Government Goes 'Judge Shopping' For Email Warrant Rubber Stamp, Gets Request Shot Down By Second Judge In A Row

from the setting-the-example-for-our-nation's-law-enforcement-agencies dept

As we covered recently, a couple of magistrate judges (Judge John Facciola and Judge David Waxse) have started pushing back against the government's broad warrant requests for electronic data. Facciola has now twice sent the government back to rewrite its warrant requests, once in relation to a seized iPhone and another dealing with a person's Gmail account. In the latter, Facciola stated the following:

[T]he government continues to submit overly broad warrants and makes no effort to balance the law enforcement interests against the obvious expectation of privacy e-mail account holders have in their communications.

The government apparently decided that rather than narrow its request, it would just ask another judge. It took this warrant request all the way across the nation to another magistrate judge in California, hoping to get the rubber stamp it couldn't coax out of the Washington, DC court. Judge Paul Grewal of California's Northern District has just joined Facciola in rejecting the request as being overly broad. He attacks the government's wish to "seize first, search later" approach as inappropriate for the securing of data stored by third parties, which face none of the limitations inherent to searching a computer on site.

The court is nevertheless unpersuaded that the particular seize first, search second proposed here is reasonable in the Fourth Amendment sense of the word. On past occasions, the government at least submitted a date restriction. Here, there is no date restriction of any kind. The activity described in the application began in 2010; Gmail has been broadly available since 2007 and in beta release "since 2004." Nor has the government made any kind of commitment to return or destroy evidence that is not relevant to its investigation. This unrestricted right to retain and use every bit Google coughs up undermines the entire effort the application otherwise makes to limit the obvious impact under the plain view doctrine of providing such unfettered government access.

Even though the warrant and all other court documents are sealed, based on what Grewal states here, it's reasonable to assume the government is seeking every email in this account, dating back to the account's creation. This sort of broad seizure meets no reasonable person's definition of "relevant," especially considering the lack of timeframe limitation.

Grewal goes on from there to criticize the government for its attempt to find someone to rubber stamp its haystack-building efforts.

A final point. This is not the first time that the substance of this application has been before a magistrate judge. On March 26, 2014, United States Magistrate Judge John Facciola denied a previous application for a similar warrant in the United States District Court for the District of Columbia.

The judge grants the government points for not attempting to hide its intentions, but doesn't let it off the hook for its unwillingness to narrow its warrant request.

But there is a long-recognized presumption against duplicating court efforts, what some charitably call "judge shopping."

He points out that the government had other options, including modifying its request or seekng a writ of mandamus. Instead, he states, the government made the shadiest and shabbiest choice: taking its business elsewhere. But it didn't work, and the government's warrant request has again been denied. Judge Grewal doesn't even give the government the option of rewriting and resubmitting, meaning it's probably going to have to take another run at this warrant in front of Judge Facciola. Or maybe it will just go on a tour of courthouses until it finds the rubber stamp it wants -- one that doesn't care about the messy paper trail of failure it's leaving behind it.

Filed Under: doj, email, john facciola, judge shopping, paul grewal, warrant

Obama Apparently Ready To Kill Bulk Phone Record Collection... As New House Bill Lowers Standards For Data Collection

from the how's-that-going-to-work dept

With two of his own review panels saying that the bulk collection of phone records under Section 215 of the PATRIOT Act had failed to produce anything of value, and one of them clearly stating that it was also illegal and unconstitutional, the NY Times is reporting that President Obama is finally ready to call for the true end of the NSA's bulk collection of phone records. Surprisingly, according to that report, President Obama is willing to do this without adding data retention requirements for the telcos to hold onto that data themselves. If true, that really is a pretty big deal -- though it only covers the issue of the bulk phone records collection. That leaves other forms of bulk collection under Section 215 in place. So, in effect, it seems like an agreement to kill off the one high profile problematic program that hasn't been remotely useful, rather than a full policy shift. It's a start, however.

Unfortunately, at the same time that's happening, it appears that the House Intelligence Committee, run by Rep. Mike Rogers is pushing a new bill that would take a step towards limiting some aspects of the NSA's data collection powers, but also lowering the standard by which the government could collect specific information:

The bill, titled the End Bulk Collection Act of 2014 and currently circulating on Capitol Hill, would prevent the government from acquiring "records of any electronic communication without the use of specific identifiers or selection terms," some 10 months after the Guardian first exposed the bulk collection based on leaks by the whistleblower Edward Snowden.

