Thread by @samwcyo

Upon my return to the United States from a trip to Japan, I was directed to a secondary inspection room where I was presented with a Grand Jury subpoena by officers from the IRS-CI and DHS. The subpoena required me to appear in New York to provide testimony for wire fraud. 🧵

For about an hour they asked me vague questions related to a "high profile phishing campaign" and how my IP address could've end up being "tagged" to a threat actor, showing me a manila folder with my own photo, my home IP address, and some random social media accounts of mine.

When I'd arrived at secondary I assumed it was just a random selection, so I'd given my unlocked device to the inspecting officer, but then watched as it was passed to the DHS and IRS-CI agents who were investigating the money laundering, conspiracy, and wire fraud charges.

After they'd questioned me, I was asked to leave the room while they sat and searched through my unlocked device for another hour. At this point I'd been given almost no information on whether or not I was a subject, witness, or anything related to the case at all.

Once they were finished, I was told that I could leave and immediately contacted a lawyer. Over the next few days, the lawyer spoke with the AUSA and also the IRS-CI and DHS agents. They learned that I was the target of the grand jury subpoena and for a really silly reason...

Back in December, 2022, I helped investigate a crypto phishing website that had stolen millions of dollars. In the JavaScript of the website, the scammer had accidentally published their Ethereum private key. Sadly, I'd found it 5 minutes too late and the stolen assets were gone.

During this process, I'd imported the private key into my MetaMask and navigated to OpenSea to check if there was anything left in the wallet. When I did this, I was on my home IP address and obviously not attempting to conceal my identity as I was simply investigating this.

The agents had requested the authorization logs of the account from OpenSea and saw that my IP. They subpoenaed the IP, found out who I was, then decided to use immigration as an excuse to ask for my device and summon me to a grand jury, rather than just email me or something.

After emailing back and forth for a few hours, the lawyer was able to get the subpoena completely dismissed and confirmation that all data from my device had been deleted. It's odd to me that they didn't see I work as a security engineer who responds to these things regularly.

I'm sharing this because I think it's something people should be aware of if they're doing similar work. It was widely shared that the private key was leaked and my background as a security researcher wasn't enough to dissuade using immigrations and a grand jury to intimidate me.

Thanks for reading, stay safe! 🤠