Latest / The Infographics Show Podcast / How the FBI Tracks Killers Online

Transcript

How the FBI Tracks Killers Online · The Infographics Show Podcast

• 0:10
  Speaker 1: Welcome to beyond infographics. Today, we're diving deep into something
• 0:14
  Speaker 1: that well probably impacts you more than you even realize,
• 0:17
  Speaker 1: how law enforcement tracks criminals in this digital age.
• 0:21
  Speaker 2: Right, forget those simple diagrams you might see online exactly.
• 0:24
  Speaker 1: We're going way beyond the surface. You've shared some really
• 0:27
  Speaker 1: fascinating insights on this how classic detective work is adapting,
• 0:31
  Speaker 1: but also these completely new techniques leveraging the tech we
• 0:34
  Speaker 1: use every single day.
• 0:36
  Speaker 2: It's a constantly evolving landscape.
• 0:38
  Speaker 1: So our mission today is to unpack these layers, understand
• 0:41
  Speaker 1: the crucial details. We've got material on how the FBI
• 0:44
  Speaker 1: tackles criminals trying to hide using things like tor and VPNs.
• 0:48
  Speaker 2: And even surprisingly how they're using things like push notifications
• 0:51
  Speaker 2: from our smartphones. It's quite eye opening, it really is.
• 0:55
  Speaker 1: So let's start with that first challenge. How does the
• 0:57
  Speaker 1: FBI deal with criminals who are actively trying to mask
• 1:00
  Speaker 1: their online presence.
• 1:02
  Speaker 2: Well, it's a major hurdle when those traditional methods, you know,
• 1:05
  Speaker 2: tracking IP addresses and standard digital forensics hit a wall.
• 1:09
  Speaker 2: The FBI actually has a specialized team. Think of them
• 1:12
  Speaker 2: as highly skilled government hackers.
• 1:15
  Speaker 1: Okay hackers, So when someone's really good at covering their tracks.
• 1:19
  Speaker 2: Precisely. We saw this example, didn't we? This person called
• 1:22
  Speaker 2: mo issuing bomb threats across the US and apparently very
• 1:26
  Speaker 2: good at staying anonymous.
• 1:28
  Speaker 1: Right, the usual steps just weren't working. So what did
• 1:31
  Speaker 1: this special team do?
• 1:32
  Speaker 2: This is where it gets interesting. They can deploy well
• 1:35
  Speaker 2: advanced malware. In most case, they actually sent it via
• 1:38
  Speaker 2: an email using classic phishing tactics to trick him into
• 1:42
  Speaker 2: installing it on his computer.
• 1:44
  Speaker 1: Wow, so old school phishing meets high tech malware exactly.
• 1:48
  Speaker 2: And once that software was on his machine, it wasn't passive.
• 1:51
  Speaker 2: It could send back his location information is browsing history.
• 1:55
  Speaker 1: Okay, that's significant intel. But there was more, wasn't there?
• 1:59
  Speaker 1: Something quite controversial?
• 2:01
  Speaker 2: Yes, the capability to activate the computer's webcam, and crucially
• 2:05
  Speaker 2: without the indicator light. Turning on that little light we
• 2:08
  Speaker 2: all rely on WHOA.
• 2:10
  Speaker 1: Okay, that definitely raises some major privacy flags. Turning on
• 2:13
  Speaker 1: someone's webcam secretly huge flags.
• 2:16
  Speaker 2: Now, the line is that this is supposedly reserved for
• 2:19
  Speaker 2: the absolute highest threats and it requires a warrant.
• 2:22
  Speaker 1: But is that always the case? We saw some indication
• 2:25
  Speaker 1: that warrants weren't always obtained right, which begs the question
• 2:29
  Speaker 1: of legal basis.
• 2:30
  Speaker 2: It does raise serious questions about oversight. In fact, there
• 2:34
  Speaker 2: was even an instant sighted where a federal magistrate specifically
• 2:38
  Speaker 2: rejected an FBI request for this type.
• 2:40
  Speaker 1: Of surveillance on what grounds.
