March 11, 2015 / by emptywheel

 

The Marathon Trial: An Assessment of FBI and NSA’s Online Investigations

There are a number of journalists doing a superb job of live-tweeting the Boston Marathon trial (I’m following @JimArmstrongWBZ, @susanzalkind, and @GlobeCullen, among others).

On top of gruesome details from survivors about the injuries they suffered, FBI witnesses have provided some interesting details on the investigation. For example, we’ve learned that Dzhokhar Tsarnaev and his brother used TMobile phones the day of the attack, though Dzhokhar’s handset had been set up just days earlier.

That the brothers used TMobile is significant because the NSA boasted it had used the phone dragnet to contact chain the brothers after the attack. But anonymous sources claiming the dragnet is not comprehensive have claimed the dragnet doesn’t pull in TMobile records. Given that Basaaly Moalin is the only other person with whom the phone dragnet was deemed a success, and he also had a TMobile phone, the claim that NSA is not getting TMobile calls (which is distinct from whether they’re getting call records from TMobile) is likely bullshit.

Dzhokhar had two Twitter accounts. Both of them — @j_tsar and @Al_firdausiA — link up to his Gmail account. And he also had a Yahoo account.

FBI Agent Steven Kimball, who introduced all this evidence, doesn’t appear to have explained how he connected all these together, which is significant because they likely could have done it via NSA databases before criminally subpoenaing Twitter and Google.

Anyway, those data points are ones we can return to as we get more information. The truly appalling revelation, however, came when Dzhokhar attorney Miriam Conrad cross-examined Kimball after he had introduced a bunch of tweets claiming they were evidence of the defendant’s jihadist intent.

Turns out they were less evidence of jihadist intent than that Dzhokhar consumes the same pop culture many other Americans his age consume (along with a Russian rap artist). Conrad not only showed that the Kimball had no idea what he had been looking at, but hadn’t even clicked through the links Dzhokhar had included to figure out what they meant.

She asked Kimball if he knew the tweet “I Shall Die Young” was from a Russian rap song.

He did not.

Were you aware, she continued, that Dzhokhar Tsarnaev posted a link to that song?

“No.”

The day before, the prosecution had gone to great lengths to point out one of Tsarnaev’s tweets that said, “September 10th baby, you know what tomorrow is. Party at my house!” It suggested someone tasteless if not cruel, someone who celebrated 9/11.

But Conrad asked Kimball if he knew that the line was from a sketch on a Comedy Central show? He didn’t.

While Conrad didn’t say, it was from a segment called “Things You Don’t Yell When Entering a Room” from the Tosh.O show, which is popular with college kids who like to sit around their dorm rooms getting high. Which is precisely the picture that the defense wants the jury to imagine. Not some jihadi wannabe kneeling on a prayer mat in front of a poster of Osama bin Laden, but some stoner down at UMass Dartmouth, watching Tosh with his buds and a bowl.

In fact, so the jury would get that picture, Conrad asked FBI Special Agent Steve Kimball if he knew what the word “cooked” meant in one of Tsarnaev’s tweets.

“I assume, like, crazy?” Kimball guessed.

He guessed wrong. It means the same as baked. High. Stoned.

About the only Twitter phrase Kimball correctly IDed was LOL.

Conrad also showed that Kimball misidentified the account photo on Dzhokhar’s twitter accounts as coming from Mecca, when it in fact came from Grozny.

“You said the picture [that forms the background of the second account] was a picture of Mecca,” said Conrad, towards the end of a lengthy and tense cross-examination.

“Yes, to the best of my knowledge,” answered Kimball.

“Did you bother to look at a picture of Mecca?” Conrad shot back.

“No.”

“Would it surprise you to learn that it is a picture of Grozny?”

The picture on the account is not of Mecca – the FBI had misidentified it. It is in fact a picture of the Akhmad Kadyrov Mosque in Grozny.

Let me be clear: While it was funny to see Conrad carve up the prosecution’s witness, that’s not, by itself, going to save Dzhokhar’s life (nor should it, if that’s what the jury decides is appropriate punishment).

But this does betray a real methodological problem with the FBI’s approach to interpreting Twitter content that goes well beyond this trial. If the FBI believes it doesn’t even have to click a link to understand a Tweet — a pretty egregious Twitter faux pas even for people just conversing — it suggests a lot of their profiling may be based off baseless overdetermined interpretations.

Copyright © 2015 emptywheel. All rights reserved.
Originally Posted @ https://www.emptywheel.net/2015/03/11/the-marathon-trial-an-assessment-of-fbi-and-nsas-online-investigations/