Slashdot Mirror
Security, Due Process and Convenience
teambpsi writes: "CNN is running an article about ISPs' concern over having law enforcement present during a court-ordered search. Since we are an ISP, I can understand the concern, however, also being a privacy freak, I think it adds a certain weight to the decision of wether to file the search in the first place. It adds a certain levity. I'm not sure what percentage of these search warrants are unnecessary, but I think that having due process in place is important. Opinions?"
If the search is court ordered, it only makes sense that some law enforcement agency should be there to assist in carrying out the "warrant." However, the agency should only become directly involved if something illegal is found. They should maintain impartiality until some law has been found to have been broken, after all, in this country we are innocent until proven guilty, right?
"I'm just here to regulate funkiness."
Time to encrypt everything. 512-bit encryption ought to slow them down, especially on large files.
You are not the customer.
If cops actually have to be there, and the city/state actually has to pay for their payroll, etc., maybe they'll be more careful and not just whip out a search warrant on a whim. I know that the local department probably wouldn't be happy having to use their officers for that rather than having them on the street doing their jobs.
Imagine having to sift through tonnes of porn material, and getting paid for it. The job itself isn't really important because most of the search warrants would be over bullshit matters anyway.
S
The police ability to hand off the search to a third party can easily be abused to circumvent fourth amendment protections. The boundary between an agent of the police and the police themselves can be fuzzy. This removes the question altogether.
Ceci n'est pas un post
Aren't "weight" and "levity" opposites?
Karma: Good (despite my invention of the Karma: sig)
I know it wouldn't help the ISP's a bit, but having an ISP return a blank note with the line 'sorry, this is all we found.' on it certainly doesn't constitute good law to me.
I'd suggest every ISP have sorta like a liason officer bound to certain laws, regular blind checks and stuff like that to confirm ISP are keeping their deal up too. Otherwise ISP's are free to act like they will
Please be patient, yahoo is down for search warrant maintenance. The system will be restored, minus any confiscated data, in a few hours...
Not only is this going on, but surveillance is increasing, and penalties are being stiffened for "cyber-crime". More info here.
This is just stupid. If the ISP wants to cooperate with law enforcement, they could do so even without a search warrant. Once the search warrant has been drawn up, if the ISP wants to cooperate in the manner most convenient for them, and the law enforcement folks agree, there's no problem. I mean, given that the ISP is legally required to cough up the info, and given that they don't even really want to put up a fight about it, what does it matter whether or not some police officer is standing there scratching his ass while someone pulls up the data? It doesn't matter at all.
Things might be different if there was a legal concept of strong privacy between an ISP and its customers, as with Attorney-Client Privilege, confidential medical info, or communications between spouses. The fact is that there isn't, though.
Arrr, it be the infamous pirate, No Beard Pete!
I find it disgusting that someone can escape justice because of en "error" in procedure, but if it was not that way, we could all be prosecuted. It's better to have one bad guy escape the justice and all the others be free, then to abandon all of our rights for one bad guy. It's the investigators obligations to make things right and honestly to catch those who brake the law. If they were to not respect any privacy rights and other rights to catch the "vilain", we would live under siege. You MUST make sure that you, as an ISP, make things the way they should be. To respect others privacy and right. And in the end, it can only help to make sure that the bad guy wont escape law.
I'd rather be sailing...
it adds a certain levity? Which form of levity would that be?
1. Lightness of manner or speech, especially when inappropriate; frivolity.
2. Inconstancy; changeableness.
3. The state or quality of being light; buoyancy.
Personally, I like the last one, law enforcement adds buoyancy.
..the POOOO LEEESE were a-waitin in the lobby, the challenge would still be valid. The search was still conducted by non-sworn personnel and such "evidence" should be suppressed. Maybe the ISP technician just typed the crap up?
"A microprocessor... is a terrible thing to waste." --
GeneralEmergency
I would expect proper procedure to generally be issuance of a subpoena for records. A search warrant should only be issued when the subpoena is refused, or the ISP is being investigated as an accessory. IANAL, but I do watch a lot of cop shows on TV. Search warrants should always be performed by law enforcement personel. That's probably the biggest difference between what makes it a search warrant and a subpoena.
bance.net
Don't ISP's always retain the right to copy and comply with law enforcement with or without the court order? The court order is merely ask the ISP to comply, but the ISP is not REQUIRED to ask for one. Used to be every time you signed up even with a BBS they'd flash that fact in your face, that the sysop CAN read your mail.
