39 ms·

Cock.li e-mail server seized by German authorities, admin announces

82 points by aaronem 11y ago

runn1ng 11y ago
cock.li. The proud owner of nigge.rs, horsefucker.org and goat.si. RIP in peace
- tomp 11y ago
  Tor browser. The proud enabler of child porn industry.
  - dogma1138 11y ago
    I'm pretty sure there's more child porn on P2P networks, Usenet and the just over private internet forums/sites than on TOR.
    - tomp 11y ago
      My point was, just because there exists one (perfectly valid) objection to Tor, it doesn't mean the project as a whole is negative and should be shut down (what the parent seems to be implying about this email provider).
    - runn1ng 11y ago
      I would bet that maybe not, but a disproportionate number of darknet websites is. P(darknet | child porn) might be low, as you are suggesting, but P(child porn | darknet) >>> P(child porn | clearweb), in orders of magnitude.
  - deleted 11y ago
    [deleted]
- leppr 11y ago
  The "anonymous mail service with offensive names" could be made a standard indicator of a country's freedom of speech status. Actually, that'd be a good research project: setup and host such a service in as many countries as possible, wait as they get shutdown (+6 points)/subpoenaed (+3)/ddosed (+1) and make a map.
  - Bud 11y ago
    Not responsive or relevant to this situation, in two very important ways: first, this isn't just any email service, a threat which cost millions of dollars was made from this service. Second, and more crucially, the service was NOT shut down.
    - leppr 11y ago
      I'll just answer by emphasizing two words in the comment you replied to. a threat which cost millions of dollars was made from this service. ...anonymous mail service... the service was NOT shut down. ...wait as they get shutdown (+6 points)/subpoenaed (+3)/ddosed (+1) ...
    - bendykstra 11y ago
      > a threat which cost millions of dollars It was the reaction to the threat which cost millions of dollars. We should be careful to distinguish between the costs of terrorism and the costs of our reaction to it.
      - cpncrunch 11y ago
        You might think differently if you were responsible for those children. Do you want to take the risk that it might be a real threat? How do you tell the difference between a real threat and one that isn't real? I'm guessing the people at the school district thought the small risk wasn't worth it, and decided to close the schools. Who would want to be labelled as the person who didn't close the schools if someone ended up getting killed? Even if the threat seems implausible, it must be a very difficult decision to make. There have been many bomb threats recently, probably mostly implausible, but for every one of them the airline acts as if it might be a real threat.
        aaronem 11y ago
        You might not, too. The LA district shut down. The NY district, which also received a threat, did not. Why? And why the difference in response?
- aaronem 11y ago
  Seeing as he's yet to be accused of anything except being a community-minded sysadmin with a low sense of humor, I'm not sure a mere lack of taste excuses the extremely unsympathetic media attention that's been focused on the operator of this service in the last few days.
  - Nadya 11y ago
    I use the provided mail service (@tfwno.gf) explicitly due to how transparent he is. Same reason why I used and donated to pomf.se before its closure (different person). If the only people who care about users and practice active disclosure of subpoenas are people with low-brow humor, so be it, I'll continue to support them. E: Also a quick note there is a bit of misinformation floating around. He doesn't own many of the domains, he just runs the mailservers for them.
  - s73v3r 11y ago
    Nobody is accusing him of anything other than hosting some poor joke domains. However, his domain was the one that the emails threatening several school districts came from. And while I'm sure they don't think he's the culprit, his server would still have some evidence on it.
    - aaronem 11y ago
      Have you seen CBS's [1] and the Daily Mail's [2] hit pieces on him? Of the latter such flagrant nonsense is to be expected, but one generally doesn't expect to see CBS descend to the same level. [1] http://losangeles.cbslocal.com/2015/12/18/cbs-news-maine-native-based-in-romania-at-center-of-school-threats-probe/ http://losangeles.cbslocal.com/2015/12/18/cbs-news-maine-nat... [2] http://www.dailymail.co.uk/news/article-3367044/Maine-college-drop-21-center-hoax-terrorist-threat-emails-New-York-Las-Vegas-issue-subpoenas-former-student-claims-knows-origin-posts.html http://www.dailymail.co.uk/news/article-3367044/Maine-colleg...
      - Bud 11y ago
        That wasn't from CBS, it was from a local TV station, which is quite different.
lkewnflkewf 11y ago
install gentoo
vox_mollis 11y ago
How, exactly, did German authorities come to decide that California has jurisdiction in Germany? Was this pursuant to MLAT?
- nickodell 11y ago
  Presumably, threatening to kill people is a crime in Germany, so the German police had the authority to open an independent investigation.
  - deleted 11y ago
    [deleted]
