EFF Weighs in on Computer Privacy Case
An anonymous reader writes "A case on appeal to the Washington State Court of Appeals, State v. Westbrook, recently drew the attention of the EFF. They argue that: "citizens have a reasonable expectation of privacy in the contents of their computers, and that their Fourth Amendment rights don't disappear when a computer is delivered to a technician for servicing." This ruling could threaten to 'turn your friendly neighborhood computer repair technician into a government informer' "
"Customers who drop off their computers for servicing reasonably expect that their private data won't be handed over to the police without a warrant," said EFF Staff Attorney Kurt Opsahl.
:(
This is completely agree with. Law enforcement should always have to get a warrant to search a computer unless we're talking about something like blatant kiddie porn as the desktop's background (and no, a picture of your child taking a bath doesn't qualify).
I have a feeling that the Gateway technician shouldn't have been poking around on the person's computer as it's doubtful that the files were of any direct relation to the problem.
It's a sad state of affairs when we have to discuss this and have the EFF come to the rescue. There is rarely ever a reason when LEOs should have the rights to look at anything w/o a warrant. Welcome to Scaredays 2005 people
"Allowing computer technicians to snoop on people's private data is like putting surveillance cameras in dressing rooms. The violation of so many people's privacy far outweighs any benefits that might be gained.
This I disagree with. While I am 100% against video cameras in the PUBLIC space I am not against video cameras in a private space (i.e. dressing rooms of a store). My feelings for personal privacy have no weight in a privately owned store that is using video cameras as a theft prevention mechanism. I do however have an equal weight with regards to my feelings about public spaces being spied upon.
...before you hand over your computer and login to a complete stranger?
"This ruling could threaten to 'turn your friendly neighborhood computer repair technician into a government informer' "
Does the saying, "discretion is the better part of valour" meant anything to anyone these days? If I saw something extremely dangerous on a computer I'm fixing I'd probably say something weather or not there was a law forbidding me to. Likewise, if there's something technically illegal, but not likely to threaten the safety of anyone, I'm not going to go to any lengths to be a snitch. Don't bite the hand that feeds you, and all that.
Saskboy's blog is good. 9 out of 10 dentists agree.
Shut off the computer, and pretend he never saw the child pornography? He wasn't reading the defendant's diary looking for thought-crimes, folks.
Configure temp directories and cache directories to use the second drive.
Better: at least, mount the second drive in a caddy which is removed whenever the system is shipped-out for servicing.
Better yet, remove the caddy and put it in a "safe" place whenever the computer is not being used, so in case of theft, you don't lose the data.
Lastly, if the system is shipped because it won't boot windoze, boot-up with Knoppix and delete all possible temporary files or cache directories.
Hmmmm, this could be something to do: kitbashing a boot Linux distribution that would ferret-out all cache and temporary directories and nuke them.
is some tech seeing pictures of my baby daughter in the bathtub and then calling the cops because of my "kiddie porn." Then having to spend the thousands of $$$ on an attourney to get myself out of custody and to prove my innocence. Because when it comes to: terrorism, drugs, taxes, and kiddie porn, you are guilty until proven innocent, maybe not legally, but that's how the system works around these crimes.
Evil people don't think they're evil. - George Lucas, Making of Ep III
While the computer was being serviced, the service technician viewed some of the files on the computer and discovered that some of the files contained child pornography.
EFF appears to be ashamed of this "detail" because they left it out of the report on their website.
How do you balance the right of someone to have his child pornography kept private against the right of children not to be victimized by child pornography? What would your opinion be if it was pictures of your child or if you lived near the defendant?
Whatever your "expectation" may be, you have a right to jack shit. That's just life these days. Any pretense of privacy, presumption of innocence, independence and so forth is misplaced outside of a historical context.
All of these people jumping on the bandwagon are a little late. Whitebreads who are suddenly shocked into the situation because their precious little princess can't get on the airplane because the two year old is on a terror no-fly list or perverts who are shocked when someone turns them in for something on their computer or soccer moms who are upset when the cable guy reports to the TIA that there is "something weird about that person" are like firemen showing up to a pile of smoldering ashes.
Face it - people see the EFF, ACLU, NCAA and other organizations that have anything to do with free speech, privacy or freedom as "communist hippies" at best and "terrorists/sympathizers" at worst. Am I the only one who hasn't missed all the polls and commentaries from joe-random on the street who clearly states that the necessary cost of safety is freedom and that we have to be willing to give some of our freedom up in the modern world of "terror"?
