Obligatory Disclaimer: Personal or political views presented within this post absolutely do not reflect those of my employer(s), client(s), and/or legal counsel.
In the final week of November 2015, a Special Agent from the Federal Bureau of Investigation, Mr. Mark Burnett, knocked on the door of my family’s home and left his card, with an additional phone number penciled in. All my family members residing in America had planned a week-long vacation and were all on a remote island. When the FBI receives DHS flight records as if they’re the morning paper, I must admit that whatever reasons for why the Bureau didn’t know that I or my family were absent escape me entirely.
|
My mom found the above card of Agent Burnett, face down on the marble entryway of the house, some days after returning home from vacation. As credit to her and my dad, and, the sheer chaos of every member of our family (including my sibling) being hackers/programmers, at first they didn’t assume the card had anything to do with me. After all, I don’t live in America anymore, and also anyone who knows me in the slightest is well aware that I’m so horribly busy with work… such that for several years I’ve often ignored, stood up, and let down my closest friends. My mother assumed that, if it were really important, the agent would call her. He did, while she was at work a couple days later. (As an aside: that any random FBI agent has the ability to learn someone’s personal cell phone number and use it — uninvited — is, in my opinion, extremely threatening and unacceptable.) He didn’t say what he wanted, only that he wanted to know how to contact her daughter. I was travelling (as always), and my mother didn’t have a phone number for me.
I had already been in the process of moving, permanently, to Germany, and had retained a German immigrations lawyer several months prior to these events. In late November, not knowing this had already been taking place, I returned to the US for two weeks to visit family and friends for the holidays, collect my remaining belongings, and make any needed long-term arrangements.
Word got to my lawyer in the US, who decided to call FBI Special Agent Mark Burnett, on that Friday, saying that he represented me and my family. Burnett said the FBI simply wanted to ask me some questions. My lawyer responded by stating that, as my invoked representation, all questions should be directed to him rather than to me or my family. The agent agreed, paused while some muffled male voices were heard in the background, and asked to call back in five minutes.
Five minutes later, Burnett called back and said, “I don’t believe you actually represent her.”¹ Burnett stated additionally that a phone call from me might suffice, but that the FBI preferred to meet with me in person. After a pause he said, “But… if we happen to run into her on the street, we’re gonna be asking her some questions without you present.”
My lawyer and I discussed what the FBI could possibly want. Theories ranged from attempted entrapment, to the recent and completely unethical Carnegie Mellon University (CMU) attacks on the live Tor network, to a Grand Jury subpoena for someone else, to some shady request for a backdoor in some software I contribute to. We honestly could not come up with any coherent rationale for why the FBI would suddenly decide to come after me, as, to my knowledge, I have done nothing which should warrant any interest besides my contributions to open source encryption tools.
In the case that they might have asked for a backdoor, I tried to distract myself from the overwhelming (I don’t think I’ve actually fully understood the word “overwhelming” before these events) stress.
I still planned to continue moving, of course, but now things would need to go to different places, and by different means. I didn’t know if I’d be stopped at the US border, or even prevented entirely from leaving. I started having panic attacks, thinking that I’d need to get myself and literally every object, including electronics, that I cared about accross the border, knowing they’d have the ability to detain me and mess with my belongings for as long as they liked. Every device I owned could be compromised, I’d lose all my data, my pictures of family and loved ones, fiction I’d wrote as a teenager, and Lisp I’d wrote as a child. I’ll admit I actually cried, not knowing when I’d hug my mom again. I prepared myself mentally, trying to model every possible tactic the FBI could play and my planned response.
If they ask for information on anyone else, or think I witnessed or committed some crime: I solemnly invoke my Miranda rights. No joking. No snark. No fucking around. Everyone knows you don’t talk to the police.
If they want a backdoor, or some other extralegal information about users or systems, likewise: I’d ask for my lawyers and shut up.
I didn’t talk to anyone who wasn’t already in regular contact with me, fearing I might endanger them — some thug might show up at their mom’s door or make some threats to their lawyers — and I didn’t want to risk harming people I care about. It hurt to not tell my friends what was happening. I felt gagged and frightened. I wanted to play chess in the park. I wanted to learn duets on the piano. I wanted to ride bicycles through the ancient groves in the park in the endless Californian sunshine. I wanted to bring homemade vegan gluten-free brownies and stickers from collectives in France to my friends at the EFF. To be selfish, I wanted to read the number theory papers I’d just downloaded and play with a new pairing-based cryptography library I’d just been given the source to, but I couldn’t do those things either, simply because I was too stressed out to think straight.
I got absolutely no work done.²
If you’re going to get arrested, you might as well look good and smile your brightest while doing so. In a blur of anxiety and self-consciousness, I bought a pair of blue-green aviators and matching blue-green lipstick. This will totally build rapport with my interlocutors, I told myself. They will have no alternative but to understand that I fight for the good guys, that they should immediately drop their badges and guns — but keep the aviators! — to join me to fight for the true cause and freedom!
