Pennsylvania Court Shrugs Off Microsoft Decision; Says Google Must Turn Over Emails Stored At Overseas Data Centers

from the redefining-'seizure' dept

Just south of the Second Circuit Court of Appeal's district, a Pennsylvania (3rd Circuit) federal judge has come to (nearly) the opposite conclusion on law enforcement's access to emails stored overseas. This case deals with two FBI SCA (Stored Communications Act) warrants seeking emails that Google says aren't stored in the United States. Google, however, also says the sought emails could be at any of its data storage sites -- which would include those in the US. It all depends on when it's asked to retrieve the communications.

And there's where this decision parts ways with the Second Circuit, which found that emails stored in an Irish data center weren't subject to US-issued warrants. The court explains [PDF] Google's process for handling user data, which is built for efficiency, rather than what's central to the FBI's demands: efficiency of retrieval in response to law enforcement requests.

Google stores user data in various locations, some of which are in the United States and some of which are in countries outside the United States. Some user files may be broken into component parts, and different parts of a single file may be stored in different locations (and, accordingly, different countries) at the same time. Google operates a state-of-the-art intelligent network that, with respect to some types of data, including some of the data at issue in this case, automatically moves data from one location on Google's network to another as frequently as needed to optimize for performance, reliability, and other efficiencies.

As a result, the country or countries in which specific user data, or components of that data, is located may change. It is possible that the network will change the location of data between the time when the legal process is sought and when it is served. As such, Google contends that it does not currently have the capability, for all of its services, to determine the location of the data and produce that data to a human user at any particular point in time.

Because of the way Google handles data, it theoretically could refuse every US law enforcement request for communications. (It could do the same to foreign requests as well.) This makes Google's case distinguishable from Microsoft's legal battle. Microsoft knew exactly where the stored communications were located. Google says the communications might be anywhere -- in one place upon receipt of a warrant and in another when retrieval efforts begin. As the court sees it, the Second Circuit's ruling would basically make Google completely immune to law enforcement requests.

[I]f the court were to adopt Google’s interpretation of the Microsoft decision and apply such a rationale to the case at bar, it would be impossible for the Government to obtain the sought-after user data through existing MLAT channels.

The "fix," according the Pennsylvania court, is to have Google round up the sought communications in the US, putting them within reach of the FBI's warrants.

In contrast, under this court’s interpretation, Google will gather the requested undisclosed data on its computers in California, copy the data in California, and send the data to law enforcement agents in the United States, who will then conduct their searches in the United States.

Of course, this means compelling Google to do something with its data that it doesn't normally do, which would make it a seizure. And since the data sought is constantly in transit, the court is giving the government the power to step in and alter Google's data-handling. This would obviously be a seizure of data potentially stored (at least temporarily) in foreign countries. To get around the Fourth Amendment concerns this raises -- not to mention the expansion of the US government's power to compel the production of data from foreign servers -- the court decides no seizure actually takes place until the government takes control of the data Google has been ordered to compile.

In contrast to the decision in Microsoft, this court holds that the disclosure by Google of the electronic data relevant to the warrants at issue here constitutes neither a "seizure" nor a "search" of the targets' data in a foreign country. This court agrees with the Second Circuit's reliance upon Fourth Amendment principles, but respectfully disagrees with the Second Circuit's analysis regarding the location of the seizure and the invasion of privacy.

[...]

Electronically transferring data from a server in a foreign country to Google's data center in California does not amount to a "seizure" because there is no meaningful interference with the account holder's possessory interest in the user data. Indeed, according to the Stipulation entered into by Google and the Government, Google regularly transfers user data from one data center to another without the customer's knowledge. Such transfers do not interfere with the customer's access or possessory interest in the user data. Even if the transfer interferes with the account owner's control over his information, this interference is de minimis and temporary.

This is a really weird -- and wrong -- interpretation of the word "seizure." While it's true the FBI won't actually have taken possession of the emails until after Google has gathered them in a California datacenter to make them more Fourth Amendment-compliant (or whatever), the fact that Google has to interrupt its normal flow of data at the government's request would appear to make that initial interruption a "seizure" -- de minimis or not.

In essence, the court is saying the Fourth Amendment doesn't apply to data in transit. The government can compel the collection of overseas data and have the Fourth Amendment applied to it after it's already been gathered and stored locally. The decision makes a mess of the Fourth Amendment cart-horse configuration, but figures this is more acceptable than informing the FBI that its warrants might be useless.

The better conclusion to reach would be the one the Second Circuit reached: if the concern is that the 30-year-old SCA limits law enforcement's ability to demand data from overseas data centers run by US companies, the solution lies with the entity that created it (Congress), rather than the courts. This decision will be appealed and it's safe to assume the Third Circuit Court of Appeals will arrive at the same conclusion.

