No Right to Privacy When Your Computer Is Repaired

Billosaur writes "ZDNet's Police Blotter bring us the interesting story of a Pennsylvania man who brought his computer into Circuit City to have a DVD burner installed on his computer and wound up being arrested for having child pornography on his hard drive. Circuit City employees discovered the child pornography while perusing Kenneth Sodomsky's hard drive for files to test the burner, then proceeded to call the police, who arrested Sodomsky and confiscated the computer. Sodomsky's lawyer argued in court that the Circuit City techs had no right to go rifling through the hard drive, and the trial court agreed, but prosecutors appealed and the appeals court overturned the lower court's decision, based on the fact that Sodomsky had consented to the installation of the DVD drive."

Comments

Ultimately....

[Whiney Mac Fanboy]

Ultimately it doesn't matter whether you have a right to privacy or not. It's not a right you can rely on. Expect the monkeys to paw through your private photos & videos regardless of where you get your PC repaired.

The answer is routine encryption, but let's face it - if you need help installing a DVD drive, you're unlikely to have any idea what encryption even is....

Re:Ultimately....

[Anonymous Coward]

There is no confidentiality involved at all, whatsoever, with regard to child abuse. In most U.S. states if you know or even suspect child abuse is occurring you are required to report it to the authorities.

Child pornography involves child abuse. Fail to report it and you can be in a world of shit.

Saying "Well the guy was my client so I had to protect his privacy." won't go over well with investigating police, the judge, the jury, or the guy you end up spending time with.

Re:Ultimately....

[Gr8Apes]

Privacy is like Freedom: It is not granted, it is earned.

If you need a locksmith to open your safe, you can't expect him to overlook the dead body inside. No. It is taken and exercised, and fought for if needed. It's interesting that you chose freedom as an object for comparison, as privacy is freedom. You'd be hard pressed to have freedom without privacy in reality.

Re:Ultimately....

[FirstTimeCaller]

Privacy -- in general, not just for these situations where someone was doing something illegal -- would be greatly served (and Geek Squad wouldn't find people's private videos of themselves on vacation or whatever) if they'd just add in the feature everyone wants. Not everyone wants that. The NSA, CIA, FBI and Secret Service would probably prefer that you not be able to easily encrypt your data.

Re:Ultimately....

[cicho]

"He'd set it up to auto-load paintshop in thumbnail mode and we got an eyeful of all the guys "teen" porn. Not sure if it was legal or not but we just handed it to the boss and said "deal with it". I don't know what actually came of that."

So you didn't know if it was or wasn't illegal, but thought the guy should be reported anyway? Congratulations, you're a Good German now, wear your badge with pride.

Really, your post is a WTF moment of the day, at least.

Re:Ultimately....

[WindBourne]

If you need a locksmith to open your safe, you can't expect him to overlook the dead body inside.

Yes, but this sounds more like a case of a locksmith who has to open your garage door and then finds a body under your master bed. While we do not know all the facts on this, it sounds like the tech went looking for it. Of course, anohter question is, did he or somebody else at the store plant it?

Idiot...

[Pedrito]

That's like taking your car to get it repaired and being pissed off when you get arrested because the mechanic notices the 5 kilos of coke in your back seat. I mean, come on. The guy is an idiot and a criminal and he should go to prison.

You wanna break the law and not get caught? Use some brain cells. Sorry, if I take my computer to get it repaired (and I have), I yank the hard drives. ALWAYS. I have no expectation of privacy when I drop my computer off with a tech. I do it largely because I have client data on my computer and I would be liable if I took it in for repairs and someone stole the data. It's just common sense, and if a criminal can't amass enough common sense to do the same, well, they deserve to be arrested, tried, and convicted.

Re:Idiot...

[Vellmont]

The guy is an idiot

There seems to be a belief on slashdot that if you're an idiot, you deserve whatever fate has befallen you. I have a basic problem with this attitude. The guy may not have been too bright about this, and he's definitely a criminal. But being dumb doesn't make you any more guilty, or any more deserving of punishment.

I have no expectation of privacy when I drop my computer off with a tech.

