Call Yourself a Hacker, Lose Your 4th Amendment Rights

An anonymous reader writes "As described on the DigitalBond blog, a security researcher was subjected to a court ordered search in which a lack of pre-notification was premised on his self description as a 'hacker.' From the court order, 'The tipping point for the Court comes from evidence that the defendants – in their own words – are hackers. By labeling themselves this way, they have essentially announced that they have the necessary computer skills and intent to simultaneously release the code publicly and conceal their role in that act.'"

Comments

Stallman would have something to say about this

[twocows]

Aside from the obvious abuse of power, there's this: http://www.stallman.org/articles/on-hacking.html

Re:Stallman would have something to say about this

[girlintraining]

they have essentially announced that they have the necessary computer skills and intent to simultaneously release the code publicly and conceal their role in that act.

I wasn't aware that capability implied intent. I suppose everyone who owns a gun now should just surrender their 4th amendment rights, since they have the ability to kill people. Someone find out where this judge is; let's put his name here and on as many web pages as possible so anytime anyone googles his name, they can point to this as a reason to have their case retried by a different judge who doesn't hate America.

Re:Stallman would have something to say about this

[Sarten-X]

No, but the defendant's repeated advocacy of open source implies intent to publish source code. The lawsuit is alleging that the defendant stole source code from his prior employer for the purpose of open-sourcing it as his own product.

Since the defendant clearly has intent to open-source his product, and if it were indeed stolen source it would immediately cause irreparable harm, and the defendant's own statement shows he has the skill to cause such harm quickly (well within the usual timeframes of the court process), an immediately-executed warrant is reasonable.

Re:Stallman would have something to say about this

[Lithdren]

Came here to say exactly that. Reviewing what they say in the artical linked:
 
 

The Court has struggled over the issue of allowing the copying of the hard drive. This is a serious invasion of privacy and is certainly not a standard remedy, as the discussion of the case law above demonstrates. The tipping point for the Court comes from evidence that the defendants â" in their own words â" are hackers. By labeling themselves this way, they have essentially announced that they have the necessary computer skills and intent to simultaneously release the code publicly and conceal their role in that act. (underline added) And concealment likely involves the destruction of evidence on the hard drive of Thuenâ(TM)s computer. For these reasons, the Court finds this is one of the very rare cases that justifies seizure and copying of the hard drive.

Way I read this...they were unsure if this guy stole code from the company he worked for, they were pushing to seize his computer at home because they felt he had stolen code to release as an open-source option to the software he helped write that they wanted to lease out instead. The court, torn on the issue, decides that because he calls himself a 'hacker' he's able to not only steal the code, but cover his tracks. So they better seize his equipment before he gets a chance.

I hope someone beats some sense into this judge, just being capable of something does not mean you might do it. We're all murders because we all own cars capable of running people over and killing them. We're all mass murders because we have bleach/cleaning fluids at home we could dump into local water supplies poisioning the entire area. Next time someone gets hit by a car while on their bike in a hit-and-run they'll need to bring in as probable suspects everyone in the tri-state area who owns a drivers liscence. What kind of insane crap is this?

Re:Stallman would have something to say about this

[Anonymous Coward]

I was recently involved as a third party in a lawsuit where similar allegations were made. They were entirely without merit and totally malicious, simply being made in order to cause the defendant the financial hardship of having to be drawn through the legal system.

Just because one party alleges intent, does not mean there is any.

Re:Stallman would have something to say about this

[RenderSeven]

Someone find out where this judge is; let's put his name here

B. Lynn Winmill
Chief Judge
United States District Court

Re:Stallman would have something to say about this

[girlintraining]

No, but the defendant's repeated advocacy of open source implies intent to publish source code.

In the same way my advocacy of and interest in international culture implies intent to engage in "unamerican" activities? In the same way that candidates for state senate saying "if itâ(TM)s a legitimate rape, the female body has ways to try to shut the whole thing down" implies the candidate is a rapist? We've been down that road before. It doesn't lead anywhere you want to be.

The lawsuit is alleging that the defendant stole source code from his prior employer for the purpose of open-sourcing it as his own product.

And was there evidence to back up this claim, such as server logs, statements by the defendant, etc.? Because from what I've read the answer is no, there wasn't. The only evidence cited in the ex parte order was the defendant's advocacy of open source and his prior access to the ex-employer's code.

Since the defendant clearly has intent to open-source his product...

Which is his right, if he designed it on his own, as many other people have done after working on a closed source product...

and if it were indeed stolen source it would immediately cause irreparable harm

... And yet no proof the code was stolen was provided.

an immediately-executed warrant is reasonable.

No, it isn't. They need to prove he's in possession of stolen property first. His statements about what he would or wouldn't do with it have absolutely no weight whatsoever in issuing the search warrant. That the judge is making these statements implies that the evidence he had done so was very, very weak, to the point they had to rely on circumstantial evidence that is only dubiously related to the matter at hand to secure the warrant.

