MSBA Computer and Technology Law Section

Dealing with Data Encryption in Criminal Cases

This comment by Sean L. Harrington provides opinions that do not necessarily reflect the positions of the Minnesota State Bar Association or its other constituents.

————————————————

Introduction

Over the last several years, I've posted a handful of short blog entries about the topic of compelling a criminal defendant to surrender a passphrase to an encrypted volume or hard-drive.  These entries concern the three cases of re Grand Jury Subpoena Duces Tecum Dated March 25, 2011, United States v. Fricosu, (D.Colo, 2012), and In re Grand Jury Subpoena (Boucher), 2009 U.S. Dist. Lexis 13006 (D. Vt., 2009).

I have developed the opinion —admittedly, more on hunch than scholarly research— that a defendant should not be able to knowingly withhold a passphrase or password to an evidence trove any more than he should be permitted to hang on to a physical key that could be used to open a safe that the Government has a valid warrant to search, and which is believed to contain evidence.

Unfortunately, I have found myself on the wrong side of this issue.  My colleagues Sharon Nelson and Craig Ball disagree with me on some aspects of the issue.  And my position is seemingly at odds with the Eleventh Circuit in Grand Jury Subpoena Duces Tecum Dated March 25, supra, a decision that Professor Orin Kerr described as mostly correct (although I note that the Eleventh Circuit did distinguish Boucher, and recognize exceptions).

Privilege

Setting aside, for the sake of this comment, the question of whether knowledge of the passphrase is both "testimonial" and "incriminating" for purposes of the Fifth Amendment (the very issues central to the aforementioned cases), or whether the knowledge of the passphrase should be distinguished from possession of a physical key, my belief has been based on a principle that parties to either criminal or civil litigation should simply not be permitted to purposefully withhold admissible evidence from each other.

Now, before I continue, let's recognize that purported principle for what it really is:  incorrect.    In fact, there are several basis under our system of law when a party is permitted to withhold otherwise relevant, admissible evidence.  We call it "privilege."  Privilege is that annoying rule of law (I'm being facetious here) that, "to protect a particular relationship or interest, either permits a witness to refrain from giving testimony he otherwise could be compelled to give, or permits someone (usually one of the parties) to prevent the witness from revealing certain information" Waltz & Park, Evidence, Gilbert Law Summaries, § 635. Perhaps the most common example of it is the attorney-client privilege. See Upjohn Co. v. United States, 449 U,S, 383, 389 (1981) (acknowledging the attorney-client privilege as “the oldest of the privileges for confidential communications known to the common law”).

But even the hallowed attorney-client privilege has its limits.  Under the civil fraud and criminal fraud exceptions, an otherwise privileged communication becomes discoverable. See, e.g., United States v. Zolin, 491 U.S. 554, 562–63 (1989) (stating goals of attorney-client privilege are not served by protecting communications made for purpose of getting advice for commission of crime or fraud). And see Deborah F. Buckman, Annotation, Crime-Fraud Exception to Work Product Privilege in Federal Courts, 178 A.L.R. FED. 87, § 2[a] (2002).

Encryption as Evidence Destruction

Craig Ball often reminds his audiences of the three ways to destroy electronically stored information: (1) overwrite the bytes with new data; (2) physically destroy the media upon which the data was written; or (3) use strong encrypt on the data and forget the passphrase.  Thus, in my assessment, if an individual encrypts evidence while engaging in the commission of a crime, it is tantamount to flushing drugs down the toilet, throwing the murder weapon in a lake, or silencing a witness. These are independent criminal acts, separable from the underlying charges.   Likewise, a civil litigant, who encrypts evidence after the duty to preserve has attached (articulated best in Zubulake v. UBS Warburg LLC, 220 F.R.D. 212, 218 (S.D.N.Y. 2003)(“Once a party reasonably anticipates litigation, it must suspend its routine document retention/destruction policy and put in place a litigation hold' to ensure the preservation of relevant documents”)), engages in spoliation that may be punishable.  Therefore, I contend, by using encryption, a defendant or litigant may engaged in spoliation of evidence —albeit undoable— which may be subject to independent criminal liability, civil sanctions, or an adverse jury instruction.

Notice, these phrases in bold, above, establish mens rea, (i.e., intent -- purposeful or knowing conduct) that the actor was using encryption in the furtherance of a crime, or to destroy evidence to thwart a law enforcement investigation.  An instructive analog may be the safe harbor provision, Fed.R.Civ.P. Rule 37(f), as applied to electronic discovery in civil cases. The provision shields a party who cannot produce evidence lost as a result of the routine, good faith operation of an electronic information system. In other words, if an individual was using whole-disk encryption not to obfuscate criminal activity, but rather because he was trying to protect against identify theft, or because the system came with it by default, there is no intent, hence no criminal culpability. Another helpful analog might be found in Arizona v. Youngblood, 488 U.S. 51, 58 (1988), where the U.S. Supreme Court held charges may be dismissed based upon evidence lost or destroyed by the Government, which is deemed to be only potentially exculpatory (as opposed to apparently exculpatory), only if defendant can show the evidence was destroyed in bad faith.

But, perhaps the best authority addressing the mens rea requirement is probably that required for the 18 U.S.C. § 1503 (conduct that, among other things, corruptly endeavors to obstruct or impede the due administration of justice): To sustain its burden of proof, the government must "show that the defendant knowingly and intentionally undertook an action from which an obstruction of justice was a reasonably foreseeable result. Although the government is not required to prove that the defendant had the specific purpose of obstructing justice, it must establish that the conduct was prompted, at least in part, by a corrupt motive.” United States v. Barfield, 999 F.2d 1520, 1524 (11th Cir. Ala. 1993) (internal quotations omitted).  Unlike the duty-to-preserve in civil cases, which requires only reasonable anticipation of litigation, the federal criminal context requires there to have been a pending judicial proceeding known to defendant at the time. See, e.g., U.S. v. Fineman, 434 F. Supp 197 (E.D.Pa 1977) (In applying the obstruction of justice statute to issues of destruction of documents, federal courts generally have not required that a subpoena have issued. Rather, it is sufficient for an obstruction conviction that the defendant knew that a grand jury was investigating possible violations of federal law and intentionally caused destruction of the incriminating document.). In fact, 18 U.S.C. § 1503  has even been applied to prosecute those who, in a civil case, were accused of willfully destroying documents subject to discovery. U.S. v. Lundwall, 1 F.Supp.2d 249 (S.D.N.Y.,1998).

Note that my theory is not that the presence of encryption is somehow admissible as relevant in demonstrating defendant's mental state or aptitudes, as it appears to have been in State v. Levie, 695 N.W.2d 619 (Minn.App. 2005) ("the existence of an encryption program on [defendant's] computer was at least somewhat relevant to the state's case against him," and the jury was allowed to consider it). See also Jessica Murphy, Swiss Cheese That's All Hole: How Using Reading Material To Prove Criminal Intent Threatens The Propensity Rule, 83 Wash. L. Rev. 317 (May 2008).  Rather, my theory is that, even if a court finds that a defendant cannot be compelled to aid in his prosecution by surrendering a passphrase (because doing so would be testimonial and incriminating), a defendant may nevertheless be criminally liable for evidence spoliation.  Further, when evidence is spoliated, a factfinder may be entitled to presume that the evidence was unfavorable to the spoliator. See Washington Gas Light Co. v. Biancaniello, 87 U.S. App. D.C. 164, 183 F.2d 982 (D.C. Cir. 1950) (Willful destruction of evidence by a party properly raises the inference that the materials destroyed were adverse to the party which brings about the destruction); Brown & Williamson Tobacco v. Jacobson, 827 F.2d 1119, 1134 (7th Cir. 1987) ("A court and a jury are entitled to presume that documents destroyed in bad faith while litigation is pending would be unfavorable to the party that has destroyed the documents."); Dale A. Oesterle, A Private Litigant's Remedies for an Opponent's Inappropriate Destruction of Relevant Documents, 61 Tex. L. Rev. 1185, 1232-39 (1983) ("[A] party's bad faith destruction of relevant documents is an admission by conduct that he believes his case is weak and cannot be won fairly."). See generally 2 John Henry Wigmore, Evidence §291 (James H. Chadbourn rev. ed., 1979) (discussing evidence spoliation).

