From the Wired article, "Instead of going for the easy bust, the FBI spent a solid year surveilling McGrath, while working with Justice Department lawyers on the legal framework for what would become Operation Torpedo. Finally, on November 2012, the feds swooped in on McGrath, seized his servers and spirited them away to an FBI office in Omaha.
A federal magistrate signed three separate search warrants: one for each of the three hidden services. The warrants authorized the FBI to modify the code on the servers to deliver the NIT to any computers that accessed the sites. The judge also allowed the FBI to delay notification to the targets for 30 days."
The FBI modified the .onion sites to serve a malicious script which was used to de-anonymize users. It's worth noting that only those using Tor improperly would be vulnerable. The FBI tracking payload required scripting to be enabled in the browser--a common blunder among inexperienced Tor users.
(Score: 2) by tynin on Wednesday August 06 2014, @09:13PM
I've worked at an ISP that also has a tier 1 network. It was SOP to never take down the offending site, but to validate it did indeed of kiddie porn (the horror), burn the site to disk and stick it in the vault (which was overflowing), and notify the FBI and our legal dept. The site serving the offensive material was always left online to allow for the Feds to gather more dirt. One of my co-workers was sick of this policy, so they sent in a forged email into support appearing to be coming from the users contact email professing how they were a scumbag pedo and requested that the account be terminated immediately, which worked surprisingly well.