The fourth amendment does not protect against companies looking at information they already have a contract with you, personally, to look at.
Never confuse volume with power.
If for no other reason than to force there to be an actual cost for LE in a search - I doubt that ISPs get to bill LE for the cost of handling searches. The cop may not be able to perform the search, but should certainly be supervising it - they aren't supposed to be sitting in the lobby eating donuts while the ISP techs are gathering data.
The article stated that Yahoo! received litterally thousands of warrants in the course of a year. This is probably not an indication of any more crimes being committed using Yahoo's services, but is instead a reflection of the greater power LEO's have to violate individual's privacy, especially in the wake of the Patriot act.
The problem here is not that there are going to be police officers in a data center around the clock carrying out warrants. It's that there are that many warrants issued in the first place.
The next Slashdot story will be ready soon, but subscribers can beat the rush and slashdot the links early!
Think about it - any police department has a finite staffing, usually very understaffed.
.
Now, imagine you are a police chief. You have five search warrents out against SomeISP.COM for stuff you feel is white-collar, victimless crimes.
On the other hand, you have five tips about meth labs.
Where do YOU send your officers?
Consider that the key part of a DoS attack is consuming all of some limited resource, be it bandwidth, sockets, Moderator points, or police officers
Now, instead of the ??AA being able to crapflood the system with bogus warrents to be filled by (relatively) plentiful techs at small ISPs everywhere, they must be filled by (relatively) scarce police officers.
Would that not tend to limit this crap?
www.eFax.com are spammers
So, following this logic, only people who are breaking the law in their homes should be concerned about the police searching their homes? We all should be concerned. This type of thing is covered in the Constitution under illegal search and seizure. Besides, for a warrant to be issued in the first place there has to be some probable cause or at least SOME evidence or implication that a crime has occured.
"I'm just here to regulate funkiness."
The ISP is being served the warrant, but they are not a suspect in the case. That is the difference here. Law enforcement is well aware that Yahoo is not in any way involved in the illegal activity, but they have information required by law enforcement. When they are served a warrant for information on clients, they cooperate every time by forwarding the requested information. There is no REASON for a police officer to be there, especially since they probably wouldn't know what was going on anyway. They'd be hanging around waiting for someone familiar with the system to call up the requested information, and it would then be faxed on, just as if the police officer wasn't there.
Where police presence IS needed is when the company/individual being served the warrant is suspected of illegal activity. If Yahoo as a company was actually intentionally distributing child porn, law enforcement could not expect them to voluntarily turn over all evidence of their illegal involvement in this regard.
As far as the 4th ammendment rights go, Yahoo has a privacy policy (as far as that goes) that states that they won't blindly hand over customer information without the customer's permission or a search warrant. If yahoo were to discover illegal activity, they could still turn over that information to the police without first being contacted by them. The 4th ammendment doesn't apply here at all. In fact, they could turn it over WITHOUT a search warrant if they wanted to. They could possibly get sued for contract violations, but it wouldn't/shouldn't save the ass of someone using their services illegally.
-Restil
Play with my webcams and lights here
This doesn't really have to do with due process, it has to do with chain of evidence.
Oversimplification - Due process means that you get your trial, and that the trial follows certain rules. One of those rules is that evidence presented against you has to meet certain standards, such as chain of custody.
Chain of custody says that the evidence, once gathered, is kept track of in a way that ensures it is genuine. The original case here was trying to cast aspersions on the chain for certain evidence since it hadn't been initially gathered by law enforcement.
This new ruling should be thrown out, though, because it's certainly going way beyond the standard for chain of custody. Anybody can be part of the chain of custody as long as they follow appropriate procedures - keep good notes, don't allow the evidence to pass out of your control, make sure that law enforcement signs for it, be able to truthfully testify that no one could have tampered with it while you had custody of it. Frankly, I'm suprised any defense attorney would WANT this - they'd rather that Joe Schmoe from the ISP, who only gathers evidence once a blue moon, gets called on the stand so they can twist his words, rather than a professional law enforcement officer who generally knows the rules of the game a lot better.
