FBI mystery man Scott Andrew Shain was sentenced to 30 months in prison.
Articles:
Earlier articles:
FBI Mystery Man ID Thief Sentenced
Leave a reply
Tag Archives: FBI
FBI mystery man identified
The Federal Bureau of Investigation has allegedly identified the “mystery man” who has as many as 32 aliases. He is identified as Scott Andrew Shain.
Articles:
John Doe identified as Boston man
Six new photos of FBI’s Seattle mystery man
Fake fingerprints, multiple aliases, in FBI custody; name=??
Six new photos of FBI’s Seattle mystery man
The FBI has released several more photos of the career identity thief but they still don’t know who he is. The FBI is asking anyone who knows this person to call them at 206-622-0460.
Aliases: William Everett Gee, Robert Allen Lowe, Robert Allan Loew, Dwayne Spill
Click on photo for larger image
Fake fingerprints, multiple aliases, in FBI custody; name=??
The FBI has taken a career identity thief into custody in Seattle. Problem is, they have no idea who it is.
Aliases: William Everett Gee, Robert Allen Lowe, Robert Allan Loew, Dwayne Spill
More on this FBI web site (now a dead link)
Update: Six new photos released
Stories:
InfraGard like Neighborhood Watch
Copy of a comment made on another blog that demonstrated a deep distrust for InfraGard and all national and local law enforcement…
David, your comments seem to indicate that you are distrustful of InfraGard. I want to challenge your distrust and suggest that you join InfraGard and find out for yourself that your fears are unfounded. We are all ordinary people – the only thing that makes us different is that we recognize the fact that we need to learn more about how to protect our citizens and assets.
We are not a ‘secret organization’. We do not have security clearances, and InfraGard membership does not grant us any such clearance. A good way to describe InfraGard is to liken it to a “Neighborhood Watch“, but instead of being aligned with neighborhoods we are aligned with industries. And like neighborhood watch, InfraGard members are equipped with knowledge on how to better deter, recognize, and report criminal activity. InfraGard helps the financial, agriculture, public utilities, telecommunications, transportation, chemical, and other industries with critical asset protection. These are the core industries that our nation depends on every day.
What it really comes down to is this: do you want criminal activity curbed, or not? Or perhaps you would prefer to live in a society without law enforcement at all – your blog suggests a deep distrust and disregard for all levels of law enforcement. Do you not recognize that, imperfect as it is, law enforcement protects your own liberties?
As to InfraGard’s Code of Ethics – my including it in my blog does not reassure myself, as I have a well-formed and clean conscience with regards to my professional conduct. I do not need the reassurance. It’s posted as an educational tool for others who are considering a career in information and business security. In this profession we are held to a high standard of professional conduct – higher than those of our peers, in the context of protecting our employers’ and country’s citizens and assets.
Todd’s position at King County Health does not give the FBI “access” to public medical information – the FBI, like any other law enforcement agency, must obtain a subpoena to access protected information.
I spoke with Nolan and Jeff – they are puzzled as to why you label them as InfraGard “recruiters”. They are ordinary members like the rest of us. All of us recognize InfraGard’s good works and benefits of membership (access to sensitive non-public (but not classified) information, training in the protection of our country’s critical infrastructure, networking with other members), and as such we frequently encourage our colleagues and acquaintances to join. InfraGard is just like a good Neighborhood Watch – most participants immediately recognize the benefits and encourage other neighbors to join.
InfraGard’s work benefits all citizens – so instead of sitting on the sidelines and criticizing what you don’t understand, why don’t you join us. We and your neighbors could use your help.
Q&A on FBI’s CIPAV
Great Computerworld article on CIPAV. And there’s more to come: Computerworld filed a FOIA (USDOJ site here) request to get more information.
Questions answered include:
- What is CIPAV?
- What does CIPAV do?
- What happens to the data the CIPAV collects?
- Does the CIPAV capture keystrokes?
- Can the CIPAV spread on its own to other computers, either purposefully or by accident?
- Does CIPAV erase itself after its job is done?
- Does the FBI have just one stock CIPAV model?
- How did the CIPAV get onto the targeted computer?
- Is CIPAV related to “Magic Lantern”?
Full article here:
http://www.computerworld.com/action/article.do?command=viewArticleBasic&articleId=9028298
Disclaimer/disclosure: I’m an InfraGard member. In my writing about CIPAV, I’m providing only information that has already been published.
my personal position on the FBI’s CIPAV capability
In the days since I posted a story on the FBI’s use of CIPAV (which may be their “magic lantern” capability), my blog has been visited by many individuals who are trying to figure out how to detect whether CIPAV is running on their systems and, if so, how to disable or remove it.
Sorry, can’t help you. Won’t help you.
As a security professional, I deeply understand the concern about spyware, key loggers, and other tools that track our movements and even our keystrokes. When they originate from commercial or malicious sources, of course I want the ability to detect, disable, and remove. I wrote a book on the subject three years ago.
But when law enforcement obtains a court order and uses the same sort of software, I will not publicly discuss if such capabilities exist or how they work. Being an InfraGard board member, I have visibly close ties with the FBI and other branches and levels of law enforcement. As my disclaimer reads, I am 100% white hat. I support law enforcement as long as law enforcement is acting within established laws. My disclaimer is reproduced below.