This sounds more like a case of a manager acting without evidence that any wrongdoing had occurred and decided to use law enforcement resources to harass the former employee. This is, for lack of a better term... a domestic dispute. It's a he said, she said situation. Except that in this case, it's a company, not an ex.

Re:Stallman would have something to say about this

[Bite The Pillow]

You might have a point if that were the only basis for the decision. The basis of the restraining order was to prevent irreparable harm based on likelihood to succeed with a claim, and that case was well made.

Here's the judge's info, it's right at the bottom of the court order where someone who read it would expect to find it, next to his signature. I doubt it will have the effect you wanted, because this is a decent decision.

B. Lynn Winmill
Chief Judge
United States District Court

The only real counterargument would be to point to https://github.com/visdom/ which has the open source version, and was registered July of this year. Surely they could just look at the code and see if there was infringement? No, the evidence on the hard drive will be captured and stored pending further developments in the trial. The Court was preserving evidence which would most likely show that any copying was more than incidental.

This was the unquestionably correct decision, and the slashdot headline and summary are woefully oversimplifying in order to cash in on outrage. I hope you have disabled advertising, because Dice should be embarrassed that shit like this end up on the front page, and should certainly not profit from page views.

Direct quotes from the decision follow. Note: this guy worked at the company he is accused of copying from, so access to the original Sophia code is not in question, only whether it was used as a reference.

As for infringement, if there is no evidence of direct copying, âoeproof of infringement involves fact-based showings that the defendant had âaccessâ(TM) to the plaintiff's work and that the two works are âsubstantially similar.â(TM)â Funky Films, Inc. v.Time Warner Entmâ(TM)t Co., 462 F.3d 1072, 1076 (9th Cir. 2006) (citation omitted).

Here, Battelle has put forward adequate circumstantial evidence to permit an inference that defendants copied Sophia. Battelle says Thuen created Visdom in a time period that is impossible without copying; he described Visdom in nearly identical language as was used to describe Sophia; he used the same demonstration videos toshowscase Visdomâ(TM)s functionality as he did to showcase Sophia; he has admitted to copying parts of Sophia; and he has adopted a nearly identical name. Based on this record, the Court concludes that Battelle is likely to prevail on its copyright infringement claim.

...Additionally, the facts show that Thuen previously defied Battelleâ(TM)s instructions to refrain from widely releasing video demonstrations of Sophia on the internet.

...To support this assertion, defendants cite Battelle employee Michael Colson, who testifies as follows: I have 23 years of experience as an investigator for government and private entities and have worked many times on matters where employees have â" without authorization â" taken data from employers for their own purposes. In my experience it is very common for such individuals to simply delete the data when they are confronted with aninvestigation, rather than admit wrongdoing. This is particularly so inregards to those with technical skills to wipe the data in a way which does [not] leave digital footprints. My investigation has revealed that Thuen has (or had) an unauthorized copy of executable Sophia code on his home computer and, from my experience, there is a high risk that he might wipe his computers destroying evidence if he had advance warning.

Re:Stallman would have something to say about this

[RenderSeven]

What the fuck makes you think you have any right to "undermine his decision"?

As a citizen I have an obligation to call attention to poor legal decisions, and my suggestion for a NPOV Wikipedia entry linking to a citation was a call for moderation over rash action. And you should know that judges cannot be voted out, and can be cited outside of jurisdiction, so I have as much standing and interest as anyone else, and I did at least read the entire decision. Did you? While I am not an appeals judge (and pretty sure you arent either) I think there is a reasonable argument that there was a judicial error in the application of the term 'hacker', in that the court applied the term arbitrarily to motive; rather, in terms of motive all that mattered is how the defendant applied the term to himself, and the decision does not take that into consideration.

Re:Stallman would have something to say about this

[BlueStrat]

The constitution says nothing about gun registration. Stop making registration into something ti is not.

Also:
The constitution specifically says congress has the right to regulate. It's IN the fucking amendment.

I'm sorry, but are you duly-authorized & licensed to post political opinions on public forums?

The point is, your argument works for government licensing & regulation of speech as well.

It's OK if you don't believe citizens should be able to defend themselves and their families and must be rendered victims/slaves to the first nut(s)/criminal(s) that come around with a gun, and/or is physically much stronger and/or greatly outnumbers the possibly young & female victim. If enough people agree with you in electing to enforce the victim-status of the weak/infirm/aged and the majority of peaceful & law-abiding citizens, then you can amend the US Constitution, as has been done numerous times already.

Don't people understand?? You can't weaken/nullify/sidestep one part of the Constitution you disagree with without also having an equal destructive effect on the parts you do like.

Either all of it is valid as it was written, or none of it is and the USA has become an authoritarian State where "Constitutional Rights", "Rule of Law", and/or any other limits to what government can do are meaningless and empty words & concepts.

Maybe you value the 1st Amendment highly, but sharply disagree with the 2nd Amendment's protections of personal firearm ownership. That's fine and is your right to believe, and there's a provision for changing the 2nd Amendment (or any others).

