U.S. Department of Justice Criminal Division Office of Enforcement Operations Washington, D.C. 20530 VIA Electronic Mail February 19, 2020 Jonathan Manes, Esq. Civil Liberties and Transparency Clinic University at Buffalo School of Law Request No. CRM-300680988 507 O’Brian Hall, North Campus Privacy International et al., v. Federal Bureau Buffalo, NY 14260 of Investigation, et al.,18-cv-1488 [email protected] (W.D.N.Y.) Dear Mr. Manes: This is the third installment of the Criminal Division’s rolling production regarding your Freedom of Information Act request dated September 10, 2018, for certain records pertaining to “computer network exploitation” or “network investigative techniques.” Your request is currently in litigation, Privacy International, et al. v. Federal Bureau of Investigation, et al., 18-cv-1488 (W.D.N.Y.). You should refer to this case number in any future correspondence with this Office. This request is being processed in accordance with the interpretation and parameters set forth by defendants in the July 12, 2019, letter to you from Senior Trial Counsel Marcia Sowles, as well as subsequent conversations regarding the Criminal Division’s processing of the request. Please be advised that a search has been conducted in the appropriate sections, and we are continuing to review and process potentially responsive records. After carefully reviewing 521 pages of records, I have determined that 436 pages are responsive to your request: 380 pages are appropriate for release in full, copies of which are enclosed. Additionally, seven pages are appropriate for release in part and forty-nine pages are exempt from disclosure pursuant to: 5 U.S.C. § 552(b)(5), which concerns certain inter- and intra-agency communications protected by the deliberative process privilege, the attorney work-product privilege, and the attorney-client privilege; 5 U.S.C. § 552(b)(6), which concerns material the release of which would constitute a clearly unwarranted invasion of the personal privacy of third parties; 5 U.S.C. § 552(b)(7)(C), which concerns records or information compiled for law enforcement purposes the release of which could reasonably be expected to constitute an unwarranted invasion of the personal privacy of third parties; and 5 U.S.C. § 552(b)(7)(E), which concerns records or information compiled for law enforcement purposes the release of which would disclose techniques and procedures for law enforcement investigations or prosecutions, or would disclose guidelines for law 2 enforcement investigations or prosecutions if such disclosure could reasonably be expected to risk circumvention of the law. For your information, Congress excluded three discrete categories of law enforcement and national security records from the requirements of the FOIA. See 5 U.S.C. § 552(c). This response is limited to those records that are subject to the requirements of the FOIA. This is a standard notification that is given to all our requesters and should not be taken as an indication that excluded records do, or do not, exist. You may contact Senior Trial Counsel Marcia K. Sowles by phone at (202) 514-4960, by email at [email protected], or by mail at the Civil Division, Federal Programs Branch, 1100 L Street, N.W., Room 10028, Washington, D.C. 20005, for any further assistance and to discuss any aspect of your request. Although I am aware that your request is the subject of ongoing litigation and that appeals are not ordinarily acted on in such situations, I am required by statute and regulation to inform you of your right to an administrative appeal of this determination. If you are not satisfied with my response to this request, you may administratively appeal by writing to the Director, Office of Information Policy (OIP), United States Department of Justice, 441 G Street, NW, 6th Floor, Washington, D.C. 20530, or you may submit an appeal through OIP's FOIA STAR portal by creating an account on the following website: https://foiastar.doj.gov. Your appeal must be postmarked or electronically transmitted within 90 days of the date of my response to your request. If you submit your appeal by mail, both the letter and the envelope should be clearly marked “Freedom of Information Act Appeal.” Sincerely, Amanda Marchand Jones Chief FOIA/PA Unit cc: Marcia K. Sowles Senior Trial Counsel Civil Division, Federal Programs Branch 1100 L Street, N.W., Room 11028 Washington, D.C. 20005 [email protected] Michael S. Cerrone [email protected] Enclosures Framework Rule 41(b)(6) and venue for search warrants Using remote searches in your dark market cases Rule 41(b)(6) issues and pitfalls Venue Traditional (physical) searches Venue is easy Where is property to be searched located? Apply for your warrant there Rule 41(b)(6)(A) a magistrate judge with authority in any district where activities related to a crime may have occurred has authority to