• 2:42
  Speaker 2: Called it extremely intrusive and importantly a potential violation of
• 2:47
  Speaker 2: the Fourth Amendment, the protection against unreasonable searches.
• 2:50
  Speaker 1: So there's pushback from the judiciary sometimes, but it's not
• 2:53
  Speaker 1: always a guarantee.
• 2:54
  Speaker 2: It seems that way. It shows the tension there.
• 2:56
  Speaker 1: Okay, let's shift gears a bit. Talk about tore the
• 2:59
  Speaker 1: onion router. People use this specifically for anonymity, routing traffic
• 3:03
  Speaker 1: through all those encrypted layers.
• 3:05
  Speaker 2: That's the goal, Yeah, to make it incredibly difficult to
• 3:08
  Speaker 2: trace back where the connection started by bouncing it through
• 3:11
  Speaker 2: this volunteer network like peeling an onion. Hence the name.
• 3:14
  Speaker 1: But as you said, it's not foolproof.
• 3:16
  Speaker 2: Not entirely. Sloppy user habits maybe clicking on bad links
• 3:20
  Speaker 2: or even vulnerabilities discovered in the TOR software itself can
• 3:24
  Speaker 2: create openings.
• 3:25
  Speaker 1: So how does law enforcement like the FBI try to
• 3:27
  Speaker 1: get around tour We saw the Silk Road takedown mentioned
• 3:30
  Speaker 1: that was a big one.
• 3:31
  Speaker 2: A huge one. In that case, reports suggest they exploited
• 3:35
  Speaker 2: a flaw specifically in the tor browser software, using something
• 3:39
  Speaker 2: called a NIT, a network investigative technique. It yeah, basically
• 3:44
  Speaker 2: a tool that takes advantage of a software weakness. In
• 3:47
  Speaker 2: the Silk Road case, it apparently allowed them to uncover
• 3:50
  Speaker 2: the real IP address of the server bypassing the tour protection.
• 3:54
  Speaker 1: So finding a crack in the code itself pretty much.
• 3:57
  Speaker 2: It highlights that ongoing tech arms race.
• 3:59
  Speaker 1: What about other methods? Traffic correlation and timing attacks sounded complex.
• 4:03
  Speaker 2: They are and resource intensive. The idea is, even if
• 4:06
  Speaker 2: the data inside tour is encrypted, you can try to
• 4:09
  Speaker 2: watch the patterns outside tour. You monitor traffic going into
• 4:13
  Speaker 2: the network at known entry points and traffic coming out
• 4:16
  Speaker 2: at exit points. Okay, if you monitor enough traffic, you
• 4:19
  Speaker 2: might see patterns like the timing and size of data
• 4:21
  Speaker 2: packets that let you correlate the entry and exit streams.
• 4:24
  Speaker 2: You infer Ah, this traffic entering here is likely the
• 4:27
  Speaker 2: same traffic leaving there.
• 4:28
  Speaker 1: But that sounds like it needs massive surveillance capabilities.
• 4:31
  Speaker 2: Absolutely significant resources and access to large parts of internet infrastructure.
• 4:37
  Speaker 2: Not easy.
• 4:38
  Speaker 1: Then there's running their own exit nodes. How does that work?
• 4:41
  Speaker 2: Right? So the exit node is the last hop in
• 4:43
  Speaker 2: the tour chain before your traffic hits the regular Internet.
• 4:47
  Speaker 2: If the website you're visiting isn't using HTTPS, that final
• 4:51
  Speaker 2: leg of the journey is unencrypted.
• 4:52
  Speaker 1: Ah okay.
• 4:53
  Speaker 2: So if law enforcement runs some of these exit nodes themselves,
• 4:57
  Speaker 2: they can potentially intercept and read that crypti traffic as
• 5:01
  Speaker 2: it leaves Tour. It doesn't directly reveal who sent it,
• 5:04
  Speaker 2: but it shows what they were accessing.
• 5:06
  Speaker 1: Giving them clues about the activity exactly.
