# Presentation: 149796

## The Law of Government Honeypots

- Anthony V. Teelucksingh
- Computer Crime and Intellectual Property Section
- U.S. Department of Justice
- (202) 202-514-1026

**Notes:**
This presentations was created by Richard Salgado, Senior Counsel, Computer Crime and Intellectual Property Section, U.S. Department of Justice.  It is intended only for presentation to and use by members of law enforcement in the United States.  Agents and prosecutors are always welcome to contact CCIPS directly both for general advice and specific case-related assistance.   During regular business hours, at least two CCIPS attorneys are on duty to answer questions and provide assistance to agents and prosecutors on the topics covered in this presentation, as well as other matters that arise in computer crime and intellectual property cases.  The main number for CCIPS is (202) 514-1026.  After hours, CCIPS can be reached through the Justice Command Center at (202) 514-5000.

## Honeypots; Topics

- Legal Issues
- Search & Seizure
- Electronic Surveillance
- Charging
- Entrapment
- Collateral Damage

**Notes:**
Network security professionals have become captivated lately with the idea of using “fake” networks (i.e., non-production servers made to look like production servers) to attract hackers and attackers.  The intruder’s actions are monitored by firewalls, IDS and sniffers, and then analyzed.  There are many different varieties of honeypots; a honeypot can, for example, take the form of a system completely independent from any production network and has no other purpose than to monitor potentially malicious activity aim against it (or perhaps routed though it), a system that is hidden among production servers and looks as though it is a functioning part of that production network, or a server that sits separately or among production servers to which the production servers route suspicious traffic aimed at the production servers.  The legality of honeypots is untested.

## Honeypots Generally

- Uncharted Legal Water
- Get Counsel Involved Pre-Development

**Notes:**
Network security professionals have become captivated lately with the idea of using “fake” networks (i.e., non-production servers made to look like production servers) to attract hackers and attackers.  The intruder’s actions are monitored by firewalls, IDS and sniffers, and then analyzed.  There are many different varieties of honeypots; a honeypot can, for example, take the form of a system completely independent from any production network and has no other purpose than to monitor potentially malicious activity aim against it (or perhaps routed though it), a system that is hidden among production servers and looks as though it is a functioning part of that production network, or a server that sits separately or among production servers to which the production servers route suspicious traffic aimed at the production servers.  
Honeypots may also provide a useful undercover tool for law enforcement. The government use of a honeypot for law enforcement purposes could look something like this: The government sets up a network of servers connected to the Internet and configured to look like production servers of a private entity or government agency.  The network, however, has no true production value.  The honeypot is configured to monitor, in a manner hidden to users, all traffic that is directed to it.  The honeypot is intentionally configured with certain vulnerabilities, each of which requires a different technique or skill level to exploit.  The honeypot is populated with user accounts and data that gives the network the appearance of a bona fide production server, thereby creating an inviting target to one or more classes of would-be attackers.  The legality of honeypots is untested.

## Honeypots; Legal Issues

- Honeypot are Undercover Operations
- Search & Seizure & Electronic Surveillance
- Fourth Amendment
- Wiretap Act
- Pen Register/Trap and Trace
- Electronic Communications Privacy Act

**Notes:**
As a fundamental point of reference, think of a honeypot as a type of undercover operation.  Be sure to follow the rules and regulations that apply to undercover operations generally.  Electronic surveillance and collection in online undercover investigations is typically regulated by to the following legal authorities: 
• The Wiretap Statute (Title III, 18 USC §§ 2510 et seq.)
• The Trap and Trace Statute (18 USC §§ 3121 et seq.) 
• The Electronic Communications Privacy Act (ECPA, 18 USC §§ 2701 et seq.) &
• The Fourth Amendment.

We will look at each in turn.