IANAL, but I'm working on my SANS GCFA certification and there's a lot of coverage of chain of custody in there that I'm pulling from.
???!?!?
I mean, how disingenous can you get? The whole point in requiring actual meat effort in order to execute a search [as opposed to massive automated electronic drag nets] is going to do nothing other than discourage any searches unless they are actually probably usefull in a real way to an ongoing investigation. By requring extra cost for the search on the part of the authorities, this isn't going to chill anyone!
How stupid do some lawyers think people are? (...or even worse, how stupid are they)
---
the pen is mightier than the sword, the sword is mightier than the court, the court is mightier than the pen.
As someone who is involved with the law enforcement community I will point out that in almost every search warrant to obtain information from a third party source I.E.. Phone records, Cell phone traces, ISP logs, and many others you are always working with others to gain information. Those people that you work with may not always be police officers. If this holds up it will cause a large problem. Security freaks (such as myself) want and deserve our privacy. However, when people are thinking of hurting or killing others should that information be off limits? If a police officer was able to obtain information that would stop your mother, daughter, son, etc.. from being hurt or killed would you want to give the advantage to him or the police? The person that was released was a child pornographer. Was the law protecting the rights of the children or the sicko in this case? As Sir Robert Peel said
"...the community is the police and the police are the community"
It is ALL of our responsibility to protect the innocent. Some people are paid to do it for a living. If you could stop a child pornographer would you? That is what this is about. This CASE LAW is saying that only the police can protect the public. It is ALL of our duty to protect the public. You shouldn't let anyone take that right away from you.
Of course, an easy way around this is to temporarly deputize anyone you need and then they are a law enforcement officer for as long as you need them.
Are we just talking about regular patrolmen here? If so, what would they do? They would watch the ISP's technicians do the work. How is this holding anyone to a "stricter scrutiny"? While the cop can be confident that the techie is looking at something and not playing quake, what else can he say? Are we talking about specialized training for some cops and only sending them? Cops with video cameras to record the search?
While I agree with your goals and I am all for protecting the 4th amendment, I'm kinda fuzzy on how this would be implemented in a useful fashion.
- doug
Do I care if cops are present at my ISP while executing a search warrant? Of course not. As long as a search warrant is required and a judge (with accountability) believed the police presented enough logical reason for the warrant, I certainly don't care.
Exactly, there was a warrant presented and that's what really matters here. If they have a warrant the courts have allready ruled that they have a right to access the data, and it's not like Officer Bag O'Donuts is gonna have the technological skill to glean the data from a server anyways, even if he is present, he will just stand there while a admin goes thru and collects the data and then hands him the printouts of it. He will not have any more of a clue about how the data was collected than if he wasn't present.
There are far more troubling ISP privacy issues than this, such as the Cyber Security Enhancement Act of 2001 that we should be worried about
It could have been account information of some sort.
You assume that all Internet providers, web hosting providers, web content providers and the like all share a common mechanism for storing data that a court would be interested in gathering. Obviously they don't. The only practical way to collect information like this is to ask the provider to collect it. To require the police to come into a provider's offices, sit down at a terminal, and pull up the information he's looking for isn't very realistic, when that information could be in a million places in any number of proprietary formats.
C'mon folks. Think!
If all ISP's simply provided a standard API to Law Enforcement (LE) so that LE could search anything they wanted, whenever they wanted, then this problem would be solved. We wouldn't even be discussing whether LE should be present.
It could even be developed as a standard module for popular OSes. For instance, for Linux, a Kernel Module which provided this remote monitoring facility would be beneficial for everyone. It would conform to the standard remote monitoring API.
Problem solved. This would be beneficial for everyone.
It saves your manpower. You avoid LE people at your facility. Your engineers don't need to waste time performing the search. It saves LE manpower, because they don't need to visit your facility each time they want to search something. In fact, for additional savings, LE could start obtaining search warrants retroactively.
Those who would give up liberty in exchange for security and DRM should switch to Microsoft Palladium!
