government
How does the FBI seize websites if they cannot use the law?
<p>After doing some research about websites that have been taken down like <strong>Silk Road</strong> I have been extremely curious about the procedure that the <strong>FBI</strong> does to take down a website from the Internet.</p>

<p>How do they do it <strong>if the website is hosted in another country</strong> for example? Do they just contact the hosting company and blackmail them? Does the FBI "hack" the websites they cannot seize?</p>

<p>My question applies for <strong>both</strong> Dark Web and Clear Web websites. I understand that is much easier for a government entity to just use the law for their purposes but that's not always possible...</p>

<p><a href="https://i.stack.imgur.com/3ryUL.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/3ryUL.png" alt="enter image description here"></a></p>

<p>Hacking a website to take it down is not effective; the target can simply regain control of their machine or restart the service somewhere else. The objective of the FBI is to make arrests and obtain convictions, not play whack-a-mole. </p>

<p>When the FBI targets a website and its operators there are a number of approaches that it can use, depending on the circumstances.</p>

<ul>
<li><p>For clear-web sites one simple approach is just to seize the domain name. When you type <code>badsite.com</code> into a web browser a system called DNS looks up the name in a distributed database and from that gets an IP address. The DNS database is <a href="https://en.wikipedia.org/wiki/Domain_name_registry" rel="nofollow noreferrer">managed by a number of national and international authorities</a>, and most national authoritities will cooperate with legal requests from the FBI, possibly routed through INTERPOL or via a <a href="https://en.wikipedia.org/wiki/Mutual_legal_assistance_treaty" rel="nofollow noreferrer">Mutual Legal Assistance</a> treaty. Of course there are some countries that won't cooperate, and this on its own doesn't help the FBI to arrest anyone.</p></li>
<li><p>The FBI can use an IP address to find out where the physical servers are located. If that is in the US then they can simply go and <a href="https://www.justice.gov/sites/default/files/criminal-ccips/legacy/2015/01/14/ssmanual2009.pdf" rel="nofollow noreferrer">seize those servers as evidence, or use a subpoena</a>. If it is outside the US then its back to INTERPOL or Mutual Legal Assistance.</p></li>
<li><p>Servers on the "dark net" use <a href="https://en.wikipedia.org/wiki/Tor_(anonymity_network)" rel="nofollow noreferrer">TOR</a> to bounce the packets around the Net a few times. This hides the IP addresses of both servers and clients, so the challenge for the FBI is to find out what the IP address of the target machine is. Once they have that they can proceed as normal. Getting the IP address generally means hacking the target machine via TOR, and then finding the IP address once inside.</p></li>
</ul>

<p>If the DNS and servers are hosted in a country that won't play ball with the FBI, well that is just too bad. The FBI can carry on investigating of course, and if someone running the website ever travels to a country where the FBI can get them arrested then they will do so.</p>

<p>The notice you use as an example is a domain name seizure notice - the FBI uses its jurisdiction with <a href="https://www.icann.org/" rel="nofollow noreferrer">ICANN</a> to <a href="https://www.icann.org/en/system/files/files/guidance-domain-seizures-07mar12-en.pdf" rel="nofollow noreferrer">seize the domain from its owners</a>.</p>

<p>They can do this because ICANN isn’t immune to US authority - they are a US non-profit and thus fall under US jurisdiction.  Thus all domain names fall under US jurisdiction.</p>