## Honeypots; The Constitution

- Fourth Amendment: Unreasonable Search and Seizure
- Collection of Electronic Communications can be a search and seizure
- Test: Reasonable Expectation of Privacy
- Hackers Do Not Have Such Expectation
- But Other Users on Honeypot May

## Honeypots; The Wiretap Act

- Value Derived from Monitoring Activity of Would-Be Attackers
- To Legally Intercept Communications, Exception to Wiretap Act Must Apply
- Consider These Exceptions
- Computer Trespasser Exception
- Party to the Communication or Consent of a Party to the Communication Exception
- Provider Exception (System Protection)

**Notes:**
The Wiretap Act broadly prohibits the intentional interception, use, or disclosure of wire and electronic communications unless a statutory exception applies.  See 18 U.S.C. § 2511(1).  In most instances, honeypots are configured to monitor all packets sent to or from the system.  For monitoring to be proper under the Wiretap Act, one of the exceptions to the general prohibition against such monitoring must apply. (Of course, if the monitoring is only of non-content information, such as addressing information in the packets, then the Wiretap Act’s prohibition against the interception of “content” of communications would not apply, and only the rules of the Pen/Trap statute would be triggered).  
Intuitively, monitoring traffic on a honeypot should be permissible.  After all, traffic on a honeypot is guaranteed to be unauthorized and very likely entirely hostile.  Yet the statutory prohibitions do not have an exception designed for this situation, and as counter-intuitive as it may seem, the Wiretap Act prohibits monitoring of content in real time on a honeypot unless one of the listed exceptions applies.  The Wiretap Act contains dozens of exceptions, which may or may not apply in hundreds of different situations.  With regard to honeypots, just as other computer systems, the primary exceptions to consider include the Computer Trespasser exception, the party to the communication exception, the consent of a party exception (e.g., a consent-bannered system), and the provider protection exception.  

## Honeypots; The Computer Trespasser Exception

- Government may monitor “trespasser”
- No contractual relationship or authority to be on computer
- Use care if “advertising” honeypot; may imply authority to use
- Provider must authorized interception
- Government must do the monitoring
- Only trespasser’s communications intercepted
- Relevant to an ongoing “investigation”

**Notes:**
The recently enacted “computer trespasser” exception may play a role in monitoring attacks to a honeypot.  18 U.S.C. § 2511(2)(i).  A classic honeypot will have no authorized users; all who gain access are trespassers.  Investigators and prosecutors should carefully avoid any implication that hackers are authorized to access the honeypot.  For example, if investigators  “advertise” the honeypot in hacker chat rooms, perhaps by identifying vulnerabilities and exploits or supplying passwords, there is a possibility that a court would later conclude that the honeypot operator authorized the intrusions. (There may be others who access the honeypot, but they should they should be closely associated with the operation, such as the system administrator or agents who are in charge of populating accounts or making it look like there is normal activity on the honeypot.  The honeypot operator can gain explicit consent of these users to monitor their communications.)
The computer trespasser exception does not permit law enforcement to monitor where there is a previous contractual relationship between the monitored party and the provider.  In the typical honeypot context, however, no such relationship exists.  In certain circumstances, however, investigators might deploy a honeypot so that it appears to be part of a production network in order to identify a suspected rogue employee who has authorization to access the production servers.  In this case a court might conclude that the insider was not a “trespasser” as defined for the purpose of this exception. 
In addition, the computer trespasser exception contains other requirements that should create few difficulties for investigators.  The exception applies only where the provider has authorized the interception, which should nearly always be the case with honeypots.  The monitoring under the exception must be done by a person acting “under color of law.”  This is easily achieved, but also possibly overlooked.  If the honeypot is run in conjunction with a private entity (possibly as part of the private entity’s network), the law enforcement entity should conduct the monitoring.  In addition, only the communications of the trespassers may be intercepted under this exception.  As discussed above, in the honeypot context the communications being monitored are either those of trespassers or of personnel working on the honeypot who have consented to monitoring.  
Finally, investigators can use the exception only if the intercepted communications are relevant to an ongoing investigation.  Although the statute does not further define the term “investigation,” it would certainly include criminal investigations.  “Investigation” probably would not include monitoring for purely academic interest in hacker skills and techniques, although there is no case law on this point.

## Honeypots; Party and Consent of a Party Exception

- A party to a communication can intercept or give consent to intercept
- Two ways this may help
- Banner the System (but is imperfect solution)
- The honeypot may be a party in some cases (but risky in other cases, e.g., IRC)