Even if Congress doesn't "fix" the SCA to make US companies with foreign data centers more responsive to law enforcement demands, cases going forward may start applying the Rule 41 changes that went into effect at the beginning of this year, which greatly expand the jurisdictional reach of US court-issued warrants. As for Google, its system isn't built with law enforcement's needs in mind, nor should it be. It does what works best for it, which is what we expect from private companies. This ruling gives law enforcement a workaround for dealing with the SCA's limits, so some forum shopping should be expected until this decision is (hopefully) overturned.

Filed Under: 4th amendment, ecpa, emails, pennsylvania, stored communications act, subpoena, third circuit, warrant
Companies: google, microsoft

Appeals Court Upholds Its Denial Of DOJ's Demand For Microsoft's Overseas Data

from the go-bother-some-legislators,-kid dept

After being handed a loss in its judicial quest to force Microsoft to hand over data held in Ireland, the DOJ asked the Second Circuit for a rehearing of its July decision. At the center of the case is the DOJ's belief that it should be able to force US companies to turn over data/communications contained in overseas servers.

The government wants to have it both ways with its warrants for electronic data. On one hand, it analogizes data demands as being no different than digging through a filing cabinet found in a house it's searching. It argues that data held in servers/devices should be treated no differently than the personal papers the founding fathers tried to protect with the Fourth Amendment.

Then it argues that even if the "filing cabinet" isn't located on the premises it has a warrant to search, it should be able to access the contents of that cabinet. This, from Microsoft's motion to dismiss, explains what the government is truly asking for, using the sort of physical world comparisons the DOJ understands.

The Government cannot seek and a court cannot issue a warrant allowing federal agents to break down the doors of Microsoft's Dublin facility. Likewise, the Government cannot conscript Microsoft to do what it has no authority itself to do -- i.e., execute a warranted search abroad.

In its original decision, the Appeals Court pointed out that Congress clearly didn't intend the wording of the Stored Communications Act to cover foreign data centers, no matter what sort of twisted, hybrid paperwork the feds served Microsoft in hopes of routing around territorial limitations. The court noted, as it often does, that if the DOJ wanted its half-warrant/half-subpoena to both skirt mutual assistance treaties and the court's interpretation of the SCA, then it needed to approach Congress directly and get the SCA updated/amended.

And, indeed, the DOJ has done exactly that. It's seeking legislation specifically targeting the terroritorial limitations in the SCA that prevent it from doing what it wants to. But in the meantime, the DOJ thought the court should take another swing at it. The Second Circuit has decided to pass on this opportunity. But it has issued an affirmation [PDF] of its original ruling, with some additional dissenting voices appended.

An equally divided federal appeals court refused to reconsider its landmark decision forbidding the U.S. government from forcing Microsoft Corp and other companies to turn over customer emails stored on servers outside the United States.

Tuesday's 4-4 vote by the 2nd U.S. Circuit Court of Appeals in Manhattan let stand a July 14 decision that was seen as a victory for privacy advocates, and for technology companies offering cloud computing and other services worldwide.

But the dissenting judges said that decision by a three-judge panel could hamstring law enforcement, and called on the U.S. Supreme Court or Congress to reverse it.

"The panel majority's decision does not serve any serious, legitimate, or substantial privacy interest," Circuit Judge Jose Cabranes wrote in dissent.

The opinion doesn't tell the DOJ anything it didn't tell it previously, other than that the court is evenly divided. The decision reiterates points the DOJ didn't like the first time around. And, once again, it directs the DOJ's efforts at legislators, while also pointing out the dissent's similar willingness to interpret the law in ways Congress never intended.

The position of the government and the dissenters necessarily ignores situations in which the effects outside the United States are less readily dismissed, whichever label is chosen to describe the “focus” of the statute. For example, under the dissents’ reasoning (as we understand it), the SCA warrant is valid when (1) it is served in the United States on a branch office of an Irish service provider, (2) it seeks content stored in Ireland but accessible at the U.S. branch, (3) the account holding that content was opened and established in Ireland by an Irish citizen, (4) the disclosure demanded by the warrant would breach Irish law, and (5) U.S. law enforcement could request the content through the MLAT process. This hardly seems like a “domestic application” of the SCA.

Rather, we find it difficult to imagine that the Congress enacting the SCA envisioned such an application, much less that it would not constitute the type of extraterritorial application with which Morrison was concerned. Indeed, calling such an application “domestic” runs roughshod over the concerns that undergird the Supreme Court’s strong presumption against extraterritoriality, and suggests the flaw in an approach to the SCA that considers only disclosure.

The DOJ's flawed approach is also its most common approach. It seems genuinely baffled/irritated when its requests -- and its interpretation of the law -- are challenged. It views laws that don't allow it to do what it wants to do as broken. Rather than view limits in laws as guidance to help keep it aligned with Constitutional rights, it tends to do what it wants and let the courts sort it out.

Sure, the judicial process isn't exactly speedy, but it has better odds and a faster turnaround time than guiding legislation through multiple Congressional hoops. And it will continue to play the odds because not every service provider has the resources or legal acumen to fight back against unlawful demands.

