FBI Pulls Security Expert Off Flight

[DIYPatriot]

Incredible. This is like interrogating the surgeon general for saying smoking causes cancer. Great job, FBI - you should be so proud. What does it say for our government when they begin confiscating the tools from the guardians who are diligently doing their best to protect the flock from the wolves? SMH

One of the world’s foremost experts on counter-threat intelligence within the cybersecurity industry, who blew the whistle on vulnerabilities in airplane technology systems in a series of recent Fox News reports, has become the target of an FBI investigation himself.

Chris Roberts of the Colorado-based One World Labs, a security intelligence firm that identifies risks before they're exploited, said two FBI agents and two uniformed police officers pulled him off a United Airlines Boeing 737-800 commercial flight Wednesday night just after it landed in Syracuse, and spent the next four hours questioning him about cyberhacking of planes.

“If you don’t have people like me researching and blowing the whistle on system vulnerabilities, we will find out the hard way what those vulnerabilities are when an attack happens,” Roberts said.


Wednesday night, FBI agents confiscated Roberts’ numerous electronic devices and computer files including his laptop and thumb drives and demanded he give them access to his data. They wanted to forensically image his laptop, but it is a company-owned asset with client information, research and intellectual property, some of which is sensitive in nature and encrypted.

So after consulting with his CEO, Roberts told the agents they would need a warrant, something they still have not presented.

“You have one element in the FBI reaching out to people like me for help, but another element doing a hell of a job burning those bridges,” Roberts said. “Those of us who do threat research are doing it for the right reasons, and we work to build relationships with the intelligence community because we want to help them identify weaknesses before they become a problem.”

Roberts flew from Denver to Chicago to Syracuse at the invitation of a defense contractor to speak an aerospace conference about vulnerabilities in airplane systems, a topic Roberts commented on for Fox News in late March, when he said commercial and even military planes have an Achilles heel that could leave them vulnerable to hackers or terrorists on the ground due to flaws in the entertainment and satellite communications systems.

Roberts’ findings were featured on FoxNews.com, on Fox News Radio and on the Fox News show "On the Record with Greta Van Susteren" on March 19, 2015, and again on April 15, 2015.

Continued (http://www.foxnews.com/us/2015/04/17/security-expert-pulled-off-flight-by-fbi-after-exposing-airline-tech/)

[Javadrinker]

this is not very surprising, this is but one of several of the FBI 's tactics, Fantastic Bungling Idiots

[ddoering]

The Gestapo Maneuver. Now that's old school.

[Badger52]

The Gestapo Maneuver. Now that's old school.It's the 21st Century; at least do the Stasi update and have him arrive home to find his murdered dog in his bed.

[(1VB)compforce]

I'm going to disagree here. Yes, the guy has done consulting with several agencies. (Edit for accuracy- remove: That said, he got on a flight with the express intent to hack into their systems.) He tweeted that he was going to hack the avionics. He wasn't sanctioned by any agency to do this type of activity. He just (remove: got on the flight) was acting as a whistleblower.

(edit: we really need a strikethrough font for stuff like this)

Let's put this into another context. A lot of people get trained in intel every year by the military and OGA's. It's against the law to collect intel on a US citizen. What if one of the intel guys or gals decided to show how easy it is to collect intel on a public person after they are no longer serving. Should they be arrested since they performed the illegal activity without sanction by an agency? What if they were conducting a personal intel operation to identify ISIS sympathizers in the US? Should they be arrested?

I would argue that arrest would be appropriate in all three of the above situations.

This guy wasn't doing this on behalf of one of the agencies. He was on the plane tweeting about (remove performing) illegal, possibly dangerous, activities trying to gain notoriety for himself and his company. Put his ass in jail and make an example of him.

[Pete]

... That said, he got on a flight with the express intent to hack into their systems. He wasn't sanctioned by any agency to do this type of activity. He just got on the flight as a whistleblower......

Hm, yeah, anything in the story that supports your claim?

The story says he was on his way to deliver a talk on the subject and return.

[(1VB)compforce]

I read the story several other places. He tweeted the attached...

He also has actually done it in the past.

He found that a hacker could theoretically do it from a passenger seat. Every chair has a tiny computer and screen, and those are plugged into the airplane's CAN bus. Every vehicle has one. Think of it like a spine. It's how the brain communicates with the limbs. It's how your car accelerator talks to your engine's fuel injector.

But -- if it's not built just right -- it also means your plane passenger seat is ultimately connected to the pilot's cockpit.

