DOJ Goes Way Overboard: Demands All Info On Visitors Of Anti-Trump Site

from the the-doj-going-too-far?-what-a-surprise dept

Not all search warrants are bad. Indeed, most of them are perfectly legitimate, and meet the qualifications under the 4th Amendment that there is probable cause of a crime being committed, and the warrant is narrowly tailored to seek out evidence to support that. But... not always. As Ken "Popehat" White explains in a recent blog post, the Justice Department has somehow obtained the mother-of-all bad search warrants while trying to track down people who were involved in protests of Donald Trump's inauguration back in January. The government has brought felony charges against a bunch of protestors from the inauguration, and now it appears the DOJ is going on a big fishing expedition.

As Ken notes, it's quite likely that some protestors committed crimes, for which they can be charged, but prosecutors in the case have decided to go ridiculously overbroad in trying to get any info they can find on protestors. They got a search warrant for the well known hosting company DreamHost, which hosts the site disruptj20.org (as an aside, the fact that a site like that doesn't default to HTTPS for all connections is really, really unfortunate, especially given the rest of this article). The warrant basically demands everything that DreamHost could possibly have on anyone who did anything on disruptj20, including just visiting. As White notes in his post, it's not that unreasonable that the DOJ sought to find out who ran the site, but now they're requesting basically everything, which likely includes the IP addresses of all visitors:

a. all records or other information pertaining to that account or identifier, including all files, databases, and database records stored by DreamHost in relation to that account or identifier;
b. all information in the possession of DreamHost that might identify the subscribers related to those accounts or identifiers, including names, addresses, telephone numbers and other identifiers, e-mail addresses, business information, the length of service (including start date), means and source of payment for services (including any credit card or bank account number), and information about any domain name registration;
c. all records pertaining to the types of service utilized by the user,
d. all records pertaining to communications between DreamHost and any person regarding the account or identifier, including contacts with support services and records of actions taken.

DreamHost, quite reasonably, found this to be somewhat overbroad and refused to immediately reply, instead having a lawyer ask the DOJ to clarify the request, while making it clear it felt the warrant was likely both vague and overlybroad. The DOJ then asked the court to compel the company to hand over the info, insisting there is "no legal basis for failing to produce" the requested information. DreamHost has now responded in court, saying that the warrant violates the 4th Amendment and appears to endanger the 1st Amendment rights of protestors. They also claim that it violates the Privacy Protection Act and that there are some jurisdictional issues with it as well. DreamHost also has a nice blog post about the whole thing:

This is, in our opinion, a strong example of investigatory overreach and a clear abuse of government authority.

Or, as the filing notes:

Where a search warrant endangers First Amendment interests, the warrant must be scrutinized with “particular exactitude” under the Fourth Amendment. See Zurcher v. Stanford Daily, 436 U.S. 547, 565 (1978). “The First Amendment is often inconvenient. But that is beside the point. Inconvenience does not absolve the government of its obligation to tolerate speech.” Int’l Soc’y for Krishna Consciousness, Inc. v. Lee, 505 U.S. 672, 701 (1992) (Kennedy, J., concurring). The government’s search warrant (“Search Warrant”) here requires non-party DreamHost, LLC (“DreamHost”) to turn over every piece of information it has about every visitor to a website expressing political views concerning the current administration. This information includes the IP address for the visitor, the website pages viewed by the visitor, even a detailed description of software running in the visitor’s computer. In essence, the Search Warrant not only aims to identify the political dissidents of the current administration, but attempts to identify and understand what content each of these dissidents viewed on the website. The Search Warrant also includes a demand that DreamHost disclose the content of all e-mail inquiries and comments submitted from numerous private e-mail accounts and prompted by the website, all through a single sweeping warrant.

The Search Warrant cannot survive scrutiny under the heightened particular exactitude standard required by the presence of the First Amendment issues. It fails to identify with the required particularity what will be seized by the government. It also fails to provide DreamHost with any assurance that the government will return or destroy the large portion of the information irrelevant to the government’s criminal case or cases. These features render the Search Warrant unreasonable under the Fourth Amendment. In addition, the Search Warrant violates the privacy protections of the Privacy Protection Act, a statute enacted specifically to address such instances, and is without a jurisdictional basis.

As Ken White points out, this fishing expedition by the DOJ should concern us all:

The Department of Justice isn't just seeking communications by the defendants in its case. It's seeking the records of every single contact with the site — the IP address and other details of every American opposed enough to Trump to visit the site and explore political activism. It seeks the communications with and through the site of everyone who visited and commented, whether or not that communication is part of a crime or just political expression about the President of the United States. The government has made no effort whatsoever to limit the warrant to actual evidence of any particular crime. If you visited the site, if you left a message, they want to know who and where you are — whether or not you did anything but watch TV on inauguration day. This is chilling, particularly when it comes from an administration that has expressed so much overt hostility to protesters, so relentlessly conflated all protesters with those who break the law, and so deliberately framed America as being at war with the administration's domestic enemies.

Of course, the DOJ overreaching is nothing new. We just spent eight years highlighting DOJ overreach during the Obama administration (and another eight of overreach under the Bush administration). But it is particularly scary to see just how far this overreach is and that it's coming from an administration that has shown itself to be significantly less tolerant of the First Amendment rights of protestors than basically any predecessor.

Filed Under: 4th amendment, disruptj20, doj, donald trump, fishing expedition, inauguration, warrant
Companies: dreamhost

ACLU Tells Court Long-Term Cell Site Location Tracking Should Require A Warrant

from the people-like-cellphones-much-more-than-they-like-their-government dept

The Supreme Court is going to take a look at the Fourth Amendment implications of warrantless access to historic cell site location information. The outlook for a Fourth Amendment win isn't particularly hopeful, given that there's no circuit split to be resolved. The lone holdout was the Fourth Circuit -- which originally had problems with the long-term collection of location information -- but that court reversed its earlier decision to align with other circuits which have addressed the issue.

That doesn't mean no one should try! Who knows what the court might decide, especially given the shifting telecommunications landscape. After all, it has managed to budge the 4th a wee bit now and then, even in decisions that were mostly punts or calls for the aggrieved to take it up with their Congressional reps.