My cabinets are in a third party's cage house in New Jersey, their business office is in Santa Clara, CA, my provider CHQ is in NY, the service arm for me the customer is based in NC, the liason to the customer is in Florida and systems management is via Colorado.
How many cops do you want to send? All of them?
Either ISP's are acting as "private" organizations or they're not. I want them off the fence, one way or the other.
"You're never ready, just less unprepared."
Unless its a non-warrant search for terrorist activities.
And if you follow the propaganda, terrorists use almost every crime to raise funds. How to side step the constitution in 1 easy step, create a loophole.
The judge was worried about the person's rights, guilty or innocent. We seem to be a loop-hole country, our legal system isn't about justice, its about politics, money, revenge and religion. Not saying the system is all bad, we have many criminals, and the cops protect us every day. But when the special interest groups muddy the whole legal system, Judges that side on the constitution are trying to protect the innocent.
-
3019 dead in Sept 11. 4200+ Dead civilians in Afghanistan. - You stand with us, or against us - President Bush
It boils down to what is realistic. Yahoo says they get thousands of search warrants a year. Is it really realistic that every one of those warrants means some law enforcement department somewhere gets to come in, load up a few boxes full of hard drives, and truck it back to his office for a forensic investigation? How many of these warrants do you think Yahoo would survive through?
It's FAR more efficient and less costly for the ISP to look this information up and give it to the requesting office in a nice, easy-to-read format.
I might see your scenario played out where the ISP itself was being investigated, being uncooperative, or where there was a risk that the ISP might destroy or tamper with the data, but these are special cases, not the general case people are really concerned about here.
IMHO, ISP warrant execution should be held to the same standards as local telephone service warrants. Both service providers store similar kinds of court-demandable information and both depend heavily on computers to extract it correctly.
IANAL, so I don't know what the POTS standard is, but I doubt police officers actually have to be present. Having a flatfoot on site won't help unless s/he's intimately familiar with the database query system.
What do you mean they cut the power? How can they cut the power, man? They're animals!
Why bother with a warrant at all? Wouldn't it be easier for Yahoo! to simply always send copies of their nightly differentials to the authorities? Eliminate all that silly paperwork (which is slowing down the speedy execution of justice).
OK, that's a bit flippant, but how far off is it really? We recently eliminated the need for two branches of government to agree before issuing a warrant with the Patriotic American Jackbooted Thug Act.
Don't get me wrong, I'm not opposed to properly executed warrants. Heck, I may not even be opposed to a totally open society (IE: trivial search and seizure), but if we're going to keep the pretense of a right to freedom from unreasonable searches and seizures, we should maintain the checks and balances that assure that those searches and seizures are authorized and executed properly. If we are choosing to make them trivial, then lets eliminate all the barriers at once and get it over with (and, of course, this should imply that the gloves come off regarding the privacy of our public officials: every sales receipt, campaign contribution, and bank transaction gets published).
Stop-Prism.org: Opt Out of Surveillance
What, this guy likes joking with cops? They'll all stand around reading some poor guy's email and laughing at how he was pretending to be a hot young girl in some chatroom?
Me, if police came to my workplace, I think it would add a great deal of *gravity* to the situation.
Chers
-b
I'm not a lawyer and I don't play one on TV, but it seems to me that if they've got a warrant, they already have probable cause.
"Hardly used" will not fetch you a better price for your brain.
Every time I see mention of evidence "from the Internet" or "from computer files" I wonder: how much evidence produced in court is actually genuine. We all know how impressed most people are with computer technology--and we all know how simple it is to create a simple text file. An email from Nicky Scarfo, Jr. admitting to loansharking? A trivial matter--just take any old email from Nicky, edit the text, and presto! "Direct" evidence that would impress 99 juries out of 99. While we're at it, why not have Nicky confess to financing the World Trade Center bombing?
This kind of thing isn't limited to email. Want to establish an alibi? If you have access to the database that stores key pass data (or E-Z Pass data) you can write a simple INSERT statement to add records necessary to prove you were on the Tappan Zee Bridge when the dirty deed was done (dirt cheap).