We already lost. Your rights couldn't be any more flatlined.
However, the person who found these purportedly objectionable files was NOT a cop. It was not his responsibility to call the police, nor was it Gateway's. Also, the fact that the police officers searched his entire hard disk based on heresay likely will be a big issue too. The files in question were clearly not in plain view of the police, and likely not even in the plain view of the technician (although that's moot anyway). I wonder if the technician was just looking for some good pr0n or maybe warez that he could copy.
This is yet another reason why I prefer to build and support my own systems... fewer prying eyes.
"Teleporting Rodents with D-Cell Battery Displacement" theory -- IgnoramusMaximus (692000)
"This ruling could threaten to 'turn your friendly neighborhood computer repair technician into a government informer' "
Back in the days when photographs had to be sent to a shop for developing and printing there was a push to require the shops to report illegal photos (porn, evidence of a crime etc.) The administration of these laws boggs down because everyone has a different opinion as to what to report.
The only way to stop this decrease in privacy is to fight for it. If we ignore this, there will be even more issues and privacy violations.
In handing the computer over to the technician, the owner left himself open to the fact that the technician was likely to examine the contents, and he might be expected to inform the police on finding illegal material. There's no confidentiality expectation.
The police then had a right to investigate, but should have obtained a warrant to examine the computer. It does not cease being private property because it's in the care of a 3rd party.
By the same token, if I drop off my car for maintenance, and the mechanic thinks he found drugs - the police need a warrant to search my car. If I leave my house while an exterminator fumigigates, and the exterminator finds a cache of illegal weapons - the police need a warrant to search my house.
The general notion of privacy, and the legal notion are actually different. The guy was boneheaded to leave the stuff where someone else could find it; but the police can't just go in and start peeking.
As for technicians being informers - there's nothing to prevent that either way.
The opinion above is fiction. Any similarity to real opinions, including facts and logic, is purely coincidental.
>
> What happens when the car gets dropped off for an oil change? If the mechanic sees blood dripping out from under the car, would he be allowed to call the cops?
Nail. Head. Hit.
Your mechanic is under no obligation to call the cops. He's also under no obligation not to call the cops.
If I hand off a hard drive full of goat pr0n to a techie, I should expect, at a minimum to get some weird stares when I get the hard drive back.
This isn't a case of "if you have nothing to hide, you have nothing to fear". This is a case of a someone being "too dumb to fear, too dumb to bother hiding", and the gene pool is improved by it.
The EFF argues the police need a warrant. This repair tech gave them all they need for a warrant. Did they get one? No. Throw it out. Doesn't matter what the files were. (PATRIOT not withstanding). Due process is the LAW. (IANAL) But the trial judges threw it out & that's good enough for me. Sloppy police work sends crimnals home everyday, this is just another one.
As for expectaion of privacy, hmm. If I give you a folder full of sensitive documents and ask you to rearrange them alphabetically, my expectation goes out the window doesn't it.
Now, do they have reasonable cause to get his ISP records, I dunno, forbidden fruit & all.
OSGGFG - Open Source Gamers Guide to Free Games
When Westbrook dropped off his personal computer at a Gateway Computer store for servicing, a technician saw private files on the computer that he thought might be illegal. Gateway called the police, who searched through personal files on Westbrook's hard drive looking for more evidence -- before ever getting a warrant. The trial court found, and EFF argues in its brief to the appeals court, that this violated Westbrook's Fourth Amendment rights.
If I drop off my car and hand the keys to a mechanic I've basically surrendered my right to privacy concerning anything he finds in the car while going about the repairs so if he finds anything illegal it is perfectly right for him to report it to the police if he feels that is his duty. The same applies to the technician.
The police, on the other hand, were obviously wrong in not obtaining a warrent to search the drive.
Time is what keeps everything from happening all at once.
Son of the late Issac Asimov was busted for child pornography the very same way. http://www.newsmakingnews.com/asimov3,29,01.htm
"Eve of Destruction", it's not just for old hippies anymore...
If you havn't got anything to hide then you don't have anything to worry about
The whole "We have nothing to fear" argument is dumb. We always have something to fear.
Is it ok for the tech to report files that are on your desktop in a folder call "Illegal stuff in here"? Ok, how about if the files are hidden in a folder, in an area that in no way relates to the service they are doing? How about if they are in an encrypted volume, the password which he gets by cracking it stored by another program withweak, reversable encryption?
.jpg that has any relivance to fixing a broken system.
