MSBA Computer and Technology Law Section

Ohio Supreme Court: Cell phones protected under Fourth Amendment.

In a recent ruling, the Ohio Supreme Court has held that police need a warrant before searching data stored on a cell phone. The court held that, lacking exigent circumstances or a safety concern to officers, such an action violates the Fourth Amendment's prohibition against unreasonable search and seizure. The court's press release is here.

In a similar case, the U.S. Supreme Court recently granted cert in a case involving a police SWAT team member's work pager. The Ninth Circuit held that the SWAT member had a reasonable expectation of privacy over text-message data held in the device, despite the police department's official "no privacy" policy covering such devices.

Plaintiffs must prove actual damages for statutory damages award under Stored Communications Act

According to a March 18^th ruling by the Fourth Circuit, plaintiffs must prove actual damages in order to be eligible for an award of statutory damages under the federal Stored Communications Act, but that a showing of actual damages is not required for awards of punitive damages or attorney fees. Plaintiff had sued under the Stored Communications Act, 18 U.S.C.A. § 2707(a), alleging that her former employer and its president illegally accessed her personal email account for over a year. Van Alstyne v. Electronic Scriptorium Ltd., No. 07-1892.

Further reading: Marcia Coyle, E-Mail Theft Case Sparks First-of-a-Kind Ruling, Law.com, March 27, 2009.

A dose of reality

Tomorrow afternoon, I am taking the CHFI exam.  While studying through the official 2,721 page exam courseware, I encountered a "case study" that was laughable.  Let me share it with you

TargetMac and OneMac are two magazines that cater to the growing Ipod users. The CEO of TargetMac is Bryan Smith and the CEO of OneMac is John Beetlesman.  Bryan  calls John one day and convinces him to purchase TargetMac.  The lawyers of both companies were called in to finalize the deal.  The lawyers draft the sale contract, which restricts removal of sensitive and confidential information and non solicitation of TargetMac customers and working staff. A non compete clause was also added in the agreement.

It has been two years and John Beetlesman is suspicious about Bryan's activities.  John suspects Bryan has breached the contract.  John knows that you are a CHFI professional and provide computer forensics services to his clients.  John's company lawyer, Smith Franklyn, contacts you to investigate and provide evidence to support the breach of contract so that John can file a lawsuit against Bryan at local civil court in San Francisco, California.

How do you investigate this incident?

Answer:

1. You want to examine hard disk and laptop computers of Bryan's home and office for evidence.
2. You ask the lawyer Smith Franklyn to obtain a search and seizure warrant at Bryan's home located at 37 Albert Avenue, San Jose and his office located at 46, Mathew Street, Santa Monica.
3. Smith Franklyn works with the local District Attorney to obtain the required search warrant.
4. Smith Franklyn and you visit Bryan's home and seize his computer which is a HP Pavilion Model 1172.
5. You later visit Bryan's office and seize his laptop, floppy disks and CD-ROMS.
6. You place the devices carefully in anti-static bags and transport it to the forensics laboratory.
7. Create a bit-stream image of the hard disk using tools such as R-Drive and Linux dd commands.
8. Generate MD5 or SHA-l hashes of the bit stream images.
9. Prepare the chain of custody and store the original hard disk in a secure location. You would be investigating the bit stream image copy.
10. You are ready for investigation.
11. You are asked to retrieve: a. Any document in the computer which shows proof for breach of contract.
12. You load the bit stream image in AccessData Forensic Tool Kit (FI'K) and browse every single file in the file system.
13. You also read every single email displayed in FTK.
14. After many days/nights of investigation you retrieve the following crucial evidence:

a. Encrypted file titled "Business Plan AppleMac Magazine"
b. Excel spreadsheet "revenuestreams.xls"
c. Numerous email messages back and forth with his investors.

15. You run a password cracking utility to crack the encrypted file "Business Plan AppleMac Magazine.doc" and the password was "planapple".
16. These above documents clearly indicate that his new business would compete with TargetOnes's business.
17. You copy these files to a CD-ROM.
18. You use FTK report facility feature and produce a professional report.
19. You deliver the report to the company along with the fee for the forensics service you rendered.

Based on your submitted report the lawyer, Smith Franklyn initiates a $20 million lawsuit against Bryan. After two weeks the court of law holds Smith Franklyn Bryan guilty and asks to pay the amount.

In my judgment, this portion of the courseware was not written with the aid of an attorney.  First, in a civil matter --contract breach-- one doesn't obtain a "search and seizure warrant" with the aid of the district attorney.  A plaintiff first files suit, then issues a narrowly tailored request for production (or subpoena, if it is third-party property) and then awaits opposing counsel's Motion to Quash and for Protective Order.