But the bill would allow the government to collect electronic communications records based on "reasonable articulable suspicion", rather than probable cause or relevance to a terrorism investigation, from someone deemed to be an agent of a foreign power, associated with an agent of a foreign power, or "in contact with, or known to, a suspected agent of a foreign power."

While a separate report says that this House bill would actually ban the mass collection of other types of data (including internet activity) as well as phone records (i.e., going further than the Obama proposal), it would leave out the requirement that a court approve specific requests for information before it's submitted to a company.

But unlike other pending legislation, it does not call for judicial approval of a specific phone number before a request for data is submitted to a company.

The Rogers-Ruppersberger legislation would have the court make that determination “promptly” after the FBI submits a number to a phone company. If the court did not approve the number as being linked to an agent of a foreign power, including terrorist groups, the data collected would be expunged.

The details of these proposals are going to matter a lot. The full House bill is expected to be introduced in a few hours, and it will take some time to go through the details to see if there are any dangerous easter eggs hidden in there. Still, for all the arguments from Rep. Rogers and the Obama administration about how "necessary" these programs have been and how horrible it's been that Ed Snowden revealed the details to the press, these moves show just how much of an impact the Snowden leaks have had on the public debate concerning surveillance. It will take some time to sort through the details of these proposals, but it's safe to say without Snowden's actions, none of this would be happening.

Filed Under: barack obama, bulk collection, metadata, mike rogers, phone records, reasonable articulable suspicion, section 215, warrant

Appeals Court Reverses Previous Decision That Found Warrants Used In Kim Dotcom's Arrest 'Invalid'

from the the-wheels-of-justice-also-apparently-tread-water dept

The Kim Dotcom saga rolls on. The legal process that resulted in Dotcom's New Zealand mansion being raided by local police was always questionable, a fact that was never more obvious than when a New Zealand high court judge declared the warrants used in the raid "invalid" because they were "general warrants" that failed to specify what offense justified the raid as well as what particular items were being sought.

As Mike noted then, the warrants were problematic because they failed to specify which US law(s) had been broken (or whose laws, for that matter), something rather important in a case being run by the US government. A New Zealand appeals court saw things differently, however.

A New Zealand appeals court ruled Wednesday that police acted legally when armed officers raided Megaupload founder Kim Dotcom's Auckland mansion as part of a US-led online piracy probe.

The decision overturned an earlier finding that the January 2012 dawn raid was unlawful because the search warrants police used were too broad to be considered reasonable.

According to the appeals court, the warrants weren't invalid, but just mildly screwed up.

An appeals bench of three judges found the warrants were "defective in some respects" but not enough to render them invalid.

"This really was a case of error of expression. The defects were defects in form not in substance," they said in a 44-page written judgement.

As the appeals court sees it, failing to specify which set of laws was being applied (US/New Zealand) is more like a typo than an indication that the underlying legal basis is flawed. I would hazard a guess that "errors of expression" are the sort of thing that tend to crop up more frequently when one law enforcement agency acts on the behalf of another country's government… which is in turn acting on behalf of an industry.

And this warrant discussion isn't completely over. Dotcom's team is planning to appeal the decision, which will subject these admittedly faulty (by two courts!) warrants to another round of scrutiny, something that can't be welcome news for the US government's prosecution team.

Filed Under: kim dotcom, new zealand, warrant

Feds Won't Challenge Ruling That Says It Needs A Warrant To Put GPS Devices On Cars... For Now

from the but-we'll-see-if-that-stays dept

Back in October, we wrote about the Third Circuit appeals court ruling that attaching a GPS device to someone's car required a warrant. While the Justice Department is now challenging the part of that decision which said that the evidence obtained via the warrantless GPS use must be sustained (the government is arguing for a "good faith exception" to let it use the information under the belief that it was collected legally -- basically saying if they knew it required a warrant they would have gotten one), it has decided to not challenge the larger point that a warrant is needed to attach a GPS device to a car. That's good news, but it's only a little bit of good news.

The government does say that it "respectfully disagrees with the Court's requirement of a warrant to install and use a GPS device" but isn't seeking a review of that ruling. That, most likely, means that it's just waiting for another court to rule on the matter in a different circuit (and hoping for a better outcome) and can pit those two circuits against each other in a Supreme Court review. So, basically, it's just avoiding the issue for the time being.