Etc.
The fact of the matter is, people doing service work should be going through your shit. When I hire someone to perform matenence on my house, I am not giving them permission to come in my bedroom and start going through my personal belongings. They are allowed in my house only to fix whatever it is that is broken.
That's the problem is that it seems that the techs finding this is evidence that they were poking around and looking for stuff, which they shouldn't be doing. There is nothing ending in
A real worry is that if this is decided to be ok, the police will start putting pressure on techs to go through people's files looking for things they might want to know about. They get a quiet little agreement going with Best Buy and CompUSA that if a computer is brought in for service they'll scan the drives for child porn, warez, any documents that might indicate disagreement with the government, etc.
People tend to get all knee-jerk because the test case is a child porn case and there's a real "kill them all" mentality but you have to think in more general terms. Any time you hear "Don't worry, we won't abuse this law" you know you are being told a lie. The DMCA is a wonderful example. We were told it wouldn't ever be used to suppress academic research and it already has been.
So sure, maybe you think it's great that every computer that comes in for service should be scanned for child porn but then where does it end? I mean with all the terrorist paranoia these days I'm sure they'd want to scan it for "subversive literature" as well. The media insudtry would be right on board wanting scans for MP3s and MPEGs, and probably just assume they were illegal rips and make you prove your innocence.
It is a path we do not want to walk down.
it doesn't sound like you need a computer repairman. if you can outsmart these watchful eyes than you probably don't even need a service like these. what about those who don't have any idea about how to go about creating knoppix disc, or have to send their computer to a repairman to install a second harddrive.
It should work like this:
1. Computer Repair Technician finds something he believes is illegal on your computer.
2. Tech calls the cops
3. Based on the claims of the tech the cops apply for and get a warrant
4. Cops search your computer
5. You go to jail, cops profit
What the EFF is upset about is that they skipped step #3. What is so hard about getting the warrant and then searching the computer?
Get a grip, people!
This isn't about whether the tech was "allowed" to call the cops, but the fact that the cops didn't see fit to get a search warrant before searching the drive. The tech has a legitimate reason to be delving into files. The cops don't.
There are 11 types of people. Those who understand binary, those who don't and those who are sick of this lame joke.
What happens when the car gets dropped off for an oil change? If the mechanic sees blood dripping out from under the car, would he be allowed to call the cops?
Sure he would, but they' should still need a search warrant to open the trunk. This case is actually quite a bit beyond that. We're not talking about bodies in a trunk, we're talking about files on a computer. "The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated..." Are you telling me computer files are not a persons papers and government agents should not have to get a warrant to browse through them all?
It's hard to stick to principals in this case because the defendant was doing the wrong thing. At the same time that does not excuse the police from also doing the wrong thing. What if a Gateway employee called the police because he saw a picture of a young looking porn star and the police then seized your computer without a warrant and searched through it all? They could then determine that the picture was not illegal, but still bust you for tax evasion based upon your receipts and tax records stored on your computer.
The police need warrants, signed by a judge to look at your personal papers, even if they are on a computer instead of in a file cabinet and even if that computer or file cabinet is not in your home. The warrant must specify the reason the police think you have something illegal and what specifically they are looking for.
In this particular case the police could easily have obtained a warrant. If a child pornographer goes free it is their fault. And we should not all sacrifice our civil liberties and legal protections against an unreasonable or oppressive government and set a legal precedent just so one person can be convicted.
Depends on what you want to hide and who you want to hide it from...
If you waive privacy rights when you bring your computer into a technician, then anything's fair game,
from reporting that child porn in the folder marked "college essays" to giving your email address to spammers to doing a search on your hard drive for anything that looks like a credit card or social security number, username and password, the possibilities are endless.
+5, Truth
This is quite correct, in the limited scope - Police should not be allowed to search through data on your computer without a warrant, as this data is as private as papers in a closed filing cabinet. Even when the cabinet is in transit, a police officer cannot decide to open it except when duly authorized, usually by a warrant. This is a position that needs to be defended, even if the individual at question isn't someone who we feel is entitled to the defense.
On the question of the Tech... well, that's a matter between the customer and the technician. I doubt any laws were broken by the Tech's report to the police - but, then, you would also be open to the "well, prove the data was there BEFORE it came into your hands, Tech" question - the computer didn't come right from the accused's hands, leaving a wide opening for "reasoanble doubt" when/if it came to trial.
I was going to mod you down, but then I thought:
What if it was my karma?
