Intruder alert: FBI tackles 'isolated' IT security breach

The FBI claims it has dealt with a cybersecurity "incident" that reportedly involved computer systems being used to investigate child sexual exploitation. "The FBI is aware of the incident and is working to gain additional information," a spokesperson said in a statement to The Register. "This is an isolated incident that has …

[Anonymous Coward]

To be fair it was isolated. Isolated to their network.

[Anonymous Coward]

"After the FBI seizes suspects' devices, they are scanned for malware or other malicious files prior to processing data with specialized forensic software"

So if it evaded FBI malware detectors it must have been the Isreali's at it again. StuxNet II - The Revenganing.

[DS999]

If you're looking for kiddie porn

Somewhere in the FBI there is probably the biggest storehouse of it in the world, to allow them to compare to known images and help trace those trading it etc. If they manage to steal that stash, I doubt the FBI brass will be wanting to make that public.

[b0llchit]

Re: If you're looking for kiddie porn

Those bastard organised perverts. We should raid their offices and confiscate all their kiddie porn asap!

Oh, wait...

[stiine]

Re: If you're looking for kiddie porn

Why wait?

[Korev]

Defence?

If the FBI's child pornography system have been compromised, could that mean that an enterprising defence lawyer defending a paedophile could claim the systems have been tampered with and that the evidence is invalid?

[WolfFan]

Re: Defence?

I suspect that if someone tried that, he’d have to demonstrate that the compromised files included the files his boy was accused of using, and, perhaps, exactly how he knew which files were hacked.

[veti]

Re: Defence?

No, all he needs to do is show that the evidence against the perp doesn't meet the standard of proof "beyond reasonable doubt". That is to say, it is "reasonable" to doubt that the evidence has been faithfully preserved and accurately documented.

Then it's up to the prosecutors to show that the evidence is clean.

[stiine]

Re: Defence?

Which they can no longer do.

This begs the question of 'has the FBI informed every prosecutor for every case in which they hold evidence of this sort? And have those prosecutors notified the presiding judges?

If you pay attention to American legal fuckups, you'll know that police in both Massachusetts (24k cases overturned) and New York (378 cases and millions and millions of dollars in lawsuits) have problems following the law.

[An_Old_Dog]

Assumption Alert

the infected or infiltrated devices are likely contained to a forensic analysis network.

This statement presupposes an iinfected device confiscated by the FBI was the vector of the attack. TFA says, "reportedly involved computer systems being used to investigate child sexual exploitation." Involved is not the same as were the only FBI devices/computers compromised.

The FBI has some extremely-sharp computer people, very-well trained, and equipped with cutting edge-software. But that's not true of the agency as a whole, nor of all their agents and support staff. I wouldn't be surprised if someone fell prey to a phishing email, or found a cool-looking USB drive left on a bartop, and brought it in.

[An_Old_Dog]

Re: Assumption Alert Correction (Sorry, you can no longer edit this post.)

the infected or infiltrated devices are likely contained to a forensic analysis network.

This statement presupposes an iinfected device confiscated by the FBI was the vector of the attack. TFA reads, "reportedly involved computer systems being used to investigate child sexual exploitation." Technically-speaking, any FBI-owned/rented/leased laptop, desktop, or server could fall into that group. (This also includes any computer providing the FBI cloud-based or contracted services.)

The FBI has some extremely-sharp computer people, very-well trained, and equipped with cutting edge-software. But that's not true of the agency as a whole, nor of all their agents and support staff. I wouldn't be surprised if someone fell prey to a phishing email, or found a cool-looking USB drive left on a bartop, and brought it in.