The ACLU has filed a brief [PDF] on behalf of the appellants, pointing out what should be obvious: cell site location info isn't Just Another Third Party Record. It's a proxy tracking system for law enforcement, which can access this data without warrants. And it's only getting more precise every day.

Service providers have long retained location information for the start and end of incoming and outgoing calls. Today, those companies increasingly also retain location information related to the transmission of text messages and routine internet connections—which smartphones make virtually constantly to check for new emails, social media messages, weather updates, and other functions. The information recorded can include not only cell site and sector, but also estimated distance of the phone from the nearest cell site. Id. Location precision is also increasing as service providers deploy millions of “small cells,” “which cover a very specific area, such as one floor of a building, the waiting room of an office, or a single home.” United States v. Graham, 824 F.3d 421, 448 (4th Cir. 2016) (en banc) (Wynn, J., dissenting in part and concurring in the judgment) (citation omitted); see also Hoy, supra, at 69-70. All told, a typical smartphone connects to cell towers hundreds of times a day, generating a densely pixelated matrix of data points documenting the user’s movements. The volume and precision of that data will grow steadily in coming years, generating ever more granular locational information.

The ACLU notes Congress itself has granted consumer protections for CSLI, giving customers control over who has access to this data. Unfortunately, multiple courts have ruled that, since cell providers have access to the info and customers are at least somewhat aware their phones must connect to towers to provide service, this information can be obtained by the government with only a subpoena. (And, obviously, without the customer's consent.) In some rulings, this has been extended to real-time location tracking, with law enforcement officers basically shoulder-surfing telco computers for pings.

The brief draws a connection between virtual location tracking with CSLI and the Supreme Court's Jones decision, which dealt with long-term tracking of individuals with concealed GPS tracking devices. That decision didn't quite establish a warrant requirement, but did suggest warrantless long-term location tracking raised a number of Fourth Amendment issues.

Allowing law enforcement agencies to use service providers as tracking devices is a problem. It shouldn't really make a difference whether it's long-term or short-term, but the tremendous amount of location data automatically gathered can provide an extremely in-depth examination of someone's life, all through the magic of third-party records.

Worse, long-term tracking through CSLI exposes even more of a person's movements to the government. Phones go places cars don't. A suspect could "opt out" of GPS data collection by walking, using public transportation, or riding in vehicles without tracking devices. But people's phones go everywhere they go. Having this wealth of information on tap is a boon for law enforcement. Obtaining a warrant isn't some sort of insurmountable obstacle. The world has changed incredibly since 1979, which is when the Supreme Court created the Third Party Doctrine out of thin air. If nothing else, this case should give it the opportunity to take another look at a decision headed into its fourth decade and see if it still remains relevant in a world where almost every citizen carries around a proxy government tracking device wherever they go.

Filed Under: 4th amendment, csli, location info, supreme court, warrant
Companies: aclu

First Playpen FBI Spyware Warrant Hits The Appeals Court Level; Is Upheld On 'Good Faith'

from the faith-based-decision-making dept

The first FBI Playpen investigation warrant challenge to reach the appellate level has been denied. Andrew Workman moved to suppress evidence obtained by the FBI's Network Investigative Technique (NIT) because warrant was deployed far outside its Eastern District of Virginia jurisdiction. Workman lives in Colorado.

The Tenth Circuit Appeals Court decision [PDF] starts with a light treatise on how technology is outpacing the law and the difficulties this poses for law enforcement agencies used to obtaining identifying information with nothing more than a subpoena.

The advent of the internet created new opportunities for viewers of child pornography, allowing immediate access to illicit websites. Use of these sites frequently leaves a computerized trail, allowing the FBI to find viewers of child pornography. But technological advances have allowed viewers of child pornography to access illicit websites without leaving a trail. To monitor access to one such website, the FBI has tried to keep up; in this case, the FBI seized and assumed control, using malware to identify and find the individuals accessing child pornography.

Though the FBI controlled the website, users lived throughout the nation. To find the users, the FBI needed a warrant. But, a paradox existed. The FBI maintained the website in the Eastern District of Virginia, but users were spread out all over the country. Finding those users could prove difficult because of geographic constraints on the FBI’s ability to obtain a warrant. Notwithstanding these constraints, the FBI obtained a warrant that led to the discovery of hundreds of viewers of child pornography. One was the defendant, who faced prosecution in the District of Colorado.

This gives the reader early notice on where the decision is heading. The lower court found [PDF] the FBI's warrant invalid because its NIT traveled far outside its authorized jurisdiction. The appeals court agrees the warrant is invalid, but says the evidence shouldn't be suppressed.

The district court shot down the government's arguments for the warrant's validity, pointing out that while the seized child porn server resided in Virginia, the information gathered by the FBI's malware was obtained from computers outside the district. The government also tried to portray the NIT as a tracking device, in hopes of putting its warrant back on firmer Rule 41 ground, but the lower court shot that down as well.

In this decision, the Appeals Court grants the FBI "good faith." While doing so, it directly contradicts the lower court's findings on both issues.

We start with the presumption that the executing agents “acted in good-faith reliance upon the warrant.” United States v. Campbell, 603 F.3d 1218, 1225 (10th Cir. 2010). This presumption is bolstered by what the executing agents would have known:

1. The software was installed in a government server located in the Eastern District of Virginia.

2. The magistrate judge, who issued the warrant, was in the Eastern District of Virginia.

3. All of the information yielded from the search would be retrieved in the Eastern District of Virginia.

With these facts, the executing agents could reasonably rely on the magistrate judge’s authority to issue a warrant authorizing installation of software and retrieval of information in the Eastern District of Virginia.

This was the lower court's finding:

I am not persuaded by the government’s argument. Rule 41(b)(2) applies to property located in the same district as the magistrate judge at the time the warrant is issued. As stated above, the NIT was designed to search “activating computers,” and, in this case, Mr. Workman’s computer was located in the District of Colorado when the warrant was issued. Further, there is no evidence that the property (information) to be seized, such as Mr. Workman’s IP address, was located in the Eastern District of Virginia at the time the warrant was issued either.