Filed Under: doj, gps, location, privacy, warrant

Megaupload Tells Court That DOJ Deliberately Misled Court In Getting Warrant

from the more-problems dept

Lawyers for Megaupload have filed a motion with the court handling the US side of the prosecution against the company, arguing that the original warrants were defective due to blatant misrepresentations by the government. As you may recall, in the case involving Kyle Goodwin, a Megaupload user who is trying to get his data back, he had to ask the court to unseal the warrant the DOJ used to seize Megaupload because the government had kept it secret. While the Justice Department went ballistic trying to prevent this unsealing, the judge allowed it to happen. And it didn't take long to figure out why the DOJ preferred to keep it private because among a bunch of problems, was the big one: a key bit of evidence that the DOJ used against Megaupload to prove that it had "knowledge" of illegal activity on its servers existed because the government -- via service provider Carpathia -- had explicitly told Megaupload to hold onto certain data since it was a part of a criminal investigation.

As Megaupload points out in this filing, it's particularly ridiculous that Megaupload was told to hold onto certain information as part of a criminal investigation -- to which it complied -- and then that very fact is being used against it, because it didn't delete the info. And, of course, the DOJ didn't explain the context in getting the warrant.

This Court recently ordered the unsealing of the documents previously submitted by the United States to support taking down the Megaupload cloud storage site by seizing the domain name(s) --- such unsealing lays bare a crucial omission the Government made to the Court in the secret process.  Specifically, the Government’s affidavits underpinning the warrants omitted critical, exculpatory information regarding whether, why and how Megaupload knew it was hosting criminally infringing files.  The Government represented that, “[o]n or about June 24, 2010, members of the Mega Conspiracy were informed, pursuant to a criminal search warrant from the U.S. District Court for the Eastern District of Virginia, that thirty-nine infringing copies of copyrighted motion pictures were present on their leased servers at Carpathia Hosting, a hosting company headquartered in the Eastern District of Virginia,” and that, “[a]s of November 18, 2011, thirty-six of the thirty-nine infringing copies of copyrighted motion pictures were still being stored on servers controlled by the Mega Conspiracy,” after it was informed of the infringing content.... This snippet—which appears in each relevant affidavit and is the only direct, corroborated evidence the Government purports to offer as proof that Megaupload had requisite knowledge—suggests that Megaupload was warned of its potentially criminal complicity yet persisted in hosting the files without concern for their illegal content.  The affidavits, in short, paint Megaupload as a brazen scofflaw. 

The truth, as the Government well knows, is quite different.  Megaupload had every reason to retain those files in good faith because the Government had sought and obtained Megaupload’s cooperation in retrieving the files and warned that alerting users to the existence of the warrant and the Government’s interest in the files could compromise the investigation.  Carpathia informed Megaupload that the warrant was sealed, and that only Carpathia and Megaupload, not the users of the infringing files, were to know of its existence, and at the Government’s request provided Megaupload a copy of the sealing order. The Government selectively parsed its account so as to exclude critical facts that negate any notion that Megaupload had criminal mens rea to retain the infringing files.  The Government deliberately neglected to apprise the Court that:

•       Megaupload received the June 24, 2010 warrant in the course of cooperating with a Government investigation; 
•       Megaupload was informed of the June 24, 2010 warrant by its vendor, Carpathia Hosting (“Carpathia”), with the Government’s consent and for the express purpose of obtaining Megaupload’s voluntary assistance with executing the warrant;
•       The Government declined to communicate directly with Megaupload about the warrant, instead deputizing Carpathia to communicate on its behalf;
• Carpathia directed Megaupload not to open “EM7 tickets” on the infringing files—which would have alerted a larger number of people to the existence of the warrant and jeopardized the secrecy of the investigation—“[b]ecause of the Government’s seal on the warrant,” asking that Megaupload instead deal directly with a single person at Carpathia;
• Megaupload’s preservation of the status quo, particularly by not taking down or otherwise disturbing the files identified in the June 24, 2010 warrant, was faithful to the Government’s express desire, reflected by the Magistrate Judge’s order sealing the warrant (provided to Megaupload by Carpathia at the Government’s request) and by Carpathia’s instructions on the Government’s behalf, for Megaupload to ensure that evidence would remain preserved and that the target users would remain unaware of the investigation; and
• Consistent with its stated desire that the warrant and investigation remain confidential so as not to tip off the target users, the Government—neither directly nor through Carpathia—ever requested that Megaupload take down the files identified in the June 24, 2010 warrant.

