FBI used malware like 'a grenade' to hack TorMail users, unsealed court documents show

Privacy experts believe that the FBI illegally exceeded the scope of previously obtained warrants that granted them permission to hack specific TorMail users. The agency had gained permission to hack into 300 users of the dark web email service in 2013. However, unsealed court documents, including the warrants and applications, now reveal that the FBI may have hacked legitimate TorMail users as well.

"That is, while the warrant authorized hacking with a scalpel, the FBI delivered their malware to TorMail users with a grenade," Christopher Soghoian, principal technologist at the American Civil Liberties Union (ACLU), told Motherboard.

The revelations come after the ACLU pushed to have the case documents unsealed in September. The US DOJ (Department of Justice) recently released the redacted versions of the documents, which detail how the FBI, in 2013, seized the dark web site hosting network Freedom Hosting. The agency then deployed a NIT (network investigative technique), a piece of malware, which was designed to grab the real IP addresses of those users visiting the Freedom Hosting sites.

Newly unsealed court documents reveal that the FBI used its NIT against users of 23 different websites.

The unsealed affidavits show that the FBI looked to target over 300 TorMail accounts. According to court documents, all of the accounts were connected to child pornography-related crimes. The affidavits also show that that NIT would be used to "investigate any user who logs into any of the TARGET ACCOUNTS by entering a username and password."

However, according to TorMail users and previous reports, the FBI's malware "appeared before" users logged into the service.

"The warrant that the FBI returned to the court makes no mention of the fact that the FBI ended their operation early because they were discovered by the security community, nor does it acknowledge that the government delivered their malware to innocent TorMail users. This strongly suggests that the FBI kept the court in the dark about the extent to which they botched the TorMail operation," Soghoian added.

"What remains unclear is if the court was ever told that the FBI had exceeded the scope of the warrant, or whether the FBI agents who hacked innocent users were ever punished," he continued.

Christopher Allen, a spokesperson for the FBI said, "As a matter of practice the FBI narrowly tailors warrants, and we do not exceed the scope of those warrants."