Thread by @MalwareJake

Quick 🧵on yesterday's FBI partial takedown of #CyclopsBlink.
1. Even for privacy types who fear government overreach (like me) this was a net positive. We should seek to degrade nation-state threat actor capabilities where it is possible to do so without collateral impact. 1/

2. The fact that WatchGuard assisted in the operation is critical. Obviously they have a vested interest in helping, but that's beside the point. It provides a level of private sector oversight that's often lacking in government operations. 2/

Now I'm mot an idiot. I know the FBI gets the final say in anything being done. But if they were abusing this access in any way during the op, there's a 1000% chance that will eventually leak given the private sector involvement. 3/

3. I think it's important that the @FBI clarified it didn't interact with the devices other than through C2 channels already established. It's also important they state they didn't collect any data (except serial number) from the devices. I get that's still not enough for some 4/

4. What can the @FBI do better? I'd personally like to see a public statement committing the FBI will NEVER use access gained through countering foreign cyber threats to investigate crimes (except terrorism or imminent loss of life). 5/

It's important the FBI publicly state they won't use parallel construction either If you're not familiar with parallel construction, read this My doc said my BP is to high to keep talking about this, but TL;DR it's basically shredding the 4th amendment. 6/
en.wikipedia.org/wiki/Parallel_…

5. I've run into some of the @FBIPittsburgh and @FBIAtlanta (less so for @FBIOklahomaCity, though I'm sure they're awesome too) cyber folks in my travels. They are top notch. Legit badasses. It was no surprise to see them leading this. 7/

6. It was absolutely CRITICAL for the public trust that @FBI tried to remove the C2 using more traditional means first (e.g. contacting victims through ISPs). But we all know there will eventually be a case where exigent circumstances takes over and waiting won't be an option. 8/

I implore @FBI to publish a framework for when that will be necessary. Get public feedback. Listen.

Sure, some will claim publishing the framework for what constitutes exigent circumstances will "give our playbook to the enemy." My friends, public trust is FAR more important 9/

I could keep going, but I'll close it out here. Bravo to the @FBI for it's work in drop kicking it to the Russians when they absolutely need points of presence for cyber operations, particularly in the US. /FIN