While I know that a tech can look at any file on the computer he/she wishes, this doesn't mean there's no expectation of privacy. If I let someone into my house to fix the drain, that doesn't mean it's OK for them to go searching through my house, read my private journals and look through my medical records.

In you scenario, would it be legally OK for a tech to reveal your client details to a 3rd party? What if I have medical test results on my computer, would it be legal for a tech to reveal my medical records on his/her blog? I'd say both those things should have some expectation of privacy.

Don't assume that just because someone committed a crime, or "is an idiot" that they have no expectation of privacy. The "I needed to burn some files" excuse is pretty lame. The tech was probably looking through the files for his own purposes, not to burn something.

Re:Idiot...

[ScrewMaster]

What makes it worse is that the people who installed the drive are being made out to be the bad guys here, it said they looked for files they could use to test the drive, they weren't randomly looking through his pictures, they most likely just searched for any media files so they could try burn them, saw child porn and reported it, like any responsible person would do.

Responsible, my ass. If what those technicians did wasn't criminal, it should be and it was at best unprofessional.

It is possible to be a criminal and a victim simultaneously. Actually, if you knew anything about the American Justice System, you'd know that merely being accused of a crime makes you a victim, because the results of an accusation are punitive, regardless of whether you committed any wrongdoing. You don't want to be in the system, you really don't: it's a surreal alternate universe where the normal rules simply do not apply. I've never been there myself, but I have enough lawyers in my family to have a pretty good idea what goes on. It's terrifying to an ordinary citizen, disruptive and costly.

Regarding TFA, I'll accept that the techs needed to test his burner, that's only what a good technician should do. However, they didn't need to use his personal picture files, didn't have to view them, and could have just used some files from the \Windows folder and verified the burn. There was also no reason to search his drive for anything! Period! End-of-the-goddamn-statement.

Regardless of what criminal acts this man may have performed, the fact is that the techs were unethical and untrustworthy, and I'd sure never take my computer there. I mean, at what point did they become part of law enforcement? Hell, they should have been fired, and be up on charges too (but they won't be, because government likes technical types that snoop around and snitch on people.) Over the years, my job has required access to confidential information from a number of multi-billion-dollar corporations, as well as private citizens. Never once did I go snooping around just to see what I could find, because it's not my goddamn business. Furthermore, if you want people to trust you, you just don't do things like that. What those techs is highly unprofessional, and once word of this gets out I have no doubt that shop will be out of business in a hurry: "Oh, you mean your technicians will search my computer for any sign of illicit activities? Yeah, right." What a bunch of dumb fucks. If there was every a reason for Joe Sixpack to learn how to fix his own machine, this is it.

Plus which, having worked as a service tech, I can tell you this: you're right, they weren't randomly looking through his pictures. They were systematically searching his drive looking for anything entertaining. Just his bad luck that they found kiddie porn, and the only reason it got reported was probably because their supervisor was looking over their shoulder enjoying the show right along with them! Otherwise they'd just have made copies for their own consumption and nobody would have been the wiser.

Did the police get a warrant ?

[BlueParrot]

Ok, I'm guessing that the staff at the store were not police officers, so I find it hard to see how them doing something wrong would invalidate evidence gathered by the police, provided that the police did everything right. Now IANAL but it would appear to me that it basically boils down to what the police did after receiving the tip, or does US law actually say the police can't act on tips from the public if the public only knows what they know because of illegal actions? I.e, if I a crook breaks in to somebody's home to steal something, then finds a large quantity of drugs, I'd expect that the police would need a warrant to search the house, but surely the mere fact that the crook tipped them of doesn't mean they can't investigate? Thus I'm guessing that the real issue here is weather the police would have needed a warrant to have a look at the computer while it was in repair. What is precedence on that? Does the police need a warrant to search your car while it is being repaired, or can the mechanic just let them have a look around if they want to ?

Circuit City is not the government.

[westlake]

it doesn't matter whether you have a right to privacy or not. It's not a right you can rely on

The constitutional Right To Privacy, to the extent that it exists at all, applies only to govenment agencies.

The defendant might try bringing a civil action.

But no matter hiw you frame the issues, there is only a snowball's chance in hell that a jury will punish Circuit City for reporting a crime it discovered in the ordinary course of business.