Second, assuming the Court finds that the suit is not a fishing expedition (which this fact situation appears to be), an adverse would never be entitled to "visit Bryan's home and seize his computer . . . and later visit Bryan's office and seize his laptop, floppy disks and CD-ROMS."  Instead, one would expect to retain a third-party vendor to search for potentially-responsive ESI or the court would appoint a special master for that same purpose.

This calls to mind a recent decision by the Colorado Supreme Court in November in the case of Cantrell v. Cameron, 195 P.3d 659 (Colo. 2008) (en banc).  The case arose from a traffic accident in which the allegedly negligent party (Cameron) was accused of using his laptop computer while driving.  Cantrell asked to inspect Cameron's laptop for evidence that it was in use at the time of the accident.  Cameron agreed to a limited inspection, but wouldn't produce the laptop without a written agreement limiting the scope of the inspection.  Whereas Cameron insisted the scope be limited "to the time of the accident," Cantrell understandably wanted a broader search to confirm that there had been no subsequent manipulation of the hard drive.  Cantrell sought an order to compel, which the trial court granted.  Cameron then filed for a writ of prohibition with the state's Supreme Court.

In its ruling, the Colorado Supreme Court noted:

personal computers may contain a great deal of confidential data.  Computers today touch on all aspects of daily life . . . they are postal services, playgrounds, jukeboxes, dating services, movie theaters, daily planners, shopping malls, personal secretaries, virtual diaries, and more. Very often, computers contain intimate, confidential information about a person. When the right to confidentiality is invoked, discovery of personal computer information thus requires serious consideration of a person's privacy interests.

195 P.3d at 661. (quotations and citations omitted).

As a result of these findings, the court concluded that the trial court abused its discretion in issuing an unqualified order directing Cameron to produce his laptop for inspection and without establishing parameters to balance the truth-seeking purpose of discovery with the privacy interests at stake.

In my opinion, Cantrell had a right to ascertain that the hard-drive had not been tampered with, which required inspection of the entire drive. In most cases, I would argue that the entire hard drive is certainly needed, although a very small fraction of ESI on the drive will be relevant.

By way of example, I was very recently involved in a case where I obtained the entire hard-drive for inspection.  All the data sought resided in slack-file space, deleted files and printer spool files (documents drafted in MS-Word and sent to the printer, but never saved, probably in an effort to leave no record).  Obviously, opposing counsel would not have been able to direct his client to extract that information (let alone produce it in a readily usable form).

The answer to this dilemma, which would not have conflicted with the Colorado Supreme Court's ruling, is: (a) to craft a narrowly-tailored discover request that is limited in relevance to the case but specific enough to overcome efforts to conceal data; and (b) to retain an third-party vendor (or ask the court to appoint a special master); and (c) to provide the forensic analyst with as much specific guidance as possible to discover potentially responsive data.  When questions arise as to whether data discovered is relevant or privileged, they may be resolved by an in camera review or the special master, if applicable, will make that call.

Officer's MySpace and Facebook Postings At Issue in Criminal Trial

The NY Times reports that an officer's postings on social networking sites MySpace and Facebook may have had an effect on a criminal trial, where the defendant was acquitted of the most serious charge. Among the officer's alleged online comments at issue: his MySpace "mood" that he was feeling "Devious," as well as the officer's Facebook post that he "is watching 'Training Day' to brush up on proper police procedure."

NY Times

Online anonymity not guaranteed in all Internet libel cases

The Maryland Court of Appeals issued a decision yesterday in Independent Newspapers, Inc. v. Zebulon J. Brodie protecting the identity of anonymous Internet posters and, for the first time, offering guidelines for that state's courts to follow in libel cases before compelling disclosure of online commenters' identities.

The five-step process the court adopted was borrowed from Dendrite Int’l, Inc. v. John Doe No. 3, 775 A.2d 756 (N.J. Super. Ct. App. Div. 2001) and explicated in detail in yesterday's 43-page majority opinion. It seeks to help trial courts "balance First Amendment rights with the right to seek protection for defamation" by suggesting they:

•Require that plaintiffs notify anonymous parties that their identities are sought.

•Give the posters time to reply with reasons why they should remain nameless.

•Require plaintiffs to identify the defamatory statements and who made them.

•Determine whether the complaint has set forth a prima facie defamation, where the words are obviously libelous, or a per quod action, meaning it requires outside evidence.

•Weigh the poster's right to free speech against the strength of the case and the necessity of identity disclosure.

