Slashdot Mirror
Security, Due Process and Convenience
teambpsi writes: "CNN is running an article about ISPs' concern over having law enforcement present during a court-ordered search. Since we are an ISP, I can understand the concern, however, also being a privacy freak, I think it adds a certain weight to the decision of wether to file the search in the first place. It adds a certain levity. I'm not sure what percentage of these search warrants are unnecessary, but I think that having due process in place is important. Opinions?"
If cops actually have to be there, and the city/state actually has to pay for their payroll, etc., maybe they'll be more careful and not just whip out a search warrant on a whim. I know that the local department probably wouldn't be happy having to use their officers for that rather than having them on the street doing their jobs.
Don't ISP's always retain the right to copy and comply with law enforcement with or without the court order? The court order is merely ask the ISP to comply, but the ISP is not REQUIRED to ask for one. Used to be every time you signed up even with a BBS they'd flash that fact in your face, that the sysop CAN read your mail.
The fourth amendment does not protect against companies looking at information they already have a contract with you, personally, to look at.
Never confuse volume with power.
If for no other reason than to force there to be an actual cost for LE in a search - I doubt that ISPs get to bill LE for the cost of handling searches. The cop may not be able to perform the search, but should certainly be supervising it - they aren't supposed to be sitting in the lobby eating donuts while the ISP techs are gathering data.
So, the point is that the law enforcement agency is the most impartial, not because they have no bias, but because the evidence they can use in a court of law is more restricted when they conduct the search. They shouldn't just assist in the search, they should be conducting it.
Ceci n'est pas un post
Think about it - any police department has a finite staffing, usually very understaffed.
.
Now, imagine you are a police chief. You have five search warrents out against SomeISP.COM for stuff you feel is white-collar, victimless crimes.
On the other hand, you have five tips about meth labs.
Where do YOU send your officers?
Consider that the key part of a DoS attack is consuming all of some limited resource, be it bandwidth, sockets, Moderator points, or police officers
Now, instead of the ??AA being able to crapflood the system with bogus warrents to be filled by (relatively) plentiful techs at small ISPs everywhere, they must be filled by (relatively) scarce police officers.
Would that not tend to limit this crap?
www.eFax.com are spammers
The ISP is being served the warrant, but they are not a suspect in the case. That is the difference here. Law enforcement is well aware that Yahoo is not in any way involved in the illegal activity, but they have information required by law enforcement. When they are served a warrant for information on clients, they cooperate every time by forwarding the requested information. There is no REASON for a police officer to be there, especially since they probably wouldn't know what was going on anyway. They'd be hanging around waiting for someone familiar with the system to call up the requested information, and it would then be faxed on, just as if the police officer wasn't there.
Where police presence IS needed is when the company/individual being served the warrant is suspected of illegal activity. If Yahoo as a company was actually intentionally distributing child porn, law enforcement could not expect them to voluntarily turn over all evidence of their illegal involvement in this regard.
As far as the 4th ammendment rights go, Yahoo has a privacy policy (as far as that goes) that states that they won't blindly hand over customer information without the customer's permission or a search warrant. If yahoo were to discover illegal activity, they could still turn over that information to the police without first being contacted by them. The 4th ammendment doesn't apply here at all. In fact, they could turn it over WITHOUT a search warrant if they wanted to. They could possibly get sued for contract violations, but it wouldn't/shouldn't save the ass of someone using their services illegally.
-Restil
Play with my webcams and lights here
This doesn't really have to do with due process, it has to do with chain of evidence.
Oversimplification - Due process means that you get your trial, and that the trial follows certain rules. One of those rules is that evidence presented against you has to meet certain standards, such as chain of custody.
Chain of custody says that the evidence, once gathered, is kept track of in a way that ensures it is genuine. The original case here was trying to cast aspersions on the chain for certain evidence since it hadn't been initially gathered by law enforcement.