Filed Under: data, doj, ireland, overseas, privacy, second circuit, subpoena, warrant
Companies: microsoft

New Mexico Legislators Looking To Add Warrants To The Stingray Mix, Curb Electronic Surveillance

from the start-papering-that-evidentiary-trail,-boys dept

The New Mexico legislature, which passed the most restrictive asset forfeiture reform bill in the nation, is once again targeting easily-abusable tools of the law enforcement trade. The Tenth Amendment Center reports that the proposed bill targets police use of Stingray devices, as well as other electronic data demands.

The bill would require police to obtain a warrant or wiretap order before deploying a stingray device, unless they have the explicit permission of the owner or authorized possessor of the device, or if the device is lost or stolen. SB61 does provide an exception to the warrant requirement for emergency situations. Even then, police must apply for a warrant within 3 days and destroy any information obtained if the court denies the application.

SB61 would also bar law enforcement agencies from compelling a service provider or any person other than the owner of the device without a warrant or wiretap order. This would include actual communication content such as phone conversations, text messages and email, location information and other metadata such as IP addresses pertaining to a person or device participating in the communication.

The bill does contain a few warrantless exceptions, but they're the expected exceptions (consensual searches, exigent circumstances) and they're limited to those two. Otherwise, deployment of a Stingray device requires a warrant or wiretap order. Law enforcement agencies will no longer be able to hide Stingray use behind pen register orders or wander into providers' offices without any paperwork and ask for historical cell site location info.

The bill also requires that any collected information be destroyed within ninety days. Information unrelated to the device targeted must be destroyed within thirty days. Any extended retention must be approved by a judge after the agency has shown cause for the additional storage and use of collected information.

Additionally, restrictions are placed on the sharing of collected information, limiting access only to those who will comply with the boundaries contained in the court order authorizing the collection. These entities will be subject to the same data destruction periods.

Stingray warrants will also receive additional judicial scrutiny. From the bill:

When issuing a warrant or order for electronic information or upon a petition of the target or recipient of the warrant or order, a court may appoint a special master charged with ensuring that only the information necessary to achieve the objective of the warrant or order is produced or accessed.

Emergency warrant exceptions won't be easy to obtain either. And, even if an exception is obtained, the law enforcement agency is required to notify the target within three days of the information's collection -- whether via a Stingray device or directly from the service provider. Law enforcement will be able to delay notification but this requires running more paperwork past a judge and convincing them that the delayed disclosure is essential to an ongoing investigation. All extension requests -- granted or denied -- will be publicly reported by the Attorney General's office on its website.

The bill also provides for a great deal of mandatory reporting on demands for information sought under the new law. This includes the number of times requests were made, the type of request, and the data/information sought. It applies to all government agencies.There's no wording contained in it that suggests this bill is solely limited to local law enforcement. That means the federal government would have to play by the same rules when deploying Stingrays or demanding information from local service providers -- something that could possibly see the feds intervening if the bill lands on the governor's desk.

The following is only part of the info list contained in the bill -- all of which must be reported to the state's Attorney General. There's a lot in there no agency is going to be in any hurry to hand over.

(b) the number of persons whose information was sought or obtained;

(c) the number of instances in which information sought or obtained did not specify a target natural person;

(d) for demands or requests issued upon a service provider, the number of those demands or requests that were fully complied with, partially complied with and refused;

(e) the number of times notice to targeted persons was delayed and the average length of the delay;

(f) the number of times records were shared with other government entities or any department or agency of the federal government and the government entity, department or agency names with which the records were shared;

(g) for location information, the average period for which location information was obtained or received; and

(h) the number of times electronic information obtained under the Electronic Communications Privacy Act led to a conviction and the number of instances in which electronic information was sought or obtained that were relevant to the criminal proceedings leading to those convictions.

If this passes, New Mexico will be leading the nation in protections of its constitutents' property and civil liberties. Expect lots of resistance as this makes its way through the legislature. And if it does become law, expect the Albuquerque PD to continue doing whatever the hell it wants to.

Filed Under: 4th amendment, imsi catcher, new mexico, privacy, stingray, warrant

Judge Tells DOJ It Can't Un-Suppress Evidence By Starting The Indictment Process All Over Again

from the if-at-first-you-don't-succeed,-upend-the-Bill-of-Rights dept

Sure, we like the DOJ when it's handing down scathing reviews of local law enforcement agencies and belatedly issuing warrant requirements for IMSI catchers, but we're not nearly as thrilled when it argues against warrant requirements for cell phone searches, demands backdoors in phone encryption, or beats mild miscreants over the head with the CFAA.

In fact, there's very little to like about the DOJ outside of its civil rights division. Here's yet another reason why the Department of Justice often seems like a misnomer. (h/t Brad Heath)

A decision [PDF] has been handed down by a federal court in Puerto Rico, presumably with an eyeroll and an exasperated sigh.