Conclusion

The right to privacy as, Justice Douglas recognized in Griswold v. Conneticut, arises from “penumbras, formed by emanations from those [specific] guarantees . . . in the Bill of Rights.”  And the Bill of Rights operates as a constraint on the Government.  But, those penumbrae do not, in my view, confer a magical privileged status to file or disk encryption under the rubric of privacy, when, in certain limited circumstances, such encryption is really just evidence spoliation.

As a forensics examiner, I am already seeing and foresee a higher frequency of criminal and civil investigations thwarted by the use of file or disk encryption and the privilege under the Fifth Amendment.  Absent new statutes addressing the misuse of encryption technology, a prosecutor should closely examine the Eleventh Circuit decision to see if his or her case falls under the limited exceptions that would require defendants to surrender the passphrase under the penalty of remedial contempt. Alternatively or conjunctively, prosecutors should determine whether the use of encryption by defendants fall within the scope of an applicable federal or state statute for destroying evidence in the furtherance of a crime, or incident to a criminal investigation, where there is extrinsic evidence of a corrupt motive.

the story of Parke-Davis

Jon M. Harkness, Dicta on Adrenalin(e): Myriad Problems with Learned Hand’s Product-of-Nature Pronouncements in Parke-Davis v. Mulford, 93 J. Pat. & Trademark Off. Soc’y 363 (2011).

Dicta on Adrenalin(e) tells the story of Parke-Davis & Co. v. H.K. Mulford Co. While that case involved a priority dispute over patents on the hormone adrenaline, Parke-Davis has been cited as standing for the proposition that purified products of nature are eligible for a patent. As the article reveals, Judge Learned Hand’s assertion that purified products of nature are patentable subject matter was dicta. The article supports this conclusion by telling the fascinating story of the key players in Parke-Davis and describing the unique circumstances in which the case was decided. With news of whether the Supreme Court granted the Association for Molecular Pathology’s petition for certiorari expected soon, the article gains increased importance. For a more detailed summary of Dicta on Adrenalin(e) visit the Journal of the Patent and Trademark Office’s website at http://www.jptos.org/news/122/15.html. For a copy of the article email the author, Jon M. Harkness, at jon.harkness@comcast.net.

United States v. Barry Ardolf

This op-ed post by Sean L. Harrington provides opinions that do not necessarily reflect the positions of the Minnesota State Bar Association or its other constituents.

————————————————

The media and blogosphere is abuzz with news that Barry Ardolf, the disgruntled neighbor who “hacked” in the WEP-secured wireless network of his neighbor and Minnesota lawyer, Matt Kostolnik. Last week, Ardolf was sentenced to eighteen years. See, e.g., Martha Neil, “Neighbor Gets 18 Years for Hacking Lawyer’s Wi-Fi Account, Using His ID to Harass Others,” ABA Journal, July 13, 2011.

There are at least a few lessons to learn from this case: (1) Don’t use WEP to secure your wireless network (it can be hacked in as little as four to ten minutes), (2) law firms benefit from having good working relationships with competent digital forensics investigators, and the most obvious: (3) check with your local police department or lawyer before you act ib any brainy ideas about hacking into your neighbor’s computer network in an effort to frame him for possessing child pornography and threatening the Vice President (or any other purpose).

But that’s not really what this comment is about. Rather, the comment focuses, in part, on whether Internet users could bear defamation liability for statements (in blogs and comments) based upon uncharged conduct contained in a Government court filing, and whether the Government should use more restraint in discussing uncharged conduct that may give rise to various unintended consequences.

Almost as interesting as the underlying facts is the story behind how those facts were uncovered. The Anoka County Sherriff deputy who worked on the case recently provided a case study for the Minnesota chapter of the HTCIA (http://mn-htcia.org).  He was joined by cybersleuth Scott Johnson, whose methodical investigation ultimately produced the probable cause evidence needed to obtain a search warrant for Ardolf’s residence. In addition, one of the Minnesota FBI cybercrime unit’s special agents, who participated in the Government’s investigation, provided a separate case study. Attending those case studies and conversing with the presenters has provided additional insight into the case than what has been publicly reported.

The short version of the facts is this: On August 2, 2008, just one day after Kostolnik and his family moved into their Blaine, Minnesota, neighborhood, their then 4–year-old son wandered on or near Ardolf’s property. Ardolf returned the boy, but not before allegedly kissing him on the lips.¹ The father confronted Ardolf about the incident. According to Ardolf:

He was upset and demanded that I never go on his property, never to talk to him, his wife, or any of his children under any circumstances. I felt powerless, humiliated, and victimized. That summer, neighbors who had previously invited me to dinner shunned me.²

The boy’s parents reported the incident to police. According to the police report, the mother's perceptions regarding the manner of Ardolf's contact with her son caused her great distress.

 In response to the Kostolnik’s reporting of the incident to police, Ardolf engaged in conduct that the Government described as “a calculated campaign to terrorize his neighbors, doing whatever he could to destroy the careers and professional reputations of Matt and Bethany Kostolnik, to damage the Kostolniks’ marriage, and to generally wreak havoc on their lives.” ³  Among other things, Ardolf intruded into the Kostolniks’ wireless account; intercepted their mail; sent fraudulent e-mails to Kostolnik’s colleagues; and in one e-mail (in Kostolnik’s name), threatened the Vice President, Governor Pawlenty, and other officials. In addition, Ardolf planted an image of child pornography into an e-mail and a MySpace page — both in Kostolnik’s name.

Eventually, through the efforts of the private investigator (Johnson, retained privately) and the Anoka County Sheriff, Ardolf was identified as the culprit. The subsequent search of his home yielded the Kostolniks' intercepted mail, numerous computer-hacking books, and compact disks containing hacking software. Several computers were seized, which contained voluminous inculpatory evidence, including evidence of the network intrusion, identity theft, and eight child pornography files (all derivatives of the same image), which Ardolf has used in his campaign, and which files formed the basis of those counts against him.⁴

It has been reported that Ardolf has no prior criminal record, although the police report (mentioned above) states Ardolf had, at that time, a “Suspense File for domestic assault.” According to both the indictment and the Government’s Presentencing Memorandum, Ardolf’s actions in this case continued a pattern of previous conduct  involving another victim.⁵  The prior criminal conduct would not have been discovered but for the search warrant executed in this case.⁶

During the trial, Ardolf fired two lawyers in succession, and proceeded pro se. The trial court nevertheless appointed stand-by counsel. Ardolf reportedly withdrew from a plea deal that would have resulted in only two years’ imprisonment, and proceeded to trial. In December 2010 — only three days into the jury trial — Ardolf threw in the towel and inexplicably pleaded guilty to all counts and, as a result, the charges were not put to a jury. Subsequently, he contended in a hand-written memorandum to the judge that his attorney coerced him into doing so.⁷  Finally, Ardolf coached his children to appeal to the judge’s emotions in granting Ardolf leniency and to conform to Ardolf’s version of events regarding the Kostolnik’s 4–year old boy.⁸ 

The result: Ardolf was sentenced to 18 years imprisonment (followed by 20 years’ probation), a $10,600 fine, and forfeiture to the Government under 18 U.S.C. § 2253(a) of the computer equipment and of the Blaine home (which, upon information and belief, has no mortgage and is worth $290,000). The court recommended defendant be excluded from any computer-based activities or technical training during the term of his incarceration.  Further, during the 20 years of supervised release, Ardolf must register as a sex offender, may have no contact with persons under the age of 18 (except in limited circumstances), may not be engaged in any computer-related employment, may not "possess or use a computer or have access to any on-line service without the prior approval ofthe U.S. Probation Office,"  and must obtain gainful employment if possible or, alternatively, work twenty hours of community service.   

The extraordinary facts of this case (including both defendant’s conduct and the case outcome), coupled with incomplete media coverage, warrant further discussion.