Re:sweet one more scumbag nailed

[corsec67]

One huge difference:

The people at the photo development place can be very sure that a person under 18 was molested by the person who brought in the roll of film.

The person with under-18 porn on their computer might never have molested a minor

Thus I think that child porn should only be considered as evidence for someone molesting a child, but not a crime in its own right, as that makes it very easy to frame someone just by emailing them some pictures. Or what if the tech in this case planted the pictures on the hard drive? And then if you make having artifically generated pictures or text stories that depict people under 18 having sex illegal, that is just crazy, as no kids were ever harmed there. What about someone under 18 taking a picture of themselves?

Of course, if you like the idea of thought police, where you can be arrested for creating something from your imagination that is evil, then where does it stop?

Planted-evidence defense

[orzetto]

The guy is an idiot and a criminal and he should go to prison.

If I had been the guy's lawyer, the first thing I would have argued is that since the evidence was not uncovered by a sworn police officer, it could have been planted. What if this guy was a rude on the clerk, who was a vindictive bastard and decided to frame him? Or maybe a jolly clerk may have decided to pull a prank that went out of control when someone in the shop contacted the police ("hey Jimbo! this guy's name is Sodomsky, guess what I found on his drive!").

Yes, the courts could have checked the last-modified filestat, but that can be tampered too.

Child abuse is not at issue here

[cicho]

No-one is arguing that child porn should be protected (although elsewhere some *would* argue, that only producing it should be an offense).

What's at issue is that next time a repair guy goes through your files and sees "...whenever any Form of Government becomes destructive of these ends, it is the Right of the People to alter or to abolish it..." and is going to report *that* too.

Next thing you know, you'll have your ass hauled from workplace to the county jail. Apologies will be slow in coming, and your work buddies may not be joining you at lunch for a while.

WHat's also at issue is that submitting a computer for repairs does not give the service people a blank check to read my email or browse through my vacation pictures. I fix my own machine, but I don't fix my car myself, and I expect the technician not to rummage through stuff I may have left in the boot, looking for thrills.

Re:Child abuse is not at issue here

[dgatwood]

Well, it's hard to argue that only producing it should be an offense. At the very least, trafficking in it should be illegal, as making money off of any crime should automatically be a crime, IMHO, whether you committed the crime or someone else did. Of course, for most crimes, that would bring up a ton of free press issues, but in this case, since it clearly falls under the "obscenity" exemption, I think those objections would fall on deaf ears from a legal perspective.

That said, I assume you're asking whether mere possession should be a crime, though. The same question could be asked about possession of illegal drugs, firearms, etc. Indeed, that is probably one of the biggest open questions for debate in our legal system today. I tend to fall on the side of possession of anything being legal unless mere possession poses a significant risk of harm to others (e.g. possession of large quantities of explosives in a residential neighborhood). That said, the law falls on the side of possession being a crime, so short of fixing the laws, those are likely to be open-and-shut cases.

I am rather disturbed about this particular case, however. I completely agree with you that this case isn't at all about child porn. It's about whether someone has a right to privacy in one's own computer, and it is about whether evidence collected through illegal actions should be admissible in court. Neither of those issues should be set aside merely under the "think of the children" propaganda simply because this happens to be a child porn case. It shouldn't matter if this is a case about child porn or money laundering or even pot smoking. In the end, the legality---or even the heinousness---of the initial act isn't the relevant legal question here.

I have always been of the opinion that the exclusionary rule should apply even if evidence was collected by private citizens. While the courts do not interpret it this way, I think they are wrong. Why? Because this giant loophole effectively sanctions all sorts of possible indiscretions by the police. I'm not saying that such indiscretions have occurred, but the potential for abuse is pretty obvious. In effect the loophole says that unless you can prove the police were aware of and supported the unlawful search and seizure, the evidence is not tainted. This, of course, is almost impossible to prove except in egregious cases of police abuse, and thus, we really can't say how often this occurs. The only safe rule that prevents any possibility of abuse of the system is for the exclusionary rule to apply to all evidence regardless of whether it was gathered by the police or a private party. At most, it should be only be allowed as probable cause for obtaining a search warrant to collect further evidence that would then be admissible. On the other hand, maybe that's all that happened here. The summary isn't clear on that point.

