Slashdot Mirror
You Are Not a Lawyer
Paul Ohm is starting a new "very occasional" feature on the Freedom To Tinker blog called You Are Not a Lawyer — "In this series, I will try to disabuse computer scientists and other technically minded people of some commonly held misconceptions about the law (and the legal system)." In the first installment, Ohm walks through the reasons why many techies' faith in the presence of "reasonable doubt" is so misplaced. "When techies think about criminal law, and in particular crimes committed online, they tend to fixate on [the 'beyond a reasonable doubt'] legal standard, dreaming up ways people can use technology to inject doubt into the evidence to avoid being convicted. I can't count how many conversations I have had with techies about things like the 'open wireless access point defense,' the 'trojaned computer defense,' the 'NAT-ted firewall defense,' and the 'dynamic IP address defense.' ... People who place stock in these theories and tools are neglecting an important drawback. There are another set of legal standards — the legal standards governing search and seizure — you should worry about long before you ever get to 'beyond a reasonable doubt.'"
Disclaimers: I am a "techie" (whatever the hell that means). I do not pirate or violate copyright or IP laws to my knowledge. I am not a lawyer.
Why do I care about this? This confusingly assuming post is trying to say that techies are so stupid that they can only comprehend there being one piece of evidence in a trial and they think that if they cast doubt on this one piece of evidence then the accused is in the clear. I know this isn't true. If I prove that a screenshot of an IP address could be photoshopped yet there are logs upon logs provided by the ISP backing this up, I have done little if anything.
So draw a Venn diagram of all evidence (shadow-of-a-doubtable evidence unioned with unshadow-of-a-doubtable evidence) and show that if there exists any evidence outside of the shadow-of-a-doubtable circle than you're boned. That was essentially the only point you had in your windy post, correct? What else was there? A lesson on how police can opt to legally collect information regarding a case?
Thank you for the world class revelation, Paul. And also thank you for the imagery of "techies" being bumbling buffoons aping Perry Mason in their dreams. Perhaps my father was on to something when he tried to teach me that for all lawyers that exist none of them have any interest other than money and sucking the blood out of other people.
My work here is dung.
You mean the ones the Florida Highway Patroll pioneered ignoring back in the 80s, and which are now routinely ignored by law enforcement agencies nationwide? Trust me, I worry about those legal standards all the time...
Here's my summary:
"Beyond a Reasonable Doubt" may get you acquitted in the end, but that doesn't apply to all the things that happen to you BEFORE the trial: Cooling your heels in jail while charged, having every piece of technology you own seized as evidence, incredibly high legal fees, yada yada.
So, I guess the summary of the summary is:
Keep yer nose clean.
I suppose if you look at all the RIAA cases that routinely pop up here on /. you can easily see what he's talking about: look at all the costs and hardships those accuesed have to go through... The old lady who had probably never even listened to an mp3 in her life could probably attest to the pain. No reasonable jury would ever have convicted her, but that didn't stop the RIAA from causing her a big bunch of trouble.
The Digital Sorceress
A couple of considerations:
(1) the attorney author comes from the DOJ's Cymbercrime division -- the DOJ may have one interpretation of the law but the courts might have another;
(2) Academic lawyers generally have a slanted view on the world; and
(3) the facts and circumstances of your given situation are very important, blanket generalizations are risky. Facts can sometimes be fluid a good lawyer, can setup the playing field to the benefit of his/her client.
... than techies trying to play lawyer are lawyers who dismiss the contributions of their technical staff.
For the record IAAL (though not your lawyer) working in house at a company. Our "techies" are engineers, builders, power system analysts, traders, etc. Another word for these people is "clients." The legal department exists to further the interest of the company and enable our techies to do business. Sure, criminal prosecutions are different than commercial contracts, etc., but the principle is the same -- the lawyer exists to aid his client in getting the best possible deal. I think the difference in outlook often results from the fact that criminal defendants tend not to be those in society best equipped to aid in their own defense, but good attorneys do their best to bring their clients along.
If fact, the best thing about being a lawyer is helping your clients execute our common goals. Really, lawyers really provide the same service as good tech support -- except we help clients navigate the twisted corridors of the law instead of technology or computer code.
Actually yes, a whole lot of people who call themselves techies are stupid. They also think they are far more intelligent then they are. On top of that, many who call themselves techies believe they are so far above blue collar 'mouth breathers' that with very little work they can completely confuse them. I mean, hell, you just did something similar here. You assumed that the article writer must be an idiot because, well, you said so. Go ahead and rethink your logic and consider that perhaps something happened, maybe even several times, that prompted the writer to write what he did.
Most people are idiots, that they call themselves a techie doesn't change that.