Ardolf’s presentencing memorandum discloses that his wife died unexpectedly in 2000, and he has been a widower and single parent to three children for the past 11 years.⁹   As a result of Ardolf's incarceration, the children will be deprived of any meaningful contact with their only surviving parent (as Ardolf himself noted in his Acceptance of Responsibility Statement (“I am leaving my children with no parent”)).¹⁰ 

Moreover, because Minnesota is not a community property state, the decedent-wife’s property (including any contributions toward the paid-for home) may have gone entirely to Ardolf, and all of Ardolf’s assets (which defendant’s memorandum suggest were tied up in the value of the home) now go to the Government.  This may mean that the three children will also be deprived not only of their mother’s estate (which they presumably had been receiving by way of a continuing measure of support from the father, or would eventually receive from their father in the future), but also of their father’s income for food, shelter, school books, clothes, and college tuition.

The Government, however, did propose an alternative to forfeiture of the Blaine home:  Because "the Government's overriding goal is the removal of defendant from the Alamo Circle neighborhood in Blaine, Minnesota, to provide for the safety of the victims . . . the Government had offered to allow defendant to sell the house and to put the money in a trust to benefit his three children."¹¹   The offer was conveyed both to defendant's current counsel, as well as to his previous counsel immediately after entered his guilty plea. Upon information and belief, Ardolf declined the Government's offer both times yet, had he agreed, the Government would not have sought an Order of Forfeiture.

Notwithstanding that defendant inexplicibly rejected the offer, the Government contended that it would not act on the Order of Forfeiture if the defendant, through counsel, arranged to have the proceeds placed in a trust administered by a neutral trustee to provide for the three children.  The trial judge noted, during the six-hour sentencing hearing, that the Government's offer in this regard was unprecedented in his experience.  Upon information and belief, Ardolf might now be taking steps to  accept the Government's offer, although his standyby counsel was unable to corroborate this for lack of authorization to comment on this or other facts of the case.

Additionally, although Ardolf’s presentencing memorandum contains the obligatory apologies to the court and the victims, it also maintains Ardolf’s continuing objection to assertions contained in the Presentence Investigation Report (referenced in Defendant’s Position Paper as to Sentencing Factors)¹² that his contact with the neighbors’ boy was inappropriate, which incident gave rise to the dispute.  Although the police report was closed with the notation that no criminal sexual conduct was found (and Ardolf was therefore not charged in connection with the same), News outlets worldwide¹³ have reproduced a quoted statement contained in the Government’s pre-sentencing memorandum referring to Ardolf as a pedophile.¹⁴

As a result of the widely-published but uncharged conduct, several Web sites and forum posts (e.g., http://www.sodahead.com/united-states/man-gets-18–years-in-prison-for-hacking-neighbors-wifi-fair-or-foul/question-1970305/) now freely characterize Ardolf as a “pedophile,” and “child molester.”  Many anonymous posters have expressed satisfaction about what other prisoners will likely do to Ardolf as a putative pedophile. Id. Indeed, “Such offenders . . . often are placed into protective custody with other prisoners seen to be under a threat. ‘Once their crime has become known, they usually don’t make it’ without protective custody.” ¹⁵

Aside from the collateral consequence, this raises the academic question of whether repeating a statement that is defamatory per se relating to uncharged conduct, which statement and uncharged conduct is memorialized in the Government’s presentence memorandum, may give rise to liability. The Minnesota Court of Appeals has held that, “[I]n almost every circumstance a reasonable listener would believe that calling a person a pedophile imputes serious sexual misconduct or criminal activity to that person. It is, therefore, defamatory per se.” ¹⁶   

To begin this analysis, one must assume that Ardolf's conduct does not fit within the meaning of “pedophile,” since a defense of “truthfulness” is dispositive.  And it is well-settled that one spouse’s statement to the other —even a statement that is defamatory per se— is absolutely privileged.¹⁷   Further, unless it falls within the so-called “sham exception,” such a statement contained in any petitioning (such as statement filed with the police) would be entitled to SLAPP immunity.¹⁸ Likewise, most states recognize an absolute privilege for defamatory communications preliminary to, or in the course of a judicial proceeding if the communication has "some relation" to the proceeding.¹⁹ But a republication of that statement could only qualify for the narrow Fair Report privilege if the republisher relied upon an official public document for the allegedly defamatory information, made clear that the document or statement was the source, and fairly and accurately used the source.

Few (if any) of the news stories, blog posts, or comments have clearly attributed the “pedophile” statement to the Government’s court filing.  Nevertheless, there is still the constitutional limitation for matters of public concern, which requires a libel plaintiff to prove that the publisher or broadcaster either knew that the allegedly-defamatory statement was false, was reckless as to truth, or was negligent as to its falsity.²⁰ 

Significantly, some courts have held that there can be no defamation where plaintiff had no reputation to injure (as may appear to be the case with Ardolf, at the time of this writing).²¹ But even if so, should Ardolf’s reputation be measured at the time the statement was uttered (when his reputation was not yet lowered by his own conduct)? At the time it was published to a third party (presumably, when the victims were interviewed by the Government)?  At the time of the republication?  Or at the time of the libel suit?  If Ardolf’s reputation is properly measured as of today (lowered by reason of his conviction), would Ardolf nevertheless have a viable cause of action because his current reputation is lowered not by reason of charges and/or convictions relating to the alleged inappropriate contact?

If so, would anonymous posters on Sodahead.com and other sites have reason for concern?  In some other countries, the answer seems to be yes: Recently, Google was held by a Brazilian court to have defamed a priest by allowing an anonymous Internet user’s post on Orkut (a Google-owned social networking site), which called the priest a “pedophile.” And a U.S. state court recently ordered the Indianapolis Star to turn over the identities of anonymous posters who made defamatory comments.²²  An amicus brief filed by PublicCitizen.org on appeal contends such an outcome is permissible if five standards are satisfied: (1) Give Notice: Courts require the plaintiff (and sometimes the Internet Service Provider) to provide reasonable notice to the potential defendants and an opportunity for them to defend their anonymity before issuance of any subpoena. (2) Require Specificity: Courts require the plaintiff to allege with specificity the speech or conduct that has allegedly violated its rights. (3) Ensure Facial Validity: Courts review each claim in the complaint to ensure that it states a cause of action upon which relief may be granted based on each statement and against each defendant. (4) Require an Evidentiary Showing: Courts require the plaintiff to produce evidence supporting each element of its claims. (5) Balance the Equities: Weigh the potential harm (if any) to the plaintiff from being unable to proceed against the harm to the defendant from losing the First Amendment right to anonymity.²³ 

The issue, therefore, is whether the legitimate purposes to be served by the Government's inclusion of this scandalous matter outweighed the risk of prejudicial effects or unintended consequences, such as those mentioned above.

Ordinarily, a sentencing judge may conduct a broad inquiry, largely unlimited either as to the kind of information he may consider, or the source from which it may come.²⁴ The commentary in the U.S. Sentencing Guidelines Manual expressly permits “reliable” hearsay evidence at sentencing, and courts have concluded hearsay is admissible in sentencing as long as it bears some indicia of reliability.²⁵  On the other hand, in United States v. Booker, ²⁶ the Supreme Court held that insofar as the federal Sentencing Guidelines required a judge to increase a sentence based on facts found by the judge using a preponderance of the evidence standard, they violated the Sixth Amendment right of a criminal defendant to be tried by a jury and to have every element of an offense proved by the Government beyond a reasonable doubt.²⁷ It is this author's understanding that the trial court made a thorough and contemplative assessment of the sentencing guidelines and the statutory sentencing factors, and explicated its decision therefor in detail, which can be confirmed when the sentencing transcript is made available to the public.