In 2014, Homeland Security agents searched Jose Silva-Rentas without reasonable suspicion, probable cause, or a warrant. Silva happened to be next to somebody HSI agents did search with probable cause. Rentas moved to suppress the evidence and the court agreed that the government's theory of probable cause osmosis wasn't enough to salvage the search.

The government makes much of Colón's unwise response to the agents' arrival, arguing that his evasive (and criminal) conduct not only gave rise to probable cause for his arrest, but also provided the agents with grounds to arrest Silva and the other individuals in the area. But probable cause as to one individual does not necessarily extend, as though by osmosis, to those in his company. It "must exist with respect to each person arrested, and `a person's mere propinquity to others independently suspected of criminal activity does not, without more, give rise to probable cause to [arrest and] search that person.'"

The government then tried to salvage the results of the search with a motion for reconsideration. This was also denied. The court here found the tip from a confidential informant too unreliable to form the probable cause needed for the detention and search of Silva.

The government moves for reconsideration, claiming again that the agents relied on trustworthy confidential sources. In this regard, it points out that the confidential sources' identities were previously known to Agent Clemente, and that the sources had provided reliable information on illegal activities allegedly carried out by members of Silva-Rentas' drug trafficking organization. The motion, however, is silent as to how the agents were aware of the confidential sources' identities, or what reliable information they previously provided.

They may have been denied twice by the same judge, but federal prosecutors weren't going to let the judicial system stand in the way of a conviction. So the did they only thing they could do, which turns out to be the sort of thing they can't actually do: they rang Rentas up for a completely identical prosecution.

The DOJ's lawyers tried to find a gap in case law to exploit, hoping that some sort of technicality (it's great when it works for the home team, right?) would allow it to use evidence already suppressed by the same court to pursue a second prosecution against someone it had already dismissed charges against.

The Puerto Rico court -- entertaining the same prosecutors and same defendant for a second time -- isn't amused by this ploy. It cites the case law the DOJ's lawyers should have read before making their Double Jeopardy Lite maneuver.

Here, the prosecuting entities in the case before Judge Delgado and the case at bar are identical. Federal prosecutors litigated Defendant’s prior suppression motion and prosecutors from the same office are litigating the instant motion. Further, both parties had a full and fair opportunity to be heard on the matter during the prior case as the Motion to Suppress was filed on December 30, 2014 and the matter was not fully disposed of until August 27, 2015 when Judge Delgado denied the United States’ Motion for Reconsideration of the Court’s ruling suppressing the evidence. Between the two dates, Judge Delgado analyzed the parties’ briefs, held an evidentiary hearing, and published a detailed opinion with findings of both fact and law. Thus, the parties were fully heard on the issue and the Court adjudicated the matter through a valid and final on the merits.

The government argued that "final" doesn't always mean "final." The court disagrees.

[I]n his prior case, Defendant was indicted on several charges relating to possession of weapons by a convicted felon and possession of a machine gun. Soon after the ruling suppressing the search and seizure which yielded weapons on Defendant’s person, the United States moved to dismiss all charges against Defendant. For the Court to now find that Judge Delgado’s detailed ruling suppressing all firearms seized from a defendant charged with possession of said firearms is not essential to the judgment of dismissal would be nonsensical. Accordingly, the Court finds this element has, too, been satisfied.

As the court points out, to buy into the DOJ's argument would be to allow it to go judge shopping repeatedly until it found a court willing to admit evidence a court had previously suppressed.

To hold to the contrary would imply that the United States is afforded infinite opportunities to use previously suppressed evidence against a defendant in subsequent proceedings in separate cases. This would also allow the United States to reargue admissibility of evidence in perpetuity until they find a judge that holds the evidence admissible. Obviously, that would not be in tune with the Constitution’s protections against Double Jeopardy nor the Fourth Amendment’s prohibition against unreasonable searches and seizures.

The DOJ probably isn't thrilled its arguments have been boiled down to a latent desire to overturn Constitutional protections and pursue multiple prosecutions for the same criminal allegations, but that's what its arguments are when all the legalese prettying it up is stripped away. This is the DOJ's farcical interpretation of the word "justice."

Filed Under: doj, evidence, jose silva-rentas, probable cause, warrant

Amazon Refuses To Comply With Police Request For Amazon Echo Recordings In Murder Case

from the always-on-microphones dept

Well, you knew this was coming sooner or later. Reports came out this week (via the paywalled site The Information) that law enforcement in Bentonville, Arkansas issued a warrant to Amazon asking for any recordings that Amazon had from its Echo device that may have been relevant to a murder case they're working on. At issue is the Amazon Echo device owned by James Andrew Bates, who is accused of murdering Victor Collins a year ago. The key bit of information here is that Amazon refused to hand over any recordings that it might have logged, but did hand over more general information about Bates' account and purchases.