This also brings up questions about whether a person's computer is or is not an extension of his/her "castle", protected by the same rights as one's home. In a growingly technological society, this question is a critical question to address, as the repercussions of an incorrect decision on that question could be seriously detrimental to the functioning of society, IMHO, and I think this decision falls on the wrong side of that issue.

Oh, yeah, and one last thing. Because the repair people committed a crime of computer trespass, the burden of proof is on the state to show that the material was obtained by the defendant and was not placed there by the repair people. Good luck on that one. The fact of the matter is that unless they have proof from, for example, a backup drive at this guy's house, their entire set of evidence should be considered hopelessly tainted by the very nature of the way in which it was obtained. If this guy's lawyer is even halfway competent, he's likely to get off even if he actually committed a crime... all because the police acted in an inappropriate manner.

The cor

Privacy or not, it's a matter of customer care

[Opportunist]

Quite directly and sensibly. As the head of the department, I'd have the guy who reported it fired. No, not because I want to protect a pedophile. But he simply has no business in a customer's personal files. Yes, in this case breaking into the privacy of the person helped discovering another crime. Yes, that's "another". Not "a", not even "a more serious".

I happen to get a lot of client PCs on my desk, for similar matters. We do forensics for various high profile customers who want to follow the trail when a trojan hijacks their machine and they want to have proof how it happened. Which also means we got quite a few certs from various places, private and governmental, that allow our findings to be used as evidence in a trial. Looking through a customer's personal files (or any files not related to the problem outlined in very fine detail) is simply a no-go. No matter what.

Yes, that means that I would have to let a pedophile get off the hook. By the contract between my company and the customer, and (as odd as this may sound), even by law. I must not look at those files. Having certain customers from certain companies that deal with certain topics plays a role here, but that's not the point.

Should I accidently look at a file that does not belong to the case at hand (for example, when looking for trojan screenshots and I happen to run across a porn pic that happens to be in the same location a certain trojan would put its pics, or when undeleting files and perusing the findings), I have to ignore it. I never saw it. For all I know, it does not exist.

Now, the kid who discovered that pedophile pics might consider himself being in the right. IMO, he's not. He broke the primary law of business: Don't break your contract with your customer. Don't invade your customer's (or anyone's) privacy.

Yes, I consider an invasion into privacy a bigger crime than collecting kiddy porn. In other words, our politicians are lower than pedos in my books.

Re:"poking around for files to test the burner?"

[HTH NE1]

The MAFIAA has been drumming it into everyone that just because someone has files on his computer doesn't mean he or anyone else has a right to make additional unauthorized copies to blank CDs or DVDs. Everything is copyrighted, even if unpublished. It doesn't matter that he's an individual and not a corporate association.

They should have put in their own test disk of data, read from that, then burned that back. That way they'd have tested both reading and writing ability of the drive without invading anyone's privacy. Or if they were afraid of modifying blank sectors, they could have plugged in a company USB drive with data they had rights to copy for testing the DVD burner and used that data instead. Surely they have a drive with boot test ISOs from corporate they can burn to replenish their supply, or other promotional disks.

If they didn't find child porn, what were they going to do with the disk they burned anyway? Retain it for later data mining? Distribute copies? Give it back to the customer? Just throw it in the trash, or shred it first?

Snooping around in a customer's drive for data to burn is not necessary to perform a hardware test on a DVD burner, and is an attempt to violate his or others' copyrights. He could civil-sue Circuit City (5 times fast) for attempted copyright infringement with premeditation... or something like that. IANAL.

US Freedom is definitely earned

[EmbeddedJanitor]

The kind of "Freedom" you guys enjoy in the USA has been earned. You had a great consitution and proper personal freedoms but you let various people scare you into shredding that constitution and those freedoms.

Re:"poking around for files to test the burner?"

[PopeRatzo]

When you send something in for repair you are giving the tech the right to look at your things.

When I call AT&T to complain about the noise on my phone line, am I giving them permission to listen to my calls?
If the lens on my digital camera breaks, can the repairman view my pictures?
You don't need to "find about 4GB of stuff to burn" in order to check a DVD-burner. What's the matter, these techs never heard of any of the dozens of diagnostic programs that fit on a flash drive that will test your burner, your hard drive, and just about everything else on your PC?

to be honest just having porn is probably an invitation for the techs to check out your stash.