- s73v3r 11y ago
  Are you saying that one should be allowed to threaten to kill people in one country from another, and not be held accountable?
  - detaro 11y ago
    Are you saying that asking how something works is the same as saying the same thing happening is horribly wrong?
    - PhasmaFelis 11y ago
      Don't pretend you don't know that "How, exactly did X happen" doesn't indicate that you disapprove of X.
  - jacquesm 11y ago
    No, he definitely was not saying that.
    - cpncrunch 11y ago
      That seemed to be the implication.
detaro 11y ago
Interesting that they only took one of the disks. a) a more aggressive forensic approach would avoid the server to be shut down if at all possible (getting data in RAM or on encrypted partitions) and b) it is very restrained in comparison to other seizures. I'd say that if they believed he were actively complicit or would do something to hinder the investigation, they would have been more aggressive, possibly went after machines in his home as well. Of course, if I'm right with this assumption, why didn't they contact him, but went directly for the server via the hoster. (I'm actually not sure how the law works with regards to seizing data vs seizing the (probably provider-owned) media it is on) Also, I guess the "just take one of the RAIDed disks" in this way is only possible if you run a server provided by a known hosting provider, were it isn't the first seizure for both police and provider. The provider knows how the servers are set up, law enforcement trusts that the provider just wants to get everything done as quickly as possible.
- nickpsecurity 11y ago
  "I'd say that if they believed he were actively complicit or would do something to hinder the investigation, they would have been more aggressive, possibly went after machines in his home as well." My thoughts exactly. His reputation of cooperation might have helped him out here. Nice of them to leave enough stuff to keep the service online. Many small-time operators hit by FBI over here aren't so lucky. They'll take down a whole colo worth of clients sometimes.
- striking 11y ago
  http://pastebin.com/raw/YuU6931t http://pastebin.com/raw/YuU6931t "We have a confiscation order for the disks of your server, but we were allowed to leave one of them installed, due to the fact that you have a Raid1 setup."
rhabarba 11y ago
Hehe. Cock.
jack9 11y ago
> I have no idea why this is happening." I'm very sure he does. It's been explained thoroughly.
- x1798DE 11y ago
  Care to share with the rest of the class?
  - jack9 11y ago
    What? You mean you didn't read the article? > Cock.li was reportedly used last week to send a bogus bomb threat e-mail from "madbomber@cock.li" Of course they are going to take records (and from the files of how very unlike-the-US-can-the-germans-be) leaving the system running and intact. If you didn't read the US news about the trouble it caused, go back to skimming headlines.
doener 11y ago
Discussion on 8ch.net: https://8ch.net/tech/res/473045.html https://8ch.net/tech/res/473045.html
hasenj 11y ago
It sounds like someone doing an experiment to see if he can get the government to take down a server. Much more efficient than DDoS attacks. Simply find a way to make the domain seem suspicious.
necessity 11y ago
Imagine if this was regular mail. It's the equivalent of German seizing private mail from EVERYONE that uses the hypothetical Cock Postal Service because one individual used that same service in the US to make a threat. This is ridiculous. Outright abuse of power and invasion of privacy. Yet another reason to encrypt everything.
- cpncrunch 11y ago
  It's more like seizing the customer records from Cock Postal Service (presumably operated by James May). My guess is that the fact this guy ran the operation from his bedroom, and they weren't sure whether he would co-operate or not, was the reason they seized the disk rather than just subpoena him. Presumably if it was hotmail or gmail this wouldn't have happened. I think it's good that this scumbag cocksucker is going to get his commuppence (I'm talking about the idiot who sent the email, not the guy who runs the cock email service). He's obviously a bit of an idiot to use an email service that says "will report any illegal activity to the relevant authorities" rather than one that is actually properly encrypted (if such a beast even exists at the moment -- they seem to all get DDoSed out of existence by China or similar pretty quickly).
  - striking 11y ago
    I think it sucks that all ~65,000 other people have their data seized because of him, though. The fellow running the service ran it on a German hosting service (https://www.hetzner.de https://www.hetzner.de), and not his bedroom. Full cooperation was provided by everyone, following in the letter and spirit of the law. It just really sucks that the German authorities took it upon themselves to take the entire thing.
    - cpncrunch 11y ago
      He managed it from his bedroom.
      - jlappi 11y ago
bloody1 11y ago
This guy deserves to be in jail. I am DISGUSTED at a human like this roaming free after threatening to hurt millions maybe even BILLIONS of children! Shame on this man!!!