Megaupload is now arguing that the warrant and the seizure itself were defective and need to be overturned based on the fact that they were completely misleading on this bit evidence. In fact, the government specifically appears to have instructed Carpathia to tell Megaupload (1) to retain the files in question and (2) that Megaupload was not the subject of the investigation:

Nowhere did the Government tell this Court that its June 24, 2010 warrant had been calculated to enlist good-faith cooperation with a criminal investigation, while preserving the secrecy thereof. Nowhere did the Government tell this Court that the Government had sought Megaupload's voluntary assistance in executing the warrant. Nowhere did the Government tell this Court that Carpathia had assured Megaupload, in the interests of its requested cooperation, that there was no basis to believe that Megaupload was a target. Nowhere did the Government tell this Court that Megaupload had in fact cooperated precisely as requested. Most importantly and most troublingly, nowhere did the Government tell this Court that Megaupload had been informed by Carpathia, acting on behalf of the Government and heeding the Government's insistence upon sealing, that the secrecy of the warrant and the Government's investigation must be preserved to avoid destruction of evidence and notification of the targeted users. Nor did the Government inform this Court that the sealing order it had obtained and furnished Carpathia to provide to Megaupload likewise required secrecy and expressly specified that [redacted ]. In sum, nowhere did the Government tell this Court that Megaupload had done exactly what the Government had asked it to do--execute a search warrant without alerting the ostensible targets to the existence of an investigation. The Government's contention to this Court that Megaupload's preservation of the status quo was evidence of criminal intent is false, and deliberately so.

Attached is an exhibit in which Carpathia explicitly says it told the DOJ that Megaupload was happy to cooperate with the US government on such investigations.

Given its responses so far, I fully expect the government to go ballistic over this filing as well, but with each filing, their case looks weaker and weaker. As we've said in the past, it really does seem like DOJ agents were taken in by Hollywood's story about how Megaupload was pure evil and that was obvious to anyone -- and, as such, the DOJ could take various shortcuts in bringing the site and Kim Dotcom down. To be honest, what's still incredible to me about all of this is that, prior to the takedown, I probably would have agreed that Megaupload was likely a "bad player" in the space and that Dotcom had a reputation of thumbing his nose at the law. But as more and more details have become clear, it's looking more and more like the DOJ cut corners so badly that it's entire case may be at risk. If true, this will be a massive embarrassment for anyone at the DOJ associated with the case.

Filed Under: doj, misleading, warrant
Companies: megaupload

Apparently, Congress Isn't Actually Interested In Requiring A Warrant For Law Enforcement To Read Your Email

from the it-was-all-a-charade dept

Yes, we've already covered the rejection of key amendments in the FISA Amendments Act renewal, but that wasn't the only case of Congress ignoring the public's privacy concerns as they close out this session.

Back in September, we noted that Senator Patrick Leahy, who has been working on much needed reforms for ECPA (the Electronic Communications Privacy Act) -- such as requiring law enforcement get a warrant to read your email -- had attached his ECPA reform plan to an update of the Video Privacy Protection Act (VPPA). While I know some privacy folks were worried about this update to the VPPA, I don't have much of a problem with it. The original VPPA, written as a quick response to a video store revealing Robert Bork's (somewhat boring) video rental history during his Supreme Court nomination hearings, did seem a bit limiting -- especially for online video sites such as Netflix that wanted to add some useful social features. However, it was the ECPA reform part that was more important. Attaching ECPA reform to VPPA reform didn't make some privacy folks happy, but they seemed willing to go along with the VPPA changes if it really meant that we'd get warrant requirements for emails and other digital messages.

There were some attempts to water down that ECPA reform at the end of last month, but the Senate Judiciary Committee kept the warrant requirement in there and rejected various attempts to weaken the bill. As we noted, however, it still was a long way from becoming law, given the need to pass a full Senate vote and to have a companion House bill make the rounds. We assumed that there would be no movement until next year and the new Congress.

But... late last week, the House rubberstamped the VPPA update, and the Senate, almost immediately signed off on the House's version, which the President is expected to sign any moment now. In case you missed it, that means that the ECPA reforms -- which were supposed to be bundled with the VPPA to make the whole thing palatable -- got dropped entirely. And now we get the VPPA reforms and no ECPA reform at all. Neat trick. "Bundle" two things to get support... and then at the last minute drop one part and rush through the other.

Filed Under: congress, ecpa reform, privacy, vppa, warrant

No Warrant, No Problem: The Government Can Still Get Your Data

from the privacy?-what's-that? dept

Pro Publica has done it again. They've put together a great report on how the government can usually get your digital data without bothering to get a warrant. On top of that, they line it up with what the law actually says about the subject. Here are just a couple examples, but check out the whole thing: Beyond phone records and location data, they explain how law enforcement can get IP addresses, emails, email drafts (treated differently than emails), text messages, general cloud data and social media information. And... the shorthand version is that the government can pretty much look at an awful lot of your data with very little judicial oversight.