**Notes:**
The Wiretap Act permits monitoring where the interception is done by a party to the communication or where a party has given prior consent to the interception.  Investigators may use  two methods to obtain consent, although each has limitations.  
First, as with normal production servers, a honeypot could deploy a logon banner to obtain the consent of users to monitoring.  An attacker who sees the banner and continues to use the system will have consented to the monitoring (assuming, of course, that the banner is properly worded to this end).  The difficulties that honeypot designers face with bannering are two-fold.  As a technical matter, it is not possible to place a banner on all ports of a computer.  An attacker may be able to gain access to the honeypot using an un-bannered port.  The operator can shut those ports off and keep a close watch to make sure that they remain closed and that there is no traffic through them. (Monitoring of those ports by the honeypot system administrator may be entirely proper, as discussed later, but the system administrator’s role should be kept distinct from that of the investigators).  Similarly, if the purpose of the honeypot is to evaluate or investigate attacks through un-bannerable ports in particular, there is little that the operator can do to obtain the attacker’s consent to monitoring.  In addition, for some honeypot scenarios, a banner may conflict with the look that the honeypot operators intend to give the server.  Deploying a banner on such a honeypot may reveal to users that it is not what it appears to be.
Second, in many situations a honeypot under attack is a party to the communication with the attacker.  In these cases the honeypot operator may be able to consent to interception on behalf of the honeypot.  Where the attacker is only using the honeypot as a “pass-through” to communicate with other systems or users, however, or where the attacker sets up an IRC server on the honeypot, the status of the honeypot as a party to the communications becomes far less clear.  Relying on this consent argument in these circumstances creates a significant litigation risk.  Still, some honeypot operators, concerned with the misuse of the honeypot as a platform for attack of others or distribution of contraband, may put in place rate-limiting mechanisms to keep to a trickle any outbound traffic, thus significantly reducing the chance that the honeypot can be used for communications with others.

## Honeypots;The Provider Exception

- To Apply, the Monitoring Must be Done to Protect the Provider’s Rights or Property
- May have Some Limited Application to Honeypots
- Helpful Facts:
- Separate Sys Admin Tasks from Investigatory Functions
- Honeypot Associated with Production Servers

**Notes:**
The provider-protection exception to the Wiretap Act may have some application in the honeypot context, but the fit is awkward.  The provider protection exceptions allows a provider to intercept the content of communications to protect “the rights or property of the provider of that service.”  Because a honeypot is deployed for the very purpose of being attacked, it may prove difficult later for the operator to successfully assert that the monitoring of the hoped-for attacks was done to protect the rights and property of the operator as the owner of the honeypot.
In spite of this shortcoming, the provider-protection exception may support lawful interception by a honeypot system administrator seeking to assure that the honeypot is not damaged so that it can continue operating as a honeypot.  For example, a system administrator of a honeypot that is deployed to evaluate real-world attacks on secure shell access may need to monitor traffic on all non-secure shell ports to make sure that the honeypot remains online to fulfill its purpose.  If monitoring on the non-secure shell connections is done by investigators (or with their oversight or at their direction), however, then the monitoring appears less motivated by a desire to protect the honeypot and more like monitoring for law enforcement investigative purposes.  In those cases in which the undercover operation does not use an independent system administrator, the functions of system administrator and investigator blur together and even legitimate monitoring to protect the honeypot may appear, after the fact, to be motivated for reasons other than system protection.  Even if there is a clear division between the system administrator and the investigative agents, there is a non-trivial risk that a court would conclude that because law enforcement operated the honeypot, no true non-law enforcement purpose lay behind any of the monitoring.  If no other exception applied, a court could rule that the monitoring violated the Wiretap Act.
In addition to separating the system administration functions from the investigatory functions, particular honeypot configurations may allow investigators and prosecutors to make a stronger argument that the monitoring was done to protect the rights and property of the provider than would other configurations.  In this regard, the closer a honeypot is associated with a provider’s true production servers, the more convincing the claim that the monitoring is done to protect those associated production servers.  For example, suppose the law enforcement division of the Inspector General of a government agency deploys a honeypot (1) with an IP address within a block of IP addresses used by the agency for its production network and (2) configured to appear to be part of the agency’s production network.  (The honeypot may, for example, run a similar operating system, respond to pings in a manner consistent with the surrounding production servers, and be populated with accounts and/or data consistent with a plausible mission of the agency).  In such a configuration, the investigators and prosecutors can argue that the honeypot acts as a lightning rod to attract attacks that otherwise might have been directed to production servers in the IP block.  Monitoring attacks destined for the production server arguably is done by the agency to protect the rights and property of the agency’s production network, not just to protect the honeypot.  Although the agency could have blocked all such attacking traffic rather than using a honeypot to watch it, the agency instead elected to monitor the attacks actually being launched against the production server so that it could deploy better security and understand the threat to the enterprise.  There is litigation risk in this argument.  A court could conclude that the “rights and property” exception does not apply because there was no real need to monitor the traffic to protect the production servers, and because the true motivation for the monitoring by law enforcement investigators was to investigate a crime.