Of course, just the request for possible audio information has lots of people paying attention. This kind of thing has been predicted for ages -- now that pretty much everyone has "always on" microphones all around them in the form of either internet-of-things connected devices like the Echo, or merely your mobile phone with Apple's Siri or Google Now. The police in this case appear to be searching for any info that could be supplied by the devices that spy on us:

Police say Bates had several other smart home devices, including a water meter. That piece of tech shows that 140 gallons of water were used between 1AM and 3AM the night Collins was found dead in Bates' hot tub. Investigators allege the water was used to wash away evidence of what happened off of the patio. The examination of the water meter and the request for stored Echo information raises a bigger question about privacy. At a time when we have any number of devices tracking and automating our habits at home, should that information be used against us in criminal cases?

Bates' attorney argues that it shouldn't. "You have an expectation of privacy in your home, and I have a big problem that law enforcement can use the technology that advances our quality of life against us," defense attorney Kimberly Weber said. Of course, there's also the question of how reliable information is from smart home devices. Accuracy can be an issue for any number of IoT gadgets. However, an audio recording would seemingly be a solid piece of evidence, if released.

NY Mag has a good analysis of the situation, noting that while the Echo is "always on" it only keeps information after a specific request.

Amazon’s Echo (and its main competitor, the Google Home) works by passively recording everything you say. None of this information is actually sent to Amazon. Think of it more like taking notes in class — as if you’re listening but not writing anything down until your professor actually says something important. But when the Echo hears “Alexa” (or whatever your activation phrase is), it begins to actively record. That snippet of speech is then sent to Amazon’s cloud servers, where your recorded message is run through a speech-recognition neural network and a response is sent back to you, whether that’s playing a song on Spotify or giving you the weather forecast.

Amazon keeps all of the recordings of you asking Alexa to play WNYC or of you setting a timer for 20 minutes. You can jump into the Alexa companion app and hear all of your requests again if you want to see just how bored you sound when talking to your home voice robot. Sure, it’s slightly creepy — but Amazon also tracks pretty much every move you make while you’re online shopping as well.

That article also notes that Amazon has no officially stated policy about how long it keeps recordings, but there's an anecdotal suggestion that it's deleted after six months.

Of course, some people will immediately use this as a reason why no one should ever have these kinds of devices -- but that ignores that they can actually be quite useful as well. This is the trade off that we continually go through with modern technology these days. The ability to make use of certain tools and services also involves revealing certain information about you -- and then you have two potential problems: first, what does the company giving you the service do with that info and, second, what would third parties (e.g., law enforcement or hackers) like to do with that info if they could get a hold of it.

This is the kind of thing that everyone -- especially in the tech industry -- should be discussing, but seems afraid to even bring it up, for fear of scaring people off of these new devices and services. This is ridiculously short-sighted. The industry should be much more upfront about this. It should be much clearer about what information is collected, what is done with it, how long it's kept and who has access to it. Even more important is that it should give the end user full control over that data. That is, let users log in and see what information is collected and how it's been accessed. Similarly, allow the user to delete that info -- perhaps while letting them know it might impact the quality of services. By being more transparent, and giving more control to the end users, then people can actually get the benefits of some of these services, without having to worry about the problems (or at least making decisions to minimize the risk).

Amazon may have chosen not to give the info in this case (if it even had any info to give) -- and that's good. But these kinds of requests are going to keep coming. And ignoring the issue isn't going to help anyone.

Filed Under: amazon echo, bentonville, iot, james andrew bates, microphones, murder, surveillance, victor collins, warrant
Companies: amazon

Unsealed Clinton Email Warrant Asks Court To Maintain Secrecy Of Investigation James Comey Publicly Announced To Congress

from the in-all-things,-boilerplate dept

The FBI's search warrant for Anthony Weiner's laptop was unsealed and released yesterday. This isn't the warrant the FBI originally used to seize and search the laptop. That one was looking for evidence related to allegations Weiner sexted an underage girl.

This warrant is the second search warrant for the same laptop, related to the discovery of emails to and from Hillary Clinton on it. This discovery during an unrelated search prompted Comey to write a letter to Congress informing it that he was going to be diving back into the Clinton email investigation.

The second dive into emails stored on the laptop by former Clinton aide (and estranged spouse of Anthony Weiner) Huma Abedin resulted in the discovery of nothing the FBI hadn't already seen. Comey apologized for getting everyone hot and bothered by his shouting of "CLASSIFIED!" in a crowded electoral season, but believed his actions were justified because he feared this information would likely leak anyway.

Leaks did abound, but the emails found on the laptop were ones that had already been seen by the FBI during its earlier investigation. Since no charges are being brought against Clinton (or Abedin) for mishandling of classified information, there's likely going to be no Fourth Amendment challenges raised in regards to the evidence the FBI didn't find.

If for some reason there was, I'm sure the FBI would feel the "plain view" exception (or perhaps "inevitable discovery," although plain view is a more accurate description...) would apply to its discovery of possible evidence completely unrelated to the Weiner sexting investigation at hand. As the affidavit explains, the normal process of going through emails for the Weiner investigation resulted in the viewing of email header info pointing to Hillary Clinton's private email server.

