Just got this in email -- I thought it might be of interest to the readership.
Perry Date: Tue, 23 Nov 2004 17:41:49 -0800 From: Fyodor <[EMAIL PROTECTED]> To: [EMAIL PROTECTED] Subject: FBI Subpoenas Message-ID: <[EMAIL PROTECTED]> Dear Nmap hackers, Let me first wish you Americans a happy Thanksgiving. Meanwhile, I'm hard at work on a holiday Nmap version which should be available by Christmas. But enough pleasantries -- I want to discuss a sobering topic. With increasing regularity this year, FBI agents from all over the country have contacted me demanding webserver log data from Insecure.Org. They don't give me reasons, but they generally seem to be investigating a specific attacker who they think may have visited the Nmap page at a certain time. If they see that an attacker ran the command "wget http://download.insecure.org/nmap/dist/nmap-3.77.tgz"; from a compromised host, they assume that she might have obtained that URL by visiting the Nmap download page from her home computer. So far, I have never given them anything. In some cases, they asked too late and data had already been purged through our data retention policy. In other cases, they failed to serve the subpoena properly. Sometimes they try asking without a subpoena and give up when I demand one. One can argue whether helping the FBI is good or bad. Remember that they might be going after spammers, cyber-extortionists, DDOS kiddies, etc. In this, I wish them the best. Nmap was designed to help security -- the criminals and spammers put my work to shame! But the desirability of helping the FBI is immaterial -- I may be forced by law to comply with legal, properly served subpoenas. At the same time, I'll try to fight anything too broad (like if they ask for weblogs for a whole month). Protecting your privacy is important to me, but Nmap users should be savvy enough to know that all of your network activity leave traces. I'm not the only one who gets these subpoenas -- large ISPs and webmail providers receive them daily. Most other major security sites probably do too. Most of you probably don't care if someone finds out that you downloaded Nmap, Nessus, Hping2, John the Ripper, etc. Nothing on Insecure.Org is illegal. But for those of you who do care, there are plenty of mechanisms available to preserve your anonymity. Remember this security mantra: defense in depth. Cheers, Fyodor -------------------------------------------------- For help using this (nmap-hackers) mailing list, send a blank email to [EMAIL PROTECTED] . List archive: http://seclists.org --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to [EMAIL PROTECTED]