Filed Under: data, government, privacy, warrant

EFF Files Motion To Have Court Release Seizure Warrant In Megaupload Case

from the should-be-public-info dept

In the ongoing case involving Kyle Goodwin trying to get back the content that he backed up via Megaupload and lost as a result of the US taking down the site, the EFF (representing Goodwin) has asked the court to unseal the initial seizure warrants that the US relied on to grab the Megaupload servers from hosting company Carpathia. They point out the number of concerns that New Zealand courts have raised with the legitimacy of the warrants, as well as some basic principles related to the limits on such warrants within the US.

.... these materials will certainly assist him to learn what steps, if any, the government took to inform the court of the scope of its planned seizure and related execution of search warrants. They would also show any plan provided by the government or the court in the warrant materials for minimization to protect innocent users before the seizure or to segregate the data after seizure. Federal judges increasingly impose detailed conditions prior to execution of computer searches.... For example, Judge Kozinski in the Ninth Circuit has observed that if the government refuses to forswear the ability to retain or use data that should have been segregated initially, the judge “should order that the seizable and non-seizable data be separated by an independent third party under the supervision of the court, or deny the warrant altogether.” .... Unsealing will allow Mr. Goodwin, as well as the general public, to learn which, if any, such conditions were undertaken in this case.

Similarly, under the Fourth Amendment people have a right to be secure in their “papers” and “effects” against unreasonable searches and seizures. A person's “effects” may be the subject of Fourth Amendment protection even where there is no particular privacy or liberty interest.... A property seizure occurs when a governmental intrusion meaningfully interferes with an individual's possessory interest.... The Fourth Amendment analysis, in turn, requires the Court to determine whether the seizure was “reasonable.” Gaining access to the materials that served as a basis for the government’s seizure of his property can assist Mr. Goodwin and other innocent Megaupload users in determining whether the seizure was unreasonable.

Separately, they note that there is tremendous public interest in revealing these details, and criminal cases should be done as publicly as possible. And, considering how frequently the US government is now seizing websites, the issue is of tremendous importance:

The public also has a strong interest in understanding the government process in executing search warrants on cloud computing servers that contain innocent third-party property. Seizures of domain names, and resulting searches of related servers, are tools the government is using with increasing frequency in criminal copyright enforcement actions. For example, the federal government has reportedly seized more than 800 websites so far under its Operation in our Sites campaign. The government has issued press releases and otherwise sought to publicize its efforts, obviously giving its own perspective on its actions. Legislators, the media, and the public are vigorously debating the very issue of these domain name seizures and related searches, even as a large percentage of Americans continue to use cloud computing services. Access to judicial records would ensure a more accurate and informed public debate, rather than one informed merely by the government’s press releases

Finally, they note that the government has already said it has no more need for the servers in question, so why would it make sense to keep the seizure warrant sealed? It seems difficult to argue with any of these points... but I have a feeling that the US Attorneys are about to try to do exactly that...

Filed Under: kyle goodwin, seizure, warrant
Companies: eff, megaupload

Supreme Court Will Weigh In On Warrantless GPS Tracking

from the finally dept

We've been covering for a while now the rather mixed results from courts concerning the legality of police sticking a GPS transmitter on a car without a warrant in order to track a suspect. While some state courts have said such tracking is illegal, most federal courts have gone the other direction, saying that it's fine. Last summer, we noted that the DC Circuit court made a somewhat surprising ruling, saying that when the GPS tracking was "long-term," it suddenly switched from being legal to illegal. This odd standard (how long the tracking goes on for) seemed somewhat arbitrary. But, more importantly, the fact that different federal circuits disagreed with the legality of such things set up what we felt was an inevitable Supreme Court case.

And now it's here. Earlier this week, the Supreme Court announced that it would hear the appeal on that DC circuit case, United States v. Jones. This means, of course, that the issue will be settled once and for all, assuming the Court gives a clear ruling (something it doesn't always do). I do worry that it will merely cement what the other appeals courts have said, and basically diminish the Fourth Amendment even further. The feds have made it clear that they'd like to ignore the Fourth Amendment in such cases, and it would be nice if the Court tells them they cannot do that.

Filed Under: 4th amendment, gps, privacy, supreme court, warrant