My point is that it is brutally easy to fabricate data--and I think the technologically unsophisticated are all too willing to accept anything that is presented as coming from "the computer".
A hypothetical example
Let's pretend that I'm a local police officer. I've been working a case for months--we've had several complaints about a man who might be a sex offender. But they're complaints of creepy behavior--nothing criminal. But I know--I know in my bones--that this guy is a ticking time bomb, just waiting to go off. And--being devoted to protecting the children of my community--I want to stop this creep before he hurts any (more?) children.
I'm in Pennsylvania, where judges are elected. A local judge who's up for re-election is likely to err in my favor when it comes to search warrants on suspected child molesters--so I get a warrant, and I seize the perp's computer. And--damn. The creep is evidently aware of the danger of computer evidence, because there is not a single shred of incriminating evidence on his hard drive.
Or is there? I can copy a few choice files into his temp directory, and copy a few incriminating cookies while I'm at it. Maybe I copy more than a few. All it takes is a floppy disk of helpful evidence and a moment or two alone with the computer--and who's going to believe the creep when he claims he never saw those pictures?
The chain of evidence? (The "chain of evidence" is a legal requirement that prosecutors be able to identify a particular person responsible for a piece of evidence from the time it is seized until it is presented in court.) I gave the perp a receipt for his computer. There's nothing that requires me to provide the perp with a listing of all the files--and no court in the world would let the perp do anything to that computer (like listing his files) when I seize it. I've provided a receipt for his computer--but who's to say what's on the hard drive?
Could this happen?
A frequent element of police fiction--and perhaps police reality--is that police officers carry "throw down" guns; a throw down gun is a firearm with no identifying numbers that can be dropped at a crime scene when a police officer shoots a suspect: the cop asserts that the suspect pulled a gun, but the cop shot first. There's the gun--and the suspect a) has an arrest record, b) is dead, or c) both. Who's to say?
In the same way, an overzealous cop or prosecutor could easily use "throw down" data to "tighten up" a case. The "bad guy" gets what he deserves--the entirely theoretical child molester gets sent to prison.
When the police come with the warrant
I have a client who pays me a few bucks to co-locate a server--which technically makes me an ISP. Ed hosts a couple of mailing lists, and while I seriously doubt any of these lists will ever be the subject of a search warrant, if I'm ever served with one I'm going to be particularly careful to maintain copies of what I provided to the cops. Sure--I'm all in favor of law and order. But fabricating computer "evidence" is so easy that it must be a temptation that is very hard to resist.
It may actually force them to cut down on their searches! As a matter of fact they may go from the 'literal thousands' to a few hundred. There is NO reason for this many searches on an ISP. The problem is all the 'slandar' that poeple are suing ever, the fact that police try to find unnecessary evidence (the bank robber may have sent e-mail!), and the most important, that courts do not oversee the warrants. What to do, make Judges issue warrants, cutting down on the number of searches, and making a police presence during searches less than a burden.
Sounds good. If police time is wasted each time a frivolous warrant is issued, maybe that will stop the dragnetting of private information.
I mean, it's bad enough that Yahoo! will let the U.S. police browse through my emails without any evidence of a crime, but for them to do it by fax is starting to push the limits of credibility.
Yes, I've now deleted all the email from my yahoo account. There are some people where it's not being paranoid if you don't trust them.
Counterpoints:
This is a non-issue.
... blah, blah,) to conduct information searches while employed there.
The Guvmint and the ISPs can deputize one employee who is granted autority (by the power vested
The lawyers are shut up. The ISPs don't have a bunch of cops around underfoot. And the bad guys still get caught.
What's the problem here?
MSBPodcast.com The opinions expressed here are my own. If you don't like 'em... Think up your own stuff.
IASAFTOATGDFWLTS IANAL!!!!!
MINUIFLHOAOHIOA
CDCR LEDMOOK Y
K KE NL E
ID ES
N D
G
How about from now on.. on slashdot.. dunt say yert not a lawyer.. odds are if your reading and posting here.. your not a lawyer.. so we'll assume yer not.. and if you are lawyer.. then say you are and we'll be like.. ohh hey a lawyer.. wooo
yes i'm ranting..
get over it.