Nevertheless, because the defendant in this case was neither charged with, nor convicted of, any crimes relating to the August 2, 2008 incident, there was little utility in its inclusion in presentencing filings.  In addition to the prejudicial effect on the judicial process,²⁸ the inclusion of these statements has brought the victims further unwanted publicity.  And, although the Government’s presentment is afforded prosecutorial immunity, it has now become the basis for defendant to be (arguably, perhaps) libeled, subjecting the defendant to public scorn and ridicule beyond the moral disapprobation that members of society expect Ardolf's convictions to express.²⁹ Not only may this endanger defendant in the prison population (thereby exacerbating the Government’s obligations and expense in incarcerating defendant for years to come), but it also risks eroding the public’s confidence in the justice system.

______________________________

¹ Government’s pre-sentencing memorandum (Dist. Minn., No. 10–cr-00159, Document 109 at 4 (“With her back to Ardolf, [the mother] heard him plant a wet kiss on [the child]”).

² Defendant’s Position Paper as to Sentencing Factors, (Document 108) at 25-25.

³ Document 109 at 5.

⁴ Defendant’s Position Paper as to Sentencing Factors, Document 108 (“[T]he preliminary pre-sentence report at #25 states: ‘Eight files depicting the complete image or the altered image, which was posted on the Myspace.com page, were found during the search warrant on various computer equipment and hard drives’”).

⁵ Document 109 at 2.

⁶ Id.

⁷ Document 80.

⁸ Document 109 at 25–27.  This author has been informed that, at sentencing, the Court noted that it did not take that event into consideration the Government’s assertions regarding the August 2, 2008 catalyst incident, but the author has not yet been able to confirm this because the sentencing transcript has not yet been released.

⁹ Document 108 at 19.

¹⁰ Id. at 24.

¹¹ Document 110 at 22-23.

¹² Id. at 20

¹³ See, e.g., http://slashdot.org/story/11/07/13/0445224/The-Wi-Fi-Hacking-Neighbor-From-Hell; http://www.twincities.com/north/ci_18458202?nclick_check=1; http://www.wired.com/threatlevel/2011/07/hacking-neighbor-from-hell/; http://www.msnbc.msn.com/id/43744533/ns/technology_and_science-security/t/wi-fi-hacker-sentenced-after-cyberattacks-neighbors/.

¹⁴ Government’s pre-sentencing memorandum (Dist. Minn., No. 10–cr-00159, Document 109 at 4-5

¹⁵ Michael S. James, “Prison is ‘Living Hell’ for Pedophiles, ABC News (Aug. 26, 2003). http://abcnews.go.com/US/story?id=90004 (last visited July 17, 2011).

¹⁶ Longbehn v. Schoenrock, 727 N.W.2d 153, 159 (Minn. Ct. App. 2007).

¹⁷ Restatement of Torts, 2d, § 592 (A husband or a wife is absolutely privileged to publish to the other spouse defamatory matter concerning a third person. The confidential character of the relationship of husband and wife is the basis for the privilege stated in this Section. Communications between spouses are so completely protected that under no circumstances can they be made the basis of an action for defamation. This is true although the matter communicated is known to be false and the purpose of the communication is altogether improper).

¹⁸ See City of Columbia v. Omni Outdoor Adver., Inc., 499 U.S. 365, 380 (1991).

¹⁹ See Restatement (Second) of Torts 587 (1977) (parties); id. 588 (witnesses); id. 589 (attorneys).

²⁰ Gertz v. Robert Welch, Inc., 680 F.2d 527 (7th Cir. 1982), cert. denied, 459 U.S. 1226 (1983).

²¹ See, e.g., Kevorkian v. AMA, 237 Mich. App. 1, 12 (Mich. Ct. App. 1999) (“In those instances where an allegedly libelous statement cannot realistically cause impairment of reputation because the person’s reputation is already so low . . . the claim should be dismissed so that the costs of defending against the claim of libel, which can themselves impair vigorous freedom of expression, will be avoided.”), quoting Brooks v Am. Broad. Co Inc., 932 F.2d 495, 501 (CA 6, 1991).

²² Jeffrey M. Miller v. Junior Achievement of Central Indiana, Inc., (In re Indiana Newspaper, Inc.) No. 49D14–1003–PL-014761.

²³ Dendrite v. Doe,775 A.2d 756, 760-61.

²⁴ United States v. Wallace, 408 F.3d 1046, 1047-48 (8th Cir., May 23, 2005) (quoting Nichols v. United States, 511 U.S. 738, 747, 128 L. Ed. 2d 745, 114 S. Ct. 1921 (1994)).

²⁵ Id.

²⁶ 543 U.S. 220 (2005).

²⁷ Id. at 243-44. 

²⁸ See Note, A Proposal to Ensure Accuracy in Presentence Investigation Reports, 91 Yale L.J. 1225, 1228 (1982) (recommending rule amendments to allow challenges to presentence reports for both sentencing and parole); Timothy Bakken, The Continued Failure of Modern Law to Create Fairness and Efficiency: The Presentence Investigation Report and Its Effect on Justice, 40 N.Y.L. Sch. L. Rev. 363, 366 (1996) (“‘[A]vailable data on the federal probation officer’s workload indicates that little, if any, verification of information is possible.’”); Robert Hanlon, Hard Time Lightly Given: The Standard of Persuasion at Sentencing, 54 Brooklyn L. Rev. 465, 493–494 (1988) (“the scope of the information allowed — hearsay testimony, uncorroborated evidence, including that from accomplices, allegations of unproven or even uncharged crimes — is so broad as to create the substantial possibility of inaccurate information being considered. The possibility of prejudicial error is exacerbated when much of the information is derived from sources likely to view the defendant in the most negative light — law enforcement officials and criminal prosecutors. In addition, information obtained from codefendants is more likely to be affected by self-serving interests, such as an attempt to transfer blame or placate prosecutors to obtain favored treatment”).

²⁸ Dan M. Kahan, What’s Really Wrong with Shaming Sanctions, 84 TEX. L. REV. 2075, 2077 (2006).

The Beginning of the End for Current Practice in Digital Forensic Recovery?

That's the title --without the question mark-- of a report appearing in the Journal of Digital Forensics, Security, and Law (JDFSL).  If there was a question, I think the answer is an emphatic Yes, and it affects both technologists and attorneys alike.

SSDs changing the technical and legal landscape

The report posits --and I agree-- that the fact we computer forensics analysts have had access to a treasure trove of evidence found as deleted files and slack file space was just good fortune taken for granted, because the natural state of modern digital storage is not to ‘preserve deleted data’ as magnetic drives have done for the past few decades, but rather to purge deleted files to improve read and write speeds.

According to the article, we should be aware that a "paradigm shift" is taking place in technology storage from magnetic hard drives to solid-state drives (SSDs); that solid-state drives have the "capacity to destroy evidence catastrophically under their own volition;" that it is "imprudent and potentially reckless to rely on existing evidence collection processes and procedures;" and that conventional assumptions about the behaviour of storage media are no longer valid. Id.

Why computer forenscis analysts should care about SSDs:

In summation, report authors Bell & Boddington note that the latest generation of SSDs on the market (of which I own three) use firmware controllers to equally distribute data across the drive's blocks, so that they're being accessed and used with equally over time; and they use a "garbage collection" process to identify deleted or slack file data so as to make these blocks available for reuse subject to the aforesaid equal allocation. The authors further posit that, because the garbage collection runs within the SSD (just by turning it on), using a write-blocker on the SSD during an investigation will have no effect  -- i.e., evidence spoliation will resume as soon as the SSD is energized (which it must be to retrieve data from). The end-result is that deleted data and slack-file evidence, which historically has yielded an abundance for fruit in digital forensics investigations, is no longer persistent.