"I use a Mac because I'm just better than you are."
I don't think the point is getting involved, it is that many tech types, and more likely self proclaimed techies, will stray into gray areas and they need to know that their short sighted, I can't be punished theories aren't all that strong outside of their mind or circle.
I have seen this in the past where people on IRC serve ip copyrighted materials and think a simple warning "if you are a law enforcement or affiliated with them, you are not allowed in the server" will get any evidence thrown out if they are busted. It's stuff like that which people think justifies behavior or removes possible penalties from it that is being addressed. It's the I'm using Lime wire but I have an open access point which I will blame everything on, just to have your computer taken by warrant before you can delete the lime wire program or any of the files your sharing.
The problem I have with any grouping is that it always degenerates to stereotypes. And before you know it, you are the stereotype, simply because you're grouped with those people. I'm not saying that there are not lawyers that are not sharks, and that there are not techies that teach, but that because of these assholes in each camp along with the stereotype, everyone in that group carries the blame.
This is all fine if made in good humor, but when it gets personal, or taken too far, the result is enemies and flaming rather than meaningful discussion. Simply put, there is no discussion if either side or both sides choose to close their minds to criticism.
Keeping your nose clean doesn't always work. If they have enough suspicions the police (or the RIAA, whatever) will do their best to nail you to the ground, which includes all the above.
As you mentioned: "the old lady who had probably never even listened to an mp3 in her life could probably attest to the pain"
Innocence is no defense against having your life ruined by invasive investigation, reputation-destroying accusation, and many other such things.
(1) you are not a lawyer.
(2) Lawyers think differently depending on the situation they are in. A "DOJ" lawyer might have completely opposing viewpoints to his employer when writing on a blog.
(3) The DOJ cybercrime division is not known for producing academic lawyers.
(4) Situations have common facts and courts often analogize.
It's sort of fascinating that you've posted the exact sort of response TFA expects. I'm tempted to think you're being ironic.
Here's the thing: a lot (i.e. the majority, actually) of these technical arguments you've referred to here are just silly. For example, you complain that the RIAA evidence links only to the computer, not the user. This is, of course, true. However, in the case of a family home that means the prosecution can narrow it down to the household members, so your argument would merely be "Well, you don't know if it was the dad or the son, so you can't sue", and that'll end up just bumping into group liability (which I won't bore everyone with here).
In the case of a shared computer, you'd have more of an argument, e.g. one a library computer or whatnot. But realistically, how many prosecutions have involved such a machine? So far, as far as I know, all the prosecutions have involved machines in private homes or apartments, so what exactly are you arguing?
"Stumble before you crawl"
Part of the problem is that "the geeks" got hold of economics and constructed their big, deterministic, agent based models. Models can be illuminating true, but in the case of economics, when reality and models parted company, the economists bemoaned the inability of the real world to match theory.
What is desperately needed in economics is a more reality based outlook that attempts to truly deal with the social and economic problems of wider society, rather than a bunch autistic, antisocial, arrogant geeks who don't even realise they're only allowed to keep doing what they're doing because it serves the interests of the powerful (and they're not getting in the way too much).
IAAE
Who's with me?! I SAID... WHO'S WITH ME!!??
That logic doesn't follow. It assumes, among other things, that: (a) we ever had a lower rate (i.e. that it has 'become' anything), and (b) we're not just better at dropping cases before they go to trial where the person is innocent (which would be a good thing).
"Stumble before you crawl"
OK, i'll bite.
I'm not a lawyer, I'm a computer scientist, but you can be damn sure that I'm going to give MY lawyer all the ammunition I can to defend me.
I'm going to have logs that "prove" I didn't do the crime.
I'm going to have "forensics" that "prove" my computers did not have the offending data in question.
I'm going to have hidden encrypted volumes 12-ways to Sunday - good luck getting to those without the NSA's help, or after my attorney tells me not to incriminate myself.
What most of my friends, who are attorneys, tell me is that law-enforcement is generally incompetent when it comes to investigating a case. Collecting evidence in a LEGAL manner is a complex and difficult process. These guys that barely made it out of the academy aren't lawyers and they will fuck it up. A good attorney will find a way to make the prosecution's evidence inadmissible.
Unfortunately, law is a complex thing. Gone are the days when the common man could defend himself. Today it's fight fire with fire.
-ted
Thank you for that. It's an interesting read but, for anyone who wants to save some time, here it is in a nutshell:
If your computer is targeted in a police investigation, your life is going to be a huge pain in the ass for a while even if you somehow manage an acquittal.
IANAL.
He's getting rather old, but he's a good mouse.