For further reading, see:

• Ki Mae Heussner, Lawsuit Cracks Open Online Anonymity, ABC News (Feb. 27, 2009)
• Tracy Frazier, You Read What About Me on the Internet?!: Anonymous Online Libel, theLegality (Feb. 26, 2009)
• Bizub v. Paterson, No. 07CV1960, district court, El Paso County, Colorado (unsuccessful attempt to compel The Colorado Springs Gazette to divulge identities of online posters)
• Federal District Court Mandates the Disclosure of the Identify of Online Posters in Yale Law Student Case, Internet Defamation Law Blog (Sep. 22, 2008)
• Kevin F. Berry, How to Unmask an Anonymous Blogger, Law.com In-House Counsel (Apr. 4, 2006)
• The First Amendment Center
• Electronic Frontier Foundation's "Bloggers' Rights" page
• Public Citizen's Internet Free Speech resources page
• Citizen Medial Law Project

First Circuit: Truth Is Not Absolute Defense to Defamation -- at least under Massachusetts law

Interpreting Massachusetts law in a diversity matter, the First Circuit has held that truth was not an absolute defense for an allegedly defamatory e-mail.  The panel interpreted a Massachusetts statute reading as follows:

Chapter 231: Section 92. Truth as justification for libel

Section 92. The defendant in an action for writing or for publishing a libel may introduce in evidence the truth of the matter contained in the publication charged as libellous; and the truth shall be a justification unless actual malice is proved.

Mass. Gen. Laws ch. 231, § 92 (emphasis added).  The district court found that there was no evidence of "actual malice," but the First Circuit disagreed, holding that there was sufficient evidence to go to a jury. 

Noonan v. Staples, __ F.3d __, No. 07-2159 (1st Cir. Feb. 13, 2009).

For further information, read the decision and commentary.

Computer illiteracy no defense for spoliation

A litigant, who was subject to an order to produce his hard drive, argued in mitigation of spoliation of evidence by reason that he was a novice computer user who was having problems with his computer because it was severely infected with viruses, spyware and adware and that he sought professional help in correcting those problems.  The Oklahoma Supreme Court reversed an order declining to impose sanctions. The following is adapted from that court's November 10, 2008 opinion.

The litigant first sought help from a friend, who was not successful in resolving the problems. He then hired a professional to repair the computer. Although he maintained that at no time were evidentiary materials intentionally deleted from the computer, the record reflected that at least three kinds of "wiping" software were downloaded onto the computer during the period that the parties were actively negotiating to obtain the information contained on the computer's hard drive.

Specifically, AbsoluteShield File Shredder was used and a file named "cable.doc" was removed; later the programs CyberScrub 3.5 and Window Washer were installed and the Window Washer program ran several times thereafter. The record reflects that the CyberScrub 3.5 program was last accessed on the same date that a motion to compel was granted by the trial judge.

The record further reveals that, after the motion to compel was granted, the litigant contacted a computer security company, Jarvis Incorporated, and asked about hiring a computer expert to work on his computer. On Jarvis's recommendation, the plaintiff hired another technician to work on his computer. The litigant told neither Jarvis nor the technician that the computer was the subject of a court order and/or that certain files needed to be preserved before it was worked on. The technician testified that he could have preserved the hard drive before working on it by making a "clone" of it if he had known it was needed. Indeed, the technician had removed the hard drive and worked on it for approximately one week and used a "drive wiper" program called Terminus 6 on the hard drive.

The litigant admitted that the technician used the Terminus program and admitted targeted destruction of specific files by the technician due to the desire to retain settings on his computer. Barnett says that it was the technician's decision to use the wiping software.

A neutral court-appointed expert found no evidence that files associated with viruses had been destroyed with the Terminus program and further noted that a log identifying the files deleted by the Terminus program had itself been deleted. The expert's report stated that there were six documents with links in the Recent Documents folder of plaintiff's computer that had no matching document on the hard drive, indicating that those files had been deleted.

A concern that I have is that wiping utilities are becoming more and more commonplace, even being packaged with ordinary utilities that ship with new computers or come with ISP services (e.g., MSN, which makes SpySweeper, McAffee and a number of wiping & anti-forensic utilities available).  The popularity of these utilities, as well as encryption, has increased because of the growing awareness of identity theft, among other reasons.  Even disk defragmenting tools, such as DiskKeeper, create a nightmare for forensic analysists attempting to located deleted files on a target system.

Whereas, in the past, such utilities required a knowing use (mens rea), the use of such utilities today may not be an indication of intent to spoliate.  This means that the standard may shift more and more --as the case above illustrates-- from scienter to negligence.  Therefore, counsel will increasingly need to observe strict data preservation protocols when litigation becomes reasonably forseeable and to communicate these obligations to clients promptly.