+5, Truth
It's none of the tech's business what files are on my computer. Unless I specifically say "Hey, I can't open BackDoorSluts9.avi" the tech has no business looking at that, or any other file. Their job is to fix the computer, not to root through my things looking for porn for their private collections.
What the hell happened to professionalism? I used to do computer repair and I NEVER snooped on peoples machines. I addressed the problem as laid out in the service ticket and left the rest alone.
"But kiddie porn is sick!" some of you will whine. Yes. Yes it is. But your job is not to search for criminal activity. Your job is to fix the computer. Stick to your job. Let the police trace the perverts download patterns on the Net.
Would you search his hard drive for illegal music downloads and call the cops because he has that unreleased Fatboy Slim Cd on it?
And to the parent, you need to grow the hell up and learn about property rights. Someone else's computer is not yours. You don't trespass on their data.
Boobies never hurt anyone. - Sherry Glaser.
Just put 2 ASD's (anti-shoplifting devices) like EM or RFID labels in the item, one very large, visible and obvious, the other very hard to detect by humans.
As soon as the client tampers with one of them, the larger one sends out a signal to set off a silent alarm to warn security to be extra alert. If the client pays up, both ASD's get deactivated and the larger one gets removed. If the client tries to leave the shop without paying and at least one of the ASD's is still functioning, the sirens go off. If both are dead, it is up to security to spot suspicious behaviour.
The Hacker's Guide To The Kernel: Don't panic()!
The parent poster is exactly correct. The computer owner looses the right to privacy when he invites someone to view and repair my computer.
If I invite guests over to my house and serve cocaine to my guests then I can't expect privacy either if one of them reports me the cops. In either case the cops can't just bash my door in they must get a warrant. But swore testimony of a witness is usually enough to land said warrant.
Simply put EFF is correct about needing a warrant and most likely they would have easily obtained one with a phone call. Cops screwed up here.
Slashdot, home of supporters of free software, free music, and free speech.Except for Moderators that disagree with you.
Don't give me that crap. Unless the problem is data file specific the tech has no reason to look at anything other than teh hardware and the OS directory.
I used to do tech work and while I never searched other people's machines (because I value my proprty rights and I respect other's property rights) I know a lot of techs that did. And they did it for one reaon: to get new stuiff for their collections. They'd copy off all of their porn, MP3s, etc... and add it to their collections. Their searches had nothing to do with fixing the computer and everything to do with data theft.
Boobies never hurt anyone. - Sherry Glaser.
If the technician was unreasonably searching through the computer for files he might find interesting, then there's a definite privacy problem. In other words, Gateway should not be allowed to run tasks on your computer that have no relevance to the repair, just as a plumber has no right to search your underwear drawer if he's just fixing a leaky faucet.
It really looks like the EFF is ensuring that proper procedure was used in this search. If the technician cannot reasonably explain why he was looking at the files (and that the files were relevant to the task of repairing the computer) then the search should most definitely be declared illegal. As the case stands now, there's nothing preventing technicians from acting as agents of the police and performing unnecessary searches of your computer.
I/O Error G-17: Aborting Installation
An example: What happens when evil kiddie porn hacker roots your box and uses it as an FTP server for all his kiddie porn hacker friends? Your machine becomes kiddie porn central, slows to a crawl because of bandwidth saturation, and your directories are stuffed with illegal files. You, not being a 1337 HAX0R DUD3 unhook it, take it to the computer repair guy, and the computer repair guy finds illegal files you were unaware of. Instead of fixing the problem, he instead turns you in to the cops as a kiddie porn wanker. Your life is ruined. You loose your job, your wife leaves you, and you aren't allowed to see your own kids without a social worker present.
Thanks Gateway!
I've seen a few responses here suggesting that before you take your computer in for repair you should encrypt your files, move them to to a removable drive, etc. (or should be doing so as a matter of course). My only question: if you know how to do that, why are you taking your computer to Gateway to get it repaired? Fix the damn thing yourself.
All you people who are so happy to report others for their crimes because of moral issues should be more than happy to have their own children call the police whenever the parents have commited a crime.
For example, dad and mom are cheating on their income taxes and jr. overhears them so he calls the cops like a good "citizen".
How about this one, you the parent steals stuff from your employer (nothing expensive just small time things) and your little angel has been told at school that this is a crime so he calls the police.
Just a couple of examples why the state has no business having it's citizen sqealing or reporting on each other for their own good. I hear this prctice was encouraged and became really popular in the USSR and Nazi Germany.