I basically agree with you, but I think your description of the problem is oversimplified and misleading. People are not monolithically "smart" or "stupid". Everybody's smart and stupid about different things. Like those wizards in the Harry Potter books that can master complicated magic spells, but can't mail a letter. What turns smart people into assholes is when they assume their smartness in one field automatically transfers to another.
I think computer techies are particularly bad this way because they tend to be self-taught. Often the most effective strategy for learning a technology is to just sit down and fiddle with it. Or they read a book that was probably written by another self-taught techie that often gets details wrong (how many of you can correctly define "ASCII"?) but gets enough essentials right to get the job done.
What techies don't get is that this style of learning just doesn't work with the law. Even if you understand a legal principle (and when techies try to understand something as abstract as a legal principle they often get it wrong) you don't have a practical understanding of its proper application in every context. Lawyers spend years studying and arguing about this stuff, and even so they have to specialize in order to develop any real expertise.
Smart people make mistakes too. More often in areas where they lack expertise. Even though in an abstract way you know all these things, in practice, they elude many people who really ought to know better. Just ask Hans Reiser how well his cunning plan worked out in practice.
As a techie, have you ever run across an otherwise intelligent person who wants to argue with you about why their network/computer/whatever doesn't work the way they think it should? Did you ever get frustrated because, despite the fact that this is what you studied to do, spent the last five (ten, thirty) years doing, etc., etc., they think they know more about networking/programming/computer security than you?
Now, as a techie, did it ever occur that some times, in arenas other than tech, it is *you* (and me -- I'm not pointing fingers) that is the know-it-all who just doesn't get it?
MCSE? No, sir...I don't do Windows. Yes, I am an idealist. What's your point?
I wouldn't shut up until the Supreme Court had heard the case.
Best of luck. There are a great many people that would love to get in front of the Supreme Court. Something tells me that your "There is no password on my WAP - Anybody could have downloaded that. I just didn't bring it up during trial to make a point." defense, although perfectly valid, will be your last words if you really keep repeating it until either getting through to the Supreme Court or dying of old age.
And I'd want enough money to be set up for life from the jurisdiction that was stupid enough to let their public officials have search warrants when there was still reasonable doubt as to innocence.
Good luck with that too. It's up to the jury to decide whether or not there's "reasonable doubt as to [your] innocence". Are you suggesting that we re-work our system so that the police can only collect evidence after conviction?
He's getting rather old, but he's a good mouse.
His point was that long before you ever get your day in court for "reasonable doubt", you will be arrested, jailed, your friends & family will be questioned about you, your stuff searched, etc... all with a much lower burden than "reasonable doubt".
So while you may ultimately prevail with "reasonable doubt", the police/prosecutors can your make you life a living hell until you get your day in court.
"I'd rather be a lightning rod than a seismometer." -Ken Kesey
You left out expensive - A huge expensive pain in the ass.
Here is one more: (4) If you are not in the US, US law does not apply.
I wished that was true :/
--- "When you gotta do something wrong. You gotta do it right. (Fighter)"
While what you say is consistent with the rules of formal logic, that really doesn't matter. The question is, is it reasonable to believe that someone else put that file on your computer, or that a file named "Sympathy For The Devil.mp3" is not the Rolling Stone song. At first glance, I'd say that those assertions are not reasonable. Therefore, your defense will need to show that they are reasonable explanations, by providing evidence that there was an intrusion or that you have a time stamped copy of the file that has something other than that particular song.
You are proving the article author's point - geeks tend to focus on the problem as if it was a formal logic problem, when it is much more.
"As God is my witness, I thought turkeys could fly." A. Carlson
Here is one more:
(4) If you are not in the US, US law does not apply.
Tell that to Gary McKinnon and Hew Raymond Griffiths.
When information is power, privacy is freedom.
Ok, lets rephrase that: "If you are not in the U.S., your rights under U.S. law do not apply."
For real.
To use the open wireless access point as an example. If someone sits outside your house and downloads kiddie porn, or starts running brute force attacks against NSA through your connection, the feds will show up and confiscate every electronic computer and storage device in your house so they can run forensics on it, which may take them 2-3 years to get to. Meanwhile all your stuff is sitting in an evidence room depreciating.
Sure you might not get into trouble if there's no evidence on any of your gear or storage, but by the time you get it all back, it will be useless and way out of date.
If you factor this depreciation, and you have a lot of gear and storage, the cost is huge. Then you have attorney bills and your reputation to worry about. You will never fully recover your reputation even if you are 100% innocent.
Leaving that default password on your router has a lot of potential to screw your life up in ways you wouldn't expect.
-Viz
Don't kid yourself. It's the size of the regexp AND how you use it that counts.