Having "segregated" those emails, the FBI applied for a second warrant [PDF] to search the content of those communications for classified material. As we know now, nothing of interest was found. Still, there was only the minimum of probable cause to search the content of these stored emails: that Hillary Clinton's email address appeared in the header info. This small possibility the seized emails may have contained classified information was used to justify a second forensic imaging of the seized laptop.

What's completely ridiculous about the affidavit is the agent's request that the affidavit and warrant be sealed because of the "confidential nature" of the investigation. Never mind the fact that James Comey himself blew past other FBI officials' recommendations and outed the results of the first investigation in a public press conference. Then he did it again with his letter to Congress on October 28 -- two days BEFORE this FBI agent asked for the sealing of documents because the investigation was apparently too "sensitive" to be made public.

It could be the agent prepared this affidavit before Comey decided to go public with his announcement, but the signature and date of October 30th appear directly below this paragraph claiming this information needed to be withheld from the public. And the judge granted it, which is just as much of an absurdity. It's not as though no one was aware of Comey's announcement. It was literally in all the papers. But, hey, law enforcement loves boilerplate and, apparently, magistrates' eyes start glossing over by the time they get to affidavit signature pages, because no one thought this request might sound ridiculous given the circumstances surrounding it.

Filed Under: anthony weiner, doj, emails, fbi, hillary clinton, huma abedin, investigation, james comey, probable cause, secrecy, warrant

Bill Introduced To Push Back Approval Of DOJ's Proposed Rule 41 Changes

from the buying-time dept

Unless someone steps up to push this off course, the DOJ's proposed changes to Rule 41 will become law December 1. That's the key part: doing something. All that has to happen is nothing for the changes to become law. The December 1st date plays right into the DOJ's hands, arriving between two major holidays when legislators have other things on their minds, including the annual Congressional fisticuffs over the federal budget.

The DOJ says the changes are no big deal. Just an "update" on outdated laws. Oddly, it's never shown any interest in updating any other outdated laws (like the CFAA) or pushed for a reconsideration of the Third Party Doctrine, which traces back nearly four decades. When it comes to expansions of power, though, it's apparently time for some "updating."

The proposed changes would allow the FBI to hack thousands of computers around the world with a single warrant, much like it already did during two child porn investigations. Unfortunately for the FBI, its warrant is being met with successful challenges because the agency clearly violated Rule 41 jurisdictional limitations.

In addition, the DOJ wants permission to break into "compromised" computers and poke around inside them without the permission or knowledge of the owners of these computers. It also wants to treat anything that anonymizes internet users or hides their locations to be presumed acts of a guilty mind. The stripping of jurisdictional limits not only grants the FBI worldwide access for digital seizures and searches, but also encourages it to go venue shopping for judicial rubber stamps.

Earlier this year, Sen. Ron Wyden introduced a bill aimed at stopping the DOJ's Rule 41 push. Not much has been heard about this bill since, so Wyden (along with Sens. Coons, Lee, Franken, and Daines) has introduced another bill seeking to prevent a "do nothing" approval of expanding hacking/search powers. The "Review the Rule Act" [PDF] is about as succinct as legislation gets. Here's the complete summary of the proposed legislation (via Naked Security):

To delay the amendments to rule 41 of the Federal Rules of Criminal Procedure.

Wyden's earlier bill hasn't gained any traction and the hopes of a complete rejection before December 1st are nearly nonexistent. So, this bill just asks for a little more time to discuss the implications of the changes. This would move the default approval date back seven months to July 1, 2017.

This would allow representatives more time to fully consider the DOJ's proposal, freed from the time crunch of major holidays and annual federal budget discussions. There's far too much at stake to simply allow the DOJ to roll its Rule 41 ball downhill and past a distracted Congress. Many legislators like procrastination as much as they like not doing anything, so signing off on this proposal shouldn't require much effort, mental or otherwise.

Filed Under: congress, doj, fbi, hacking, nit, ron wyden, rule 41, warrant

Unsealed Warrant Shows FBI Malware Affected Innocent Tor Users While Agency Ran More Than 20 Child Porn Sites

from the supporting-justifications-cited:-1.-the-ends dept

Thanks to the ACLU's push to unseal documents related to the FBI's targeting of TorMail users and Freedom Hosting, the warrant affidavits supporting its NIT deployment have been released by the agency. Joseph Cox of Motherboard reports:

In 2013, the FBI received permission to hack over 300 specific users of dark web email service TorMail. But now, after the warrants and their applications have finally been unsealed, experts say the agency illegally went further, and hacked perfectly legitimate users of the privacy-focused service.

“That is, while the warrant authorized hacking with a scalpel, the FBI delivered their malware to TorMail users with a grenade,” Christopher Soghoian, principal technologist at the American Civil Liberties Union (ACLU), told Motherboard in an email.

