Just a friendly reminder to not click on links. I don’t believe this was zero-click and he actually interacted with the link based on the wording. They spent 2 months building his trust eventually getting him to click whatever the link was and send a selfie.
Source:
complaint.pdf (3.0 MB)
Very interesting, thanks for sharing the original document. It shows technology can’t protect you if you if you are not aware of how it works.
The same techniques/VPN/encryption we try to protect ourselves with, is used against the perpetrators.
good that they caught the guy
Has the media covered this?
I mean it’s nothing revolutionary but I’m more interested in what the URL was. Back in 2007 during the Timberline High School bomb threat investigation, the FBI setup a fake article about the bomb threat to make it appear as if the article came from the Associated Press and got the suspect to click it.
Source?
I think this is reputable: How a school bomb-scare case sparked a media-vs.-FBI fight
Am I understanding correctly that had the individual used a VPN the user would have been protected?
Depending on the VPN, possibly. But him sending his face is just stupid. The FBI has a team dedicated to matching faces to identities. Drivers License photo prob matched him or passport. Then he used a number linked to him to signup for Telegram which added more credibility.
This is a really odd complaint to reference given this is a text book case of good law enforcement work, and basic privacy hygiene advice. Does anyone in this sphere really need to be reminded not to click on random/untrusted links?
I mean it’s interesting so I don’t think it’s weird to share. But it’s also good to see law enforcement doing targeted investigations rather than using mass surveillance.
These are the most common cases that come up when I’m filtering for Telegram/Signal. I try to find cases where it appears the individual took steps to hide their identity. It’s a bit more than don’t click random links, more like don’t click any link. This guy was social engineered for 2 months before he clicked it so I wouldn’t call it a basic mistake.