Here's the lower court on the "tracking device" argument:

While it is tempting to view the NIT as a tracking device, the reality of the technology at issue here is that the NIT did not “track the movement of . . . property” as Rule 41(b)(4) contemplates. The government did not obtain Mr. Workman’s IP address by tracking the data as it moved through various relay nodes back to Mr. Workman’s computer. Rather, the government, through the NIT, searched Mr. Workman’s computer and seized his IP address along with various other pieces of information.

In response, the appeals court just says the FBI needs to defer to the magistrate issuing the warrant because technical things are too complicated for agents to sufficiently grasp.

It is true that the affiant and magistrate judge never mentioned the term “tracking device,” and the FBI’s method differs from more conventional tracking devices. But the executing agents lacked precedents on these issues and could reasonably defer to the magistrate judge on these nuanced legal issues.

In fact, it's ignorance that saves the day, as it often does when courts hand down "good faith" rulings. The less law enforcement knows, the more likely it is the evidence won't be suppressed.

We expect agents executing warrants to be “reasonably well-trained,” but we do not expect them to understand legal nuances the way that an attorney would.

No, we don't expect law enforcement officers to be lawyers but we do expect them to be aware of the same jurisdictional limits the FBI was petitioning the government to have lifted. It's inconceivable the agent requesting the warrant -- an agent the government uses as an expert witness -- didn't know the reach of the NIT would extend far beyond the jurisdiction it was approved for.

Filed Under: 10th circuit, 4th amendment, fbi, good faith, network investigative technique, nit, playpen, privacy, warrant

Cops Sent Warrant To Facebook To Dig Up Dirt On Woman Whose Boyfriend They Had Just Killed

from the blue-lives-are-more-equal-than-others dept

Everything anyone has ever said about staying safe while interacting with the police is wrong. That citizens are told to comport themselves in complete obeisance just to avoid being beaten or shot by officers is itself bizarre -- an insane inversion of the term "public servant." But Philando Castile, who was shot five times and killed by (now former) Officer Jeronimo Yanez, played by all the rules (which look suspiciously like the same instructions given to stay "safe" during an armed robbery). It didn't matter.

Castile didn't have a criminal record -- or at least nothing on it that mattered. Otherwise, he wouldn't have been allowed to own a weapon, much less obtain a permit to conceal the gun. Castile told Yanez -- as the permit requires -- he had a concealed weapon. He tried to respond to the officer's demand for his ID, reaching into his pocket. For both of these compliant efforts, he was killed.

Castile's shooting might have gone unnoticed -- washed into the jet stream of "officer-involved killings" that happen over 1,000 time a year. But his girlfriend, Diamond Reynolds, immediately live-streamed the aftermath via Facebook. Her boyfriend bled out while responding officers tried to figure out what to do, beyond call for more backup to handle a dead black man sitting in his own vehicle. Only after Yanez fired seven bullets into the cab of the vehicle did officers finally remove his girlfriend's four year old daughter.

To "win" at killing citizens, you must start the spin immediately. Yanez spun his own, speaking to a lawyer less than two hours after killing Castile. Local law enforcement did the same thing. Documents obtained by Tony Webster show Special Agent Bill O'Donnell issued a warrant to Facebook for "all information retained" by the company on Diamond Reynolds, Castile's girlfriend. This was to include all email sent or received by that account, as well as "chat logs," which presumably means the content of private messages. The warrant also demands any communications that may have been deleted by Reynolds, as well as metadata on photos or videos uploaded to Facebook. It came accompanied with an indefinite gag order.

Why would law enforcement want (much less need) information from the victim's girlfriend's Facebook account? It appears officers were looking to justify the killing after the fact. The following sworn statement was contained in the affidavit:

Your affiant is aware through training and expertise that individuals frequently call and/or text messages to each other regarding criminal activity during and/or after and [sic] event has occurred.

This is warrant boilerplate, especially when it comes to obtaining information from accounts or devices. But this warrant should be considered anything but business as usual. Should be. Isn't. This is the actual standard operating procedure after an officer kills someone: the department goes digging through its criminal records to find any reason at all to have killed the person and to buttress "feared for safety" excuses given by officers -- awarding them points for effort based on information they didn't have when they ended someone's life.

When it comes to police shootings in America, there are no aggressors in uniform, only victims. Officer Yanez made his own excuses, theorizing Castile's willingness to smoke pot in front of a 4-year-old child indicated Castile had no respect for human life.

I thought, I was gonna die, and I thought if he's, if he has the, the guts and the audacity to smoke marijuana in front of the five year old girl and risk her lungs and risk her life by giving her secondhand smoke and the front seat passenger doing the same thing, then what, what care does he give about me?

Following his testimony's logic, smoking pot in front of a child has so severely damaged Castile's moral compass, he apparently would have thought nothing about shooting an officer over a non-functioning tail light. There's no logical boundary cops won't cross to pin the blame on the dead. Hence the Facebook warrant to dig up dirt on his girlfriend in hopes of adding a bit more post facto righteousness to the shoot.

The only upside -- and it's incredibly small given the surrounding circumstances -- is Facebook refused to hand over the information on the grounds that the indefinite gag order was unconstitutional. Faced with this pushback, Minnesota police withdrew the warrant. But in the end, Yanez was acquitted and Philando Castile is still dead -- a man who did nothing more than try to comply with an officer's orders.

Filed Under: diamond reynolds, fishing expedition, gag order, jeronimo yanez, philando castile, warrant
Companies: facebook

Another Judge Says The Microsoft Decision Doesn't Matter; Orders Google To Hand Over Overseas Data

from the when-reality-is-complicated,-simply-ignore-it dept

Microsoft may not have to respond to government demands for US persons' data held overseas, but it looks like everyone else (specifically, Google) will have to keep trawling their foreign data stores for US law enforcement.

The Second Circuit Appeals Court ruled US government warrants don't apply to overseas data. Courts outside of the Second Circuit are finding this ruling doesn't apply to Google's foreign data storage. The most obvious reason for this is other circuits aren't bound by this decision. The less obvious reason has to do with how Google stores its data.

As Google describes it, communications and data are in constant motion, moving in and out of the country as needed for maximum efficiency. When a warrant arrives, Google gathers everything it finds in its domestic servers but hands back a null response to data currently held overseas. Sometimes what Google hands law enforcement is nothing more than unusable digital fragments. Obviously, the government isn't happy with this new status quo.