 

Why litigators should care about SSDs:

The following may be welcome news to defense attorneys, as authors Bell & Boddington warn:

• that data stored on all types of solid-state drives "should be immediately and henceforth considered to be a 'grey area' as far as forensic recovery and legal validation are concerned until extensive studies have been made of drive and data behavior;"
• that evidence spoliation may take place extremely suddenly, extremely quickly and automatically without human awareness or control;
• that present-day evidence indicating 'no data' does not authoritatively prove that data did not exist at the time of capture;
• that evidence of deleted data being permanently erased or partially corrupted is not evidence of intentional permanent erasure or corruption;
• that hashes not matching at the end of a forensic analysis should be evaluated to establish if the original or subsequent images could have been taken during or after a garbage collection;
• that past metadata and data blocks may be deleted without warning and without the opportunity to realise that they had existed at time of capture;
• that quick-formatting of disks is a reasonable activity that an innocent person might choose to do to improve performance, tidy up a disk, etc., yet may completely eradicate evidence from a disk within minutes;
• that there are no longer any guarantees for previously deleted file data to be preserved on an SSD, regardless of whether the drive image was taken during a 'live' capture of evidence or following a 'dead' capture of evidence;
• that drives can clearly self-modify their data after physical evidence has been gathered, despite best practice efforts by forensic analysts to prevent such behavior using traditionally effective write-blockers;
• that it would be an unwise investment of time for analysts to try to develop workaround procedures that operate against the drive controller behavior specifically identified, because new firmware & models are regularly released;
• that it would be imprudent to develop procedures for physical asset capture whereby operators attempt to distinguish SSDs from HDDs, because of the similar physical appearance of the drives and the need to gain access to the computer's internals, and because hybrid disks incorporate both HDD and SSD technologies;
• that it is unwise to assume that irreversible file erasure suggests intent to destroy evidence in cases where a defendant has quick-formatted a SSD drive prior to police seizure; and
• that the issues identified in the Bell & Boddington report will later come to affect large USB flash drives as well.

Mobile Devices Changing the technical and legal Landscape

Perhaps needless to say, mobile devices are pervasive and, to a growing extent, replacing traditional PCs in the home. Some PC users, who have been besieged with and befuddled by malware, spyware, computer viruses, and maintaining a complex operation system (viz. Microsoft Windows), have replaced their computers with tablets and other devices, including Apple's iPad, Sony WebTV, Samsung Galaxy, inter alia. Some people I know have even substituted their trouble-prone PCs with ordinary smart-phones (iPhone, Android, inter alia).

Because mobile devices use a variety of operating systems, file systems, and data storage models; and because some are proprietary and, perhaps, not subject to standards (or, at best, subject to rapidly evolving standards); and because some use proprietary hardware connections and protocols, an ordinary computer forensics analyst with expertise in Windows, Macintosh, or Linux has not the skills, software, or hardware to conduct a competent analysis.  Further, the technology is evolving and being released with blinding speed.

Cloud Computing Changing the technical and legal Landscape

Cloud computing is defined by the National Institute of Standards and Technology (NIST) as “a model for enabling convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction.”

For companies, this may mean entrusting either data or computing resources or both to other companies' data centers, like Microsoft (NASDAQ:MSFT), Salesforce (NYSE:CRM), or EMC (NYSE:EMC).   For private individuals, it may mean entrusting personal data from their computer or mobile devices to, for example, Apple's MobileMe, or Motorolla's Motoblur.

Cloud computing raises digital evidence challenges regarding the location of potential responsive data, preservation, and analysis. Because data can be stored anywhere in the world, it may reside in a jurisdiction where subpoena power or privacy laws are non-existent or not enforced, and establishing a chain of custody might prove difficult or impossible, where data integrity and authenticity (where was it stored, who had access to it, was data leaked, was the data commingled, etc.) cannot be fully ascertained.  Moreover, data entrusted to the cloud may be logically  (and certainly physically) disassociated from the local metadata usually accompanying it (e.g., registry entries, temp files, etc.) and which may not exist in the virtual/cloud environment.  For example, modifying data in a cloud environment, rather than locally, might be less likely to result in metadata written to a client device's hard-drive (if it has one), and more likely to reside in the packets and client or host server logs, if applicable.

Conclusion

The foregoing is a summary, not an exhaustive discussion, of three challenges facing the discipline and profession of digital forensics examinations and electronic discovery.  Computer forensics examiners will be hard-pressed to stay current, to diversify, and to rely on a network referral partners in order to understand and meet their clients' needs.  Lawyers will need to understand how these developments may hurt or help their clients' causes, and to become even more vigilant in selecting a digital forensics consultant to identify what expertise is needed in a particular case.  finally, it will be the lawyers' responsibility, and not the experts or the courts, to understand these developments and the judiciary on its import, lest the outcome of justice be the result of ignorance.

Why Divorce Lawyers Should Get Up to Speed on CyberCrime Law

One of my clients, a Texas divorce law firm, recently presented the following fact situation to me, which prompted me to write this article:

Lawyer accepted a case where client (hereinafter “wife”) surreptitiously took husband’s laptop three or four months ago while the parties were still residing together, and had it forensically imaged by a private investigator.¹ Wife intends to present evidence obtained from the laptop in support of her petition for marital dissolution.²

Issue: Is the lawyer precluded from introducing evidence and does the lawyer incur any malpractice, tort, or attorney disciplinary liability in possessing, viewing, or proffering evidence obtained from the laptop?

My conclusions —based on somewhat cursory research— appear immediately below. I’ve provided some annotations as footnotes for application in Minnesota (for academic discussion purposes only, not as legal advice). I found very little in the way of Minnesota published cases regarding unauthorized computer access. See, e.g., In re Trudeau, 705 N.W.2d 409 (Minn. 2005) (attorney discipline conditional admission based, in part, on respondent's unauthorized computer access by installing and using an email spyware program).

(1) If husband's laptop was not an employer's computer, and if husband's laptop was not password protected by him (requiring wife or wife's private investigator to circumvent any security measure that would create a reasonable expectation of privacy), then wife probably had equal dominion over laptop, as a matter of law (see Texas statute re: "effective consent," infra). However, to whatever extent the court's evidentiary ruling is discretionary, the court might well frown on procurement of evidence through such means, and husband might attempt to invoke the Unclean Hands doctrine. This is even more likely so if that area of the hard-drive was password-protected (from wife), or if the laptop belonged to an employer.

(2) Unless some Texas Rule of Evidence and/or rule of Civil Procure (unknown to me) bars admissibility of evidence based upon "unlawful interception of communications," in a civil case (compare Tex. Code Crim. Proc. Ann. art. 38.23(a)) or based upon any violation of criminal or administrative law, and if wife's conduct in surreptitiously taking laptop for forensic imaging would not constitute an act of "interception" in violation of Tex. Penal Code Ann. § 16.02(b)(1) or unauthorized access under § 33.02, the evidence recovered from the hard-drive probably is admissible, subject to the court's broad discretion.

My conclusions are based on cases from around the country. Although, this fact situation does not appear to have been yet addressed Texas’ appellate courts, I did find the following authorities and analysis helpful:

• Tex.Penal Code Ann. § 33.02 (“A person commits an offense if the person knowingly accesses a computer, computer network, or computer system without the effective consent of the owner”).³

• Tex.Penal Code Ann. § 33.01(12) ("'Effective consent' includes consent by a person legally authorized to act for the owner. Consent is not effective if: (A) induced by deception, as defined by Section 31.01, or induced by coercion . . . (E) used for a purpose other than that for which the consent was given").⁴

• Tex.Penal Code Ann. § 16.02(c)(4)(B). (It is an affirmative defense to prosecution a person not acting under color of law intercepts a wire, oral, or electronic communication and is one of the parties to the communication has given prior consent to the interception, unless the communication is intercepted for the purpose of committing an unlawful act).

• Vaughn v. Drennon, 202 S.W.3d 308, 320 ( Tex.App., 2006) (tort case, noting that the intrusion-upon-seclusion type of invasion of privacy is "generally associated with either a physical invasion of a person's property or eavesdropping on another's conversation with the aid of wiretaps, microphones, or spying")

• Signorelli v. State, 2008-TX-V0117.004 (In a criminal context, "Generally, when a third party has equal control over the thing to be searched, the third party may properly consent to the search.")

• Lasater v. State, 2007-TX-V0829.002 (discussing reasonable expectation of privacy and scope of consent, where defendant granted victim limited consent to enter his home, and victim searched for and found evidence she provided to law enforcement)

• But see Tave v. Alanis, 109 S.W.3d 890 (Tex.App., Dallas, 2003) (School district employee's termination affirmed, where employee accessed and subsequently disseminated confidential information (inadvertently left on a computer assigned to him for classroom use) violated the District's policy and constituted conduct could cause the public, students, or employees to lose confidence in the administration and integrity of the District).