• 5:08
  Speaker 2: Another piece of the puzzle.
• 5:09
  Speaker 1: And it seems like good old fashioned phishing and malware
• 5:12
  Speaker 1: are still in the toolkit even against tour users.
• 5:15
  Speaker 2: Definitely, Tour can't protect you if you're tricked into giving
• 5:17
  Speaker 2: up your info on a fake site, or if you
• 5:20
  Speaker 2: download and run malware. If they get that malicious software
• 5:23
  Speaker 2: onto your device, it can just bypass Tour altogether and
• 5:26
  Speaker 2: phone home with your real IP address.
• 5:29
  Speaker 1: Makes sense. It's not just tech versus tech, though. Legal
• 5:32
  Speaker 1: tools are still vital. Subpoenas and things.
• 5:35
  Speaker 2: Oh, absolutely, they can issue legal orders, subpoenas, warrants to
• 5:38
  Speaker 2: compel companies like email providers, website hosts, maybe even crypto
• 5:42
  Speaker 2: exchanges to hand over user data they might hold.
• 5:45
  Speaker 1: So even if the tour traffic itself is hidden, maybe
• 5:48
  Speaker 1: the user signed up for a service using a real
• 5:50
  Speaker 1: email or paid for something precisely.
• 5:53
  Speaker 2: Those other digital breadcrumbs can be crucial in connecting the
• 5:56
  Speaker 2: dots back to an individual.
• 5:57
  Speaker 1: And we've seen this work right growed Operation Pacifier, targeting,
• 6:02
  Speaker 1: child exploitation, alphabet market. The FBI has had successes.
• 6:06
  Speaker 2: They certainly have. These are significant takedowns. By the way,
• 6:09
  Speaker 2: if you're finding this deep dive valuable, please do consider
• 6:12
  Speaker 2: giving Beyond Infographics a five star rating. It really helps
• 6:15
  Speaker 2: us keep producing this kind of analysis.
• 6:17
  Speaker 1: Good point, But these methods aren't fool proof either, are they.
• 6:21
  Speaker 2: No, not at all. They often require immense resources, top care,
• 6:25
  Speaker 2: technical skill, sometimes a bit of luck, and frequently they
• 6:29
  Speaker 2: rely on the target making a mistake. For an average
• 6:32
  Speaker 2: person just seeking privacy, tour is generally still quite effective.
• 6:36
  Speaker 1: Okay, let's broaden out again. Beyond tour people use VPNs
• 6:41
  Speaker 1: proxies lots of ways to try and hide their real
• 6:44
  Speaker 1: IP address. The FBI is always looking for ways around
• 6:48
  Speaker 1: these two constantly.
• 6:49
  Speaker 2: It's a core challenge in cybercrime investigations and finding the
• 6:53
  Speaker 2: IP isn't always the endgame. We saw that example of
• 6:55
  Speaker 2: Slavic in Russia, the guy behind the Zeus Trojan right.
• 6:59
  Speaker 1: They knew who he was generally where he was.
• 7:01
  Speaker 2: But he was in Russia, a country without a straightforward
• 7:03
  Speaker 2: extradition treaty for these kinds of cases, so identification didn't
• 7:07
  Speaker 2: mean arrest.
• 7:08
  Speaker 1: It becomes a waiting game sometimes, like Roman Selesnov. They
• 7:11
  Speaker 1: eventually nabbed him when he traveled to the maldi Use.
• 7:14
  Speaker 2: Exactly, they waited for him to travel to a country
• 7:16
  Speaker 2: where they could execute an arrest warrant an extrad item.
• 7:18
  Speaker 1: Jurisdiction is key, So let's talk about specific tactics against, say,
• 7:23
  Speaker 1: fraudulent emails when people are hiding their ips. The fake
• 7:26
  Speaker 1: FedEx site was an interesting one.
• 7:28
  Speaker 2: Yeah, that was kind of a honeypot approach. They likely
• 7:31
  Speaker 2: set up a fake track stage and made sure the
• 7:33
  Speaker 2: link was sent out in the fraudster's own spam emails.