And it is a new status quo, as is pointed out in this ruling [PDF] by a DC magistrate judge [via FourthAmendment.com]. The ruling here aligns itself with one handed down in Pennsylvania earlier this year. In that decision -- like in this one -- the judge noted Google used to capture everything requested, no matter where it was located. It's only very recently Google has refused to chase down data (and data fragments) located in servers around the world.

The process was described this way in the Pennsylvania decision:

Google stores user data in various locations, some of which are in the United States and some of which are in countries outside the United States. Some user files may be broken into component parts, and different parts of a single file may be stored in different locations (and, accordingly, different countries) at the same time. Google operates a state-of-the-art intelligent network that, with respect to some types of data, including some of the data at issue in this case, automatically moves data from one location on Google's network to another as frequently as needed to optimize for performance, reliability, and other efficiencies.

As a result, the country or countries in which specific user data, or components of that data, is located may change. It is possible that the network will change the location of data between the time when the legal process is sought and when it is served. As such, Google contends that it does not currently have the capability, for all of its services, to determine the location of the data and produce that data to a human user at any particular point in time.

Nothing has changed here. And nothing has changed in terms of legal analysis, despite this memorandum order being issued in a DC court. The court finds Google does not effect a seizure of requested data because it simply makes a copy of it. It also points out (and Google concedes) that it does not act as a government agent when it does this, despite the only reason for Google's copying of the data is to respond to a government warrant. The court notes the Stored Communications Act does carry privacy implications, but only as far as the private entity's actions -- not the government's demands. The court's analysis states the SCA provisions only prohibits unlawful access (such as hacking) while regulating companies' responses to government demands.

The court goes on to say Google's view of its legal responsibilities is completely untenable. Because of the transitory nature of Google's data handling, it would never be able to fully comply with demands for records, no matter which country issued the order.

Finally, it must be said that the above Morrison analysis of the operative sections of the SCA has the added benefit of avoiding the bizarre results that application of the Microsoft decision to modern data networks like Google's would produce. If that decision's focus on the physical location of the data's storage were to be applied to service providers using such networks, the records and information the government would receive in response to an SCA warrant may differ significantly depending on the date on which the warrant is served. Indeed, the same warrant served on ten different days may well produce ten different results depending on where on the network the shards of responsive data are located at the moment each warrant is served. Such random results -- generated by a computer algorithm -- would serve the interests of neither privacy nor international comity.

Compounding the problem, even assuming the service provider could and would identify for law enforcement the location of the foreign-based servers on which the missing data was stored (as Google refused to do here), that knowledge would effectively be useless to the government here. By the time the government could initiate the international legal process necessary to obtain the missing data from wherever it was stored, it is entirely possible that the network would have relocated the data yet again to a server in a different country. Moreover, it is Google's position that it need not respond overseas to any such international legal requests because it is only at its headquarters in California that its data can be accessed and compiled into a recognizable electronic file. Thus, in Google's view, the only means available to obtain records and information related to a Google account is by serving an SCA warrant on its LIS team in California.

The magistrate says that's not going to work -- not under the stipulations of the SCA. In fact, it's just not going to work at all because of Google's data-handling. It may be primed for efficiency, but does little to help it comply with warrants.

To reach the conclusion advanced by Google here, the Court would need to find that a properly-issued SCA warrant requiring the disclosure to law enforcement in the United States from Google's headquarters in the United States of digital files accessible only from the United States constitutes an extraterritorial application of the SCA simply because pieces of data that make up those files were stored on a server located outside the United States at the moment in time the warrant was executed. Because such a conclusion runs contrary to the straightforward extraterritorial analysis of the SCA under Morrison detailed above, the Court finds that Google has not shown cause for its failure to produce all the records and information called for in the instant warrant within its possession, custody, or control.

In the end, the court orders Google to ignore the realities of its data flow. It may make things easier for law enforcement, but it has very little to do with keeping the government within its jurisdictional confines.

Google's LIS representatives in California can access, compile, and disclose to the government those records and information with the push of a button and "without ever leaving their desks in the United States." Microsoft, 829 F.3d at 229 (Lynch, J., concurring). Because that "entire process takes place domestically," id., Google will be ordered to comply with the warrant in full, and to disclose to the government all responsive electronic records and infonnation identified in Attachment B to the warrant within its possession, custody or control, wherever those records and information may be electronically stored.

In essence, Google is being ordered to act as a government agent to secure all requested data wherever it happens to reside. Since it can do it from a California office, the court reasons nothing foreign is touched -- at least not by the government. Once it's all packaged up locally, the local boys can access it without fear of a suppression challenge.

Filed Under: 4th amendment, doj, ecpa, international data, privacy, sca, subpoena, warrant
Companies: google, microsoft

Oregon Cop's Inability To Keep His Hands Off A Resident's Phone Costs Taxpayers $85,000 In Legal Fees

from the stop-touching-other-people's-stuff dept

Oregon residents will be opening up their wallets and handing out $85,000 to a citizen and her ACLU representation, thanks to a police officer being the only cop on the scene unable to handle being filmed while effecting an arrest.

Carrie Medina sued the city of Portland in early 2015 after an officer seized her camera and ended her livestream of an arrest two years earlier. The lawsuit [PDF], filed by the ACLU, contains the full conversation between Officer Taylor Letsis and Medina during the livestream's premature conclusion.

It contains some choice highlights in law enforcement overreach and the assertion of nonexistent authority. The confrontation starts with Officer Letsis claiming Medina's phone probably contains "evidence of a crime," and continues on through to Letsis claiming his seizure and search of the phone is neither a seizure or a search but is very definitely something he has the "legal jurisdiction" to do.

After some back and forth with Medina about his supposed "legal jurisdiction," Letsis decided to seize the phone and view the recording of the arrest. And by "seize," I mean "rip Medina's phone out of her hand."

According to the lawsuit, Medina had offered to provide the video footage to the officer if he gave her a subpoena. After he grabbed the phone, a prompt popped up on the Ustream app to archive the video. Medina, concerned the officer wasn't going to save the video, urged him to archive it. He did, and she then walked him through the process of posting it to a social media site, the suit says.

The officer handed the phone back to Medina and ordered her to show him the video and she complied, since he had posted it for her on social media.