Roberts said he eventually tested out the theory himself 15 to 20 times on actual flights. He'd pull out his laptop, connect it to the box underneath his seat, and view sensitive data from the avionics control systems.

http://money.cnn.com/2015/04/17/technology/security/fbi-plane-hack/index.html


I may not have said it well. Maybe he didn't go on to hack this particular plane, but he definitely set himself up. This would constitute a credible threat in my mind. Maybe not worth an arrest, but a questioning would definitely be in order.

I'd have picked him up too

[Flagg]

I read the story several other places. He tweeted the attached...

He also has actually done it in the past.


http://money.cnn.com/2015/04/17/technology/security/fbi-plane-hack/index.html


I may not have said it well. Maybe he didn't go on to hack this particular plane, but he definitely set himself up. This would constitute a credible threat in my mind. Maybe not worth an arrest, but a questioning would definitely be in order.

I'd have picked him up too

I'd be thinking that if he wasn't doing it as part of a sanctioned manufacturer/airline/FAA/government security assessment, or on a privately owned airliner IT "sandbox", then he may have gone WELL outside his realistic remit.

How does that differ with another passenger professionally employed in safety equipment fiddling around with airliner emergency O2 systems?

I'd also be thinking that his public sharing of such information could put him and his family at risk by bad people without the skillset to do what he does, but with the skillset to induce him to do bad things on their behalf.

Will be interesting to see how this turns out.

[ddoering]

It's against the law to collect intel on a US citizen.

Tell that to the NSA.

[Joker]

Quote:
Originally Posted by (1VB)compforce

It's against the law to collect intel on a US citizen.
Tell that to the NSA.

Tell that to the NSA.

It is not against the law to collect intel on a US citizen. Private corporations and investigators, local, state, and the federal governments do it every day. Heard of Clear or Lexus Nexus?

[(1VB)compforce]

I appear to have typed that without being specific enough. It is illegal for members of the intelligence community to collect on US individuals except in very specifically prescribed circumstances spelled out in EO12333, DOD Directive 5240-1 and DOD 5240.1-R.

I should have specified an off-duty intel analyst from the Army.

2.3 Collection of Information. Agencies within the Intelligence Community are authorized to collect, retain or disseminate information concerning United States persons only in accordance with procedures established by the head of the agency concerned and approved by the Attorney General, consistent with the authorities provided by Part 1 of this Order. Those procedures shall permit collection, retention and dissemination of the following types of information:
(a) Information that is publicly available or collected with the consent of the person concerned;
(b) Information constituting foreign intelligence or counterintelligence, including such information concerning corporations or other commercial organizations. Collection within the United States of foreign intelligence not otherwise obtainable shall be undertaken by the FBI or, when significant foreign intelligence is sought, by other authorized agencies of the Intelligence Community, provided that no foreign intelligence collection by such agencies may be undertaken for the purpose of acquiring information concerning the domestic activities of United States persons;
(c) Information obtained in the course of a lawful foreign intelligence, counterintelligence, international narcotics or international terrorism investigation;
(d) Information needed to protect the safety of any persons or organizations, including those who are targets, victims or hostages of international terrorist organizations;
(e) Information needed to protect foreign intelligence or counterintelligence sources or methods from unauthorized disclosure. Collection within the United States shall be undertaken by the FBI except that other agencies of the Intelligence Community may also collect such information concerning present or former employees, present or former intelligence agency contractors or their present or former employees, or applicants for any such employment or contracting;
(f) Information concerning persons who are reasonably believed to be potential sources or contacts for the purpose of determining their suitability or credibility;
(g) Information arising out of a lawful personnel, physical or communications security investigation;
(h) Information acquired by overhead reconnaissance not directed at specific United States persons;
(i) Incidentally obtained information that may indicate involvement in activities that may violate federal, state, local or foreign laws; and
(j) Information necessary for administrative purposes.
In addition, agencies within the Intelligence Community may disseminate information, other than information derived from signals intelligence, to each appropriate agency within the Intelligence Community for purposes of allowing the recipient agency to determine whether the information is relevant to its responsibilities and can be retained by it.


http://www.archives.gov/federal-register/codification/executive-order/12333.html

I'm done, my foot has been in my mouth enough today.

[Joker]

I appear to have typed that without being specific enough. It is illegal for members of the intelligence community to collect on US individuals except in very specifically prescribed circumstances spelled out in EO12333, DOD Directive 5240-1 and DOD 5240.1-R.

I should have specified an off-duty intel analyst from the Army.



http://www.archives.gov/federal-register/codification/executive-order/12333.html

I'm done, my foot has been in my mouth enough today.

None of those are laws. You could get fired for violating them, but not sent to jail.

[ddoering]

If stupid was a crime there would be no traffic jams in DC.

[Joker]

If stupid was a crime there would be no traffic jams in DC.

You are mistaken, DC would be the penitentiary.
Are the airport on the way to the penitentiary, uh I mean DC. :D