• 7:36
  Speaker 2: And the trick was the fake site was configured to
• 7:39
  Speaker 2: block access from known VPNs proxies or tor exit notes.
• 7:43
  Speaker 2: The hope was the criminals would click their own link
• 7:45
  Speaker 2: to check it get blocked, and then try again without
• 7:49
  Speaker 2: their anonymity tool.
• 7:50
  Speaker 1: Turned on, revealing their real IP. Clever but maybe easy
• 7:54
  Speaker 1: to spot if you're paranoid.
• 7:56
  Speaker 2: Possibly. But then there was that other method, the one
• 7:59
  Speaker 2: used on the Russian hacker, supposedly run by authorities, that
• 8:02
  Speaker 2: seemed more subtle.
• 8:03
  Speaker 1: Right the tchas tell us about that.
• 8:06
  Speaker 2: Okay, so imagine this form. If you connected normally, it
• 8:09
  Speaker 2: was fine, but if you connected using a VPN proxy
• 8:13
  Speaker 2: or tour you were bombarded with really difficult, annoying capitcha
• 8:18
  Speaker 2: puzzles over and over again.
• 8:20
  Speaker 1: Just making it a massive pain to use the site
• 8:22
  Speaker 1: while anonymous.
• 8:23
  Speaker 2: Exactly. The official reason was security, you know, fighting bots,
• 8:26
  Speaker 2: but the practical effect was to make using anonymity tools
• 8:29
  Speaker 2: incredibly inconvenient, And then.
• 8:31
  Speaker 1: They nudged people towards using Russian IP.
• 8:33
  Speaker 2: Addresses, sort of subtly encouraged it. Yes, because Internet providers
• 8:38
  Speaker 2: in Russia often have legal obligations to cooperate with authorities
• 8:41
  Speaker 2: and share user data, so.
• 8:43
  Speaker 1: They didn't tell people to turn off their VPNs. They
• 8:45
  Speaker 1: just made it super annoying not to and steered them
• 8:47
  Speaker 1: towards connections that were less private anyway.
• 8:49
  Speaker 2: A pretty ingenious bit of social engineering, really making inconvenience
• 8:54
  Speaker 2: a weapon for de anonymization.
• 8:56
  Speaker 1: Okay, wow, now left it to something maybe even more surprising,
• 9:00
  Speaker 1: leveraging push notifications from our phones.
• 9:02
  Speaker 2: Yeah, this is relatively new territory, it seems. Those little
• 9:05
  Speaker 2: alerts that pop up from apps all day long.
• 9:07
  Speaker 1: How can those be used for tracking?
• 9:10
  Speaker 2: Well, every app installation on your specific phone gets a
• 9:13
  Speaker 2: unique push token. Think of it as a unique address
• 9:17
  Speaker 2: for that app on your device, used by platforms like
• 9:19
  Speaker 2: Google and Apple to send the notification.
• 9:22
  Speaker 1: Like a digital mailbox for each app.
• 9:24
  Speaker 2: That's a good analogy, and these tokens, these unique identifiers
• 9:28
  Speaker 2: can apparently be requested by law enforcement from the tech
• 9:31
  Speaker 2: giants under legal order, of course.
• 9:33
  Speaker 1: And how does that token link back to a person?
• 9:36
  Speaker 1: We saw an Affidavid mention tracing an email address via
• 9:40
  Speaker 1: a push token.
• 9:41
  Speaker 2: Right, So, when you sign up for an app, maybe
• 9:44
  Speaker 2: using your Google or Apple account, that push token often
• 9:47
  Speaker 2: gets associated with your account information in the platform's back
• 9:51
  Speaker 2: end systems. That could include the email address link to
• 9:54
  Speaker 2: the account, sometimes the IP address used during setup, and.
• 9:58
  Speaker 1: Potentially even location data associated with the account or device.