issue a warrant to use remote access to search electronic storage media and to seize or copy electronically stored information located within or outside that district if: the district where the media or information is located has been concealed through technological means; Location of Data and to seize or copy electronically stored information located within or outside that district Concealment If the district where the media or information is located has been concealed through technological means; Locating Your Target NIT sent to target through document Usually to obtain true IP address (b) (7)(E) REMOTE SEARCHES Rule 41(B)(6): a court where activities relating to a crime may have occurred can issue warrant for remote search if: (A) location of computer has been concealed through technological means (i.e. proxy); or (B) victim computers of 1030(a)(5)(A) located in 5 or more districts Otherwise: CEOS Quarterly Newsletter Page 13 NITs Make Nice: Defeating an Offender’s Use of Proxies by Employing a Network Investigative Technique (NIT) By (b)(6), (7)(C)CEOS Trial Attorney Sophisticated online offenders have increasingly turned to anonymization technologies, such as proxy servers, to hide their true location and identity from law enforcement. See CEOS Quarterly Newsletter (September 2009), Proxies, Anonymizers, Private Networks and You: A Primer on Internet Misdirection, Deception, and Finger Pointing. Law enforcement is not, however, without techniques to defeat anonymization. One option is a Network Investigative Technique, or “NIT.” This article discusses the use of one type of NIT and the process required to obtain authorization for it. I. What is a NIT? (b)(7)(E) A NIT is a tool that allows law enforcement to remotely collect information from a target computer. Computer code is delivered to the target computer; the code runs or activates on the target computer; and that information is delivered to a government-controlled computer. II. How Does a NIT Work? The exact specifications and design of a NIT will vary based upon your forensic agent or programmer and the information you are seeking. (b)(7)(E) IV. What Sort of Information Can a NIT Collect? In the context of an offender who is using a proxy server, the primary objective of a NIT is to identify the actual IP address of the offender. However, a NIT can obtain other useful -- and potentially identifying -- information as well. For example, a (b)(7)(E) Continued . Page 14 CEOS Quarterly Newsletter (b)(7)(E) (b)(5) V. What Authorization is Needed to Implement a NIT? As with many issues involving electronic evidence, technology advances faster than the law. (b)(5) (b)(5), (7)(E) (b)(5) ____________________________________ (b)(5) VII. Conclusion A NIT can be a creative technological solution to the difficult and increasingly prevalent problem of anonymization use by offenders. By measures such as causing offenders’ true IP addresses to be sent to the government, NITs can help law enforcement identify those who believe they are able to commit child exploitation crimes free of the risk of being caught. } Case 4:13-mj-00234 Document 3 Filed in TXSD on 04/22/13 Page 1 of 13 UNITED STATES DISTRICT COURT SOUTHERN DISTRICT OF TEXAS HOUSTON DIVISION IN RE WARRANT TO SEARCH A TARGET § COMPUTER AT PREMISES UNKNOWN § CASE NO. H-13-234M § § MEMORANDUM AND ORDER The Government has applied for a Rule 41 search and seizure warrant targeting a computer allegedly used to violate federal bank fraud, identity theft, and computer security laws. Unknown persons are said to have committed these crimes using a particular email account via an unknown computer at an unknown location. The search would be accomplished by surreptitiously installing software designed not only to extract certain stored electronic records but also to generate user photographs and location information over a 30 day period. In other words, the Government seeks a warrant to hack a computer suspected of criminal use. For various reasons explained below, the application is denied. Background In early 2013, unidentified persons gained unauthorized access to the personal email account of John Doe, an individual residing within the Southern District of Texas, and used that email address to access his local bank account. The Internet Protocol (IP) address of the computer accessing Doe’s account resolves to a foreign country. After Doe discovered the breach and took steps to secure his email account, another email account nearly identical to Doe’s the address differed by a single letter was used to attempt a sizeable wire Case 4:13-mj-00234 Document 3 Filed in TXSD on 04/22/13 Page 2 of 13 transfer from Doe’s local bank to a foreign bank account. The FBI has commenced an investigation, leading to this search warrant request. At this point in the investigation, the location of the suspects and their computer is unknown.