Then he seized it again.

"As soon as Ms. Medina pressed 'play' to start the video, Officer Letsis grabbed the phone from her a second time,'' the suit says. "Officer Letsis did so without warning, and without the consent of Ms. Medina, despite the absence of any probable cause - or any reason at all - to suspect either that Ms. Medina had committed a crime, that the phone contained evidence of a crime, or that the evidence (which he himself had just archived to the Ustream web server) was in any danger of being destroyed.''

The lawsuit goes on to point out Gresham police officials dug their own hole with their post-incident statements, which claimed nothing illegal had occurred and no department policies had been violated.

On approximately February 15, 2013, KGW television published a report on the incident. During the report, a person identified as Gresham police spokesman Claudio Grandjean asserted that Officer Letsis' conduct during the encounter had been legal. Officer Grandjean stated:

“He wasn't doing something illegal. Now, was he inappropriate, or... or or a little rough, or officious or whatever? We can look at that, but that's not nearly as important as was he doing something illegal."

Thus, three days after the incident, the Gresham Police Department took a clear and public position that the actions of Officer Letsis were lawful.

And this, from the police chief, issued nearly a month after the incident:

In the March 5, 2013 memorandum, the Chief stated that "I highly discourage the seizing of property, or the arresting of persons, for simply recording your official actions without your knowledge."

In the March 5, 2013 memorandum, the Chief stated that "I support the reasonable actions of officers to seize cell phones when there is probable cause to believe the recording contains evidence of a crime and there are exigent circumstances to seize the cell phone to prevent the destruction or loss of the evidence," but went on to warn that "[i]f no exigent circumstances that place the property at risk of destruction, you must obtain a search warrant to download the video."

According to the ACLU, these statements indicated officers had not received proper training in respecting the First and Fourth Amendment rights of citizens. That pretty much nailed things down case-wise, as proving "failure to train" is a key element in lawsuits seeking to hold government agencies and employees accountable for their constitutional violations.

Understandably, the three entities being sued decided to settle [PDF] rather than see this debacle rack up even greater monetary losses in front of a jury.

The settlement agreement stipulated that Portland and Gresham must adopt new police policies and training regarding the public’s right to film police activities. The City of Gresham’s new policy under the settlement went into effect in May 2016 and the City of Portland’s new policy went into effect in October 2016. The City of Gresham was also required to pay $85,000 in legal fees to Medina.

The victim of police misconduct only asked for legal fees, which she has donated to the ACLU which represented her pro bono. More important to Medina (and the ACLU) was the establishment of department and city policies recognizing the public's right to hold their public servants accountable through public recordings.

The ACLU notes, however, that the new policies don't appear to have reached every officer covered by them.

Oregon law is now clear that the public has the right to record law enforcement doing their jobs in public, but dos Santos says the ACLU of Oregon still hears from people who have been hassled, detained, or arrested, or who have had their devices confiscated for filming the police, including an incident in Portland last November involving another local activist, Benjamin Kerensa.

“We still see arrests, detentions, and seizures simply for filming the police,” dos Santos said. “With this settlement, we hope that law enforcement across the state will finally respect the public’s right to record. Otherwise, we’ll see them in court again.”

Old habits die hard. And the oldest habits always seem to be the worst ones. The sooner these are broken (or, conversely, the sooner those who can't break them are forced out of jobs), the less expensive it will be for Oregon's taxpayers.

Filed Under: carrie medina, civil liberties, filming police, oregon, phones, taylor letsis, warrant

FBI Tries New Rule 41 Changes On For Size In Fight Against Long-Running Botnet

from the one-warrant;-all-the-computers dept

The DOJ is proud to announce it's flexing its new Rule 41 muscle. The changes proposed in 2015 sailed past a mostly-uninterested Congress and into law, giving the FBI and other DOJ entities permission to hack computers anywhere in the world with a single warrant.

With the new rules, the law has finally caught up with the FBI's activities. It deployed a Network Investigative Tool -- the FBI's nifty nickname for intrusive malware that sends identifying info from people's computers to FBI investigators -- back in 2012 during a child porn investigation and mostly got away with it. It tried it again in 2015 and ran into a bit more resistance.

Rule 41's (former) jurisdictional limitations meant the FBI wasn't supposed to be able to "search" computers all over the US using a single warrant issued in Virginia. This activity was supposed to be confined to the state of Virginia. The aftermath of the Playpen investigation has led to a multitude of conflicting judicial opinions. Some have found the warrant invalid and the evidence obtained worthless. Others have granted good faith exceptions or determined no privacy violation took place. In at least one case, the government has dismissed the charges rather than expose any information about its Rule 41-flouting NIT.

In this case, the FBI isn't hacking computers to uncover child porn site visitors. Instead, it's going to be fiddling with a lot of computers to take down a botnet. The DOJ press release makes particular note of how lawful this all is now, post-Rule 41 amending:

In seeking authorization to disrupt and dismantle the Kelihos botnet, law enforcement obtained a warrant pursuant to recent amendments to Rule 41 of the Federal Rules of Criminal Procedure. A copy of this warrant along with the other court orders are produced below.   The warrant obtained by the government authorizes law enforcement to redirect Kelihos-infected computers to a substitute server and to record the Internet Protocol addresses of those computers as they connect to the server. This will enable the government to provide the IP addresses of Kelihos victims to those who can assist with removing the Kelihos malware including internet service providers.

The search warrant [PDF] application leads off with this as well, waving it in front of its unusual request like a wary vampire hunter's cross.

I make this affidavit in support of an application for a warrant under Federal Rule of Criminal Procedure 41 to authorize an online operation to disrupt the Kelihos botnet currently under the control of Peter Yuryevich LEVASHOV, a criminal hacker. The operation, which is particularly described in Attachment A and Attachment B, involves the distribution of updated peer lists, job messages and/or IP filter lists, further described in Attachment B, to the TARGET COMPUTERS currently infected with the Kelihos botnet malware in violation of Title 18, United States Code, Sections 1030, L343, and 2511, as described in Attachment A. This operation will also obtain the Internet Protocol addresses and associated routing information of those infected computers, and those addresses are evidence of crimes committed by LEVASHOV. A PRTT order has been requested for the purpose of attaining those IP addresses and associated routing information. This operation will not capture content from the TARGET COMPUTERS or modify them in any other capacity except limiting the TARGET COMPUTERS' ability to interact with the Kelihos botnet.