This new ruling should be thrown out, though, because it's certainly going way beyond the standard for chain of custody. Anybody can be part of the chain of custody as long as they follow appropriate procedures - keep good notes, don't allow the evidence to pass out of your control, make sure that law enforcement signs for it, be able to truthfully testify that no one could have tampered with it while you had custody of it. Frankly, I'm suprised any defense attorney would WANT this - they'd rather that Joe Schmoe from the ISP, who only gathers evidence once a blue moon, gets called on the stand so they can twist his words, rather than a professional law enforcement officer who generally knows the rules of the game a lot better.
IANAL, but I'm working on my SANS GCFA certification and there's a lot of coverage of chain of custody in there that I'm pulling from.
???!?!?
I mean, how disingenous can you get? The whole point in requiring actual meat effort in order to execute a search [as opposed to massive automated electronic drag nets] is going to do nothing other than discourage any searches unless they are actually probably usefull in a real way to an ongoing investigation. By requring extra cost for the search on the part of the authorities, this isn't going to chill anyone!
How stupid do some lawyers think people are? (...or even worse, how stupid are they)
---
the pen is mightier than the sword, the sword is mightier than the court, the court is mightier than the pen.
This is just stupid. If the ISP wants to cooperate with law enforcement, they could do so even without a search warrant. Once the search warrant has been drawn up, if the ISP wants to cooperate in the manner most convenient for them, and the law enforcement folks agree, there's no problem.
It's even better than that - if the ISP wants to gather evidence of wrongdoing related to their computer resources (say, someone hacking from their dialups) they have much greater leeway in their search, for they aren't bound by the fourth amendment. Once law enforcement becomes involved, it actually places limits upon what the ISP could do on its own.
Now, once law enforcement requests the cooperation of the ISP, then the ISP IS bound by the fourth amendment, because they are an agent of the government. So, as I understand this case, the defense should be attacking whether the data was gatherable under 4th amendment and under the particular warrant used, not whether there was a policeman there or not. Evidence gathered by an ISP in response to a warrant is held to fourth amendment rules, no matter who executes the search.
Consider this: You walk in on a convenience store shooting. Should you not be able to go up on the witness stand and testify because you aren't a law enforcement officer? As long as the defense can't prove the search was conducted in excess of fourth amendment rights, it should make no difference whether it was carried out by someone with a badge or not (assuming search was in accordance with warrant parameters, chain of custody was kept, etc. etc.)
IANAL - YANMM
It seems the only reasonable thing to do is require that the person at the ISPconducting the search for the police, be certified and deputized in some way. I'm sure that most ISP's already have one or more persons who basically spend all their time handling these requests. Clearly sending your average traffic cop to supervise is rediculous. Perhaps some level of co-funding of salaries for these "Search Warrent Officers" should be offered by the government?
:)
And I'm not an Anonymous Coward, I am just monumentally Lazy
As someone who is involved with the law enforcement community I will point out that in almost every search warrant to obtain information from a third party source I.E.. Phone records, Cell phone traces, ISP logs, and many others you are always working with others to gain information. Those people that you work with may not always be police officers. If this holds up it will cause a large problem. Security freaks (such as myself) want and deserve our privacy. However, when people are thinking of hurting or killing others should that information be off limits? If a police officer was able to obtain information that would stop your mother, daughter, son, etc.. from being hurt or killed would you want to give the advantage to him or the police? The person that was released was a child pornographer. Was the law protecting the rights of the children or the sicko in this case? As Sir Robert Peel said
"...the community is the police and the police are the community"
It is ALL of our responsibility to protect the innocent. Some people are paid to do it for a living. If you could stop a child pornographer would you? That is what this is about. This CASE LAW is saying that only the police can protect the public. It is ALL of our duty to protect the public. You shouldn't let anyone take that right away from you.
Of course, an easy way around this is to temporarly deputize anyone you need and then they are a law enforcement officer for as long as you need them.
Are we just talking about regular patrolmen here? If so, what would they do? They would watch the ISP's technicians do the work. How is this holding anyone to a "stricter scrutiny"? While the cop can be confident that the techie is looking at something and not playing quake, what else can he say? Are we talking about specialized training for some cops and only sending them? Cops with video cameras to record the search?
While I agree with your goals and I am all for protecting the 4th amendment, I'm kinda fuzzy on how this would be implemented in a useful fashion.
