Federal Judge: Keystroke Logging Isn't Wiretapping

TospenJ writes "A federal judge in Los Angeles has dismissed wiretapping charges against a California man who used a hardware keystroke logger to spy on his employer, SecurityFocus is reporting. The court ruled that the device doesn't violate the federal Wiretap Act because it only intercepted signals off a keyboard cable, not an interstate network. The government is asking for reconsideration. Ironically, the judge relied in part on the Scarfo precedent, which allowed the FBI to use such a keylogger without a wiretap warrant."

Comments

Ironic?

[forkazoo]

How exactly is that ironic? Judge upholds precident. Wow, that's an unexpected turn!

Re:Ironic?

[Anonymous Coward]

Well well well! Looks like the cat has been caught by the very person who was trying to catch him!

How ironic!

Re:Ironic?

[identity0]

It's ironic because the feds want to prosecute this guy, but their previous power grab backfired on them.

They argued in a previous case that a keylogger was not a wiretap and thus did not require a warrent, now they're trying to argue the other way around when it suits them - but the judge used their previous arguments against them.

Irony and poetic justice at once, really. But does anyone else think it should be the other way? That is, that it should be considered a wiretap when done by either FBI or private citizen, and regulated accordingly? I don't think people should be snooping on other people's computers any more than the FBI...

Re:Ironic?

[Anonymous Coward]

Except that this isn't the typical irony nazi-ism. People often use ironic to mean tragic or coincidental. Except this time, it's being used just plain wrong -- The judge upheld a precedent. That's not coincidental or tragic and it's certainly not ironic.

Sounds fine to me.

[Anonymous Coward]

But isn't running trojan software to monitor someone illegal by other means anyway? I mean, these overbroad "unauthorized access of a computer system" laws must be good for something.

Re:Sounds fine to me.

[dretay]

The point of this case was the scope of Federal Wiretapping Act applies only to information in transit. A trojan, by sending information over an inter-state network would be subject to federal control. Since, however, the keylogger only recorded information entered at the one terminal, and not communications that traveled over state lines, it is not.

Wire

[BlackMagi]

What part of the word wire do I not understand? My keyboard is attached to my PC with a wire. Don't know about yours...

Re:Wire

[om3ga]

Mine's wireless via RF radio! Would listening on the radio frequency of the wireless keyboard count?

Fossils on the Bench

[mordors9]

I think one of the main reasons we have these sorts of decisions is the fact that the average judge is so old he has no idea what a computer is or what it is being used for. To say that typing on a keyboard would not possibly be an interstate communication shows a lack of knowledge of what email is, what irc is, what instant messaging is......

Re:Fossils on the Bench

[Laivincolmo]

I don't mean to sound like a flamebait, but the parent has a very good point. Maybe it is time to consider the fact that while with age comes wisdom, with age also comes irrelevance with current day. They might represent the ideals of the people from when they were in their prime, but they certainly do not reflect on today's technological society in general. Maybe voting for justices?

Re:Fossils on the Bench

[eofpi]

That sounds to me like the DA didn't do their job right. It's their responsibility to try to convince the judge/jury that the defendant has committed what he's been charged with. Part of that is educating them about nonobvious yet relevant consequences of the applicable law(s). This means demonstrating how keystroke loggers are capable of intercepting email, instant messaging, IRC, MUDs, etc.

Any reasonable judge should be able to understand that when it's pointed out to them. That doesn't mean it'll spontaneously occur to them though.

Re:Fossils on the Bench

[Have Blue]

The judge in this case may actually be correct. The keylogger was installed between the keyboard and the computer; it only intercepted signals traveling between the CPU and the keyboard. This signal is not transmitted directly onto the Internet on even the lowest level connections; it just causes the I/O controller to create a record in a buffer somewhere and schedule an interrupt for the CPU to handle it. It would no more be interstate communication than watching someone write down a phone number would be traditional wiretapping.

Re:Fossils on the Bench

[grasshoppa]

The subject matter is irrelevant. With age does come wisdom, and the ability to make decisions regarding new technology.

Youth, on the other hand, lacks wisdom, and is double-wammied by believing they have it.

Given the choice between the two, guess which I'd choose.

Re:Fossils on the Bench

[trolluscressida]

You missed the point of the article entirely.

The federal law makes wiretapping an interstate transmission illegal. What you type on your keyboard and gets sent to your computer is not going to be an interstate transmission.

If the wiretapping device had been between say, the computer and router - than the wiretap act may have been properly invoked.

So you criticize the judge without reading the article or understanding the issue at hand. The judge may be old but he's certainly clever, understands computers, and picked up subtleties which you didn't even know existed.