So it's not reasonable to believe that "Sympathy For The Devil.mp3" is an audiobook of Holly Lisle's novel by that name? The title enough, combined with the fame of the song, is sufficient to convict beyond reasonable doubt? That's harsh.
All this persecutor in the YANAL blog is saying is that there ain't no justice, and it doesn't matter how much evidence there is, innocent or guilty they can fuck up your life. That's true, but it doesn't really take a lawyer to know it -- or a non-lawyer not to.
As i was one of the few somebodies who observed a certain spammer (Mr Robert Soloway) and his use of bot nets let me insert some euro's into this.
Mr Gary was an idiot - lets all agree on that using trial remote software in windows (with the credit card number) during the middle of the American day means at some point even the most idiotic American computer user knows things are not right.
Is it right that this [Gary] idiot goes to American justice ?, well if the us congress ever ratifies the extradition agreement with the UK then maybe we might get back some of those DeLorean millions lost. Buts that is ok as the special relationship means special to one side only.
So as a european citizen could i expect to see Robert Soloway in a european for computer crimes - no way.
I AM NOT trying to troll
I do not have court powers (i know) but the law is a joke, lets face it the coke dealer on the american corner is probably much more likely to see a policeman than Robert Soloway
To my knowledge the courts,the ftc,local state law all failed to act on Soloway, until federal level.
I could troll an anti american conclusion here, but i know better, Gary is a retard, the UK law that approves all extradition to the us no questions asked proves that there are plenty of idiots in UK government.
I dont want to be an lawyer, even an idiot watcher of Robert Soloway could tell you that in civil court Soloway admitted to not paying tax of any kind in court.
My conclusions - what i know stands up in court, the law in america would seem to overlook a great deal.
Please note i note trying to troll.
A couple of considerations:
(3) the facts and circumstances of your given situation are very important, blanket generalizations are risky. Facts can sometimes be fluid a good lawyer, can setup the playing field to the benefit of his/her client.
...which is relevant in the trial. What he's talking about is BEFORE that, the investigation has a much lower bar on what they need to prove that they can go rifling through your stuff.
"A good lawyer" isn't going to do you any good at 10:00 on a Tuesday night when the police knock on the door with a warrant in hand, ready to arrest you if you don't cooperate right then.
Don't you wish your girlfriend was a geek like me?
Pretty much, yes. I am unaware of any laws in Sweden that prevent you from having your stuff seized and searched and your reputation ruined if you are suspected of a crime (and they can gather enough evidence). This isn't an "the American Government are all Nazis" article it's a "Being investigated for a crimes sucks almost as much as being convicted" article. It's pretty much true anywhere. The Police in more "civilized" countries still search for evidence, they still arrest you before you are put on trial, and good attorneys still cost lots of money. The man's argument is undeniable. If the Police suspect you of a crime, they can make your life hard. If they can get enough evidence to search your premises, they can make your life VERY hard. If they can get enough evidence to arrest you, they can make your life MISERABLE. Even if you wind up getting acquitted, It will cost you time, reputation, and money. In Sweden, the United States, Canada, or the North Pole.
I don't need a million points of light, just two points of multi-mode fiber and a 10 Gig-E router.
Except that politicians make laws, not lawyers. I seriously doubt all politicians are lawyers.
"All" is a very strong statement, but there is no question that the overwhelming majority of politicians are lawyers, at least in the USA. If you made it something of a research project, you would probably have difficulty naming even a few politicians (at least on the state and federal levels) who do not hold law degrees. It does make sense that most of the people who make new laws have the qualifications necessary to understand and work with existing laws. Unfortunately the idea that their profession is special and exclusive can also be more important to them than the idea that all citizens are expected to know and obey all laws, which is why many laws appear (in my humble unqualified opinion) to be written by lawyers, for lawyers.
As a side comment, the fact that the vast majority of politicians are lawyers is why I feel that they should be held personally responsible (i.e. face criminal charges) when a law that they created or endorsed is later found to be unconstitutional. This would be a much-needed counterbalance against the fact that a citizen cannot challenge an unconstitutional law until after he or she has suffered because of it and risked experiencing the business end of state power. But then, I have always felt that when officials and authority figures screw up, it is far worse than when an average citizen screws up because when officials do it, it undermines the respectability of the law as an institution. I think too that the prospect of power attracts some extremely undesirable personality traits; there is a shortage of good, wholesome, selfless reasons why someone would want it. So, I like the idea that if you want power, you should be held more accountable for your actions than someone who doesn't. Perhaps incorporating these ideas into our legal system would reinforce the idea that public officials are our servants and were never intended to be our masters.
It is a miracle that curiosity survives formal education. - Einstein