demands for Fyodor logs

[David Farber <dave () farber net>]

Begin forwarded message:

From: "Kevin T. Neely" <ktneely () astroturfgarden com>
Date: November 23, 2004 9:58:07 PM EST
To: dave () farber net
Subject: Re: [IP] Philadelphia Citywide WLAN in Jeopardy

I thought this was interesting, and it's already been forwarded to the 
cryptography mailing list.  Anyway, apparently Fyodor, creator of the 
well-known (and hollywood superstar via the Matrix and others) program, 
nmap, has been periodically served by the FBI for logs of his webserver 
and download data.

Might be of interest to the IP list, forwarded message follows.

enjoy.
K



-------- Original Message --------
Subject: FBI Subpoenas
Date: Tue, 23 Nov 2004 17:41:49 -0800
From: Fyodor <fyodor () insecure org>
To: nmap-hackers () insecure org

Dear Nmap hackers,

Let me first wish you Americans a happy Thanksgiving.  Meanwhile, I'm
hard at work on a holiday Nmap version which should be available by
Christmas.

But enough pleasantries -- I want to discuss a sobering topic.  With
increasing regularity this year, FBI agents from all over the country
have contacted me demanding webserver log data from Insecure.Org.
They don't give me reasons, but they generally seem to be
investigating a specific attacker who they think may have visited the
Nmap page at a certain time.  If they see that an attacker ran the
command "wget http://download.insecure.org/nmap/dist/nmap-3.77.tgz";
from a compromised host, they assume that she might have obtained that
URL by visiting the Nmap download page from her home computer.  So
far, I have never given them anything.  In some cases, they asked too
late and data had already been purged through our data retention
policy.  In other cases, they failed to serve the subpoena properly.
Sometimes they try asking without a subpoena and give up when I demand
one.

One can argue whether helping the FBI is good or bad.  Remember that
they might be going after spammers, cyber-extortionists, DDOS kiddies,
etc.  In this, I wish them the best.  Nmap was designed to help
security -- the criminals and spammers put my work to shame!  But the
desirability of helping the FBI is immaterial -- I may be forced by
law to comply with legal, properly served subpoenas.  At the same
time, I'll try to fight anything too broad (like if they ask for
weblogs for a whole month).  Protecting your privacy is important to
me, but Nmap users should be savvy enough to know that all of your
network activity leave traces.  I'm not the only one who gets these
subpoenas -- large ISPs and webmail providers receive them daily.
Most other major security sites probably do too.  Most of you probably
don't care if someone finds out that you downloaded Nmap, Nessus,
Hping2, John the Ripper, etc.  Nothing on Insecure.Org is illegal.
But for those of you who do care, there are plenty of mechanisms
available to preserve your anonymity.  Remember this security mantra:
defense in depth.

Cheers,
Fyodor

--------------------------------------------------
For help using this (nmap-hackers) mailing list, send a blank email to
nmap-hackers-help () insecure org . List archive: http://seclists.org


--
In vino veritas
http://openwine.net

-------------------------------------
You are subscribed as interesting-people () lists elistx com
To manage your subscription, go to
 http://v2.listbox.com/member/?listname=ip

Archives at: http://www.interesting-people.org/archives/interesting-people/