## Honeypots; Examples

**Notes:**
A honeypot can be configured in innumerable ways.  How a honeypot is configured may well have legal implications.  Here are just two examples of how a honeypot may be set up.  We will discuss in a moment how the law may apply differently to each of these,

## Honeypots; Pen/Trap

- Monitoring only addressing information (to the exclusion of content), then the Pen Register, Trap and Trace statute would apply
- If have exception to Wiretap Act to intercept communications, then have argument that ok to collect related info

**Notes:**
If monitoring on a honeypot is configured to acquire only addressing information (to the exclusion of content), then the Pen Register, Trap and Trace statute would apply.  Section 3121 et seq. generally prohibits the unauthorized installation or use of a pen register or trap and trace device.  (The term “trap and trace” device means “a device which captures the incoming electronic or other impulses which identify the originating number or other dialing, routing, addressing, and signaling information reasonably likely to identify the source of a wire or electronic communication, provided, however, that such information shall not include the contents of any communication.”  18 U.S.C. §3127(4). Similarly, a pen register is “a device or process which records or decodes dialing, routing, addressing, or signaling information transmitted by an instrument or facility from which a wire or electronic communication is transmitted.”  18 U.S.C. §3127(3).)  IP addresses are routing or addressing information.  Therefore, normal operation of honeypot and the creation of log files in relation to those operations appears to fit the definition of both a pen register and trap and trace device,10 requiring a court order to operate, unless use falls within one of the statutory exceptions.  18 U.S.C. § 3121(a).

Arguably the provider can consent to use of a pen/trap device, just as a party to a communication can consent to interception of content of a communication under 18 U.S.C. §§2511(c) or (d).  A contrary rule “would lead to an anomalous, if not absurd, result.” United States v. Freeman, 524 F.2d 337, 341 (7th Cir. 1975) (“To arrive at such an answer we would have to conclude that the . . . lesser intrusion of privacy, compels suppression while the . . . greater intrusion, does not.”).  See also United States v. Auler, 539 F2d 642, 646 n.9 (7th Cir. 1976) (“We have held, however, that such a limited intrusion by a telephone company [use of pen register], in light of the greater surveillance permitted under section 18 U.S.C. § 2511(2)(a)(i), is surely permissible.”)

## Honeypots; ECPA

- ECPA Rules May Limit
- Voluntary Disclosure of Info Stored on Honeypot
- Process Necessary to Compel Production
- Do Voluntary Disclosure Limits Apply?
- Only if services offered “to the public”
- Not Clear what this Condition Means
- Avoid Rapid Collection of Info that, although in Stored State, has been Stored only Short Time; Looks Like Wiretap

**Notes:**
Whether ECPA will have an impact on gathering or disclosure information on a honeypot will depend in the first instance on whether ECPA applies to the honeypot at all.  As a general matter, ECPA may apply to restrict the access to or disclosure of stored information if the honeypot operates either as an “electronic communications service” or as a “remote computing service.”  
ECS:  A honeypot that offers authorized users the ability to send and receive wire or electronic communications operates as an “electronic communications service” (“ECS”), as that term as defined by statute.  18 U.S.C. § 2510(13) & (15).  Although not yet presented to a court for decision, arguably, if a honeypot operator has not authorized any person to use the honeypot to communicate, then the honeypot is not an ECS.  Whether a court would find this argument compelling in the context of a honeypot configured to appear to have numerous authorized users, have wide-open access and run by an operator who hopes and intends that the honeypot will be used by intruders to connect with other servers is unknown.  A court could rule that this honeypot is an ECS because the owner intended that intruders access it, and as such authorized the conduct, even if such authorization was not apparent to the intruders.  
In any event, the ECPA disclosure prohibitions relating to electronic communication services apply only to persons providing such services “to the public.”  18 U.S.C. §§ 2702(a)(1) & (3).  A honeypot typically will not be available to the public, and thus not within the prohibitions applicable to an ECS that does offer the service generally.  There is a risk that an intruder could enabled the honeypot to allow for outbound connections (e.g., established an IRC server) available to the world generally.  It seems doubtful that this alone would convert the honeypot into a publicly available ECS; a court may conclude that it was the unauthorized conduct of the intruder that made the service available, not the honeypot operator, and reject the application of the ESC label on that ground.
RCS:  A honeypot that provides computer storage or processing services to the public is a “remote computing service” (“RCS”), as that term is defined by statute.  18 U.S.C. § 2711.  As discussed above with regard to the ECS issue, a honeypot typically will not be available to the public, and thus by definition will not qualify as an RCS.  Arguably, a court deciding whether a honeypot offers services “to the public” in determining whether the honeypot is an RCS (or ECS) may consider factors such as whether it is left open for anybody to establish accounts or otherwise connect (no password protection) to use the communications for storage functions.  It is unlikely that a honeypot that has been left unpatched (and thus vulnerable to certain types of attacks) would, based on its insecure settings alone, be deemed to offer services “to the public.”  In the unlikely event that a service on a honeypot does provide services “to the public,” then you may wish to consult with the Computer Crime and Intellectual Property Section for additional guidance.
Note: A honeypot operator should exercise great caution if rapidly gathering stored communications that, while technically in a stored state on the honeypot, have been in that state only a very short time after transmission.  A court may view such a process as an interception, governed by the Wiretap Act and not ECPA. 