I don't even know what to say...

Re:"poking around for files to test the burner?"

[svnt]

You make me sad.

It's obviously not a conspiracy, but so what? It is completely wrong.

They were hoping for shots of his wife, instead found some child porn, and suddenly because caped crusaders instead of the low-life porn thieves they were.

They are paid to install DVD drives and don't have an OTS test disk that they burn? Bullshit. This is an excuse made up after the fact, and the cops are only too happy to catch this guy - why question a convenient excuse about a process they don't really understand anyway.

And you're willing to throw away your rights for a PC upgrade. I hope you don't vote.

Re:Apple care

[quarrel]

Or better yet ... don't download child porn.

Re:"poking around for files to test the burner?"

[stoolpigeon]

you don't have to give at&t permission to listen to your phone calls - the government will.

Re:Apple care

[hedwards]

If I had mod points, I'd mod you insightful. It amazes me that people don't think that they'll get reported for that.

Gary Glitter got busted for that in a similar manner quite a while back. Realistically, if you hand your computer in for repair they may very well have to look at the files to figure out what's going on. Especially if they need to log in and they're on the desktop.

It does surprise me that people don't realize that computer techs have to report that sort of thing to the authorities when they find out.

Re:"poking around for files to test the burner?"

[testadicazzo]

In this case we can make a pretty good guess what went down, by reading the article:

Circuit City told Sodomsky that the upgrade would be finished in about an hour. After installing the DVD burner, the technicians tested the drive's new software by searching the computer's hard drive for video files to play back. (Amusingly, the court refers to "codecs"--video compression and decompression software--as "code X.") When searching the Windows XP computer for some sample video files, a technician named Stephen Richert allegedly spotted files that "appeared to be pornographic in nature" based on their names. Richert clicked on one that had listed a male name and an age of 13 or 14 and found a video he believed to contain child pornography. Then the usual series of events happened: Richert called Wyomissing police, who promptly showed up, seized the computer, and, after Sodomsky returned to pick it up, seized its ...

Now, I'm not arguing that the guy shouldn't be busted for child pornography. But I do think the guys privacy was violated by the techs: From the article, we know that the techs did a search for video files "to test the burner". Well, you don't need video files to test the burner, so based on my understanding of human nature within menial jobs, they guys were probably having a laugh about what kind of porn the guy had on his computer. Probably it's that systematic too. I would be surprised if the techs in question didn't have a pretty big stash of burnt porn, collected from various computer users.

Now, yeah, the guy should have been more careful with his data, especially concerning the nature of the data. But did he have a reasonable expectation of privacy when bringing his computer in for an hour, to have a dvd burner installed. That's actually a question of policy, and I think we should make it policy that YES we should have that right. If I'm going to give up the privacy of my data, I think that should be explicit, and that the techs should be bound to violate my privacy only to the minimum extent necessary (which doesn't include searching my hard drive for video files).

Discussing these issues has nothing to do with defending child-pornography (as the ACLU understands). We have to question these things to protect our more pedestrian privacy interests, which would otherwise be compromised by such systems. For example, I have some artistic movies of me and my girlfriend on my hard drive. They're on a linux partition, and I do my own repairs, but if I were just some non tech-savvy joe, I wouldn't want the techs searching for video files so they and their colleagues can have a laugh over me shtupping my gf, or (god forbid) burning a copy for their own use. And based on the procedure described in the article, I'd bet my money that that's happening pretty often.

Sure the guy is probably a dope, but I doubt he had his files on the desktop or some easily discovered place. When the tech guys are sitting with the criminal prosecutors and or the police they have to come up with a description of their activities that doesn't make them sound criminal, so "searching for video files to test the burner" sounds more reasonable than "killing some boredom by seeing what kinda freaky shit the guy had on his PC".

What amazes me is that more people haven't commented on the poor guy's name. Sodomsky? The poor guy was doomed from the beginning.