The intent here is to dismantle the botnet by freeing zombie computers. All well and good, except it's not the government pointing victims to malware removal tools, but rather letting themselves into the "house" to size up infections before passing this info on to third parties to actually perform the removals.

This new form of intrusion raised concerns in Congress, but the DOJ insisted the changes were innocuous and please let's all stop talking about this before someone stops the Rule 41 amendments slow roll to tacit approval.

Here it is in action: thousands of computers temporarily hosting digital G-men. We're in unknown territory right now with the FBI's anti-botnet work. The FBI itself doesn't even appear all that sure about the extent of its new Rule 41 powers. As is noted in the warrant, the FBI also applied for a Pen Register/Trap and Trace (PRTT) order [PDF] just in case.

Other than the three elements described above, federal law does not require that an application for an order authorizing the installation and use of a pen register and a trap and trace device specify any facts. The following additional information is provided to demonstrate that the order requested falls within this Court's authority to authorize the installation and use of a pen register or trap and trace device under 18 U.S.C. g 3123(a)(1).

This is the FBI basically saying the law doesn't require this application, but here it is anyway. A CYA PRTT for the interception of communications metadata that might help identify botnet victims. And for all its talismanic waving of Rule 41, the FBI isn't even sure it's really required to seek a warrant to perform this botnet cleanup. From the warrant affidavit:

To effectively combat the P2P structure of the Kelihos botnet, the FBI with assistance of private partners will participate in the exchange of peer lists and job messages with other infected computers. The FBI's communications, however, will not contain any commands, nor will they contain IP addresses of any of the infected computers. Instead, the FBI replies will contain the IP and routing information for the FBI's "sinkhole" server. As this new routing information permeates the botnet, the Kelihos infected computers will cease any current malicious activity and learn to only communicate with the sinkhole. The effect of these actions will be to free individual infections from exchanging information with the Kelihos botnet and with LEVASHOV. This will stop Kelihos's most immediate harm, the harvesting of personal data and credentials, and the transmittal of that data to servers under LEVASHOV's control.

Another portion of the Kelihos job messages is a list, known as the IP filter list. This list functions as a type of blacklist, preventing communication with those IPs contained within the filter list. If necessary, the FBI also seeks authorization to send a filter list to TARGET COMPUTERS to block Kelihos infected computers from continuing to communicate with router nodes.

The footnote attached to this reads:

The law is unsettled as to whether the operation authorized by the proposed warrant constitutes a search or seizure. However, in an abundance of caution, the United States is seeking a warrant.

It looks like the FBI is tentatively exploring its new powers, making sure it has the paper trail it needs to stave off courtroom challenges. If it sticks to disrupting a botnet, it shouldn't face any. If it takes advantage of its new access privileges, it might.

Filed Under: botnet, doj, fbi, hacking, nit, rule 41, warrant

Judge Says FBI's NIT Warrant Invalid, Points Out FBI Agent Knew It Was Invalid When He Requested It

from the new-strategy-needed-for-spreading-malware-worldwide dept

A Minnesota judge has granted a motion for suppression in an FBI Playpen case, using an agent's nineteen years of service and expertise against the government's good faith arguments. The court here found the warrant to be invalid from the moment it was signed, meaning everything obtained past that point to be fruit of the poisonous tree. (via FourthAmendment.com)

While other courts have noted the warrant's invalidity under Rule 41's territorial limitations (now nonexistent), no other judge has taken time to point out the FBI agent requesting the warrant knew it was invalid when he requested it.

First, the decision [PDF] points to the breathtaking scope of the single warrant the FBI obtained.

[T]he Government claims legal authority from this single warrant, issued in the Eastern District of Virginia, to hack thousands of computers in 120 countries and to install malicious software for the purpose of investigating and searching the private property of uncounted individuals whose identities and crimes were unknown to the Government before launching this massive worldwide search.

From there, the judge makes the point that the government can't claim it had any "good faith" in its warrant because it knew the scope and reach of the warrant exceeded the jurisdictional limitations imposed by Rule 41. As evidence of this knowledge, Judge Franklin Noel points to sworn statements by Agent Macfarlane, which indicate he knew the request was invalid when he submitted his warrant request.

The search warrant application and the warrant, as issued, expressly limit themselves to the search of persons or property located in the Eastern District of Virginia. Yet paragraph forty-six of Agent Macfarlane's affidavit explains in some detail how the NIT malware might be deployed anywhere on earth. Specifically, paragraph forty-six provides that "the NIT may cause an activating computer wherever located -- to send to a computer controlled or known to the government, network level messages containing information that may assist in identifying the computer." Under these circumstances, Agent Macfarlane must have known that he was acting in reckless disregard of proper procedure. It was not objectively reasonable for Agent Macfarlane, a "law enforcement . . . veteran" employed by the FBI "for 19 years" to believe that the NIT warrant, which he knew could reasonably reach any computer in the world, was properly issued given the specific territorial limits under Rule 41(b) and the language of the warrant itself…

Put differently, it was not objectively reasonable for Agents to believe that a single warrant, which by its terms was explicitly limited to searches in the Eastern District of Virginia, could be used to electronically search Carlson's computer in Minnesota…

The judge goes on to point out the government can't avail itself of the "good faith" argument because it relies on a valid warrant's issuance. In this case, the warrant was invalid the moment it was issued, making this akin to having no warrant at all. Good faith denied.

The court also finds the warrant defective in other ways. The NIT warrant had no particularity -- a requirement for valid warrants. Since the government didn't know who it would infect with its malware or where they were located, its warrant could not possibly satisfy particularity requirements, even if it somehow managed to adhere to Rule 41 jurisdictional limitations.

Identification of the particular place to be searched cannot depend upon facts that have not yet occurred. A warrant must particularly describe the place to be searched at the time it is issued. Just as a warrant must be supported by probable cause at the time it is issued, this Court concludes that the warrant must particularly describe the place to be searched when it is issued.

[...]

As neither the Magistrate Judge nor the affiant know which computers are to be searched until after the search has already occurred, the NIT warrant fails to particularly describe the place to be searched.