So, whereas I found no Texas appellate cases that directly address the fact situation, the cases below from around the country do. In reading through these cases, the advocate should pay particular attention to “effective consent,” (in Minnesota "without authorization," which phrase is defined under Minn. Stat. § 609.87(b)) and the meaning of the phrase “interception of electronic communications.” Although some courts, have held that recorded screen-shots constitute “interception of electronic communications,” (e.g., O'Brien v. O'brien, infra), under the narrow reading of the Wiretap Act adopted by the Fifth, Ninth and Eleventh Circuits, very few seizures of electronic communications from computers will constitute “interceptions.” Larue, Wiechman, Terry, & Turner, Trails from the Aether: Cyber-Evidence, (State Bar of Texas CLE, 2007). The advocate should also consider whether a violation of criminal law by wife (or wife's PI) could translate to liability to the firm as an “accessory after the fact,” and that some judges in similar cases from other states based their discretionary decisions on whether the conduct in obtaining the hard-drive was an unlawful act.

(1) Bailey v. Bailey, 2008 WL 324156 (E.D. Mich)). In this recent case from the US District Court for the Eastern District of Michigan, the parties were married for nearly 30 years and had three children. Husband became suspicious of his wife’s activities and installed keystroke logging software on both home computers, with which he was obtained wife’s e-mail and instant-messaging passwords. Husband used these passwords to access her e-mail and messages and learned of her extra-marital activities. Husband fled the marital home with the parties’ three children. He provided the e-mails and messages to his divorce attorney and petitioned for divorce. A custody dispute ensued and husband’s attorney used the wife’s e-mails to impeach her. Wife lost custody and was granted only supervised visitation. After the divorce action concluded, wife sued ex-husband, his attorney and her attorney. Husband and his attorney were sued for violation of (1) 18 U.S.C. §2511 (the Wiretap Act); (2) 18 U.S.C. §2701 (the Stored Communications Act) against husband; (3) 18 U.S.C. §2512 (Wiretap Act) against the husband, his attorney and a John Doe who supplied the keystroke logging software; (4) MCL § 750.539a et seq. and MCL §750.540 (Michigan’s Eavesdropping statutes) against the husband, his attorney and John Doe; (5) invasion of privacy against the husband and his attorney; (6) intentional infliction of emotional distress against all defendants; and (7) malpractice against the wife’s own attorney.

The Wiretap Act. Wife claim against husband and his attorney was based on their obtaining her e-mails and messages using the password retrieved from the key logger software. Under § 2511 (1)(a), a person violates this Act if he or she “intentionally intercepts…any…electronic communication” (c) “intentionally discloses…any…electronic communication…knowing…the information was obtained through the interception of a …electronic communication in violation of [the Act]” and (d) intentionally uses…any…electronic communication” (c) “intentionally discloses…any…electronic communication…knowing…the information was obtained through the interception of a …electronic communication in violation of [the Act]” Defendants successfully argued that there was no “interception” as defined in the Wiretap Act. The court agreed and reasoned that the key logging software only allowed the husband to learn his wife’s passwords, which he then used to access her e-mail. Since the husband did not obtain the e-mails and messages contemporaneously with the transmission, the court ruled the Wiretap Act was inapplicable. The court also ruled that that § 2512 of the Act does not provide for a private right of action and the court dismissed wife’s claim based regarding husband, his attorney and a John Doe who supplied the key logger software.

Stored Communications Act. Wife contended her husband violated the Stored Communications Act by accessing her e-mails. The Act provided that a person was in violation if that person (a)(1) “intentionally accesses without authorization a facility through which an electronic communication service is provided…and thereby obtains…a…electronic communications while it is in electronic storage in such system…” Although husband accessed the wife’s e-mail on her Internet service provider’s (ISP) server and not from the messages stored on her home computer, he argued, because wife had already accessed her e-mails, the Act was inapplicable. But, the court found that the messages on the ISP’s server were stored for purposes of backup protection (since the wife had already accessed those messages) but that does not take it out of the provisions of the Stored Communications Act and therefore the husband’s motion for summary judgment on this count was denied.

Invasion of Privacy tort claim: The court granted husband’s attorney’s motion for summary judgment because there was no evidence the attorney participated in the “intrusion of another’s seclusion,” as alleged by wife. But, the court stated that the wife had a right to privacy in her private e-mail account. Husband’s defense was that wife could not establish her claim because his actions were not objectionable to a reasonable man, because they were subsequent and based upon his inadvertently discovery of wife’s extra-marital activities, and because they were necessary and prudent to protect his family and children. The court found that an issue of fact existed as to whether or not use of keystroke logging to gain access to the wife’s e-mail was objectionable to a reasonable man. Intentional Infliction of Emotional Distress tort claim: The court dismissed wife’s IIED cause-of-action because the use of the key logger did not constitute “extreme and outrageous conduct.”

(2) In Moore v. Moore, (NYLJ, August 14, 2008, at 26, col 1 [Sup Ct, New York County]), a New York County trial court recently ruled that a wife seeking a divorce can use evidence of her husband’s internet activities with another woman which she found on a computer she took from her husband’s car.

The Moore’s were married in 1963. Wife took a laptop computer from husband’s car just before she petitioned for marital dissolution. According to wife’s attorney, she was searching the computer for financial information when she came upon a large number of salacious instant messages which the husband exchanged with a woman in Texas.

Wife’s counsel informed husband’s counsel she had the computer, and the parties agreed to make forensic images from of the computer’s hard drive. The materials found on the hard drive were repeatedly referred to by the wife in affidavits submitted to the Court without objection by husband.

Subsequently, husband moved to suppress the contents of the hard drive. The Court denied the motion, finding that the wife did not commit a crime or otherwise violate the husband’s rights in taking the computer and copying its contents.

The Court noted that the attorneys for the parties specifically agreed to image the hard drive, and husband waived his objection by not timely moving to suppress the evidence. The Court determined that the computer was a family computer and not a work computer as alleged by the husband. The Court also found that the taking of the computer was appropriate since it was done before the commencement of the dissolution case and was taken from the family car.

(3) In O'Brien v. O'Brien, 899 So.2d 1133 (Fla.App. 5 Dist. 2005), a Florida appeals court ruled that wife “illegally obtained” records of husband’s Internet conversations with another woman as the two played Yahoo Dominoes online. “It is illegal and punishable as a crime under (state law) to intercept electronic communications,” wrote the panel.

The court barred wife from revealing the contents of the intercepted conversations, and said the chat records could not be introduced as evidence in the divorce proceedings. At issue in a civil case arising out of the divorce proceedings was whether the use of the spyware, called Spector, violated Florida's wiretapping law, which provides that a person who “intentionally intercepts” any “electronic communication” commits a criminal act.

Wife's lawyers argued that the monitoring didn't fall under the law's prohibitions and was kin to reading a stored file on her husband's computer--which would not be treated as wiretapping. But the court concluded, “because the spyware installed by the wife intercepted the electronic communication contemporaneously with transmission, copied it and routed the copy to a file in the computer's hard drive, the electronic communications were intercepted in violation of the Florida Act.”

(4) In Gurevich v Gurevich (2009 NY Slip Op 29191) the Supreme Court considered CPLR 4506 ⁵ in the context of matrimonial proceedings in which the wife sought to lead email communications obtained from her husband's email account after the service of the divorce action.

The parties had been married for 16 years prior to separation, during which husband had provided wife with the password to his email account, and during which both parties had access to each others email accounts. After separation, wife changed her email password, but the husband neither changed his, nor told or gave notice to the wife that she was not permitted to access his account.

Husband argued that wife was aware he used one password for all his computer accounts, and that she was unreasonable in her belief that, despite his not changing his password until some two years after separation, she was allowed to access his accounts. Husband argued that the content of his emails were inadmissible under CPLR 4506 by reason that the wife had acted unlawfully under Penal Law 250.05 (hereinafter “eavesdropping statute”). Further, husband argued that the initiation of the divorce proceedings was an implied revocation of any authority previously given to her to access his account. The Supreme Court rejected husband’s contention, holding “there is no statute that would recognize an ‘implied revocation upon service of a divorce action’ and bar the use of the email ‘stored.’”

