In 2013, the FBI seized servers belonging to Freedom Hosting Network (FHN), an ISP hosting a variety of websites only visible on the anonymous Tor network. The servers were seized because child pornography was hosted on one of its websites, unbeknownst to FHN. As a part of its investigation, the agency infected the server with Network Investigation Technique (NIT) software.
NIT behaves much like malware, installing itself secretly, without a user's knowledge.
An FBI warrant enabling the deployment of NIT ran from the end of July 2013 to August 5 of that year. On August 4, a TorMail user noticed that an email service website hosted on the same Freedom server, attempted to install unwanted software later found to be similar to NIT used by the agency.
TorMail, a free email service used by thousands, including activists and journalists, is not affiliated with the Tor Project, or pornography of any kind. Nonetheless, users were infected, stated the ACLU representative.
"There is reason to believe… that the malware warrant issued by this Court on July 22, 2013, was the source of authority for the deployment of malware not just against [child pornography defendant,] but across Freedom Hosting websites and services — which had thousands of users — including against innocent users of TorMail," according to the ACLU filing.
The organization says that public debate on the potentially illegal malware infection is not possible because docket sheets for the case have been sealed by the court. Docket sheets would explain general procedural information about which judge issued the warrant, claimed the ACLU representative.
"The sealing of the docket sheet associated with the July 22, 2013, warrant prevents these concerns from being aired and debated publicly. Indeed, it prevents the public from learning or confirming even the most basic facts about the deployment of malware for law-enforcement purposes: the fact of judicial approval is unconfirmed; any reasoning supporting such approval is inaccessible; even the reasons for precluding public access are themselves inaccessible," reads the filing.