This suggests the FBI may not be completely in the clear despite the Rule 41 changes. The malware it deployed targeted individuals who visited the seized server, but the FBI had no way of knowing who would visit or when. This is a take we haven't seen from other judges in Playpen/NIT cases and this order will likely be cited by several defendants still facing prosecution.

Filed Under: 4th amendment, fbi, malware, nit, privacy, warrant

Judge: FBI's NIT Warrant Invalid And IP Addresses Do Have An Expectation Of Privacy, But No Suppression Granted

from the good-findings-mixed-with-questionable-conclusions dept

Thanks to the FBI's one-to-many NIT warrant, which was issued in Virginia but reached thousands of computers all over the world, yet another federal judge is dealing with the fallout of the feds' efficiency. Michigan federal judge Thomas Ludington finds plenty he doesn't like about the FBI's malware and the DOJ's defense of it, but still can't quite find enough to warrant suppression of the evidence [PDF link].

Properly stated, the question here is whether the FBI’s NIT warrant so exceeded the limits of the magistrate judge’s jurisdiction and authority or reasonable behavior by law enforcement as to require suppression to deter similar actions in the future. Although the NIT warrant exceeded the scope of Rule 41(b) as it existed at the time, the FBI’s actions in investigating and closing Playpen were reasonable and directed toward securing the judicial review of law enforcement which the Fourth Amendment contemplates. Given the circumstances, suppression is not appropriate.

That being said, the opinion does offer plenty of counters to the DOJ's legal rationale -- something that other defendants in the FBI's massive Playpen investigation might find useful. The court, like others, finds the FBI exceeded the jurisdictional limitations of Rule 41 and no amount of creative phrasing is going to change that.

None of the three bases in Rule 41(b) provided jurisdiction for the magistrate judge to approve the warrant. Rule 41(b)(1) cannot serve as the basis for jurisdiction. Under that provision, a magistrate judge can issue a warrant to seize property “located in the district.” Here, the server housing Playpen had been transported to Virginia by the FBI, but the NIT involved the transmission of information from that server to computers located around the country and then back to the server. The relevant information (or “property”8 ) was the information requested by the NIT from the user’s computer. The NIT cannot be reasonably construed as seizing information “located in the district” even if the request for the information originated from a server in Virginia.

[...]

Even if Kahler had some contact with the Playpen server located in Virginia, the information sought by the NIT was all located in Michigan. The mere fact that the information from outside the district was brought into the district cannot satisfy Rule 41(b)(2). If that scenario was sufficient, then there would effectively be no jurisdictional limit on warrants for seizure of personal property, because property can typically be moved.

It also finds -- during its discussion of Rule 41 limitations -- that the DOJ can't justify its defective warrant by claiming the software was merely a "tracking device." The NIT pulled information from a computer -- including information that would ID the user -- and left nothing behind to track further computer "movements." That changes the purpose -- and the scope -- of the intrusion.

The receipt of the username associated with the computer’s operating system goes beyond simple location data to descriptive data regarding the identity of the user. The NIT is more than just a “tracking device”; it is a surveillance device.

Additionally, the entire purpose of the NIT was to interact with a computer and obtain information that was located in another district. Even though the NIT was nominally installed on the Playpen Server, the NIT’s “tracking” functionality occurred in other districts. Finally, the purpose of the NIT was to discover the location of the users accessing Playpen, not track their movement.

The government also argued that even if the warrant was faulty, it was ultimately unnecessary because the information obtained fell under the Third Party Doctrine. The court disagrees (nodding to the Supreme Court's Riley decision), finding that efforts users make to cloak their identity -- even while engaging in criminal activity -- generates a layer of privacy protection under the Fourth Amendment.

The Government argues that, despite using a software which exists only to veil the user’s IP address from prying eyes, the user has no reasonable privacy interest in his or her IP address. This argument has little to recommend it. If a user who has taken special precautions to hide his IP address does not suffer a Fourth Amendment violation when a law enforcement officer compels his computer to disclose the IP address, the operating system, the operating system username, and other identifying information, then it is difficult to imagine any kind of online activity which is protected by the Fourth Amendment. Internet use pervades modern life. Law enforcement, acting alone, may not coerce the computers of internet users into revealing identifying information without a warrant, at least when the user has taken affirmative steps to ensure that third parties do not have that information.

This contrasts with other decisions dealing with the same subject matter, where judges have found there's no expectation of privacy in IP addresses, even when one has taken extra steps to obscure it. Those findings seem logically contradictory, at best. If someone's attempts to keep third parties from obtaining information, this information can't truly be considered held by a third party. Stripping away these efforts turns the FBI into the "third party," and the government isn't allowed to both act as a third party and excuse its actions with the Third Party Doctrine.

But in the end, there's no suppression. As the court points out, two things weigh against suppressing the evidence, even with the warrant being facially invalid under Rule 41. First, the FBI malware only infected registered users visiting the dark web child porn site, which makes the possibility of accidental infection almost nonexistent. Second, the fact that the FBI had no idea where the site's visitors were actually located makes this an inelegant solution to a problem, not a case of judge-shopping for compliant magistrates.

[T]his is not a case where the FBI purposely avoided compliance with the law. The investigation of Playpen was difficult precisely because the FBI had so little information about the location of the users. If the FBI had known where certain users were located but nevertheless chose to seek a warrant in another district, suppression would be appropriate. In that case, the FBI would have purposely skirted the law despite a legal alternative. Kahler’s arguments, if accepted, would imply that the FBI should not have conducted the NIT investigation at all because the users were masking their true location. The FBI’s decision to adopt novel tactics to bring individuals distributing child pornography behind location-concealing software to justice is not inherently troubling behavior.

In the future, the FBI won't have to deal with nearly as many suppression hearings, thanks to changes to Rule 41. These decisions are becoming relics of statutorial limitiations almost as soon as they're issued. Even if courts find the malware deployment to be a search invasive enough to trigger Fourth Amendment protections, the lack of jurisdictional limits going forward will prevent them from being challenged.