*But*, attempting to "game the system" through judicial/executive/legislative/regulatory legal sophistry (much of which reads like the "Chewbacca Defense" and/or a never-published chapter of "Animal Farm") instead of following the established amendment process, destroys all of the rights, protections, and limits set forth in the entire document as the same can be done with *them* if and whenever those in government so desire.

Strat

Re:Stallman would have something to say about this

[girlintraining]

As a previous post said, "It's more like if you claimed to be a professional killer and later claimed you kill deer." I know reading TFA is terribly out of fashion, but I recommend it. His advocacy included repeatedly pushing employers to open-source their product. That's what showed intent, not his website.

Advocating doing something isn't evidence for having actually done something. That's the point that neither you, nor apparently this judge, understands. It's like saying "Good for those 9/11 terrorists blowing up the building!" ... Not exactly winning you any friends saying that, but it doesn't make you a terrorist and it isn't a crime. It's just incredibly poor taste to say, and that is all.

So let me get this straight... before an investigation, the investigators must already have their proof?

They must have some evidence of a crime, yes. When a cop pulls you over, he can't just search your car because of the "I LOVE WEED" bumper sticker. But if he smells it on you, or sees wrapping papers on the floor, smells marijuana, etc., then that gives him what's called probable cause to conduct the search.

What exactly do you think the point of the investigation is?

Hopefully the truth. In practice though, it's more often a witch hunt. Either way, a search warrant is issued to find additional evidence of a crime (or crimes). For example, "I hate the president," isn't enough to get a search warrant issued, but "I plan on shooting the president at 3:00pm after his speech with my dad's hunting rifle" is. But the defendant in this case didn't say "I have the source code and intend to release it". It's arguable whether there was any evidence that he had it. The intent to release is based solely on previous statements made in support of open source.

What this case lacks is credibility. The judge has made assumptions about motive which are not supported by the available facts. He has linked two separate statements together to form a third statement which supports his position. In layman's terms, he jumped to a conclusion. And this is specifically why search warrants require a judge's authorization -- to prevent exactly this from happening and thus violating a person's rights. Suspicion isn't enough for a search warrant; It's rarely enough to take any action, especially when this is a civil matter and there is no imminent threat to life or property.

The judge agreed that there was a significant risk of irreversible harm if the defendant kept his computer during the investigation, so it's been seized. Big deal. It can be checked in a few days, and should be returned, if not, then it's time for a countersuit.

You clearly haven't worked with law enforcement much. Even back in the 90s, when 'cyber crime' was in its infancy, Steve Jackson Games had all its computers seized and nearly went bankrupt over allegations that their game was a 'manual for computer crime'. The computers weren't returned until over two years later, at which time the computers were worthless and out of date and the data they contained had been painstakingly recreated with varying degrees of success by the employees. Once a computer is seized, it doesn't get turned over "in a few days"... For one, the forensic labs have a backlog of months to years, and for two, as it is now material evidence, it can't be released until and unless all legal action involving it is concluded which included appeals from both sides.

So yeah, it is a big deal. It means his computer, his primary method of income has now been locked up, along with all kinds of collateral damage -- his entire digital life, including copies of resumes, bank records, pictures, etc., are all now inaccessible to him. He won't even get a copy of the hard drive back because until it has been processed, the police won't take the chance of giving him back data he could theoretically use

Wait, what? I'm a unicorn, arrest me?

[Anonymous Coward]

I thought it was about a reasonable suspicion of committing a crime, that sort of thing?

If I call myself a sex god do they do diligence on that one too?

Re:Meh, too alarmist

[Wycliffe]

In short, this isn't a "violation of the 4th amendment" so much as it is an excuse to try and get access to the guy's hard drive and recover stolen assets.

What do you think a "violation of the 4th amendment" is then? To me "an excuse to bypass the 4th amendment to gain X" is
exactly that. It is a violation and an attempt to bypass the 4th amendment. Whether he is guilty is not the point.
Now if they got a proper warrant and executed it correctly, that's a different story but if they are using an excuse to bypass
proper protocol then it very much is a violation of the 4th amendment. It doesn't really matter what the excuse is either.

Re:Wait, what? I'm a unicorn, arrest me?

[bws111]

Bullshit. Read the damn article.

The guy is being sued by his former employer, who claims he took their code and plans to offer it as open source (copyright infringement). The plaintiff contends that there is crucial evidence on the defendants computer. The court ordered (as is usual in such cases) that an image be made of the defendants computer in order to preserve any evidence that is there. The computer is to be returned to the defendant as soon as the image is made, in the same condition as before the computer was taken. Nobody can look at the image until further court orders allow it.

So where does 'being a hacker' enter the picture? The plaintiff asked the court for a temporary restraining order without notification to the defendant. The courts rules state that a temporary restraining order can only be granted if there are specific facts that show irreperable harm will occur before the opposing party can present his position in court. In this case, the plaintiff is claiming that the defendant will have the ability to destroy the evidence before the plaintiff can present their case. The court used the 'we are hackers' statement as evidence that the defendant probably had the means and knowledge to destroy the evidence. Thus, the restraining order was granted.

It is not a criminal case. No 4th amendment rights were violated.