A very interesting topic and one that reveals how much mythology and folklore there is about US Constitutional Rights, police procedures, and technical/professional ethics.
...
IANAL, however
I did RTFA and from what was presented there, the police blew it on this one. Gateway's privacy policy and the tech's morals/ethics may have required them/him to notify the police. Police procedures and legal guidelines SHOULD have mandated a warrant, once the "probable cause" evidence was shown them by the tech and before they so much as touched the machine to adjust the viewing angle. That's the way it's SUPPOSED to work (in most U.S. jurisdictions, YMMV).
Computer forensics 'sperts come in like the CSIs from the TV shows, with all sorts of techie gizmos and gimmicks. They can, and do, create a bitwise, forensic clone of the hard drive, take photos, make notes, and maintain a chain of evidence. For them, it's routine. Some of the toys they have are enough to make you drool with envy. It doesn't sound like any of that happend here - instead the locals came in like the guy in the Swiffer commercial.
Computer forensics cuts both ways. A good defense expert CAN show that the bomb-making instructions ended up on the computer without your consent or knowledge, just as a good prosecution expert can demonstrate that you really did keep two sets of Quicken books for your money-laundering home business.
But as has been noted here before, when it comes to drugs, taxes, terrorism, or kiddie porn, it's guilty until proven innocent. A computer forensics consultant I know had to obtain "Get Out of Jail Free" cards from the State DAs in two states to carry evidence back and forth across a state line for one case he was involved with. Had he been stopped, and his evidence bag examined, without them, he could have ended up incarderated for "possession" of kiddie porn. Talk about mindless, knee-jerk situations.
Oh, well, if you want to experience a wild life of techno-crime, consider a career in computer criminal forensics. The pay is great, you get to play with neat toys, and if you are really unlucky you'll get to meet a lot of VERY interesting people.
Spiritus ex Machina
"The universe is not only stranger than we imagine, it's stranger than we CAN imagine."
And you said exactly like the folks he's talking about--the very hint, not even conclusive, just the mere suspicion, and you've already made a judgment and misleading statement.
btw, I have been falsely accused before, although usually not in a legal situation.
The most socially pointed was when I passed a girl with a group of her girl friends on a busy DC street corner one (September I believe) weekend in Georgetown (SW corner of M and Wisconsin if I recall right). I'm one and a half steps passed the group, and the girl closest near the back turns around and goes utterly ballistic. I turn to see what the ruckus is about, I'm met with one really PO'd person, who apparently thinks I did something to her; I was taken back at getting screamed at for no apparent reason so I suspect she believed I had felt her up. I did nothing of the sort. I had simply weaved my way through her group getting past a crowd. There were also at least 1 other guy that walked around her on the other side at the same time, and I didn't see him (although I wasn't paying attention) do anything either, and I think there was another small group north of her as well.
Nonetheless, I got screamed at for half a block and got accusing stares from the other folks on the street the entire time. My suspicion afterwards was that she was a freshman or sophomore college new in town, vaguely pretty (hard to tell when you're trying to figure out what's going on in the first place in that mill of people) shopping with friends who had been getting hit on or felt up that entire afternoon and just thought someone had groped her or run into her on purpose, and she directed her verbal assault on the nearest person.
I gave up shortly trying to figure out what was up and eventually just walked away. Staying was just making things volatile and escalating something bad was going to get directed to me, and she and her friends were of no mind to really figure out what happened much less actually saw or knew themselves. All I knew was that I hadn't done anything.
Amendment IX,
... be compelled in any criminal case to be a witness against himself, nor be deprived of life, liberty, or property, without due process of law ...
... No State shall make or enforce any law which shall abridge the privileges or immunities of citizens of the United States; nor shall any State deprive any person of life, liberty, or property, without due process of law ...
The enumeration in the Constitution, of certain rights, shall not be construed to deny or disparage others retained by the people.
coupled with IV,
The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized.
V,
No person shall
and XIV,
add up to a Right To Privacy. Between them, what the Framers were saying was that if the state wants to invade your personal space, they had better be able to show a pretty compelling reason.
Oh, and when the Feds institute that system of internal passports that some folks are worried about in connection with the new driver's license law, remember that the Constitution guarantees no explicit Right To Travel either.
FreeSpeech.org
Without more details, you can't apply that label. Child porn is never legal, but not all naked pictures of children is child porn, even though I'd like to see Anne Geddes stopped as much as the next guy.
Never confuse volume with power.