Due to speak at several cryptographic conferences in Europe, I flew from San Francisco’s internation airport to Brussels on the next Monday evening, on the latest flight I could get. I had been advised by another lawyer that, “For the FBI, ‘quitting time’ means quitting. After 5 o’clock, you’re good; you can do whatever you want, party in the streets naked on LSD, and they won’t notice a thing.” I also booked a return flight (though I had no intention of using it, since I planned to live in Germany) upon the advice of multiple lawyers. With printed out conference and speaking invites, blue-green aviators, and blue-green lipstick, I went to San Francisco International Airport expecting to be detained indefinitely and lose everything I cared about.
Nothing happened.
I don’t understand this. The FBI is handed DHS flight records like they’re the morning edition. They should have known, when they knocked on my parents’ door, that no one would be home. They should have known when I would fly into San Francisco, and they could have easily detained me then. They reasonably could have known, and potentially acted fast enough, to detain me when I left San Francisco for Brussels.
Once in Germany, I proceeded to compile “The Book” of documents necessary for obtaining an Aufenthaltserlaubnis (roughly translated, “residence visa with permission to work certain jobs, e.g. as a contractor/freelancer”). My appointment was in early January. The day before my appointment, I spoke with my lawyer. He had received another call, this time from a FBI Special Agent Kelvin Porter in Atlanta.
Lawyer: Hello?
Agent: Hello, this is Special Agent Kelvin Porter at the FBI field offices in Atlanta. I’m calling concerning your client.
Lawyer: Yes. Why are you trying to contact her?
Agent: Well… as before… we would strongly prefer to meet her in person. We have teams in Los Angeles, San Francisco, Chicago, New York, and Atlanta keeping an eye out for her.
Lawyer: Your colleague mentioned last time that you would accept a phone call?
Agent: We would strongly prefer to meet her in person. We… uh… have some documents we’d like her opinion on.
Lawyer: Umm…? What documents?
Agent: Anyway, if she’s available to meet with us, that would be great, thanks.
It didn’t exactly help with the stress of applying for a residence visa to know that there were teams in five cities across America keeping an eye out for me. However, I’m glad to say that, the next day, my residence visa was approved. Eight hours afterwards, my laywer received a voicemail saying:
Agent: Hello this is Special Agent Kelvin Porter, we spoke two days ago regarding your client. Umm… well… so the situation with the documents… it’s umm… it’s all fixed. I mean, we would of course still be happy to meet with your client if she’s willing, but the problem has… uh… yeah… been fixed. And uh… yeah. Just let us know if she wants to set up a meeting.
Admittedly, I can’t even begin to understand what was going on here. Documents? Was this attempted entrapment? Or were they using this as bait to get me interested in meeting them, so that they could ask about something else? I mean, help me, please — I really don’t understand what the FBI’s strategy was here.
Or, are they retracting their previous position in order to entice me to return to the US? Should I be worried about what happens to me when I return? Why is the FBI trying to make a developer of an open source encryption tool feel unwelcome in their country of origin? Should I try to get a different citizenship? Is my family safe in the US? Should I worry about the FBI raiding my parents’ house and shooting our family dog? Should I worry about FBI agents stalking and harrassing my mother? Is this really how the United States has decided to treat American tech workers? Am I just the forerunner in a larger campaign by the FBI to personally go after developers of encryption software which annoys them?
Update: 2016-04-26
The FBI has contacted my lawyer again. This time, they said, “She should meet with one of our agents in San Francisco to talk. Otherwise, are you the point of contact for serving a subpoena? She’s not the target of investigation, but, uh… we uh… need her to clear up her involvement or… uh… potential involvement in a matter.”
In case the FBI is seeking data on Tor users or Tor bridges, and especially in case the subpoena turns out to be sealed or accompanied by an NSL: the original published contents of this post are archived as a PDF here, and the RIPE160(SHA256(PDF)) is equal to 5541405e08048658cf457b3c59bf42a51f84a1a3 and hence Bitcoin address 18mnc4BCud3vjAdLbCc3QhyrjN84VTT1iM, in order to prove in a cryptographically verifiable manner that I published before that point in time.
For over a year, I have maintained a warrant canary which covers the case of law enforcement agencies serving me a subpoena for information about Tor users or Tor bridges.
¹ My lawyer mentioned a legal technicality (which may or may not be actually legal because precedent is unclear): having a prior retainer to a defense lawyer in the United States does not mean that a lawyer can invoke the client’s Miranda Rights (i.e. the right to remain silent) for the client, but that the client may be technically required to personally invoke their own Miranda Rights.
² Dear FBI, for what it’s worth: technically, financially-speaking, we’re funded by the same government. You can view my current contract and pay here and you can subscribe to any of several mailing lists in order to track my development progress. You can also watch my commits in real time. You can literally see everything I do, who I work for, how much money I make, where I go, and probably a whole bunch of other data about me. I have an email address (and legal counsel). Protip: do your homework next time.