Documents: FBI Spyware Has Been Snaring Extortionists and Hackers for Years

The software’s primary utility appears to be in tracking down suspects that use proxy servers or anonymizing websites to cover their tracks. That’s illustrated in several cases in the documents, including the 2004 hunt for a saboteur who cut off telephone, cable TV and internet service for thousands of Boston residents. The man’s name is redacted from the documents, but the description of the case matches that of Danny Kelly, an unemployed Massachusetts engineer.

According to court records, Kelly deliberately cut a total of 18 communications cables belong to Comcast, AT&T, Verizon and others over a three month period. In anonymous extortion letters to Comcast and Verizon, Kelly threatened to increase the sabotage if the companies didn’t begin paying him $10,000-a-month in protection money. He instructed the companies to deposit the cash in a new bank account and post the account information to a webpage he could access anonymously.

When the FBI tried to track him down from his visits to the webpage, they found he was routing through a German-based anonymizer. The FBI obtained a warrant to use the CIPAV on February 10, 2005, and was apparently successful. Kelly went on to plead guilty to extortion, and was sentenced to five years probation.

The CIPAV also played a previously-unreported role in an investigation of a prolific computer hacker who made headlines after penetrating thousands of computers at Cisco, various U.S. national laboratories, and NASA’s Jet Propulsion Laboratory in 2005. The FBI agent leading the case sought approval to plant a CIPAV through an undercover operative posing as a Defense Department contractor “with a computer network connected to JPL’s computer network,” according to one document. The FBI linked the intrusions to known 16-year-old hacker in Sweden.

And in 2005, FBI agents on the Innocent Images task force hit a wall when trying to track a sexual predator who’d begun threatening the life of a teenage girl he’d met for sex. The man’s IP addresses were “from all over the world” — a sign of web proxy use. The bureau sought and won court approval to use the CIPAV on August 9 2005.

Other cases are less weighty. In another 2005 case, someone was unwisely using the name of the chief of the FBI’s Buffalo, New York office to harass people online. The FBI got a warrant to use the spyware to track down the fake agent.

Additional cases include:

• In March 2006, the FBI investigated a hacker who took over a Hotmail user’s account and acquired personal information. The hacker tried to extort the owner out of $10,000, demanding the victim crete and fund an E-Gold account and e-mail the password to the hacker. The FBI obtained a search warrant allowing them to send the intruder a CIPAV instead, to uncover his or her location.

• In October, 2005, an undercover agent working a case described as “WMD (bomb & anthrax)” communicated with the suspect via Hotmail, and sought approval from Washington to use a CIPAV to locate the subject’s computer.

• In December 2005, FBI agents sought to use the spyware to track down another extortionist who sent an e-mail to a casino threatening violence.

• In June 2005, an intruder deleted a database at an unnamed company and demanded payment to restore it. The FBI prepared a search warrant affidavit and was ready to ask a judge for authorization to deliver the CIPAV through the hacker’s Yahoo e-mail account. They were briefly thwarted when the intruder stopped communicating with the victim, but after a month of silence the hacker reestablished contact and, presumably, got the FBI’s spyware for his trouble.

The documents appear to settle one of the questions the FBI declined to answer in 2007: whether the bureau obtains search warrants before using the CIPAV, or if it sometimes uses so-called “pen register” warrants that don’t require a showing of probable cause that a crime has been committed. In all the criminal cases described in the documents, the FBI sought search warrants.

The records also indicate that the FBI obtained court orders from the Foreign Intelligence Surveillance Court, which covers foreign espionage and terrorism investigations, but the details are redacted.

The FBI released 152 heavily-redacted pages in response to Threat Level’s FOIA request, and withheld another 623. We’re scanning the documents now, and we’ll add them to this story later Friday.

Image courtesy ABCNews.com