Some obvious questions that are often raised include:

• Must clients be instructed to immediately cease using a computer --at the first hint of reasonably forseeable litigation-- until the hard-drive can be forensically imaged?  If so, what about the accumulating data that is created after the imaging date?
• If a client takes reasonable steps to preserve extant potentially-responsive data, must the client disable the use defragmenting utilities and other anti-forensic utilities that arguably are necessary for maintaining the optimum efficiency of a computer (especially considering that litigation may last several years)?
• Assuming the h.d.d. wasn't imaged, If a client has taken reasonable steps to preserve the obvious potentially-responsive data, should the client also have been expected to identify and preserve files that have been deleted but are still recoverable (given that further use of the computer will overwrite these files)? 

For counsel seeking to discover ESI, the availability of that evidence may decrease as a result of the widespread use of anti-forensic utilities, but the shifting jurisprudence may allow for adverse jury instructions based on the missing evidence, which instructions possibly could be more damaging than the destroyed evidence, itself.

VA Court: Antispam law is unconstitutional

In Jaynes v. Commonwealth of Virginia (slip opinion, Sept. 12, 2008), the Virginia Supreme Court overturned the conviction of North Carolina resident Jeremy Jaynes, who sent over 10,000 emails over a 24 hour period to subscribers of America Online using falsified header information and sender domain names.  None of the recipients had requested communication from Jaynes. Jaynes was charged with violating Virginia's anti-spam law, which prohibits sending unsolicited bulk emails (UBEs) with false email transmission information.  The anti-spam law also raises the offense to a felony if the volume of UBEs is greater than 10,000 attempted recipients in any 24 hour period.  The court held that, while the lower court had jurisdiction over him because the emails went through AOL's servers in Virginia, the law was unconstitutionally overbroad.  The right to engage in anonymous speech is an aspect of the freedom of speech protected by the First Amendment, and the only way a speaker can publish an anonymous email is to use a false IP address or domain name.  Therefore, by prohibiting false routing information, the anti-spam law infringes on the right to engage in anonymous speech, which the U.S. Supreme Court has held to be a direct regulation of the content of speech.  In its analysis, the court suggested that had the statute been limited to commercial or fraudulent transmission of email or transmission of illegal or otherwise unprotected speech, the statute may have been constitutional.  However, as written, the statute prohibits the anonymous transmission of all UBEs, even those containing political, religious, or other speech protected by the First Amendment, and was therefore impermissably broad.

NJ court: No 'Legitimate' Privacy Expectation in Data on Office Computer

This decision in People v. M.A., was one of first impression in New Jersey, but is consistent with several other jurisdictions, including U.S. v. Angevine, 281 F.3d 1130 (10th Cir. 2002); U.S. v. Simons, 206 F.3d 392 (4th Cir. 2000); and U.S. v. Bailey, 272 F. Supp. 2d 882 (D. Neb. 2003) in holding that an employee has no reasonable expectation of privacy in personal files stored on a company-owned computer and an employer's consent makes a police search lawful.

Moreover, the court applied what appears to be a derivative of the Fundamental Equity Doctrine in holding that, even if defendant had a subjective expectation of privacy because he used a confidential password, that expectation was unreasonable because of the criminal use to which it was put: "A burglar plying his trade in a summer cabin during the off season may have a thoroughly justified subjective expectation of privacy, but it is not one which the law recognizes as legitimate,'" the court said, quoting the U.S. Supreme Court's ruling in Rakas v. Illinois, 439 U.S. 128 (1978).

An intriguing question arises when applying this doctrine to overcome the legitimate expectation of privacy:  What if the encryption software used is discovered to have been pirated or in violation of the EULA, but defendant was not otherwise putting the computer use or data to criminal use?  Does the Independent Source Doctrine warrant exception apply?  What if defendant's alleged unlawful conduct has no relation to the data or computer use  --can that conduct be used as a pretext for overcoming defendant's legitimate privacy expectation?  Can tortious, but not unlawful conduct, be used as a pretext for overcoming the legitimate privacy expectation?

For related prior blog posts, see:

• Domestic Travelers' Laptops Subject to DHS Searches
• Email and Text Messaging Protected from Law Enforcement and Employers
• Reasonable Suspicion not Required for Laptop Search at Int'l Airport
• Third party PC technician's discovery of contraband held admissible
• Surrendering the PGP passphrase
• Evidence Obtained Through Spyware May Be Admissible
• Employees Waive Privilege In Communications Transmitted From Company Computer System

Federal Circuit: Open Source Coders May Sue for Copyright Infringement

Open-source coders rejoice: the Ninth Circuit Federal Circuit has released a decision based upon Ninth Circuit law, Jacobson v. Katzer, No. 2008-1001 (9th Cir. Aug. 13, 2008), that expands the control that authors of open-source software have regarding future distribution and modification of that work. In particular, the panel held that rather than being limited to breach-of-contract claims, the suit may go forward on a theory of copyright -- along with the concomitant statutory damages and potential for attorney fees.  This decision will undoubtedly be well-cited, as open-source software continues its march to ubiquity.

Decision and coverage.