Yes there are clueless judges. Doesn't look like this is one of them.

Score one for the old guys.

From the article:
But district court judge Gary Feess disagreed, and last month granted a defense motion to dismiss the indictment. Feess ruled that the interception of keystrokes between the keyboard and the computer's CPU did not meet the "interstate or foreign commerce" clause in the federal Wiretap Act, even if some of those keystrokes were banging out e-mail. "[T]his court finds it difficult to conclude that the acquisition of internal computer signals that constitute part of the process of preparing a message for transmission would violate the Act."

"The network connection is irrelevant to the transmissions, which could have been made on a stand-alone computer that had no link at all to the internet or any other external network," Feess wrote. "Thus, although defendant engaged in a gross invasion of privacy ... his conduct did not violate the Wiretap Act. While this may be unfortunate, only Congress can cover bases untouched."

Re:Fossils on the Bench

[plastik55]

The federal law makes wiretapping an interstate transmission illegal. What you type on your keyboard and gets sent to your computer is not going to be an interstate transmission.

You know, when I make a phone call, it goes from my phone line to the local switch. Then it goes from the local switch to a regional switch. Maybe it makes its way to an interstate line. Who knows? It depends what number I call. But the signal that goes between my house and the local switch, well, that doesn't cross state lines, right?

So if you tap the phone line from my house to the local switch, the signal you are tapping never crosses state lines. Therefore a federal agency can tap my phone line with impunity.

See, the network connection is irrelevant to the transmissions, which could have been made on a stand-alone phone with no link at all the a long-distance network. Therefore no local phone taps violate the Wiretap Act.

Right?

After all, as defined in the Act, ''electronic communication'' means any transfer of signs, signals, writing, images, sounds, data, or intelligence of any nature transmitted in whole or in part by a wire, radio, electromagnetic, photoelectronic or photooptical system that affects interstate or foreign commerce. It's crystal clear.

Re:Fossils on the Bench

[srleffler]

Voting for judges is a bad idea. The last thing you want is for judges to have to pander to public opinion in order to secure reelection. It's not good for keeping the judiciary unbiased and focused on the law. (Yes, I know many jurisdictions in the U.S. elect judges. It's a bad idea there too.)

Re:Fossils on the Bench

[benna]

For 1, it doesn't matter if what is typed is later relayed by the computer out of state. All the key logger is doing is recording the signal from the keyboard to the computer. For 2 my guess would be that technically if the data never left the state, meaning it didn't through any routers outside of the state, on its way to the destination, then it would be legal under the wiretap act.

Re:Fossils on the Bench

[Xtifr]

"I think one of the main reasons we have these sorts of decisions is the fact that the average judge is so old he has no idea what a computer is or what it is being used for."

That may have been the case in the earlier case (where the FBI's claim that a keylogger was not a wiretap was upheld), but in this case, the judge was merely following precedent, which is what a judge is supposed to do. The law is supposed to be consistent. When two judges make conflicting rulings, the result is a mess that usually has to be straightened out by an appeals court or even the Supreme Court. It could even result in the earlier case being re-opened and overturned. This way, the law is consistent, we all now know for sure whether a keylogger counts as a wiretap, and if anyone doesn't like it (e.g. the Feds), they can petition Congress to change the law. That's the way it's supposed to work, and I'm glad to see that that's the way it did work in this case.

But maybe I've been hanging out on Groklaw too much. :)

Of course it's not wiretapping.

[Anonymous Coward]

It was keystroke logging. But there should be a law against that.

Re:You can't have it both ways

[MrRTFM]

Yes, but surely they'll get him on other charges (hacking, spying, whatever..).

Of course

[div_2n]

When the federal government or a company does it, it isn't wiretapping. But if the common man does it especially to a company or the government in return it is.

If only people would realize that the depth and breadth of the hipocrisy the current powers that be employ, they would be shocked.

Re:Of course

[Phosphor3k]

What the hell are you talking about?

The judge ruled the man didn't break any laws. It's not wire-tapping for the FBI, and it's not wire-tapping for civilians.

Time to do some pre-typing checks...

[Justin205]

1) Check the keyboard connection. Remove any foreign devices and destroy them, if need be.

2) Check for any odd or suspicious processes running in the background. Kill processes that don't look right (can be very dangerous though, and impossible if it's running as another user...).

Maybe if someone had a list of known keylogger processes, it'd be fine to kill processes... Google doesn't turn up anything like that easily. If someone feels like going more in-depth into the search and finding a nice list, feel free.

