The Unusual FBI Raid of a Dallas Datacenter

April 5th, 2009 By: Michael Merritt | Tags: , , ,

datacenterIt’s a couple days old, but still worth commenting on.  Via CBS 11 News, early Thursday morning the FBI raided a Core IP, a Dallas company providing datacenter services.  However, rather than target certain servers, the feds took all the computers, including machines certainly not pertaining to any investigation.  According to the company’s owner, Matthew Simpson, a former customer of his is the target of investigation, but no longer does business with his company.  He is understandably angry at what is going on:

Currently nearly 50 businesses are completely without access to their email and data.  Citizen access to Emergency 911 services are being affected, as Core IP’s primary client base consists of telephone companies.

Rumors have been abound that the raid is linked to the leaking of the soon to be released X-Men Origins: Wolverine, but there is no evidence of this, only speculation.  In any case, that leak was on bittorrent, making it unlikely that any server at the datacenter was actually hosting the file (Bittorent is decentralized P2P between many computers), though there is precedent for the authorities going after sites that link to illegal Bittorrent downloads.

But one question remains:  Is there precedent for allowing the FBI carrying out entire datacenters worth of computers, thus affecting business for more than just the criminal?  I would say yes.

I have heard of it happening before in hearsay, but I now have a little bit of evidence to back up these stories.  News accounts here and here, albeit on charges of fraud and receiving kickbacks, both show the FBI taking out a lot of computer equipment.  I think the problem before the FBI is that they don’t know exactly where the offending files and/or programs may be, so that they need to scan all the equipment for what their investigation needs.

However, like I said, those are different cases.  Fraud and corruption may have incriminating evidence on multiple computers.  However, assuming that the owner’s story stands up (we still don’t know all the details), one would think the FBI could pinpoint the computers where illegal activity was taking place.  It certainly isn’t that hard to do traceroute, and even if the activity was happening across multiple computers (if the customer had more than one), it would be easy enough to ask where they were located.

I’m skeptical that federal investigation into computer crimes necessitates the removal of more equipment than necessary.  I know it is SOP for law enforcement agencies to not comment on ongoing investigations, but the FBI in Dallas may be wise to explain why they took so much.  At the very least, it would do wonders to combat the image of overstepping bounds that they have now created.

However, the details about this story are still very hazy.  It is unwise for anybody reading about it to assume anything.

Share and Enjoy:
  • Digg
  • del.icio.us
  • Technorati
  • SphereIt
  • NewsVine
  • TailRank
  • Reddit
  • StumbleUpon

This website uses IntenseDebate comments, but they are not currently loaded because either your browser doesn't support JavaScript, or they didn't load fast enough.

  1. Interested
    April 5th, 2009 at 03:34
    Reply | Quote | #1

    a traceroute would have little to nothing to do with it other than pinpoint where DNS records are pointing to. What they do not know is if the public side is on server 32, but data is linked over to server 45.

  2. bt
    April 5th, 2009 at 04:02
    Reply | Quote | #2

    Here is a screen-shot of the site disclosing some information about the raids before it went down:
    http://imagee.org/images/qgemybz4j5b9a3v4da7.png
    and a copy on sribd thanks to another person saving it
    http://www.scribd.com/doc/13974347/mirror-of-wwwuwwwbcom-FBI-indiscriminate-actions-in-fascist-america

    He makes the case that it was the result of an informant the FBI on a wild ride, at the cost of taxpayers, and multiple legit businesses, which the informant said were fronts and did not really exist.

  3. Dan Tyler
    April 5th, 2009 at 04:23
    Reply | Quote | #3

    http://cbs11tv.com/local/Core.IP.Networks.2.975776.html

    “CBS 11 News has uncovered new information about FBI raids against Dallas companies that provide web servers for dozens of businesses in North Texas and across the country.

    Court documents show it’s all part of an alleged massive fraud scheme against AT&T and Verizon.

    Court records show Verizon first went to the FBI this past January, alleging some North Texas web server providers were cheating them and AT&T out of millions of dollars.”

  4. Michael Merritt
    April 5th, 2009 at 05:20
    Reply | Quote | #4

    Interested: In that case, it’s still probably easier to ask the owner where the person’s computers are.

    BT: I need to analyze it again, but the fact that I’m already seeing more holes than swiss cheese is not a good sign. I also note the fact that both stories by both owners sound similar in tone.

    Dan: I was wondering if something like this might come up.

  5. Sebastin
    April 5th, 2009 at 05:47
    Reply | Quote | #5

    Here is the urban dictionary defition of the “special” agent in charge Allyn Lynd.

    http://www.urbandictionary.com/define.php?term=lynd3d

    He has a history for these kinds of raids. A whole swat team to take down some geek on a computer is a bit of overkill but I guess they have to justify their budget. And from what I hear this is the third of second data center he has hit in a month in Dallas. He has reportedly frozen the assest of the companies hit this way so they have no real recourse to fight such malicious abuse of power. I think Core IP must have had lawyers on retainer to just get as much out as he did.

    http://www.wired.com/politics/law/news/2008/02/blind_hacker?currentPage=3

  6. Sebastin
    April 5th, 2009 at 05:51
    Reply | Quote | #6

    Is this one guy in the linked website uwwwb.com the real sole informant. Anyone know if he really is a druggie? Would be a lot to do on one druggies word.