- doug
Heck, I wouldn't be surprised to see it as a part of the Trusted PC specification.
Call (206) 338-5780 COLLECT for information about a genuine BA, BS, MA, MS, MBA, or Ph.D.
A defense lawyer came to my high school government class to talk about the legal system and its exciting collaries. He told several stories of legal bumblings that let him keep various clients out of jail. At the time, he disgusted me -- he was using the letter of the law to wiggle his clients out of the punishment they deserved for the crimes they comitted.
But then it dawned on me: that defense lawyer was fighting the border war to protect my rights. He reminded the police that they can't do whatever they want -- that the Bill of Rights is important.
The guilty must be punished, but not at the expense of the rights of the people.
Every time I see mention of evidence "from the Internet" or "from computer files" I wonder: how much evidence produced in court is actually genuine. We all know how impressed most people are with computer technology--and we all know how simple it is to create a simple text file. An email from Nicky Scarfo, Jr. admitting to loansharking? A trivial matter--just take any old email from Nicky, edit the text, and presto! "Direct" evidence that would impress 99 juries out of 99. While we're at it, why not have Nicky confess to financing the World Trade Center bombing?
This kind of thing isn't limited to email. Want to establish an alibi? If you have access to the database that stores key pass data (or E-Z Pass data) you can write a simple INSERT statement to add records necessary to prove you were on the Tappan Zee Bridge when the dirty deed was done (dirt cheap).
My point is that it is brutally easy to fabricate data--and I think the technologically unsophisticated are all too willing to accept anything that is presented as coming from "the computer".
A hypothetical example
Let's pretend that I'm a local police officer. I've been working a case for months--we've had several complaints about a man who might be a sex offender. But they're complaints of creepy behavior--nothing criminal. But I know--I know in my bones--that this guy is a ticking time bomb, just waiting to go off. And--being devoted to protecting the children of my community--I want to stop this creep before he hurts any (more?) children.
I'm in Pennsylvania, where judges are elected. A local judge who's up for re-election is likely to err in my favor when it comes to search warrants on suspected child molesters--so I get a warrant, and I seize the perp's computer. And--damn. The creep is evidently aware of the danger of computer evidence, because there is not a single shred of incriminating evidence on his hard drive.
Or is there? I can copy a few choice files into his temp directory, and copy a few incriminating cookies while I'm at it. Maybe I copy more than a few. All it takes is a floppy disk of helpful evidence and a moment or two alone with the computer--and who's going to believe the creep when he claims he never saw those pictures?
The chain of evidence? (The "chain of evidence" is a legal requirement that prosecutors be able to identify a particular person responsible for a piece of evidence from the time it is seized until it is presented in court.) I gave the perp a receipt for his computer. There's nothing that requires me to provide the perp with a listing of all the files--and no court in the world would let the perp do anything to that computer (like listing his files) when I seize it. I've provided a receipt for his computer--but who's to say what's on the hard drive?
Could this happen?
A frequent element of police fiction--and perhaps police reality--is that police officers carry "throw down" guns; a throw down gun is a firearm with no identifying numbers that can be dropped at a crime scene when a police officer shoots a suspect: the cop asserts that the suspect pulled a gun, but the cop shot first. There's the gun--and the suspect a) has an arrest record, b) is dead, or c) both. Who's to say?
In the same way, an overzealous cop or prosecutor could easily use "throw down" data to "tighten up" a case. The "bad guy" gets what he deserves--the entirely theoretical child molester gets sent to prison.
When the police come with the warrant
I have a client who pays me a few bucks to co-locate a server--which technically makes me an ISP. Ed hosts a couple of mailing lists, and while I seriously doubt any of these lists will ever be the subject of a search warrant, if I'm ever served with one I'm going to be particularly careful to maintain copies of what I provided to the cops. Sure--I'm all in favor of law and order. But fabricating computer "evidence" is so easy that it must be a temptation that is very hard to resist.
Unless the salaries of the police officers are included to the court costs and assesed against the loser, this is an unnecessary expense. The police officers will not understand what the ISP personnel are doing, and will contribute nothing to the reliability of the data. At a minimum, the cost should come from the court budget rather than the police budget.