PA Seizes Newspaper's Computers

twitter writes "Computer equipment from the Lancaster Intelligencer Journal was seized for alleged improper data access and disclosure. From the article: 'If the reporters used the Web site without authorization, officials say, they may have committed a crime.' Journalist are understandably upset that confidential information, that has nothing to do with the investigation, will be found and used for retribution."

Comments

/. headline is wrong

[MaggieL]

Contrary to the /. headline, Philadelphia did not sieze the four hard drives.

Philadelphia is a city.

Pennsylvania is a commonwealth.

Surprisingly enough, the Pennsylvania Attorney General's Office works for the Commonwealth of Pennsylvania, not the City of Philadelphia. I know it's confusing; after all: they both start with the same letter.

Re:/. headline is wrong

[Anonymous Coward]

I was about to point out the mistake as well. The article appears in the Phildelphia Inquirer, but in the beginning it clearly says: "the PENNSYLVANIA Attorney General's Office has seized four computer hard drives".

Again, though Philadelphia is the most prominant city in the state, Harrisburg is the capital, and is where the office of the Pa. Attorney General is located.

This just ticked me off a little because it's giving Philadelphia a bad name, we might have corruption in our city government but at least we respect peoples civil liberties!

Oh, and FYI, in response to this:
Philadelphia County or the City of Brotherly Love?

They're the same entity, the city and county share the exact same borders and government, the county is really a legal nullity since the act of colsolidation in 1864.

Re:Proof that there's no proof

[funkman]

The website had disclaimers on it (either during the login process or once you are signed in) that states unauthorized access is prohibited and that the web site is for official use only.

So a journalist (or anyone) using the site with someone's else's login credentials violates the terms of service of the site.

There is no way to plead ignorance for those who improperly accessed the site.

The lesson Learned here kids?

[Lumpy]

I think the biggest lesson here is that ALL your files that are important or private MUST be encrypted on your computer. Because the federalies will come looking through them sooner or later. Using a encryption system that gives you plausable deniability like True Crypt is a better choice as you can lead them astray. you can give them a fake password that lets them into the encrypted file but only gives up worthless information keeping the secure documents hidden.

Finally, with today's fervor over terrorism it's best for you to not write anything down, record nothing and deny, deny, deny.

Re:Logs?

[Technician]

Certanly. Read the Tomsnetworking review. It's in about the 4th page of the review.

http://www.tomsnetworking.com/2005/04/15/review_st inas250/page4.html

Snip Digging deeper into the menus revealed some advanced functionality that didn't appear to be advertised anywhere on SimpleTech's web site or product brochures. I found menus for creating encrypted, mirrored and striped shares, which are RAID capabilities that I have not seen in other boxes of the same class. Selecting the Help button on this screen brought up a full help listing for all features of the box, including these advanced ones. Reading through the help menus indicated that the mirror and striping capabilities are designed to be used on external drives plugged into the box.

end snip

It's one of the main reasons I bought it. Raid, Encryption and easly hidden someplace to be left behind in a raid or burglary. What more could a geek want?

Re:Can remote 3rd party storage be siezed?

[Red Flayer]

Warrants are not that specific. Warrants can be issued for entire computer systems looking for one tidbit. Law enforcement is only allowed to use the information that is covered by the warrant, but the only way they can verify that you've provided the keys to all the relevant files is to have a blanket warrant for all keys, and then check each file to see if it is relevant.

Same as standard home search warrants -- they don't issue a warrant to just search your sock drawer, because you told them that's the only place you'd keep the contraband they're looking for.

Re:More info.

[Technician]

The encryption is invisable to the users. When the box is rebooted, the encrypted shares simply vanish and are not seen on the network until the password is input from the web interface. Another snip from Toms site;

I was initially a little confused about how an encrypted share would work. Would the client have to enter the encryption password, as well as the user password, when mounting the network share? I saw no provision for this, but what I had to do became clear the next time I rebooted the box. When the SimpleShare rebooted, I received an e-mail from it telling me that I had to go into the administration screen and enter the encryption password. Once I did this, the share was available for clients. So this feature is meant to protect your data if someone walks off with your drive - without the password, they won't be able to access it.

end snip

That's the way to survive a raid. Packing it up breaks it if they find it.
I know from experiance (i made a configuration error) that using the reset to reset it to factory defaults does not open the encrypted share. It stays encrypted and can only be opened and mounted by entering the encryption key.

Website

[mach-5]

Our sleepy little town made slashdot...wow!

Here's the paper's website. Nothing is mentioned about it there.

http://lancasteronline.com/index.php

Yes, you are missing something

[JetScootr]

It's called "probable cause" to believe that an entity (the paper) was involved in the crime. The state can not know whether the newspaper's computers were also used illegally as the state is claiming the coroner's password was. I can easily guess that some hacker that got the password might also hack some news corp's site that had weak security. Why? Cuz anyone would know that the state will (or should) use extra care when kicking in the doors of the press.

Something else you're missing is called "Innocent until proven guilty".

The paper is innocent, and the siezure would obviously have a serious impact on their business. A judge should take this into account before signing a warrant, especially when the criminal could so easily be someone else.

Even if non-public facts were disclosed by the newspaper, the state does not "know" that hacking was the source unless there is clear evidence. Even if hacking was the source, what indication does the state have that it was the newspaper that did the hacking? They may have been hacked too.

The coroner claims he didn't share the password. Who else would know?

Another (better) story on the same topic

[guacamolefoo]

The following link is from the Lancaster papers' website. It has greater detail on the case and more information about what Judge Feudale actually authorized, which was a relatively limited search and in camera review of the findings prior to allowing them to be turned over to the Commonwealth.

http://local.lancasteronline.com/4/21327

In addition, the Lancaster papers' attorney failed to secure any witness or provide any testimony that could demonstrate that the computer forensics work could be done in the newspapers' offices as opposed to taking the drives to the AG's forensics lab. You have to at least put up a fight to win. I think that the attorney for the paper knows bupkis about technology and he was completely unprepared to fight the subpoena on that basis. It's an example of having the wrong lawyer and being outgunned by people who specialize in this sort of criminal prosecution.

I suspect also, having read the bio of the attorney (George C. Werner) on his firm's (Barley Snyder) website (http://www.barley.com/attorney/bios/bio.cfm?attor neyID=24) that he knows bupkis about criminal law. Barley Snyder attorneys are usually pretty sharp folks, but they are not who I would select for this sort of case, either for the newspaper company or the journalists in the underlying criminal case.

GF.

HD locking

[Penguinoflight]

I'm not sure if your NAS device is IDE based or SCSI based (internally). ATA drives use a locking mechanism that is not actually on the disk, but on the circuit boards surrounding the disk (I have some experience with locking/unlocking drives for Xbox repair/modification). Some drives dont lock, others will lock, but do not unlock when supplied with the correct password. I haven't had a new drive go into a persistant lock state, but a referbished drive was persistantly locked the first time I locked it, and a older 8gb drive failed to work in a system simply because it would not unlock.

You should be especially careful with any data you keep on a system of this type. I would reccomend at least keeping a mirror of the box to make sure you dont loose the whole thing.