    Anyone have any “friends” who may have bought from him or dealt with him. A friend of mine said he used ot deal off SMU.

  7. Michael Merritt
    April 5th, 2009 at 09:00
    Reply | Quote | #7

    Sebastin, are you actually defending Lil’ Hacker? He’s not a simple geek but a criminal. I’m certainly not going to entertain mischaracterizations of people based on what you think I think of the FBI. I’m not anti-FBI, just anti abuse of power, which any agency can do.

    I apologize in advance if this isn’t what you were getting at, but that’s what it seems like right now.

  8. Sebastin
    April 5th, 2009 at 19:03
    Reply | Quote | #8

    I am saying they are over reaching. The FBI to raid some kid or a geek at a computer desk. Do a little research. I think anyone with half a brain could do a better investigating job.

  9. Michael Merritt
    April 5th, 2009 at 19:28
    Reply | Quote | #9

    I read the whole article. It actually portrays him quite negatively so I’m not sure why you’re trying to mischaracterize him. Even his own friends say he’s doing bad stuff. And in any case, investigating cybercrime is one of the FBI’s jobs.

  10. Sebastin
    April 5th, 2009 at 21:34

    Cybercrime yes, but putting people lively hoods in jeporday is a misuse of power. Core IP is not the first data center this cyber team has hit. They hit the Infomart and 4360 Bryan street also. Shutting down 3 data centers. The reason you have only heard of the last one is that the FBI threatened the other DC owners and told them to not discuss the investiagtion publicly. Not that any of them had much ability to do so as the FBI froze all of their assests. How are they suppossed to make a living? How are the comapnies that used them suppossed to survive?

  11. Michael Merritt
    April 6th, 2009 at 03:32

    The other DC was hit on the same investigation. I read those reports, too. I have sympathy for those companies but service providers go down the tube all the time, for fraud or other reasons. These companies survive by moving to other providers.

    By the way, you dodged my question on whether you’re defending Lil’ Hacker. Don’t think I didn’t notice.

  12. Sebastin
    April 6th, 2009 at 23:01

    @Michael Merritt
    Not defending him just pointing out the tactics. For the lil guy it seems warranted. But the FBI has raided what I count as 4 datacenters in the Dallas area all in the same manner. They have, as far as I know, also frozen all of the owners accounts. How do they fight such actions. I use lawyers and they are not cheap.

  13. Joseph Libuszowski
    April 7th, 2009 at 05:46

    Core IP,LLC who registered as an Competitive Local Exchange Carrier (CLEC) under the name CVC CLEC,LLC, in the state of North Dakota and Washington. The original Interconnection agreement with qwest for the state of North Dakota can be found at http://www.psc.state.nd.us/jurisdiction/orderlib/2009/09-0046/001-010.pdf.

    And information of Washington CVC CLEC, LLC formation: http://utc.wa.gov/rms2.nsf/frm2005VwFilingWeb?OpenForm&vw2005L3CompName=Cvc%20Clec%2C%20Llc&NAV=9999CatL2CCatL3Cvc%20Clec%2C%20LlcCatL4

    After reviewing the original CLEC agreements, one thing that immediately stuck out to me was the company’s balance sheet. Generally speaking, with CLEC applications there are several months of balance sheets, along with resumes of the owners, ect. In this case $100,000 showed up in Core IP, LLC’s accounts with no evidence as to how the money was deposited.

    However, the companies CLEC application was granted and the state of Washington put its stamp of approval on the newly formed company. And if you like you can presumably purchase services on their website at http://cvctermination.com

    Also, I should note Jason Trahan a reporter for Dallas News was able to obtain the original warrant filed on March 11, 2009 by FBI Special Agent Allyn Lynd. So apparently the Judge unsealed the original warrant as promised, or the reporter obtained the warrant by other means. However to protect myselft legally I have no evidence that the legal document was obtained illegally http://crimeblog.dallasnews.com/2323%20Bryan.pdf. http://crimeblog.dallasnews.com/archives/fbi/

  14. Interested
    April 9th, 2009 at 09:26
Comments are closed.

PoliGazette Comments Policy

PoliGazette encourages comments from all viewpoints, especially those that disagree. Comments submitted must, however, adhere to the following standards. Comments that violate these standards may be edited or deleted without notice at the sole discretion of the editors. Commenters who repeatedly or egregiously violate these standards or who attempt to argue publicly with editors regarding the comments policy may be banned from commenting further.

(1) Comments should address the substantive content of the post. Comments that repeatedly or blatantly misrepresent the content of the post or of others' comments are not welcome. Comments that respond to something other than which the contributor or commenter may have said are irrelevant and should not be posted.

(2) Comments should avoid vulgarity as well as racial, ethnic, religious, or sexual bigotry.

(3) Comments should not personally attack the character, personal integrity, or professional reputation of any PoliGazette contributor or of other commenters.

(4) Comments should reflect the contributions of the commenters themselves and should not include extensive cut-and-paste reproductions of others' words except insofar as necessary to supplement the commenter's own arguments. Link spam, trackback spam, and propaganda spam will be instantly deleted.

(5) Public figures are considered open to all substantive criticism of their policies and statements. Comments that present objectively false factual information about public figures (i.e. "Obama is a Muslim") or that attack public figures by attacking their families are not welcome. Comments that merely repeat slogans for or against a candidate without engaging in substantive comment are not welcome.

Questions or challenges to these policies or their application should be directed to the editors by email only.