## Honeypots; Other Rules

- Other Laws May Apply Too
- E-Government Act of 2002
- Rules on Use of Cookies
- Rules on Privacy Policies
- Internal Agency Regulations on Internet Resources
- Populating Honeypot with Contraband
- Make Sure You Know What Rules Apply and What Waivers are Available
- DOD-Specific Rules

## Honeypots; Charges

- Know your Goal before Designing
- If Purpose to Prosecute
- Identify Charges of Interest
- Attempt (Impossibility)
- Other Victims
- Warez, etc.
- Consider Jury Appeal

**Notes:**
When designing the honeypot, have clearly identified goals.  A honeypot configured to attract warez groups may look very different than one deployed with the intent to catch intruders or to analyze malcode.  If you know your goals, you will have a better chance of being able to minimize the risk that the honeypot will be used as an attack platform to inflict damage on others.
It is not yet clear if honeypots, in their pure form, can be useful investigative tools.  Prosecutors may find themselves with difficult cases to make if based only on the attack of a honeypot.  There is probably no real damage to support a section 1030 charge other than attempt, and in any event may suffer from a lack of jury appeal.  Still, a successful honeypot-based investigation may lead to the discovery of other victims that have suffered  real damage and can support criminal charges.

## Honeypots; Entrapment

- Entrapment is a potential factor in any undercover
- To find entrapment in most jurisdictions:
- The government induced the illegal conduct and
- The defendant was not predisposed to engage in the illegal conduct.
- Entrapment is unlikely a good defense in pure honeypot cases
- Still, keep it in mind
- Trappings of Honeypot (*e.g.,* promotion, password or vulnerability distribution)
- If core of charge is based on gov’t supplying necessary item available only through the government

**Notes:**
In the nascent honeypot literature, some have suggested that prosecutions brought based on attacks on a honeypot are vulnerable to the defense of entrapment.  A honeypot standing alone, without much more conduct by the government to promote an attack on the server, is very unlikely to constitute entrapment.  In most jurisdictions, the defense of entrapment requires a finding that (1) the government induced the illegal conduct and (2) the defendant was not predisposed to engage in the illegal conduct.  See Sherman v. United States, 356 U.S. 369, 373 (1958).  But as with any undercover, keep the possibility of entrapment in mind particularly if (a) there is conduct attributable to the agents that may appear to be inducements to attack, or (b) the charge you would like to bring is based on materials provided by the agents necessary for commission of a crime and that were not obtainable through non-governmental channels.

## Honeypots; Collateral Damage

- Do No Harm
- Potential lawsuits
- Downstream victims of intrusions
- Launch Pad for Denial of Service Attack
- Drop or Distribution Site for Contraband
- Plan Ahead
- Evidence of Criminal Activity
- Evidence of National Security Breach
- Victim Notification Issues
- Can Take Significant Resources

**Notes:**
We should not under-estimate the resources that it takes to operate a honeypot while reducing to an acceptable level the risk that it will be misused to harm others.  Consider the manpower needed to keep an eye on the honeypot while online so that it can be brought down or connection aborted if it is misused. 

## Where To Get More Information

- Computer Crime Section:  (202) 514-1026
- E-Mail:  anthony.teelucksingh@usdoj.gov
- Computer Crime Section’s Web page: