DreamHost Wins Challenge Against DOJ's Overbroad Data Demands

from the the-Man-briefly-experiences-having-it-stuck-to-him dept

DreamHost has been fighting the DOJ and its breathtakingly-broad demand for information on all visitors to an anti-Trump website. This has gone on for a few months now, but the origin of the DOJ's interest in the DreamHosted disruptj20.org site traces all the way back to protests during Trump's inauguration.

Here's what the DOJ demanded DreamHost hand over:

a. all records or other information pertaining to that account or identifier, including all files, databases, and database records stored by DreamHost in relation to that account or identifier;

b. all information in the possession of DreamHost that might identify the subscribers related to those accounts or identifiers, including names, addresses, telephone numbers and other identifiers, e-mail addresses, business information, the length of service (including start date), means and source of payment for services (including any credit card or bank account number), and information about any domain name registration;

c. all records pertaining to the types of service utilized by the user,

d. all records pertaining to communications between DreamHost and any person regarding the account or identifier, including contacts with support services and records of actions taken.

These demands conceivably applied to every single one of the site's 1.2 million visitors. The DOJ scaled back some of its demands a week later, but also stated its attempt to "converse" (read: talk DreamHost into compliance) had been rebuffed, with the hosting company stating its desire to continue challenging the subpoena.

This demand for information would be in addition to a warrant it served to Facebook, seeking everything ever from the accounts of more than 6,000 users. This was served to Facebook, along with a gag order -- something the DOJ conveniently dropped the night before oral arguments, perhaps sensing it might be in for an unfavorable precedential ruling.

Chief Judge Morin of the DC Superior Court has issued a ruling on the DreamHost-targeting subpoena, and it's good news for everyone but the overreaching DOJ. DreamHost reports on the judge's order:

Under this order, we now have the ability to redact all identifying information and protect the identities of users who interacted with disruptj20.org before handing over any data to the court.

[...]

We are now required to hand over a drastically reduced amount of data to the government and will redact any identifying information from every scrap of it that relates to non-subscribers.

On top of that, the DOJ will have to submit search protocols and procedures to the court for approval before demanding further site visitor info and limit its requests to info it can show the court is linked to actual criminal activity (violations of DC's rioting statutes). The DC Superior Court will make final determinations on the validity of the government's data requests before any identifying information is released by DreamHost.

As the court notes in its order [PDF], it's not interested in assisting the government with its fishing expeditions.

Because of the potential breadth of the government's review in this case, the Warrant in its execution may implicate otherwise innocuous and constitutionally protected activity. As the Court has previously stated, while the government has the right to execute its Warrant, it does not have the right to rummage through the information contained on DreamHost's website and discover the identity of, or access communications by, individuals not participating in alleged criminal activity, particularly those persons who were engaging in protected First Amendment activities.

And this still may not be the end of the DOJ's problems. Even if revised info demands are approved by the court, there are still a handful of potential investigation targets (site visitors and owners) readying their own challenges of the government's data requests. At this point, site visitors who've already attempted to challenge the subpoena obviously don't know if they're actually targeted by the DOJ. The court has dismissed their appeals without prejudice, which will allow them to refile if they make the government's final cut.

This is good news for everyone who avails themselves of third-party services (which is pretty much everybody). A little pushback sometimes goes a long way. Anyone seeking to keep their private info private should be taking note on who's willing to challenge the government's overreach and who's willing to act as little more than a data broker for law enforcement agencies.

Filed Under: disruptj20, doj, fishing expedition, inauguration, privacy, protests
Companies: dreamhost

Court Calls Out Government For The 'General Warrant' It Served To Facebook

from the but-awards-it-an-A-for-effort dept

In a disturbing case involving the sex trafficking of minors, the 11th Circuit Appeals Court has reached a few interesting conclusions involving digital searches and the Fourth Amendment. Included in the court's findings are rulings on the use of the All Writs Act to force Apple to unlock a device, an email warrant served to Microsoft, and warrants used to obtain a vast amount of information from Facebook. [h/t Orin Kerr]

The All Writs Act received a ton of free publicity thanks to Apple's fight with the DOJ over the (forced) unlocking of the San Bernardino shooter's iPhone. Ultimately, the DOJ hired outside help to crack open the phone, abandoning its search for helpful precedent. (And, ultimately, the phone -- the shooter's work-issued phone -- contained nothing of interest.)

Here, the Appeals Court finds [PDF] there's nothing wrong with using the 1789 All Writs Act to paper over holes in the 200+ years of legislation.

The authority granted by the All Writs Act is broad but not boundless. The Act “is a residual source of authority” that permits issuing writs only if they “are not otherwise covered by statute.” Penn. Bureau of Corr. v. U.S. Marshals Serv., 474 U.S. 34, 43, 106 S. Ct. 355, 361 (1985). It is a gap filler. “Where a statute specifically addresses the particular issue at hand, it is that authority, and not the All Writs Act, that is controlling.” Id. And where Congress has proscribed a certain type of judicial action, the Act cannot overcome that proscription. See id. The bypass order meets this requirement because no statute expressly permits or prohibits it.

Using somewhat circular reasoning, the court states the All Writs warrant issued here doesn't produce any Fourth Amendment difficulties because Apple willingly complied with it.

To comply with the bypass order, Apple simply had to have an employee plug the iPad into a special computer and then transfer the iPad’s data to a thumb drive. That is not an unreasonable burden, especially in light of the fact that Apple did not object to the bypass order’s requirements.

More helpfully, the court seems to suggest it's amenable to challenges like the one raised here. In most cases, challenging an All Writs warrant can only be done by the company receiving it. The court doesn't have to meet the issue of whether or not the defendants had standing to challenge the warrant served to Apple, but doesn't immediately dismiss their attempt to establish standing.

Moving on, the court examines the warrant served to Microsoft for emails related to the criminal charges. The court finds the warrant was not overbroad.

Viewed against that constitutional history, the Microsoft warrant complied with the particularity requirement. It limited the emails to be turned over to the government, ensuring that only those that had the potential to contain incriminating evidence would be disclosed. Those limitations prevented “a general, exploratory rummaging” through Moore’s email correspondence. The Microsoft warrant was okay.

How often does a court describe a warrant as merely "okay?" I'm guessing it's probably not that often. Here's why it did in this case, explained in the footnote attached to the "okay" descriptor.

It is somewhat troubling that the Microsoft warrant did not limit the emails sought to emails sent or received within the time period of Moore’s suspected participation in the conspiracy. Nevertheless, the warrant was appropriately limited in scope because it sought only discrete categories of emails that were connected to the alleged crimes. As a result, the lack of a time limitation did not render the warrant unconstitutional.

The government passes this warrant examination with C-. The work needs improvement and the government just isn't applying itself. Unfortunately, neither is the court if it's going to allow third parties do the government's particularity work for it.

The Facebook warrant, however, doesn't live up to the court's "okay" standard.

The Facebook warrants are another matter. They required disclosure to the government of virtually every kind of data that could be found in a social media account… And unnecessarily so. With respect to private instant messages, for example, the warrants could have limited the request to messages sent to or from persons suspected at that time of being prostitutes or customers. And the warrants should have requested data only from the period of time during which Moore was suspected of taking part in the prostitution conspiracy. Disclosures consistent with those limitations might then have provided probable cause for a broader, although still targeted, search of Moore’s Facebook account. That procedure would have undermined any claim that the Facebook warrants were the internet-era version of a “general warrant.”

If there's one thing law enforcement doesn't want to hear from a judge, it's the term "general warrant." Being compared to an occupying force is never a good thing. And these warrants are definitely not "okay."

The two warrants required Facebook to “disclose” to the government virtually every type of data that could be located in a Facebook account, including every private instant message Moore had ever sent or received, every IP address she had ever logged in from, every photograph she had ever uploaded or been “tagged” in, every private or public group she had ever been a member of, every search on the website she had ever conducted, and every purchase she had ever made through “Facebook Marketplace,” as well as her entire contact list. The disclosures were not limited to data from the period of time during which Moore managed the prostitution ring; one warrant asked for all data “from the period of the creation of the account” and the other did not specify what period of time was requested.

The government claimed the Facebook warrant was no different than warrants used to search electronic devices. In the latter case, the government generally takes possession of the device and digs through it until it finds what it needs. (This is an area of jurisprudence that is slowly shifting. With "persons' entire lives" often located on devices like smartphones, the analog equivalent is the government seizing the entire contents of a person's home before taking what's actually relevant to the case at hand.) The court has no sympathy for this argument, pointing out the warrant should have asked Facebook for only what was relevant and allow a non-government party to dig through the suspects' digital personal effects.

The means of hiding evidence on a hard drive — obscure folders, misnamed files, encrypted data — are not currently possible in the context of a Facebook account. Hard drive searches require time-consuming electronic forensic investigation with special equipment, and conducting that kind of search in the defendant’s home would be impractical, if not impossible. By contrast, when it comes to Facebook account searches, the government need only send a request with the specific data sought and Facebook will respond with precisely that data.

And the government should know this, because it does this thousands of times a year.

That procedure does not appear to be impractical for Facebook or for the government. Facebook produced data in response to over 9500 search warrants in the six-month period between July and December 2015.

Unfortunately, the government is allowed to keep the Facebook evidence under the "good faith" exception.

The Facebook warrants do not fall within either category of excludable warrants. As we have already explained, probable cause supported issuance of the warrants. And while the warrants may have violated the particularity requirement, whether they did is not an open and shut matter; it is a close enough question that the warrants were not “so facially deficient” that the FBI agents who executed them could not have reasonably believed them to be valid.

This suggests a two-step process for warrants served to service providers might be the better path to take in the future. While particularity is difficult to nail down when you're not sure exactly what you're looking for, trimming down demands for data and communications to relevant time periods raises the chances of warrants surviving suppression challenges. The court sets no precedent in this decision thanks to its good faith ruling, but the footnote addressing the Microsoft warrant and the multiple paragraphs devoted to the government's Facebook haul hints the government really needs to tighten up its search warrant procedures.

Filed Under: all writs act, doj, fishing expedition, general warrant, surveillance
Companies: apple, facebook, microsoft

DOJ Walks Back Its Demands For Info On Everyone Who Visited A Trump Protest Site As Some Of Those Visitors Protest Subpoena

from the oops,-didn't-mean-such-blanket-surveillance dept

Last week we wrote about a crazy warrant from the DOJ, effectively demanding information -- possibly identifying information -- on everyone who visited the site disruptj20.org, which had been used by people organizing protests of Trump's inauguration. When we wrote about it, the site's hosting company, DreamHost, had just announced that it was pushing back on the demand in court. On Monday of this week, some of the visitors to the site pushed back too. Public Citizen Litigation Group took on the case of five individuals who had visited the site, asking the court if they could intervene to oppose the warrant.

As Paul Levy, who wrote the briefs, noted in the accompanying blog post, there's a legitimate fear of our President creating an "Enemies List."

Although a warrant this broad would be disturbing in any administration, Internet users have every reason to be concerned in an administration led by a President who has shown intense intolerance for disagreement and a tendency to lash out with raw language and threats directed at political adversaries, and who has urged his supporters to attack protesters. The listing of all those who visited or interacted in any way with this web site could easily form the beginning of an “Enemies List” that would put Richard Nixon to shame.

Our clients in the intervention are five anonymous Internet users who viewed the web site, either to learn more about the protests, to coordinate their own protest activities; one of our clients was also a journalist whose reasons for visiting the site included reporting remotely on the protests. The Does object to allowing federal prosecutors to put their names on a list of potential enemies of the Trump Administration who are to be visited by FBI agents or hauled in for questioning by federal prosecutors. Our argument is based on the First Amendment right to read anonymously — analogous to the right to speak anonymously that we have litigated in many other cases; that right is now broadly accepted as a basis to refuse to enforce discovery to identify online speakers without evidence that the speakers have done something wrong.  The right to read anonymously has been addressed less often, but in drafting our papers on very short notice we were able to draw on an amicus brief we had filed ten years ago in the Maryland Court of Appeals.

However, just a day after those filings, the DOJ itself admitted that perhaps the warrant was a step or two too far and has responded to DreamHost, admitting that the original warrant was too broad and asking to modify the warrant to make it more narrow. The DOJ insists that it is just looking for actual criminal behavior, not building a list of Trump haters.

The Warrant--like the criminal investigation--is singularly focused on criminal activity. It will not be used for any other purpose. Contrary to DreamHost's claims, the Warrant was not intended to be used, and will not be used, to "identify the political dissidents of the current administration[.]"... Nor will it be used to "chill[ ] free association and the right of free speech afforded by the Constitution." In fact, as discussed further below, after conducting a careful search and seizing the evidence within the scope of the Warrant, law enforcement will set aside any information that was produced by DreamHost but is outside the scope of the Warrant; it will seal that information; and it will not revisit that information without a further court order.

The DOJ then suggests that part of the problem was that it didn't quite realize just how much info DreamHost might have had on visitors to this site, and thus it didn't realize that it was actually requesting so much:

The government is acutely aware that criminal investigations involving electronic evidence present unique challenges. One of those challenges is that some of the evidence -- particularly the full scope of the evidence -- will be hidden from the government's view unless and until the government obtains a court order or search warrant. That is an important part of the history in this case because much of DreamHost's challenge to the Warrant is based on information that was not known (and would not reasonably have been known) to the government when the Warrant was applied for and obtained. What the government did not know when it obtained the Warrant -- what it could not have reasonably known -- was the extent of visitor data maintained by DreamHost that extends beyond the government's singular focus in this case of investigating the planning, organization, and participation in the January 20, 2017 riot. The government has no interest in records relating to the 1.3 million lP addresses that are mentioned in DreamHost's numerous press releases and Opposition brief. The government's investigation is focused on the violence discussed in the Affidavit.

And, to make that even more clear, it agrees to amend the warrant:

Consistent with that focus, the government is asking this Court to enter a new Attachment B to the Warrant, and remains committed to minimizing the information that is ultimately seized for the government's criminal investigation.

While I imagine many people won't be willing to give the DOJ the benefit of the doubt here, I think it's entirely possible (and even likely) that the request for so much info was due to confusion and bumbling agents, rather than a nefarious plan to build an enemies list. I still think that there are serious concerns to be had about the warrant -- and it sounds like DreamHost still isn't comfortable with things either:

Notably, the government has attempted to have a dialogue with DreamHost about these matters. Regrettably, those attempts have proven unproductive because DreamHost maintains that the Warrant is improper and that the Court lacks jurisdiction to issue the Warrant... As recently as this past week, DreamHost told the government that it would provide no information about the Website without further legal process and--somewhat incompatibly--told the government that DreamHost would only discuss limiting the production of information called for by the Wanant if the government first withdrew the Warrant in its entirety

You can see the amended warrant at the end of the DOJ's filing. It still feels like a fishing expedition, but it's clearly not nearly as broad as before, where it may have included basically all IP addresses of anyone visiting the site.

Filed Under: 4th amendment, disruptj20, doj, donald trump, fishing expedition, warrant
Companies: dreamhost

DOJ Goes Way Overboard: Demands All Info On Visitors Of Anti-Trump Site

from the the-doj-going-too-far?-what-a-surprise dept

Not all search warrants are bad. Indeed, most of them are perfectly legitimate, and meet the qualifications under the 4th Amendment that there is probable cause of a crime being committed, and the warrant is narrowly tailored to seek out evidence to support that. But... not always. As Ken "Popehat" White explains in a recent blog post, the Justice Department has somehow obtained the mother-of-all bad search warrants while trying to track down people who were involved in protests of Donald Trump's inauguration back in January. The government has brought felony charges against a bunch of protestors from the inauguration, and now it appears the DOJ is going on a big fishing expedition.

As Ken notes, it's quite likely that some protestors committed crimes, for which they can be charged, but prosecutors in the case have decided to go ridiculously overbroad in trying to get any info they can find on protestors. They got a search warrant for the well known hosting company DreamHost, which hosts the site disruptj20.org (as an aside, the fact that a site like that doesn't default to HTTPS for all connections is really, really unfortunate, especially given the rest of this article). The warrant basically demands everything that DreamHost could possibly have on anyone who did anything on disruptj20, including just visiting. As White notes in his post, it's not that unreasonable that the DOJ sought to find out who ran the site, but now they're requesting basically everything, which likely includes the IP addresses of all visitors:

a. all records or other information pertaining to that account or identifier, including all files, databases, and database records stored by DreamHost in relation to that account or identifier;
b. all information in the possession of DreamHost that might identify the subscribers related to those accounts or identifiers, including names, addresses, telephone numbers and other identifiers, e-mail addresses, business information, the length of service (including start date), means and source of payment for services (including any credit card or bank account number), and information about any domain name registration;
c. all records pertaining to the types of service utilized by the user,
d. all records pertaining to communications between DreamHost and any person regarding the account or identifier, including contacts with support services and records of actions taken.

DreamHost, quite reasonably, found this to be somewhat overbroad and refused to immediately reply, instead having a lawyer ask the DOJ to clarify the request, while making it clear it felt the warrant was likely both vague and overlybroad. The DOJ then asked the court to compel the company to hand over the info, insisting there is "no legal basis for failing to produce" the requested information. DreamHost has now responded in court, saying that the warrant violates the 4th Amendment and appears to endanger the 1st Amendment rights of protestors. They also claim that it violates the Privacy Protection Act and that there are some jurisdictional issues with it as well. DreamHost also has a nice blog post about the whole thing:

This is, in our opinion, a strong example of investigatory overreach and a clear abuse of government authority.

Or, as the filing notes:

Where a search warrant endangers First Amendment interests, the warrant must be scrutinized with “particular exactitude” under the Fourth Amendment. See Zurcher v. Stanford Daily, 436 U.S. 547, 565 (1978). “The First Amendment is often inconvenient. But that is beside the point. Inconvenience does not absolve the government of its obligation to tolerate speech.” Int’l Soc’y for Krishna Consciousness, Inc. v. Lee, 505 U.S. 672, 701 (1992) (Kennedy, J., concurring). The government’s search warrant (“Search Warrant”) here requires non-party DreamHost, LLC (“DreamHost”) to turn over every piece of information it has about every visitor to a website expressing political views concerning the current administration. This information includes the IP address for the visitor, the website pages viewed by the visitor, even a detailed description of software running in the visitor’s computer. In essence, the Search Warrant not only aims to identify the political dissidents of the current administration, but attempts to identify and understand what content each of these dissidents viewed on the website. The Search Warrant also includes a demand that DreamHost disclose the content of all e-mail inquiries and comments submitted from numerous private e-mail accounts and prompted by the website, all through a single sweeping warrant.

The Search Warrant cannot survive scrutiny under the heightened particular exactitude standard required by the presence of the First Amendment issues. It fails to identify with the required particularity what will be seized by the government. It also fails to provide DreamHost with any assurance that the government will return or destroy the large portion of the information irrelevant to the government’s criminal case or cases. These features render the Search Warrant unreasonable under the Fourth Amendment. In addition, the Search Warrant violates the privacy protections of the Privacy Protection Act, a statute enacted specifically to address such instances, and is without a jurisdictional basis.

As Ken White points out, this fishing expedition by the DOJ should concern us all:

The Department of Justice isn't just seeking communications by the defendants in its case. It's seeking the records of every single contact with the site — the IP address and other details of every American opposed enough to Trump to visit the site and explore political activism. It seeks the communications with and through the site of everyone who visited and commented, whether or not that communication is part of a crime or just political expression about the President of the United States. The government has made no effort whatsoever to limit the warrant to actual evidence of any particular crime. If you visited the site, if you left a message, they want to know who and where you are — whether or not you did anything but watch TV on inauguration day. This is chilling, particularly when it comes from an administration that has expressed so much overt hostility to protesters, so relentlessly conflated all protesters with those who break the law, and so deliberately framed America as being at war with the administration's domestic enemies.

Of course, the DOJ overreaching is nothing new. We just spent eight years highlighting DOJ overreach during the Obama administration (and another eight of overreach under the Bush administration). But it is particularly scary to see just how far this overreach is and that it's coming from an administration that has shown itself to be significantly less tolerant of the First Amendment rights of protestors than basically any predecessor.

Filed Under: 4th amendment, disruptj20, doj, donald trump, fishing expedition, inauguration, warrant
Companies: dreamhost

Cops Sent Warrant To Facebook To Dig Up Dirt On Woman Whose Boyfriend They Had Just Killed

from the blue-lives-are-more-equal-than-others dept

Everything anyone has ever said about staying safe while interacting with the police is wrong. That citizens are told to comport themselves in complete obeisance just to avoid being beaten or shot by officers is itself bizarre -- an insane inversion of the term "public servant." But Philando Castile, who was shot five times and killed by (now former) Officer Jeronimo Yanez, played by all the rules (which look suspiciously like the same instructions given to stay "safe" during an armed robbery). It didn't matter.

Castile didn't have a criminal record -- or at least nothing on it that mattered. Otherwise, he wouldn't have been allowed to own a weapon, much less obtain a permit to conceal the gun. Castile told Yanez -- as the permit requires -- he had a concealed weapon. He tried to respond to the officer's demand for his ID, reaching into his pocket. For both of these compliant efforts, he was killed.

Castile's shooting might have gone unnoticed -- washed into the jet stream of "officer-involved killings" that happen over 1,000 time a year. But his girlfriend, Diamond Reynolds, immediately live-streamed the aftermath via Facebook. Her boyfriend bled out while responding officers tried to figure out what to do, beyond call for more backup to handle a dead black man sitting in his own vehicle. Only after Yanez fired seven bullets into the cab of the vehicle did officers finally remove his girlfriend's four year old daughter.

To "win" at killing citizens, you must start the spin immediately. Yanez spun his own, speaking to a lawyer less than two hours after killing Castile. Local law enforcement did the same thing. Documents obtained by Tony Webster show Special Agent Bill O'Donnell issued a warrant to Facebook for "all information retained" by the company on Diamond Reynolds, Castile's girlfriend. This was to include all email sent or received by that account, as well as "chat logs," which presumably means the content of private messages. The warrant also demands any communications that may have been deleted by Reynolds, as well as metadata on photos or videos uploaded to Facebook. It came accompanied with an indefinite gag order.

Why would law enforcement want (much less need) information from the victim's girlfriend's Facebook account? It appears officers were looking to justify the killing after the fact. The following sworn statement was contained in the affidavit:

Your affiant is aware through training and expertise that individuals frequently call and/or text messages to each other regarding criminal activity during and/or after and [sic] event has occurred.

This is warrant boilerplate, especially when it comes to obtaining information from accounts or devices. But this warrant should be considered anything but business as usual. Should be. Isn't. This is the actual standard operating procedure after an officer kills someone: the department goes digging through its criminal records to find any reason at all to have killed the person and to buttress "feared for safety" excuses given by officers -- awarding them points for effort based on information they didn't have when they ended someone's life.

When it comes to police shootings in America, there are no aggressors in uniform, only victims. Officer Yanez made his own excuses, theorizing Castile's willingness to smoke pot in front of a 4-year-old child indicated Castile had no respect for human life.

I thought, I was gonna die, and I thought if he's, if he has the, the guts and the audacity to smoke marijuana in front of the five year old girl and risk her lungs and risk her life by giving her secondhand smoke and the front seat passenger doing the same thing, then what, what care does he give about me?

Following his testimony's logic, smoking pot in front of a child has so severely damaged Castile's moral compass, he apparently would have thought nothing about shooting an officer over a non-functioning tail light. There's no logical boundary cops won't cross to pin the blame on the dead. Hence the Facebook warrant to dig up dirt on his girlfriend in hopes of adding a bit more post facto righteousness to the shoot.

The only upside -- and it's incredibly small given the surrounding circumstances -- is Facebook refused to hand over the information on the grounds that the indefinite gag order was unconstitutional. Faced with this pushback, Minnesota police withdrew the warrant. But in the end, Yanez was acquitted and Philando Castile is still dead -- a man who did nothing more than try to comply with an officer's orders.

Filed Under: diamond reynolds, fishing expedition, gag order, jeronimo yanez, philando castile, warrant
Companies: facebook

from the comic-can't,-amirite? dept

Editor's Note from Mike Masnick: Tim alerted me that he was writing on this subject, based on the article he found in the Deseret News, and I realized that we separately needed to reveal some stuff that happened earlier this year in relation to Tim's earlier reporting on this story. As Tim mentions in the story below, he first wrote about this case in 2014 (again, based on an article he found in the Deseret News) and then mentioned it obliquely in 2015 when discussing another lawsuit, and until now, had not written about it again. Back in February, one evening, I received a knock on my front door at home, with a process server handing me a subpoena. I was... confused. The subpoena was from a lawyer, Michelle Herrera, of the very large law firm Pillsbury Winthrop Shaw Pittman, on behalf of San Diego Comic Con. I was still confused. The subpoena demanded all sorts of information from us, including any "business relationship" we might have with the people who ran the Salt Lake City Comic Con (including whether or not they held any ownership stake in our company), any communications we had ever had with the organizers of Salt Lake City Comic Con and... incredibly... "all documents concerning SDCC or any SDCC Convention."

Yes, because three years ago we had written a story -- clearly based on coverage in the Deseret News -- San Diego Comic Con was demanding that we cough up every document we have that even mentions San Diego Comic Con, while similarly implying that merely having written about a legal dispute (something we do all the damn time) meant that we were somehow in cahoots with the folks who run Salt Lake City Comic Con -- people neither Tim nor I (nor anyone else working here) have ever spoken to in any context for any reason. Such a request, beyond being over-broad and completely misguided, is also a nuisance and a burden. At best, it appeared to be a wild and unnecessary fishing expedition. At worst, it could certainly be seen as an attempt to stifle reporting that was critical of San Diego Comic Con's litigation strategy.

It also wasted our time and resources, while at least creating something of a chilling effect in making us think twice about whether it was even worth it to publish the article below, because who knows if it will lead to another knock on my door, and more time having to talk with lawyers and whatnot.

Either way, soon after receiving the subpoena, lawyer Ken "Popehat" White, filed our response, noting that we had no responsive documents for most of it, but also objecting to the overly broad nature of the request. The key part:

With respect to request 7, seeking “All documents concerning SDCC or any SDCC convention,” Witness responds that the request is over-broad, burdensome, harassing, not reasonably calculated to lead to production of admissible evidence, and seeks documents equally available to Plaintiff. Witness operates a popular blog, Techdirt.com, that has covered legal issues surrounding technology and internet culture since 1997. Plaintiff has served this subpoena because Witness has published two posts critical of Plaintiff’s case. The public posts Witness has published about SDCC or mentioning SDCC are equally available to Plaintiff at https://www.techdirt.com/blog/?tag=comic+con or https://www.techdirt.com/search-g.php?q=comicon. It would be extremely burdensome and expensive for Witness to review 20 years of records of reporting to determine if it has any document mentioning SDCC or any SDCC convention, whether or not those documents have any relationship to this case. Moreover, Plaintiff’s motive to seek such a wide range of documents unrelated to this case is clearly to harass and retaliate against Witness for critical coverage of Plaintiff’s case. Moreover, Witness objects pursuant to California Evidence Code § 1070 that the subpoena seeks unpublished information from a publisher. O'Grady v. Superior Court, 139 Cal. App.4th 1423 (Cal. Ct. App. 2006) [Section 1070 protects online news magazine]. Witness stands on its objections and will not produce documents in response to this request.

We filed that in response and never heard another peep from San Diego Comic Con. But, Tim found this latest bit of news and wished to report on it, and we felt it necessary to waste even more time putting together this bit of disclosure about SDCC's subpoena to us. No wonder the damn case is still going. Anyway... on to Tim's post:

Nearly three years ago, we wrote about a rather silly trademark dispute between the folks that run the San Diego Comic-Con and Don Farr Productions, organizers of the Salt Lake City Comic Con. The SDCC has a registered trademark for "comic-con" and suggested that iterations such as "comic con" infringed on that trademark. We pointed out at the time that there are all kinds of comic conventions using similar or identical terms, and many had done so for many years, resulting in the term "comic con" being rendered generic. Add to that the low likelihood that anyone would actually be confused into thinking these other conventions were the product of the SDCC and this whole episode seemed head-scratchingly silly.

Except it isn't silly for those targeted by these kinds of bullying trademark lawsuits. Despite the SDCC filing its suit in the summer of 2014, I want to take a moment to point out that this legal dispute is still going on and has finally reached the deposition phase.

Co-founders Dan Farr and Bryan Brandenburg will each face a full day of deposition Tuesday and Wednesday, leading up to a final settlement conference before a federal judge in San Diego on Thursday. Following that conference, the judge will decide whether the case will continue to advance toward a trial scheduled in October. While the organizers staunchly maintain they are in the right, Brandenburg says that after investing approximately $1 million in their defense, they are ready to focus exclusively on their event.

"I would just as soon use those creative juices to really level up (the event)," Brandenburg said. "I think we've done a great job putting on great events over the past two years in spite of this thing going on, but you know, just imagine what we could do if it wasn't."

This is the largely unheralded toll that is paid when these kinds of trademark disputes arise. Sure, there is the cost of legal fees to consider, and the annoyance of having to defend themselves in court as well. But there is a cost to the public as well, paid in terms of a lack of production that would otherwise exist by the accused. When individuals or companies that are not truly infringing upon a trademark get caught up in this sort of legal web, their customers suffer along with them.

What's truly irritating about all of this is how the SDCC appears to have decided to enforce this trademark at the flip of a switch, having spent years failing to do so. The Salt Lake City folks, meanwhile, remain rather sweet in their disposition by comparison.

Brandenburg emphasized that despite the prolonged litigation, he and Farr hold no ill will toward San Diego Comic-Con but continue to admire the iconic event. He speculated that the lawsuit represents a kind of "Custer's last stand" for San Diego Comic-Con, which has dabbled for years in taking action about other events using the name "comic con," ultimately latching onto the Salt Lake event after Brandenburg and Farr drove their branded Audi to the competing event in July 2014.

In the lawsuit, the San Diego convention claims legal ownership over the term "comic con" in its various forms, though similar events around the country — including the recently renamed "Stan Lee's Los Angeles Comic Con" — have used the name for years.

The San Diego Comic-Con remains a wildly successful event. By all accounts, it is one hell of a show, one that I personally have wanted to visit for some time. It reached that level of success despite years of other conventions using some form of the "comic con" term. What harm it may have suffered that would warrant three years worth of litigation, and all of the legal costs associated with that litigation, is absolutely beyond me.

Filed Under: deposition, fishing expedition, subpoena, trademark
Companies: salt lake city comic con, san diego comic con

Malibu Media Copyright Troll Wakes The Beast In Trying To Push Verizon Around

from the not-a-good-idea dept

While we have our issues with Verizon in other areas, the giant telco does have a strong history of protecting its users against crazy copyright trolling and other forms of attacks. Verizon led the way in fighting back against the RIAA when it started demanding Verizon hand over information on tons of customers before any lawsuits were filed. Verizon won. Without this big victory, the copyright trolling situation today would be much, much worse. Verizon has also been known to be on the side of good when the RIAA and MPAA push for extreme changes to copyright laws as well. So it's no surprise that it's now entering a key case in the US's biggest copyright troll, Malibu Media.

In a case before Judge Katherine Forrest in the Southern District of NY, things have not been going that well for Malibu Media. And, this may be surprising to some, given prior to becoming a judge, Forrest was one of the RIAA's lawyers in copyright lawsuits over online infringement. Yes, really.

As per usual, the FightCopyrightTrolls site has been doing a great job keeping tabs on this case, which started getting attention a month ago when the lawyers representing the (still anonymous) John Doe defendant called Judge Forrest's attention to Malibu Media's latest nasty shakedown trick. Earlier in the case, Malibu Media was granted discovery of the Doe's computers and couldn't find any evidence of the Malibu Media/Xart material. But rather than drop the case, Malibu Media's legal team did the standard trick of subtly threatening to embarrass/harass the Doe if he didn't pay up, by putting him through a litany of irrelevant questions designed to find out other people who know the Doe who Malibu Media might go after:

During the deposition, Malibu’s counsel propounded a morass of irrelevant questions concerning, inter alia, Doe’s educational background (including factual and technical details about the courses Doe studied), the identity and location of Doe’s family members, the identity and location of Doe’s employers years before the relevant period herein (including factual and technical details about Doe’s job roles and responsibilities), the location of Doe’s residences years before the relevant period herein, the existence of Doe’s resume/CV, identity and location of persons in Doe’s personal and social life. Indeed, Doe answered questions about two decades’ worth of his life. This line of questioning lasted for more than 2.5 hours. Doe’s testimony in response to these questions is not relevant or material to Malibu’s single cause of action for direct copyright infringement or any of Doe’s defenses.

[....]

Dissatisfied with the lack of evidence of infringement and existence of testimony denying same, Malibu’s counsel falsely accused Doe of destroying evidence and reiterated her intention to depose Doe’s significant other (wrongly identified by Malibu as Doe’s wife). In person, at the deposition, the undersigned reiterated Doe’s objection to producing Doe’s significant other and indicated that no evidence exists as to infringement by Doe, such that testimony from any other person concerning same has no probative value and would be pursued only for purposes of harassment. Malibu’s counsel reiterated Malibu’s intention to depose Doe’s significant other and potentially other parties.

[....] While Doe is cognizant of Malibu’s ostensible desire to conduct thorough discovery, it has become apparent that, in the absence of any evidence of infringement on Doe’s part, Malibu is conducting a fishing expedition and campaign of harassment by threatening to depose nonparty witnesses on irrelevant topics and to continue to depose Doe on same. In so doing, Malibu is attempting to prevent ultimate resolution in this matter by creating the false sense that evidence of infringement or wrongdoing exists.

Judge Forrest quickly sided with the Doe and against Malibu Media:

Protective order granted. Plaintiff may not subpoena neighbors or Defendant’s significant other based on the current record. As to the neighbors, Plaintiff would be engaged in a fishing expedition and/or harassment of defendant (by way of causing embarrassment/humiliation).

The issue in this is [sic] case is did this defendant download Plaintiff’s works — not anyone living in the apartments nearby.

As to Defendant’s significant other, the Court has read the transcript of the deposition. The testimony is that any use of this woman was on Defendant’s computer. There is no evidence that the computer has or had any of Plaintiff’s copyrighted works that I can see — thus, whether the girlfriend used the computer is irrelevant.

Malibu Media is not happy about this. It is both continuing to push the issue by arguing that the Doe should be "sanctioned" for "perjury" because its "computer forensic examiner has discovered that Defendant used military grade computer wiping software to delete material evidence from his hard drive" and it has asked to subpoena Verizon to try to continue its fishing expedition.

And, yes, now we've finally gotten to Verizon which appears to be fairly pissed off about Malibu Media and has made it clear that Malibu Media's subpoena attempt is not just "defective" but flat out ridiculous.

Here, Plaintiff has not demonstrated “good cause” for extending the discovery cut-off. Its subpoena suffers from multiple defects. It was served on the eve of the discovery cut-off without affording Verizon any meaningful opportunity to investigate the alleged facts. The subpoena was issued from this district but served in Texas and purports to command the appearance of Verizon’s representatives—who reside in or near Arlington, Virginia—to testify on six days’ notice in Texas, i.e., outside the 100-mile radius for commanding testimony of a witness.... And, the subpoena seeks information far beyond that contemplated by the Cable Communications Policy Act (“Cable Act”) as discoverable from an ISP — i.e., more than the name and address of the subscriber associated with an IP address, which Verizon already provided in response to an earlier subpoena in this action. Verizon objected in writing to the current subpoena within six days of service, yet Plaintiff has made no real attempt to address those objections.

At bottom, Malibu Media’s subpoenas impose a significant, cumulative burden on Verizon, while “us[ing] the offices of the Court as an inexpensive means to gain the Doe defendants’ personal information and to coerce payment from them.” K-Beech, Inc. v. Does, 2011 U.S. ...; see also Northwestern Mem’l Hosp. v. Ashcroft,... (rejecting argument that a subpoena causes no undue burden merely because “the administrative hardship of compliance would be modest,” but considering instead “the rash of suits around the country” and the publicity generated). Given the defects in the subpoena and other problems addressed herein, Verizon respectfully submits that Plaintiff’s request for relief should be rejected.

Many people have wondered why Malibu Media/Xart have not yet faced the same sort of crackdown as Team Prenda, and it seems likely that it's only a matter of time, and the right case -- with the right judge. Getting a big ISP involved in a case seems like the kind of thing that could finally tip the scales -- as it did in one of the key Prenda cases as well.

Filed Under: copyright, copyright troll, fishing expedition, katherine forrest, subpoenas
Companies: malibu media, verizon, xart

DOJ Reasserts Its Right To Engage In Seized Data Fishing Expeditions

from the so-many-'interests,'-so-few-granted-to-individual-citizens dept

Last June, the Second Circuit appeals court restored a bit of Fourth Amendment protection to computers/devices seized by government investigators. In the case being appealed, accountant Stavros Ganias had three of his computers imaged by Army investigators looking for evidence of billing fraud and property theft. He wasn't a suspect in either of the crimes and the warrant specified investigators were only to review information from Ganias' hard drives pertinent to these allegations.

Instead, the Army held onto every piece of data it had obtained for two-and-a-half years before investigators came across data that suggested Ganias was committing tax fraud. It reoriented its investigation and obtained a warrant to search the imaged drives for more evidence of Ganias' malfeasance.

Ganias challenged this, claiming the government's inability to stay within the limits of its initial investigation violated his Fourth Amendment rights. The appeals court agreed, and tossed the evidence investigators had gathered with its second warrant.

The Government had no warrant authorizing the seizure of Ganias's personal records in 2003. By December 2004, these documents had been separated from those relevant to the investigation of American Boiler and IPM. Nevertheless, the Government continued to retain them for another year-and-a-half until it finally developed probable cause to search and seize them in 2006. Without some independent basis for its retention of those documents in the interim, the Government clearly violated Ganias's Fourth Amendment rights by retaining the files for a prolonged period of time and then using them in a future criminal investigation.

The DOJ disagreed with this finding and asked for an en banc rehearing. The court has obliged, giving the agency a second crack at receiving legal permission to engage in prolonged fishing expeditions with seized devices and data. The DOJ has filed an 86-page brief, which not only suggests investigators have every right to root around in digital unmentionables until evidence of criminal activity -- any criminal activity -- is found, but that the term "brief" is often severely misleading.

TL; DR: because warrants were issued (even if the second had nothing to do with the target of the first warrant), no Fourth Amendment violation occurred. And, if a violation did occur, here's a "good faith" band-aid.

The government’s actions in this case were reasonable and complied with the Fourth Amendment. The Fourth Amendment permits the seizure of computers to execute search warrants and further permits the retention of those computers—even if they contain non-responsive files—for legitimate government reasons, including, inter alia, evidence authentication and compliance with discovery obligations. Because the government legitimately holds the forensic images, a subsequent search of those images is generally reasonable where, as here, the search is authorized by a search warrant. But even if the government agents failed to comply with the Fourth Amendment in some respect, they acted in good faith, in reliance on two warrants, and with the goal of respecting the defendant’s Fourth Amendment rights. Accordingly, there is no basis for suppression in this case.

More specifically, the DOJ argues that the government's needs and wants (along with its possessory interest during the duration of the original investigation) supersede any privacy interest raised by Ganias. The DOJ makes only a passing reference to its fishing expedition, claiming it was prompted (mostly) by evidence not located on the seized computers.

Because the government acted reasonably in obtaining and retaining the forensic images in this case, its subsequent search of those images for evidence of tax violations by Ganias—under the authority of a new search warrant—was also reasonable. The images were legitimately in the government’s possession, and the government developed probable cause (based largely on evidence outside the retained forensic images) to believe that the images contained evidence of another crime. Thus, it is entirely reasonable for the government to obtain a subsequent search warrant to review a retained image anew. The individual’s privacy interest is protected effectively by the issuance of a second warrant.

The DOJ spends most of the brief explaining both imaging methods and the many reasons all seized data must remain intact during the course of an investigation. It devotes far fewer paragraphs to explaining why it feels it has the right to examine unrelated files for evidence of other wrongdoing. When it does finally get around to discussing this aspect of its "rummaging" efforts, it unsurprisingly decides this is best illustrated with a recounting of a child pornography investigation.

This doesn't conflate Ganias' almost-undetected tax evasion with the sexual abuse of children, because that would be pointless and crazy. It's actually more devious and disingenuous than that. It not-so-subtly implies that if the court finds rummaging through files and examinations exceeding the scope of issued warrants to be a violation of the Fourth Amendment, child pornographers will go undetected or unpunished.

Now, in all fairness to a government agency (one frequently unwilling to extend the same courtesy to others), examining hard drive images is far from straightforward and it's often difficult to determine what's relevant without looking at what isn't.. The language of affidavits isn't really built to handle the nuances of forensic data examination. Changes in technology definitely raise new concerns and issues, but the DOJ feels any new problems should be resolved in its favor.

It contends that the government retains a possessory interest in seized computers, which will almost always outweigh the interests of those whose devices have been seized. This becomes very problematic when the agency seizing the data also determines the extent of the searches and the endpoint of any investigations. While the establishment of probable cause and the securing of warrants does conform with the requirements of the Fourth Amendment, the strength of those protections can easily be undermined by the same government that's supposed to be respecting these boundaries.

The appeals court will be wading back into some very thorny issues. Hopefully, it won't result in scaled-back protections.

Filed Under: doj, fishing expedition, fourth amendment, stavros ganias

New York's Attorney General Shouldn't Be Able To Go On A Fishing Expedition Through AirBnB Hosts

from the that's-not-how-the-law-works dept

In an odd bit of timing, I happen to be writing this post in a nice studio apartment in Midtown Manhattan, which I was able to rent via AirBnB, which has turned out to be a great find. I'm in NYC for a conference and some meetings, and while the conference offered a "special rate" on a hotel, this better located, much nicer, full studio apartment was more than $100 cheaper per night. The owner is a really nice guy who's able to make some money renting out this apartment -- and he's legitimately worried that NY is going to shut this down. And yet, as we noted last month, NY's grandstanding attorney general (is there any other kind?), Eric Schneiderman, has demanded that AirBnB turn over information on every host in NY in an insane fishing trip. His office claims it's just looking for "bad" AirBnB users -- mainly those doing "long-term illegal rentals," but that shouldn't allow for a massive fishing trip into the activities of the 15,000 hosts in the state of NY.

The EFF and CDT have now filed an excellent brief arguing that Schneiderman has no right to this vast treasure trove of information.

"Indiscriminate subpoenas that seek the identity and other personal information of thousands of Internet users without specific justification are improper and should be quashed," EFF Senior Staff Attorney Matt Zimmerman said. "It is not enough for the state to speculate that some Airbnb users might have broken some law at some unknown point. An online service's users deserve to be protected from fishing expeditions like this one."

In the brief, the groups argue that this is a threat to plenty of people's privacy.

While Airbnb has opposed the subpoena, innocent third parties should not have to rely on a company to protect their private interests.... The Attorney General has not curtailed its request to what it is legitimately entitled to receive, and this type of unfettered dragnet collection of user records should be denied.

Hopefully, the court will quash this overbroad subpoena, and NY will make it clear that merely renting out your place doesn't subject you to random fishing expeditions for information from the state's attorney general.

Filed Under: eric schneiderman, fishing expedition, ny
Companies: airbnb, cdt, eff