What to do if the FBI/Secret Service/etc comes to 2169 investigating Internet traffic
0. Be Polite
The agent is probably a decent person doing a hard job. Don't be an ass to them. However keep in mind that any law enforcement agent is never your friend, no matter how nice they seem, and lying to a federal agent is a serious crime, even if you didn't intend to deceive them, and even if the lie is not relevant to their investigation. They also probably know more about the situation than they are telling you. If you feel uncomfortable answering the agent's questions, the following may be helpful:
- "That question would be best answered by the technical contact."
- "I'll need to talk to our lawyer before we can answer any additional questions."
- In response to, "Can we go inside and sit down?"
You can say: "We can discuss this issue here on the public sidewalk."
(If you invite the agent inside, you've given up a significant chunk of your 4th and 5th Amendment rights.)
- In general, don't volunteer information, and keep the discussion limited to direct factual questions.
1. Contact the Technical Contact
Please call the following people and keep calling until you get someone on the phone:
- Andy Isaacson 415-509-3112
- Shannon Lee 503-539-3700
- Patrick O'Doherty 650-701-7829
2. Verify if the investigation is in regards Noisetor
Ask the agent what IP address is being investigated. Write down what they say, including dates and description of the traffic. Check if the IP is Noisetor or another network.
- 220.127.116.11/27 is Noisetor
- 18.104.22.168/28 is Pony and related Sonic DSL gear at 2169
- 22.214.171.124/22 is Monkeybrains (2169 WiFi and other networks)
If the IP address they're asking about is not one of those listed above, do not assume that it has nothing to do with Noisebridge, and do not make this claim to the investigators. The above list may not be exhaustive, and likely will not be kept up-to-date over time.
3. Communicate with the community
- Write down the agent's contact info and email it as appropriate. (It's polite not to post people's contact information on publicly archived lists without their explicit permission, so don't send it to tor@lists or board@lists or noisebridge-discuss.)
- Ensure that someone sends an email to at least one of the lists describing the visit. Include the agent's name and agency and describe the conversation, but respect any requests to avoid compromising the investigation, and don't post email/phone number to the list.
- Consider using IRC #noisebridge to communicate as well.
Technical Background on Noisetor
126.96.36.199/27 is a Tor exit node named noisetor01. Tor is an anonymity network which, by design, makes it difficult or impossible to trace a specific user. noisetor01 does not create any logs of Tor traffic, so there is no further information that can be provided to investigators regarding TCP connections coming from this IP range. noisetor01 handles 500 Mbit/sec of Tor traffic from tens of thousands of Tor users worldwide, and provides about 7% of the Tor network's total exit bandwidth. For more information, consult http://tor.noisebridge.net.
The above information does not apply to other Internet links at Noisebridge.
Feel free to give a copy of this factsheet to the agent.
Other Contact Details
Our lawyer at the EFF is Andrew Crocker, 415 436 9333 x139. Please don't call Andrew directly unless it's urgent and none of the tech contacts (above) have responded.