The court examined the eavesdropping statute and CPLR 4506, and rejected wife's contention that CPLR 4506 did not apply to electronic communications:

She relies on dicta in the case of Pure Power Boot Camp v. Warrior Fitness Boot Camp (587 F.Supp.2d 548 [SD NY 2008]) for the proposition that "[t]he plain language of the statute [CPLR 4506] seems to limit its application to the contents of the overheard or recorded communication[s]'" not electronic communication. However, the U.S. District Court further stated that "[u]ltimately, a determination of the meaning of CPLR § 4506 is unnecessary, and better left to the New York state courts." Furthermore, the court in Power Boot Camp v. Warrior Fitness Boot Camp in a footnote stated “Penal Law section 250.05 explicitly includes "electronic communication . . . .”

Husband argued that CPLR 4506 and the eavesdropping statute were not limited to communication or transmission, but also applied to “the intentional acquiring, receiving, collecting, . . . of an electronic communication, without the consent of the sender or intended receiver thereof . . .”

The Supreme Court considered cases cited by wife and the legislative intent behind the eavesdropping statute (to prohibit the interception of communications, not the access of stored communications) and found that she was entitled to rely on the content of the email transmission:

It is this court's understanding from the reading of the statute, legislative history and case law that the purpose of Penal Law section 250.00 is to prohibit individuals from intercepting communication going from one person to another, and in this case an email from one person to another. In the case at bar the email was not “in transit,” but stored in the email account. Even assuming the husband's facts, as stated, to be true, the wife may have unlawfully retrieved information from a computer; in violation of Penal Law 153.10 but there was no interception and accordingly fails to fall within scope of CPLR 4506 as presently written.

(5) ⁶ In White v. White, 781 A.2d at 87-88, the family computer and entertainment center were located in the sun room, where the husband slept; the wife and the parties’ children often used the sun room to utilize the computer, watch television, and adjust the stereo volume. It was in the sun room that the wife discovered, fatefully, a letter from the husband to his girlfriend.

Shortly after the wife discovered the letter, she hired a private investigative firm, and unbeknownst to the husband–and without using the husband’s password–the PI firm copied the husband’s files from the computer’s hard drive. Such files contained e-mail sent between the husband and his girlfriend, as well as images [uh-oh] that he viewed on [and apparently downloaded from] Netscape. It was only while being deposed during the divorce proceedings that the husband learned that the wife had accessed his e-mail; he had thought–incorrectly as it turned out–that his e-mail and attachments could not be read without his AOL password. Understandably concerned about his e-mails, the husband sought to suppress the electronic evidence, based on violations of the New Jersey Wiretap Act. The New Jersey court opined that, in order to understand the error of the husband’s thinking, it was necessary to understand the technical workings of America Online Service [“AOL”], the husband’s Internet Service Provider [“ISP], explaining as follows:

[i]ncoming e-mails are received on the AOL e-mail server and are accessible to an AOL user only after dialing in and authenticating with the user’s screen name and password. Also, a user cannot send an e-mail via the AOL server until he has similarly dialed in....AOL’s server receives and maintains the e-mail until the recipient dials into AOL and accesses (seeks to read) his mail. In addition, an AOL user can save his e-mails and attachments on his computer’s hard drive. AOL offers the Personal Filing Cabinet [“PFC”] feature, which is created automatically on the hard drive during the installation of AOL on the user’s computer. The PFC is named for user’s screen name...[A]n AOL user must voluntarily choose to save the e-mail, attachment or address to his PFC or address book. The AOL user can save e-mail, attachments, or addresses either by using the automatic AOL feature or manually. To save automatically to the PFC on the hard drive, the user must select that option in “Mail Preferences.”

Specifically, in the main tool bar, the user chooses “Mail Center,” “Preferences” and then checks “Retain All Mail I Send in My Personal Filing Cabinet” and/or “Retain All Mail I Read in My Personal  Filing Cabinet”....Additionally, in the “Notes” section of [the Help screens], AOL informs the user that he can read mail stored in the PFC when he is not signed onto AOL, i.e. the PFC is on the hard drive. Similarly... AOL informs the user that e-mail saved in the PFC will remain on the hard drive until the user deletes it.

Id. at 87-88.

Thus, the only way for the husband to be sure that his e-mail would be saved permanently was to use the PFC file on the his hard drive, because his e-mail could not be saved permanently on AOL’s server. Id. at 88. Not knowing his e-mails were being saved, he took no steps to delete them, nor any steps to protect them with a password, which meant that any computer user could view his PFC and e-mails by simply opening the AOL software on the hard drive, and that was exactly what happened: the wife’ s expert simply opened the AOL software and viewed and copied the husband’s emails.

Turning to the legal issues in the case, the New Jersey court first held that the doctrine of interspousal immunity was inapplicable, and that the New Jersey Wiretap Act applied to unauthorized access of electronic communications of one’s spouse. Id. at 88.

Next, the court noted that the New Jersey act [identical to the federal act] prohibited “access” to electronic information in “temporary, immediate storage,” in backup protection, or in transmission. Id. at 89. The court observed that the e-mail in the hard-drive of the computer was in “post-transmission storage.” Id. Pursuant to the statutory language, the court held that the New Jersey act was not meant to extend to e-mail retrieved by the recipient and then stored, but rather protected only those electronic communications which were in the course of transmission, or were backup to that course of transmission. Id. at 90.

The Court then rejected the husband’s argument that the wife accessed his e-mail “without authorization.” Id. Since other courts had held that “without authorization” meant using a computer from which one has been prohibited, or using another’s password or code use the family computer, the court stated that nonetheless she had the authority to do so. Id. (citations omitted). Additionally, according to the court, the wife did not use the husband’s password or code without authorization, but instead accessed the information in question by roaming in and out of different directories on the hard drive. Id.

 Finally, the New Jersey court held that the wife did not “intercept” the husband’s e-mails, since the concept of “interception” did not apply to “electronic storage.” Id. at 91. The husband’s electronic communications had already ceased being in “electronic storage,” i.e., they were in post-transmission storage, and therefore the court held that the wife did not “intercept” them. Id.

Endnotes

____________________
¹ Under Texas law, a person performing computer forensics analysis must be licensed as a private investigator in that state.
² Texas is not a no-fault divorce state, and divorces may be tried to a jury.
³ See Minn. Stat. §§ 609.89 (Computer theft) & 609.891 (Unauthorized Computer Access, amended 2006).
⁴ Minn. Stat. § 609.891 uses the phrase, “without authorization”
⁵ Under CPLR 4506, (Eavesdropping evidence; admissibility; motion to suppress in certain cases), “The contents of any overheard or recorded communication, conversation or discussion, or evidence derived therefrom, which has been obtained by conduct constituting the crime of eavesdropping, as defined by section 250.05 of the penal law, may not be received in evidence any trial, hearing or proceeding before any court or grand jury, or before any legislative committee, department, officer, agency, regulatory body, or other authority of the state, or a political subdivision thereof; provided, however, that such communication, conversation, discussion or evidence, shall be admissible in any civil or criminal trial, hearing or proceeding against a person who has, or is alleged to have, committed such crime of eavesdropping.”
⁶ The White v. White case digest is excerpted in its entirety from Larue, Wiechman, Terry, & Turner, Trails from the Aether: Cyber-Evidence, (State Bar of Texas CLE, 2007).

eDiscovery lamented as cost prohibitive, unwieldy

Patrick Oot, a lawyer for Verizon interviewed by The Economist, claims almost every case involves e-discovery and spits out “terabytes” of information—the equivalent of millions of pages.  Almost every case? That may be his experience, but as an industry professional, it's not mine and I'm still amazed:  many lawyers --especially in family law-- haven't yet had a case where they've been asked to or found it necessary to image a single hard-drive.  Some tell me they're holding out for as long as possible.