The 99-page affidavit [PDF] is lightly-redacted but contains some completely uncensored and surprising admissions from the agency. Contrary to its post-release statements about the scope of the "narrowly-tailored" warrant not being exceeded, the actual contents show the deployment of the NIT to unmask Tor users is much more aligned with Soghoian's "grenade" description.

As Cox points out, the TorMail affidavit [PDF] says the NIT would only be delivered to logged-in, specifically-targeted TorMail users.

[T]he NIT… will be deployed on the TARGET ACCOUNTS while the TARGET ACCOUNTS operate in the District of Maryland, to investigate any user who logs into any of the TARGET ACCOUNTS by entering a username and password.

In reality, the deployment occurred the moment a user landed on any site utilizing Freedom Hosting -- not just the child porn sites the FBI had taken control of. And the number of sites the FBI was running during this investigation is staggering.

According to the new documents, the NIT was used against users of 23 separate websites.

If you thought the FBI's admin efforts for two separate child porn websites (in two investigations spaced a couple of years apart) were questionable, you have to wonder about the morality (or legality) of the US government becoming one of the world's largest distributor of child pornography. Researcher Sarah Jamie Lewis notes that, according to her numbers, the FBI could have been operating close to half (if not more) of the child porn websites in existence.

And, as for the claims the FBI didn't exceed the scope of the warrant: that's clearly not true. The warrant was issued in Maryland and was delivered to users all over the world. The supporting affidavit contains descriptions of one site apparently located in Hungary, but never makes any attempt to limit the FBI efforts to within US borders, much less Maryland.

The NIT violated Rule 41 limitations and then exceeded the FBI's own assertions about targeting specific users. It continues to deploy the same malware against Tor users with a similar lack of concern for jurisdictional restrictions or its implicit invitation for foreign law enforcement agencies to engage in the same tactics against US citizens.

Filed Under: 4th amendment, child porn, doj, fbi, malware, nit, playpen, warrant

Belgian Court Fines Microsoft For Failing To Comply With Its Impossible Order

from the we-said-JUMP dept

You can't always get what you want. But if you try sometime, you just might fine... a company for being unable to deliver on the impossible.

Belgium has fined Skype €30,000 for failing to comply with a court request to intercept users' communications, something Skype claims was technically impossible at the time of the request.

According to Het Belang van Limburg, a Dutch-language newspaper in Belgium, the fine was delivered by the court in Mechelen because Skype had failed, in September 2012, to deliver up anything more than metadata in response to an investigation into a criminal organisation.

The court, failing to understand anything but its power to order people around, demanded that Skype turn over communications. Skype turned over the only thing it could actually obtain, explaining that its architecture didn't support the interception of calls. No dice. That only made the court angry.

The court was no more happy to have pointed out to it that Microsoft didn't actually fall under its jurisdiction. It maintains no data centers in Belgium, nor does it have anyone employed there. Microsoft suggested the court work with governments of countries where it actually maintains a presence and utilize their mutual assistance treaties.

None of these facts appear to have mattered. The court says Microsoft should be able to do the impossible because the law is the law.

Het Belang van Limburg quoted prosecutor Tim Hoogenbemt as saying: "Skype offers services in our country, so it needs to know the laws. And therefore know that the court may ask interception measures."

Sometimes the law isn't the law, though. Microsoft pointed out the law doesn't actually apply to it since it's a software provider, rather than a service provider.

And sometimes the law is an ass. The fine is still in place despite arguments of impossibility, illegality, and "not applicable" to the contrary. It may not stick. Microsoft is appealing the decision.

This isn't the first time Belgian courts have overreached. Back in 2009, Belgian officials blew off perfectly workable mutual assistance treaties, demanding user information directly from Yahoo's US headquarters. Yahoo, like Microsoft, pointed out that it has no data centers or employees in Belgium. Instead of rethinking its approach, the government took the company to criminal court. That court, like this one, decided to fine the company for doing the exact thing it was supposed to be doing: protecting its users' privacy.

And that's not the limit of Belgian exceptionalism. A "royal decree" from the Belgian government (which bypasses the Parliamentary approval process needed for actual legislation) forces ISPs to collect and store tons of info on their subscribers, including how many emails are sent, VoIP use (hello, Skype!), call metadata, etc. -- just in case law enforcement might need it. When it was pointed out this decree violated the EU's privacy directive, the government shrugged and called the agreement it signed "obsolete."

Given these decisions, it's not even useful advice to suggest just not doing business in Belgium. It quite obviously doesn't matter to the courts where the data or communications they're seeking are actually located.