Re:Apple care

[Hal_Porter]

or cartoons of naked children (watch out, Simpsons Movie rippers), or images of statues of naked children (David, get out your ID). Child porn is clearly a very bad thing, since children must have been abused to create it, but you have to wonder if the laws against child porn might be a bad thing too. It reminds me of a comic -

http://pbfcomics.com/?cid=PBF215-Kitty_Photographer.jpg

The sad thing, this has happened. Parents in the UK have been arrested for pretty much exactly this. From what I can see, no one seriously thinks they were abusing their children - they just took a few admittedly tasteless pictures of them.

E.g.
http://en.wikipedia.org/wiki/Elton_John

Controversy struck in late September of 2007 when police confiscated a picture taken by a well known photographer by the name of Nan Goldin that featured two naked prepubescent girls. The concern surrounding the picture was the "provocative" position they were standing in. The picture was one of 4,000 pictures in John's collection. On October 27, 2007, the charges were dropped due to lack of evidence. I actually think that pictures should be legal in themselves. If they show someone committing a crime, they could be used as evidence to prosecute that person but would not become illegal in themselves. Making pictures illegal when they don't depict any criminal activity is an absurd overreaction.

Re:Apple care

[NtroP]

The legal concerns of our position were important to us, but not as important as the possibility that this crime could go on, uninhibited.

The crime of allowing your computer to keep a local digital copy of a file that someone has deemed "illegal"? Was this guy generating the CP or was he just saving photos that caught his sick fancy? Was he paying for a subscription to access areas where he could get these photos and therefore financially rewarding and encouraging another to assault a child or did he stumble accross them on *chan?

Except for the fact that he isn't arguing the point, what *proof* do we have that the tech themselves didn't plant the CP? If I had it in for someone, that'd be a pretty good start. All you have to do is mention CP and the witch hunt begins.

I know I'm going to get flamed into oblivion for this (not to mention accused of being a pedophile, homophobe and everything else in the book), but, if we take it as proven that homosexuality (being sexually aroused by your own gender) is genetic (or at least something you're born with) and therefor an "abnormality" and at best a "normal variant in human sexual preference" how is pedophilia, necrophilia, and bestiality different? Are we saying it's a choice of "lifestyle" and not something you're born with? How do we prove that?

In many countries of the world it is still illegal to be gay. If someone is born with the abnormality of being attracted to "those below the [arbitrary] age limit", and goes through life never once molesting a child, but only collects images that titillate their particular twisted interests, should they be branded a pariah and be sent to prison for years and years?

"But", you say, "seeing those pictures will encourage them to rape a child!". Hmmm... Does that mean that seeing pictures of naked men will force my gay coworker to rape me?. If I download rape photos, will I be driven to rape, should I be charged with the rapes in the photos? It's like the whole "violent games" argument all over again. Maybe this is some sort of release valve for some people.

Don't get me wrong. I think the exploitation of children is wrong, but I also think that the irrational fear and associated draconian laws are so ridiculous that we can't even hold a rational discussion on the matter any more. I mean, really, a 14 year old girl takes a picture of herself naked in the mirror with her cell-phone and she is convicted of creating and possessing child pornography. A 13 year old girl has sex with her 12 year old BF and is charged as a sexual predator and the victim? WFT?!

Something in me says that the same people who make the most noise in government about pedophilia are the ones that are probably hiding something in themselves, sorta like those politicians that bash gays so bad then get caught soliciting strange men.

C'mon people! If pedophilia is a "genetic disease" we should be working for a cure. If it is a sociopathic "choice" then we should be allowing those "suffering" from it to get treatment, not cart them off to jail.

And if someone assaults a child, charge them with the assault and lock them up. Rape is rape. Kidnapping is kidnapping. Child abuse is child abuse. There are already laws for that. Use them. But destroying someone's life because some pictures were found of a child without proper clothing on is ridiculous. Where I grew up it was normal for a girl to be married off and start having children as soon as she started menstruating. That often made her 12 or 13 years old. That was life. That's the way it had been for untold generations. Suddenly, there's something terrible about those people. My grandmother was married at 14. I guess my grandfather was a sick bastard. Funny, he never struck me that way. They were married for almost 70 years.

Well, I've got my flame-proof panties on and karma to burn. Flame on!