Recently, a few reports have been published, highlighting a phenomenon that I and, I suspect, many of us anticipated:  that the cost and burdens of e-discovery would become eventually become unwieldy  and unmanageable, even for the firms with an infrastructure and regular need to deal with it.  But, not everyone paints the picture as bleakly  --certainly not the EDD firms that benefit.

A telephone research survey sponsored by EDD firm Fios, Inc. concluded: technologists and lawyers are working more closely than previously thought; the most significant investments are being made in legal hold and archiving tools; and the 2007 amendments to the federal Rules didn't have the impact feared.

However, a joint survey, released in September, by the American College of Trial Lawyers and the Institute for the Advancement of the American Legal System reports that a majority of those surveyed found that the discovery system in particular is broken and "has become an end in itself," and that "Electronic discovery clearly needs a serious overhaul."  Nearly a quarter of those surveyed characterized the civil justice system is "broken." The report claims that 83 percent of nearly 1,500 lawyers responding found costs  --not the merits-- of a case to be the deciding factor in settling.  A significant 68 percent of the college fellows disclosed that civil cases do not get filed because of the prohibitive litigation costs.   

Frankly, I'm not so sure that surveying "college fellows" on the practicality of electronic discovery are the right people to ask these questions of.  So, I decided to ask a colleague, Sharon Nelson, for her perspective.  Nelson and her husband, John Simek, operate a computer forensics firm in Virginia.  She is an attorney, frequent lecturer and co-author of the Electronic Evidence and Discovery Handbook.

Nelson concludes --as I have, also-- that, "The truth is often somewhere in the middle." She recalls, "Discovery was a nightmare even in paper - because there was often so much. The problem has grown exponentially with ESI, because there is so much more data. However, a portion of the blame belongs to all of us. We don't 'take out the trash' so our garbage heap of data expands constantly. It is just too cheap and easy to move it all to ever larger hard drives."

As a result, e-discovery has led to a new boom industry of specialized service providers which  charge $125-600 an hour. George Socha (based here in Minnesota and who adminsters an annual survey regarded as the industry benchmark) estimates that their annual revenues have grown from $40m in 1999 to about $2 billion in 2006 and may hit $4 billion next year.

"Additionally, there are now at least two tiers of EDD companies - the whales, who are interested only in the mega-firms and their cases, and the smaller fish, who handle the small to mid-range cases of small to mid-range firms," Nelson noted. She also observed that, "There is little interaction between those two worlds - and huge price point differences," and believes that, "A continuing shake-out among vendors is probably likely, especially given the state of the economy."

Further reading:

• Pamela A. MacLean, Cost of Discovery a Driving Force in Settling Cases (The National Law Journal, Sept. 10, 2008)
• The Economist, "The big data dump" (Aug. 28, 2008)
• Survey Shows eDiscovery Best Practices (Law.com, July 21, 2008)
• The Sedona Conference

Internet posting of not-yet-tried defendants may create defamation cause-of-action

11/24/2008 Update: dead link (below) replaced with different link.  Also, plaintiff's concerns about the damage to her reputation seem legitimate, as I recently discovered (hat tip to Sharon Nelson): On September 10^th, CareerBuilder.com published the results of a survey that found one in five employers screen their job candidates online, double the amount of employers using social networking sites in 2006. Of the employers that used the sites, 34% dismissed the candidate after what they saw. The main concerns of the employer were candidates posting information about drinking or drugs, posting provocative information or photos, poor communication skills, and lying about qualifications. Conversely, 24% found that the social networking site solidified their desire to hire a person. Factors that made an employer hire a potential candidate were a background supporting the candidate’s qualifications, proof that they had good communication skills, and evidence that the candidate was a good fit for the office culture.

---

A DWI defendant in Nassau County. NY has sued, demanding that her name and photograph posted to the County's Web page --dubbed "Wall of Shame"-- be removed. Read story.  Defendant's claim is based primarily on the prospective harm caused when potential employers and others find her name and photo on the Web.  Her attorney argues that publication to the "Wall of Shame" of persons who have not yet been found guilty of a crime is a form of punishment, noting "I don't think you need a law degree to understand that this fundamentally goes against a system of justice in which punishment occurs after you've been found guilty."

Last month, another woman sued the county over publication.  She had lapsed into a hypoglycemic shock¹ and was subsequently arrested for DWI.

______________________
¹  As I have witnessed first-hand, a person experiencing hypoglycemia, when his or her blood sugar is too low, can appear to be drunk. They may sweat, talk confused, become disoriented, stumble, lose their bearings, become aggressive, even "ornery," belligerent or pass out.

Ninth Circuit Judge Accused of Tampering with U.S. Courts' Web Filtering Software

9^th Circuit Chief Judge Alex Kozinski faces a misconduct complaint that accuses him of illegally disabling Web site filtering software in 2001.

As Pamela MacLean (Law.com) reports:

A potentially more serious problem for Kozinski is [the] resurrection of the 2001 internal bureaucratic fight over court monitoring of use of government computers to download movies and music.

[The] complaint includes among the 80 pages of documents, a scathing October 2007 letter from retired court administrator L. Ralph Mecham, who wrote to the head of the Judicial Conduct Committee for the Judicial Conference of the U.S., which sets policies for the federal judiciary.

Mecham, who managed the federal courts for 21 years, recounted the 2001 episode of Kozinski and former Circuit Executive Greg Walters disabling the monitoring software used for three circuits. His 16-page letter to committee chairman, Judge Ralph K. Winter, says Kozinski's action was considered by government lawyers "not only 'illegal' but constituted at least one felony" citing 18 U.S.C. 1361, destruction of government property.

Mecham wrote that although the 9th Circuit's then-Chief Judge Mary Schroeder knew of the issue, as did the circuit judicial council, no misconduct complaint was brought against Kozinski at the time.

"It is my strongly held view that this total absence of action is the worst example of failure by those responssible for disciplining judges that I have witnessed during my 21 years as AO director," Mecham's letter states.

Read MacLean's article, which contains numerous URL-links for further reading.

Bush signs Pro-IP Act into law

The PRO-IP Act of 2007, "To enhance remedies for violations of intellectual property laws, and for other purposes" was signed into law on Monday.

The law, backed by the Recording Industry Association of America and Motion Picture Association of America and the U.S. Chamber of Commerce, enhances and expands existing piracy and counterfeiting laws and also creates an intellectual property czar, reporting directly to the president.

• Wikipedia entry
• Electronic Frontier Foundation coverage
• Reuters news release

In related (but somewhat dated) news, the copyright wars have gone criminal. A blogger was arrested in late August for posting songs of a widely known rock group, which songs had not yet been released. LA Times article. 

An enhanced spin on this story was put out by the legal blog, May it Please the Court, which explained:

The penalties for criminal infringement are determined by its extent: if the infringer has made in any 180-day period ten or more copies of one or more copyrighted works with a total retail value of $2,500, the crime is a felony entailing up to five years imprisonment and/or a fine of up to $250,000 for individuals and $500,000 for organizations. 18 U.S.C. §§ 2319(a), 3571(b).  Jail time can be increased to ten years for repeat offenders.  Infringement is a crime where it is done "willfully and for purposes of commercial advantage or private financial gain." 17 U.S.C. § 506(a).   Recent fines levied in criminal copyright infringement cases have been as much as $250,000.

Courts and "The New Media"

[O]verall . . . judges seem[] to embrace — like it or not — the notion that engaging and informing the public are now part of their job description. In the digital information age, the public expects all institutions to be transparent in multiple media, immediately and at all times, and courts are no exception. Some federal and state courts are already putting a lot out there — all court documents, streamed audio of hearings, everything except what the judge ate for lunch — and that trend is spreading. J. Rich Leonard, bankruptcy judge in the U.S. District Court for the Eastern District of North Carolina, described a remarkable and popular pilot project in his court that makes digital audio of bankruptcy hearings available online for a nominal fee.

So writes Tony Mauro in Courts and the New Media (The Legal Times, Sept. 10, 2008)

- continued -