My professional codes of ethics ((ISC)², ISACA, GIAC, InfraGard) forbid me from activities that give even the appearance of impropriety. Hence, I do not possess, and never have possessed, nor downloaded, examined, or viewed, any tools that can be used to exploit weaknesses. I do not associate with those who do. I am 100% white hat.
Policeware: the spyware that aids law enforcement
Policeware is the new term to describe spyware that is used by law enforcement to gather evidence in law enforcement investigations.
It is highly likely that anti-virus and anti-spyware software will look the other way if they detect policeware. Or, more likely, they won’t carry signatures for policeware at all.
So will it be possible to detect policeware? Possibly. I think that policeware will be the backdrop for the next cat-and-mouse game between law enforcement and the underworld.
Hackers are anxious to get a copy of CIPAV, the investigative tool (that gets installed on a suspect’s PC) used by the FBI to log outbound TCP/IP connections. Certainly they will device tools to detect and block CIPAV and other such tools. In fact, this may be history as I write this – the capability to detect and remove CIPAV may already exist. And given that Magic Lantern and Carnivore have been around for several years, I can’t help but wonder if tools exist to detect its activities.
FBI implanted spyware leads to arrest of bomb threat suspect
Submit: 
The FBI used a novel type of remotely installed spyware last month to investigate who was e-mailing bomb threats to a high school near Olympia, Wash.
Federal agents obtained a court order on June 12 to send spyware called CIPAV to a MySpace account suspected of being used by the bomb threat hoaxster. Once implanted, the software was designed to report back to the FBI with the Internet Protocol address of the suspect’s computer, other information found on the PC and, notably, an ongoing log of the user’s outbound connections.
My earlier blog entry on whether anti-virus can detect law enforcement-installed malware.
Entire story here:
AV vendors will block law enforcement key loggers, for now
Updated 7/19/07: FBI nabs bomb threat suspect with spyware
Updated 7/19/07: Policeware: the spyware used by law enforcement
A recent case that was heard by the U.S. Court of Appeals involved law enforcement use of a key logger on a suspect’s computer. The case involved a suspected illicit drug maker that was under investigation by the U.S. Drug Enforcement Agency (DEA). The DEA obtained permission from a judge to install key logging software on the suspect’s computer in order to harvest passwords for PGP and Hushmail encryption.
This case highlights a question that I’ve been thinking about for years: would my anti-virus program alert me to the presence of key logger software, even if it was installed by law enforcement? C|Net News interviewed representatives from several anti-virus/malware companies and got answers to that question. Would the following vendors’ programs detect key loggers even if installed by law enforcement?
▪ Grisoft/AVG: Yes
▪ Checkpoint: Yes
▪ Computer Associates: Yes
▪ eEye: Yes
▪ IBM: Yes
▪ Kaspersky: Yes
▪ McAfee: Yes
▪ Microsoft: Yes
▪ Sana: Yes
▪ Sophos: Yes
▪ Symantec: Yes
▪ Trend Micro: Yes
▪ Websense: Yes
C|Net News also asked these vendors if they had ever received requests from law enforcement (including subpoenas) that their products not inform a specific user of the presence of a law enforcement installed key logger. Some of the companies have a policy to not discuss specific dealings with law enforcement – and the rest said they had received no such request.
I am wondering just now – what would McAfee, Trend, Symantec, or any of the others do if law enforcement DID request / require that their products not report the presence of a key logger. How would they accomplish that feat? I can imagine a number of scenarios on how that would be accomplished:
- The specific anti-virus vendor would design in a mechanism that would silence the software’s alert of a key logger if it received a specific signal from the vendor’s update service. To accomplish this, the vendor would have to know precisely which PC should be silenced, and be able to do so silently.
Other, less serious, alternatives come to mind:
- Law enforcement could sneak into the suspect’s computer and run a program that would disable anti-virus programs’ ability to detect or report the presence of the key logger. I can easily imagine malware that would perform the same disabling feature in order to hide its own key logger. Some malware already has the ability to completely shut down anti-virus programs, firewalls, and so on, so this capability is not that far-fetched.
- Law enforcement could send an e-mail to the suspect, where the e-mail either contained an executable, or a URL to a law enforcement website. “Please run this program or visit this web site so that we can install a key logger for you.” Uh huh.
Remember: anything that law enforcement can do, hackers can do. In fact, hackers are often one step ahead of law enforcement, experienced with the illicit installation of key loggers.
Anyway, I can imagine a future where law enforcement may have the ability to get key loggers onto computers, and at the same time get anti-malware programs to look the other way. But I expect that there will be capabilities of detecting and disabling such key loggers: hackers are notoriously anti-law enforcement and they would quickly fill the need to detect and block law enforcement key loggers.
In the meantime I can think of a few countermeasures:
- Regularly scan your computer with one of several available online malware scanners (see this tip for more information).
- Run one or more anti-rootkit programs to scan for rootkits (I feel that key loggers and/or the means for blocking anti-malware’s alerting it may be done by rootkits).
- Switch your OS: use MacOS or Linux instead of Windows.
I have a feeling that the Electronic Frontier Foundation and the ACLU will be watching these developments.
Links to stories:
Peter H. Gregory 