Filed Under: belgium, intercept, phone calls, skype, warrant
Companies: microsoft, skype

FBI Boss Blows Past Policies, Guidelines, His Own Staff To Bring Back Clinton Email Investigation

from the marching-to-the-beat-of-his-own-ridiculous-drummer dept

So, months after clearing Hillary Clinton's slate by deciding she was stupid rather than malicious, James Comey has again gone rogue, declaring there's something worth investigating in emails recovered from a sleazy ex-politician's computer. (Thus subverting the norm of recovering emails from a sleazy, CURRENT politician's computer…)

The timing is, of course, suspect. The FBI really isn't supposed to be announcing investigations of presidential candidates this close to Election Day. As Marcy Wheeler points out, there are guidelines Comey appears to be violating.

Jamie Gorelick (who worked with Comey when she was in DOJ) and Larry Thompson (who worked with Comey when Comey was US Attorney and he was Deputy Attorney General, until Comey replaced him) wrote a scathing piece attacking Comey for violating the long-standing prohibition on doing anything in an investigation pertaining to a political candidate in the 60 days leading up to an election.

It's not the law, but it's something. And until Comey decided to merge Weinergate into Emailgate, this guidance has been followed:

Decades ago, the department decided that in the 60-day period before an election, the balance should be struck against even returning indictments involving individuals running for office, as well as against the disclosure of any investigative steps. The reasoning was that, however important it might be for Justice to do its job, and however important it might be for the public to know what Justice knows, because such allegations could not be adjudicated, such actions or disclosures risked undermining the political process. A memorandum reflecting this choice has been issued every four years by multiple attorneys general for a very long time, including in 2016.

It would be a bit much to claim Comey wants to see Trump in the White House. But he apparently has no qualms about violating internal DOJ gentlemen's agreements, which should raise questions -- as Wheeler notes -- about what other policies or guidance Comey considers optional.

The reason you can't put this down as a move meant to damage Clinton's campaign is because that narrative already got used up when Comey refused to recommend prosecution for actions most other government employees wouldn't have walked away from. Suffice it to say, the reaction to Comey's latest announcement depicts partisanship at its best/worst.

So of course the Republicans that had been claiming Comey had corruptly fixed the investigation for Hillary immediately started proclaiming his valor and Democrats that had been pointing confidently to his exoneration of Hillary immediately resumed their criticism of his highly unusual statements on this investigation. Make up your minds, people!

While certain voters sort out their love/hate relationship with James Comey, the next question about broken rules applies to the emails themselves. The FBI seized Anthony Weiner's laptop to search for evidence of alleged communications between Weiner and a 15-year-old. In the course of doing that, agents came across emails between Clinton aides and Huma Abedin, Weiner's estranged wife.

Apparently without knowing the content of these emails, Comey went ahead and decided to alert Congress to the new details of the investigation. Oddly, this happened before the FBI even had a warrant to search those emails -- though it received one over the weekend. Even with the warrant in hand, it's not entirely clear the agency has the right to do that under the Fourth Amendment. The laptop's search and seizure isn't at all related to the (supposedly closed) Hillary Clinton email investigation.

Orin Kerr examines the issues thoroughly at the Volokh Conspiracy. As he sees it, the FBI can't legally expand its investigation for several reasons. Court decisions have suppressed evidence in cases where searches have uncovered evidence of other criminal activity not related to the investigation at hand. These emails are clearly unrelated to the messages sent from Weiner that the FBI was looking for.

The FBI may try to avail itself of the "plain view" exception, but this claim would be dubious at best.

The plain view exception does not allow evidence to be seized outside a warrant unless it is “immediately apparent” upon viewing it that it is evidence of another crime. Just looking quickly at the new evidence, there needs to be probable cause that it is evidence of a second crime to justify its seizure, which would presumably be necessary to apply for the second warrant.

Assuming the FBI hadn't already taken a peek, all that was known about these emails was that they involved a top Clinton aide. There could be no determination at that point that they contained classified or sensitive material. The Fourth Amendment doesn't (or at least shouldn't [stupid courts]) allow communications to be searched first in hopes of justifying the search after coming across some probable cause. The FBI needed to establish that first and it's unclear how it would do it without actually seeing the content -- though the fact that a court granted the warrant raises some questions about why.

Unfortunately, case law is nowhere approaching "settled" on the limits of digital searches. "Plain view" in regards to digital files is much harder to pin down. Some decisions have made it clear the government can't seize devices and look through everything in hopes of finding evidence of other criminal activity. Fishing expeditions are discouraged, but not every court has felt compelled to suppress evidence gathered in this fashion.

However that all shakes out, one thing is clear: James Comey is running the FBI like it's a one-man shop. He's managed to anger other FBI officials with his autonomous decisions and declarations. Marcy Wheeler notes in her post that the DOJ has shown it can't control Comey, and Comey himself -- in his letter to Congress -- suggested that if he didn't come forward with this, someone inside his agency would have leaked the information. So, the DOJ can't control Comey. Comey can't (or won't) control his own people. And Comey will continue to do things his way, no matter what collateral damage he may cause.

Filed Under: 4th amendment, anthony weiner, doj, emails, fbi, hillary clinton, huma abedin, investigation, james comey, warrant