82 points by aaronem 11y ago

runn1ng 11y ago

cock.li. The proud owner of nigge.rs, horsefucker.org and goat.si. RIP in peace

tomp 11y ago
Tor browser. The proud enabler of child porn industry.
- dogma1138 11y ago
  I'm pretty sure there's more child porn on P2P networks, Usenet and the just over private internet forums/sites than on TOR.
  - tomp 11y ago
    My point was, just because there exists one (perfectly valid) objection to Tor, it doesn't mean the project as a whole is negative and should be shut down (what the parent seems to be implying about this email provider).
  - runn1ng 11y ago
    I would bet that maybe not, but a disproportionate number of darknet websites is. P(darknet | child porn) might be low, as you are suggesting, but P(child porn | darknet) >>> P(child porn | clearweb), in orders of magnitude.
- deleted 11y ago
  [deleted]
leppr 11y ago
The "anonymous mail service with offensive names" could be made a standard indicator of a country's freedom of speech status. Actually, that'd be a good research project: setup and host such a service in as many countries as possible, wait as they get shutdown (+6 points)/subpoenaed (+3)/ddosed (+1) and make a map.
- Bud 11y ago
  Not responsive or relevant to this situation, in two very important ways: first, this isn't just any email service, a threat which cost millions of dollars was made from this service. Second, and more crucially, the service was NOT shut down.
  - leppr 11y ago
    I'll just answer by emphasizing two words in the comment you replied to. a threat which cost millions of dollars was made from this service. ...anonymous mail service... the service was NOT shut down. ...wait as they get shutdown (+6 points)/subpoenaed (+3)/ddosed (+1) ...
  - bendykstra 11y ago
    > a threat which cost millions of dollars It was the reaction to the threat which cost millions of dollars. We should be careful to distinguish between the costs of terrorism and the costs of our reaction to it.
    - cpncrunch 11y ago
      You might think differently if you were responsible for those children. Do you want to take the risk that it might be a real threat? How do you tell the difference between a real threat and one that isn't real? I'm guessing the people at the school district thought the small risk wasn't worth it, and decided to close the schools. Who would want to be labelled as the person who didn't close the schools if someone ended up getting killed? Even if the threat seems implausible, it must be a very difficult decision to make. There have been many bomb threats recently, probably mostly implausible, but for every one of them the airline acts as if it might be a real threat.
      - aaronem 11y ago
        You might not, too. The LA district shut down. The NY district, which also received a threat, did not. Why? And why the difference in response?
aaronem 11y ago
Seeing as he's yet to be accused of anything except being a community-minded sysadmin with a low sense of humor, I'm not sure a mere lack of taste excuses the extremely unsympathetic media attention that's been focused on the operator of this service in the last few days.
- Nadya 11y ago
  I use the provided mail service (@tfwno.gf) explicitly due to how transparent he is. Same reason why I used and donated to pomf.se before its closure (different person). If the only people who care about users and practice active disclosure of subpoenas are people with low-brow humor, so be it, I'll continue to support them. E: Also a quick note there is a bit of misinformation floating around. He doesn't own many of the domains, he just runs the mailservers for them.
- s73v3r 11y ago
  Nobody is accusing him of anything other than hosting some poor joke domains. However, his domain was the one that the emails threatening several school districts came from. And while I'm sure they don't think he's the culprit, his server would still have some evidence on it.
  - aaronem 11y ago
    Have you seen CBS's [1] and the Daily Mail's [2] hit pieces on him? Of the latter such flagrant nonsense is to be expected, but one generally doesn't expect to see CBS descend to the same level. [1] http://losangeles.cbslocal.com/2015/12/18/cbs-news-maine-native-based-in-romania-at-center-of-school-threats-probe/ http://losangeles.cbslocal.com/2015/12/18/cbs-news-maine-nat... [2] http://www.dailymail.co.uk/news/article-3367044/Maine-college-drop-21-center-hoax-terrorist-threat-emails-New-York-Las-Vegas-issue-subpoenas-former-student-claims-knows-origin-posts.html http://www.dailymail.co.uk/news/article-3367044/Maine-colleg...
    - Bud 11y ago
      That wasn't from CBS, it was from a local TV station, which is quite different.

lkewnflkewf 11y ago

install gentoo

vox_mollis 11y ago

How, exactly, did German authorities come to decide that California has jurisdiction in Germany? Was this pursuant to MLAT?