• 10:02
  Speaker 2: Potentially, Yes, the token itself might not contain location data,
• 10:06
  Speaker 2: but the account it's linked to might or the IP
• 10:08
  Speaker 2: address history might help geolocate. It gives investigators a powerful
• 10:13
  Speaker 2: link between an anonymous app activity and a real world account.
• 10:16
  Speaker 1: Again, this isn't just happening freely, right, Warrants are needed.
• 10:19
  Speaker 2: Yes, the information strongly indicates that legal processes like warrants
• 10:22
  Speaker 2: or court orders are required, and it seems to be
• 10:25
  Speaker 2: used in really serious cases child exploitation, terrorism, kidnapping.
• 10:30
  Speaker 1: And there are concrete examples cases solved using this.
• 10:33
  Speaker 2: We saw mentions, Yes, an arrest in a child exploitation
• 10:37
  Speaker 2: case link through an app's push token, perpetrators identified in
• 10:41
  Speaker 2: a kidnapping and murder using a communication apps token. It
• 10:44
  Speaker 2: shows this is actively being deployed.
• 10:46
  Speaker 1: So the obvious question then is if I just turn
• 10:49
  Speaker 1: off push notifications for my apps, does that stop this?
• 10:52
  Speaker 2: It seems probably not Entirely. Disabling the alert you see
• 10:57
  Speaker 2: on your screen doesn't necessarily delete the underlying push token
• 11:01
  Speaker 2: or the fact that it's registered and associated with your
• 11:04
  Speaker 2: accountant device.
• 11:04
  Speaker 1: Ah Okay, the identifier still exists, right.
• 11:07
  Speaker 2: The token is more fundamental to how the app communicates
• 11:10
  Speaker 2: with the platform, and as we've seen, investigators rarely rely
• 11:14
  Speaker 2: on just one method They correlate data from multiple.
• 11:17
  Speaker 1: Sources, so turning off notifications might reduce some data flow,
• 11:20
  Speaker 1: but it's not an invisibility cloak.
• 11:22
  Speaker 2: Not likely. No tracking is usually multifaceted.
• 11:25
  Speaker 1: Man, It's really clear the whole landscape of digital privacy
• 11:28
  Speaker 1: versus law enforcement is incredibly complex and always shifting. These
• 11:32
  Speaker 1: techniques go way beyond just looking up an IP address.
• 11:35
  Speaker 2: Absolutely, it highlights this intricate dance between security, privacy and
• 11:41
  Speaker 2: the technology that's just woven into our lives now.
• 11:43
  Speaker 1: So as you can see, Beyond Infographics really tries to
• 11:47
  Speaker 1: live up to the name. We've gone from basic phishing
• 11:51
  Speaker 1: tactics all the way to sophisticated denonymization methods and using
• 11:55
  Speaker 1: everyday tech like push notifications in surprising ways.
• 11:59
  Speaker 2: We really hope this deep has given everyone listening a richer,
• 12:02
  Speaker 2: more nuanced understanding of how digital investigations actually happen today.
• 12:06
  Speaker 2: This is fascinating intersection of tech skill and legal frameworks,
• 12:10
  Speaker 2: and it raises some big questions.
• 12:12
  Speaker 1: Definitely, and if you found this kind of exploration valuable
• 12:14
  Speaker 1: getting the real story beyond the headlines, please do consider
• 12:17
  Speaker 1: giving Beyond inf Graphics that five star rating. It genuinely
• 12:20
  Speaker 1: helps us bring more deep dives like this to you.
• 12:23
  Speaker 2: Your support makes a difference.
• 12:24
  Speaker 1: So thinking about everything we've discussed, this exploration into digital
• 12:29
  Speaker 1: tracking really leaves us with a significant question, doesn't it.
• 12:33
  Speaker 1: As technology keeps racing forward, how is that balance the
• 12:36
  Speaker 1: balance between legitimate law enforcement needs and our fundamental right
• 12:40
  Speaker 1: to individual privacy. How is that going to evolve?
• 12:43
  Speaker 2: That's the multi billion dollar question, isn't it, And something
• 12:45
  Speaker 2: definitely worth pondering long after this discussion ends.