Or maybe just use a password-protected laptop, that only you can use. And I mean a good, secure password.

Wiretaps

[Punboy]

Wiretaps should be any recording device attached to any device or cable that sends or recieves data. After all its a "Wire" "Tap".

How was the data relayed?

[yorkpaddy]

does it matter if the physical hardware is local, and then transmits the data over interstate lines. Is it legal if the FBI installs a key logger, that they have to physically access? What about a video camera that doesn't transmit pictures but records them to tape. The tape is then accessed without sending the data over comunication lines or radio, is that legal?

Correct ruling

[bobhagopian]

In Constitutional terms, this is the correct ruling. Federal laws only extend to "interstate commerce," which these days is interpreted to mean "interstate anything."

I do see the sad humor in the government's hypocrisy, given their arguments in the FBI wiretapping case. However, the real outrage here is that there is no state law which clearly prohibits the interception of electronic signals.

Remember, folks, the states are supposed to take care of their own business. It's not always convenient, but it's how the Constitution gives primary power to state governments rather than the federal one.

rawr

[Renraku]

Like an earlier poster said.

Can of worms.

So monitoring a phone line is wiretapping. What about monitoring the cord between the handset and the phone?

Same difference here. 9 times out of 10, a computer is used to communicate with another computer in the workplace, or beyond the workplace. Monitoring the connection between the keyboard and the PC is monitoring interstate communication.

Problems on both sides

[laughingcoyote]

First off, it looks like the FBI, -in this case-, was acting legitimately, with authority from a judge. The fact that they had only a search warrant, rather than a wiretap order, is a technicality, they could have gotten either one with probable cause (which I presume they had, since nothing has been presented to the contrary.)

However, I am concerned about the broader scope of this precedent. The earlier post and article already mentioned keylogging by everyone from jealous spouses to bosses. Do we not need to draw a line (and demand that our state legislatures do so) by enacting privacy protection for this type of scenario?

While we decry "activist judges", the fact remains that technology is quickly outpacing the laws made to cover it. Under the current strict interpretations that seem to be in vogue by the courts, laws are obsolete before they get out of their Senate committee. Someone will figure out a new way to do something that flaunts the spirit of a law without -technically- violating its letter.

Given that, it would seem that judges need to look at the intent of laws as well as their specific, strict letter. It certainly applies that "freedom of speech" applies to email and websites as well as the spoken and written word, even though such things are (obviously) not mentioned, as they didn't exist. Similarly, it would seem to me that the wiretap law is being construed quite narrowly here. The obvious intent of the law is that communication is private and protected from snooping except from legitimate law-enforcement authorities under strict court scrutiny. Bosses and spouses should, quite simply, not be allowed to monitor your communications without your explicit knowledge, consent, and full understanding of what is being snooped and when. Law enforcement agencies should not be allowed to do it except with probable cause and under court scrutiny.

It seems to me that changing the location or type of monitoring (a hardware or software keylogger rather than a traditional wiretap) still is doing exactly what this law is intended to prevent. I hope, given the judge's very narrow decision, that similar laws will be passed that protect us against similar types of snooping, from law enforcement or anyone else.

No. Well, maybe.

[raehl]

If they use a keylogger to capture what I type into my online journal, it's not a wiretap. If they use a keylogger to capture what I type to my mother, it's boring, and sometimes profane - but probably also a wiretap.

This is a case where judges are forced to apply old rules for old tech to new tech. The original intent of the wiretap law was to prevent people from eavesdropping on conversations between two parties without appropriate judicial oversight. So is using a keylogger wiretapping? It depends.

The real answer is an updated law to reflect the updated technology. Relying on Judges to protect our rights is the sign of a lazy legislature.

Re:No. Well, maybe.

[Vellmont]

The original intent of the wiretap law was to prevent people from eavesdropping on conversations between two parties without appropriate judicial oversight. So is using a keylogger wiretapping? It depends.

That's true, but the reason the feds are allowed such a law is because only the federal government is allowed to regulate interstate commerce. That's why the scope of this federal wiretapping law is only within the bounds of interstate communications. In this case the content of the communication is irrelevant (letters to mom not withstanding).


The real answer is an updated law to reflect the updated technology. Relying on Judges to protect our rights is the sign of a lazy legislature.

The real answer is to get your state legislature to pass easedropping laws (though I'm almost positive they already exist). I'd bet he could be still prosecuted at a state level for violating some kind of anti-bugging law. As far as relying on judges to protect our rights, you do that every single day. Lest you forget our form of government was set up as a system of checks and balances. The judges interpret the law and the legislature makes them. Really the primary defendent of your rights is the judges.