nickodell 11y ago
Presumably, threatening to kill people is a crime in Germany, so the German police had the authority to open an independent investigation.
- deleted 11y ago
  [deleted]
s73v3r 11y ago
Are you saying that one should be allowed to threaten to kill people in one country from another, and not be held accountable?
- detaro 11y ago
  Are you saying that asking how something works is the same as saying the same thing happening is horribly wrong?
  - PhasmaFelis 11y ago
    Don't pretend you don't know that "How, exactly did X happen" doesn't indicate that you disapprove of X.
- jacquesm 11y ago
  No, he definitely was not saying that.
  - cpncrunch 11y ago
    That seemed to be the implication.

detaro 11y ago

Interesting that they only took one of the disks. a) a more aggressive forensic approach would avoid the server to be shut down if at all possible (getting data in RAM or on encrypted partitions) and b) it is very restrained in comparison to other seizures. I'd say that if they believed he were actively complicit or would do something to hinder the investigation, they would have been more aggressive, possibly went after machines in his home as well. Of course, if I'm right with this assumption, why didn't they contact him, but went directly for the server via the hoster. (I'm actually not sure how the law works with regards to seizing data vs seizing the (probably provider-owned) media it is on) Also, I guess the "just take one of the RAIDed disks" in this way is only possible if you run a server provided by a known hosting provider, were it isn't the first seizure for both police and provider. The provider knows how the servers are set up, law enforcement trusts that the provider just wants to get everything done as quickly as possible.

nickpsecurity 11y ago
"I'd say that if they believed he were actively complicit or would do something to hinder the investigation, they would have been more aggressive, possibly went after machines in his home as well." My thoughts exactly. His reputation of cooperation might have helped him out here. Nice of them to leave enough stuff to keep the service online. Many small-time operators hit by FBI over here aren't so lucky. They'll take down a whole colo worth of clients sometimes.
striking 11y ago
http://pastebin.com/raw/YuU6931t http://pastebin.com/raw/YuU6931t "We have a confiscation order for the disks of your server, but we were allowed to leave one of them installed, due to the fact that you have a Raid1 setup."

rhabarba 11y ago

Hehe. Cock.

jack9 11y ago

> I have no idea why this is happening." I'm very sure he does. It's been explained thoroughly.

x1798DE 11y ago
Care to share with the rest of the class?
- jack9 11y ago
  What? You mean you didn't read the article? > Cock.li was reportedly used last week to send a bogus bomb threat e-mail from "madbomber@cock.li" Of course they are going to take records (and from the files of how very unlike-the-US-can-the-germans-be) leaving the system running and intact. If you didn't read the US news about the trouble it caused, go back to skimming headlines.

doener 11y ago

Discussion on 8ch.net: https://8ch.net/tech/res/473045.html https://8ch.net/tech/res/473045.html

hasenj 11y ago

It sounds like someone doing an experiment to see if he can get the government to take down a server. Much more efficient than DDoS attacks. Simply find a way to make the domain seem suspicious.

necessity 11y ago

Imagine if this was regular mail. It's the equivalent of German seizing private mail from EVERYONE that uses the hypothetical Cock Postal Service because one individual used that same service in the US to make a threat. This is ridiculous. Outright abuse of power and invasion of privacy. Yet another reason to encrypt everything.

cpncrunch 11y ago
It's more like seizing the customer records from Cock Postal Service (presumably operated by James May). My guess is that the fact this guy ran the operation from his bedroom, and they weren't sure whether he would co-operate or not, was the reason they seized the disk rather than just subpoena him. Presumably if it was hotmail or gmail this wouldn't have happened. I think it's good that this scumbag cocksucker is going to get his commuppence (I'm talking about the idiot who sent the email, not the guy who runs the cock email service). He's obviously a bit of an idiot to use an email service that says "will report any illegal activity to the relevant authorities" rather than one that is actually properly encrypted (if such a beast even exists at the moment -- they seem to all get DDoSed out of existence by China or similar pretty quickly).
- striking 11y ago
  I think it sucks that all ~65,000 other people have their data seized because of him, though. The fellow running the service ran it on a German hosting service (https://www.hetzner.de https://www.hetzner.de), and not his bedroom. Full cooperation was provided by everyone, following in the letter and spirit of the law. It just really sucks that the German authorities took it upon themselves to take the entire thing.
  - cpncrunch 11y ago
    He managed it from his bedroom.
    - jlappi 11y ago

bloody1 11y ago

This guy deserves to be in jail. I am DISGUSTED at a human like this roaming free after threatening to hurt millions maybe even BILLIONS of children! Shame on this man!!!