major security sites probably do too.  Most of you probably
don't care if someone finds out that you downloaded Nmap, Nessus,
Hping2, John the Ripper, etc.  Nothing on Insecure.Org is illegal. But
for those of you who do care, there are plenty of mechanisms available
to preserve your anonymity.  Remember this security mantra: defense in
depth.

Cheers,
Fyodor

--------------------------------------------------
For help using this (nmap-hackers) mailing list, send a blank email to 
nmap-hackers-help at insecure.org . List archive: http://seclists.org