Is it beyond the pale for law enforcement to impersonate the press?
by Joe Mullin
In 2007, the FBI wrote a fake news story about bomb threats in Thurston County, Washington, and then sent out e-mail links "in the style of the Seattle Times."
The details have now been published by that very same newspaper, which today carries a story including outraged quotes from a Seattle Times editor. The FBI put an Associated Press byline on the fake news story, which was about the bomb threats in Thurston County that they were investigating.
“We are outraged that the FBI, with the apparent assistance of the US Attorney’s Office, misappropriated the name of The Seattle Times to secretly install spyware on the computer of a crime suspect,” said Seattle Times editor Kathy Best. "Not only does that cross a line, it erases it."
The information comes from documents about the 2007 FBI operation, which were acquired via a Freedom of Information Act request and published by the Electronic Frontier Foundation in 2011. It wasn't until yesterday that ACLU Technologist Christopher Soghoian noted The Seattle Times/AP reference and published it on Twitter. That spurred the newspaper to express its outrage and get FBI response.
"Every effort we made in this investigation had the goal of preventing a tragic event like what happened at Marysville and Seattle Pacific University,” Frank Montoya Jr., special agent in charge of the FBI in Seattle, told the newspaper. "We identified a specific subject of an investigation and used a technique that we deemed would be effective in preventing a possible act of violence in a school setting. Use of that type of technique happens in very rare circumstances and only when there is sufficient reason to believe it could be successful in resolving a threat."
Police in Lacey, Washington, contacted the FBI after a series of bomb threats were placed to Timberline High School in May and June of 2007.
The FBI e-mailed the fake news story via a link to a suspect's MySpace account. When the suspect clicked on the link, FBI software revealed his location and IP address to agents working the case. A juvenile suspect, who was not named by The Seattle Times, was arrested on June 14, 2007.
A month later, the student was sentenced to 90 days' juvenile probation and ordered to pay $8,852 to compensate the school for additional security.
The fact that the FBI had used this type of "phishing" attack was noted by Ars and other outlets, but it wasn't known until yesterday that the FBI had impersonated a newspaper as bait.
"I remember reading about it at the time and wondering, 'How do they get people to click on their stupid links?'" Soghoian told The Stranger.
"We hope that this mistake in judgment by the FBI was a one-time aberration and not a symptom of a deeper lack of respect for the role of a free press in society," said Best in her e-mailed comments.
One press advocate thought that was unlikely.
"As outrageous as it is, secretly impersonating newspapers to send malware probably works," wrote Trevor Timm, of the Freedom of the Press Foundation. "You can bet the FBI has done this more than once."