Unfortunately, the rule changes are almost guaranteed to encourage more frequent deployments of tools designed to decloak anonymous internet users. The breadth and reach of these warrants will be almost unchecked and that's bad news for activists, dissidents, and others who just want to stay off the internet grid. Sure, it's also bad news for child porn fans, but child porn, terrorism, drug warring, etc. is where these efforts start. It's seldom where they end.

Filed Under: 4th amendment, doj, fbi, malware, nit, playpen, warrant

Judge Rejects Warrant Seeking To Force Everyone At A Searched Location To Unlock Seized Electronic Devices

from the new-brute-force-method-revealed dept

Late last year, Thomas Fox-Brewster of Forbes uncovered a strange search warrant among a pile of unsealed documents. The warrant -- approved by a magistrate judge -- allowed law enforcement officers to demand that everyone present at the searched location provide their fingerprints to unlock devices seized from the same location.

In support of its request, the government cited cases dating back to 1910, as though they had any relevance to the current situation. The most recent case cited was 30 years old -- still far from easily applicable to today's smartphones, which are basically pocket-sized personal data centers.

The judge granted it, stating that demands for fingerprints, passwords, or anything (like encryption keys) that might give law enforcement access to the devices' content did not implicate the Fourth or Fifth Amendments. While the magistrate was correct that no court has found the application of fingerprints to unlock devices to be a violation of the Fifth Amendment, the other access options (passwords, encryption keys) might pose Fifth Amendment problems down the road.

Riana Pfefferkorn has uncovered a similar warrant request, but this one has been rejected by the magistrate judge. Pretty much across the board, the order is the antithesis of the one revealed last year. The judge finds [PDF] that the broad request to force everyone present at the residence to apply their fingerprints to seized devices to unlock them implicates multiple Constitutional amendments.

The issues presented in this warrant application are at the cross section of protections provided by the Fourth and Fifth Amendments. Essentially, the government seeks an order from this Court that would allow agents executing this warrant to force "persons at the Subject Premises" to apply their thumbprints and fingerprints to any Apple electronic device recovered at the premises. (See Attach. B, tT 12.) The request is neither limited to a particular person nor a particular device. And, as noted below, the request is made without any specific facts as to who is involved in the criminal conduct linked to the subject premises, or specific facts as to what particular Apple-branded encrypted device is being employed (if any).

The judge notes the government is able to detain and search persons located at the premises being searched, but that does not extend to forcing every single person in a residence at the time of a search to comply with attempts to unlock seized devices. Because the warrant affidavit contained no particularity about the devices or who in the household the government suspected of engaging in criminal activity, the court can't find anything that justifies the broad, inclusive language contained in the request.

This Court agrees that the context in which fingerprints are taken, and not the fingerprints themselves, can raise concerns under the Fourth Amendment. In the instant case, the government is seeking the authority to seize any individual at the subject premises and force the application of their fingerprints as directed by government agents. Based on the facts presented in the application, the Court does not believe such Fourth Amendment intrusions are justified based on the facts articulated.

The court has other problems with the affidavit -- beyond the government's unwarranted extension of Fourth/Fifth Amendment jurisprudence to cover any devices/fingerprints encountered at a searched location. Early in the order, it notes the government is deploying boilerplate nearly as outdated as its case citiations.

Despite the apparent seriousness of the offenses involved, the Court notes that some of the "boilerplate" background information included in the warrant is a bit dated, such as its explanation that "[t]he internet allows any computer to connect to another computer [so] [e]lectronic contact can be made to millions of computers around the world;" its explanation that a "Blackberry" is a common "Personal Digital Assistant" and its suggestion that the use of "cloud technology" is the exceptional way of transferring files and that transferring images to a computer by directly connecting a cable to a camera or other recording device is the expected means of data transfer.

The judge notes outdated boilerplate isn't enough to undo probable cause assertions, but it certainly doesn't help -- especially not when the government is requesting this sort of broad permission.

The inclusion of this somewhat dated view of technology certainly does not distract from the application's goal of establishing probable cause. However, the dated "boilerplate language" is problematic for what is not included. There is absolutely no discussion of wireless internet service and the possibilities and capabilities that wireless service presents in this context. For example, an unsophisticated intemet user, or a careless one, may fail to properly encrypt his wireless service or may share the password injudiciously. Such practices leave open the possibility that it is not an inhabitant of the subject premises that has used the internet to gather and distribute child pornography, but rather it is a person who has access to the internet service at the subject premises.

Obviously, this possibility holds true in all investigations that track the investigation outlined in the instant application. The limitations of this investigation are not fatal to establishing probable cause, but, in the Court's view, these limitations do impact the ability of the government to seek the extraordinary authority related to compelling individuals to provide their fingerprints to unlock an Apple electronic device.

Then there's the other assertions. The government's application does nothing to narrow down which resident it's seeking or what device(s) might contain evidence of criminal activity. What it does appear to be certain about -- for reasons not included in the application -- is that the devices it seeks are Apple products. A footnote in the order questions this assertion.

Why Apple devices are likely to be found at the premises is not explained. The Court is aware that Apple has a large market share in online hardware, but Microsoft's Windows operating systems continue to dominate the overall market share of operating systems used.

What makes these broad, unsupported assertions even worse, especially when combined with the outdated boilerplate, is that this is apparently the direction the government is heading with its search warrants.

In closing, upon presentation of the warrant application to this Court, the government identified for this Court that the warrant application was seeking the forced fingerprinting discussed herein. The government further noted "[t]his is the language that we are making standard in all of our search warrants." This declaration of standardization is perhaps the crux of the problem. As the Court hopes it is plain from the above, the issues presented here require a fact-intensive inquiry both for purposes of the Fourth Amendment and the Fifth Amendment.

More particularity, better probable cause, and fewer assumptions about the Fourth and Fifth Amendment's application in a post-Riley world are what's needed from the government, according to this order. Even though this application was rejected, it's safe to say this same approach has worked elsewhere. We've seen one approved warrant already and there are likely several more safely hidden from the public eye in the government's multitudinous sealed cases.

What's troubling about the government's assertions in this application is its apparent belief it's found an encryption workaround: one that blows past Fourth and Fifth Amendment concerns using little more than boilerplate that still considers cables to be an essential part of "cloud computing," and magistrate judges willing to buy its outdated legal arguments.

Filed Under: 4th amendment, 5th amendment, fingerprints, location, search, warrant