Good Faith Beats Bad Warrant In Another Win For FBI's World-Traversing NIT Malware

from the this-should-keep-this-out-of-the-Supreme-Court's-hands dept

Another challenge of the NIT (Network Investigative Technique) warrant used by the FBI during its investigation of a dark web child porn website has hit the appellate level. A handful of district courts have found the warrant used invalid, given the fact that its reach (worldwide) exceeded its jurisdictional grasp (the state of Virginia, where it was obtained). That hasn't had much of an effect on appeals court rulings, which have all found the warrant questionable to varying degrees, but have granted the FBI "good faith" for violating the jurisdictional limits the DOJ was attempting to have rewritten (Rule 41 -- which governs warrant jurisdictional limits, among other things) to allow it to do the things it was already doing.

Even though the FBI had to have known searches performed all over the world using one Virginia-based warrant violated Rule 41 limits, appellate judges have declared the FBI agent requesting the warrant wasn't enough of a legal expert to know this wasn't allowed. Two appeals courts have stated suppressing the evidence is pointless because the law changed after the jurisdiction limit violation took place. The appellate decisions have been troubling to say the least, providing further evidence that the good faith exception is the rule, rather than the outlier.

The latest decision [PDF] dealing with the NIT warrant comes from the Third Circuit Appeals Court. It, too, finds the warrant questionable. And it states the government has agreed the warrant was not valid under Rule 41(b).

The Government conceded below that “[a]lthough Rule 41 does authorize a judge to issue a search warrant for a search in another district in some circumstances, it does not explicitly do so in these circumstances.” App. 91 (Government Br. in Opposition to Motion to Suppress) (emphasis added).

The opinion goes on to note the government, having admitted its warrant was bad, then argued it was good because it was apparently thinking of a different part of Rule 41 when it applied for a warrant, even though none of this thought made its way into the affidavit as words.

On appeal, however, the Government curiously has reversed course, and now contends that the NIT was in fact explicitly authorized by Rule 41(b)(4), which provides that a magistrate judge may “issue a warrant to install within the district a tracking device; the warrant may authorize use of the device to track the movement of a person or property located within the district, outside the district, or both.” Fed. R. Crim. P. 41(b)(4) (emphasis added).

According to the Government, under this Rule, “the NIT warrant properly authorized use of the NIT to track the movement of information—the digital child pornography content requested by users who logged into Playpen’s website—as it traveled from the server in [EDVA] through the encrypted Tor network to its final destination: the users’ computers, wherever located.”

Wrong again, says the court, noting the disingenuousness of the government's goalpost move. (All emphasis added by me and not the court from this point forward.)

We need not resolve Werdene’s contention that the Government waived this argument because we find that the Government’s tracking device analogy is inapposite. As an initial matter, it is clear that the FBI did not believe that the NIT was a tracking device at the time that it sought the warrant. Warrants issued under Rule 41(b)(4) are specialized documents that are denominated “Tracking Warrant” and require the Government to submit a specialized “Application for a Tracking Warrant.” See ADMINISTRATIVE OFFICE OF U.S. COURTS, CRIMINAL FORMS AO 102 (2009) & AO 104 (2016). Here, the FBI did not submit an application for a tracking warrant – rather, it applied for, and received, a standard search warrant. Indeed, the term “tracking device” is absent from the NIT warrant application and supporting affidavit.

The court also helpfully finds that computer users have an expectation of privacy in their IP addresses and other identifying info housed in their computers. It points out the government obtained this directly from targets' computers rather than third parties, making this a Fourth Amendment search rather than a Third Party Doctrine case.

But that's where the good news ends for the defendant. The appeals court says the warrant was invalid the moment it was issued, but that this can't be held against the FBI. It rationalizes its opinion this way: suppression of evidence is for deterrence, not for righting the government's wrongs. So, it's OK for the FBI to rely on an invalid warrant because the judge made the error approving it. The FBI was not wrong to rely on the warrant, even though it very likely knew its request violated Rule 41 jurisdictional limits. Then it arrives at this conclusion -- one reached previously by another appeals court:

More importantly, the exclusionary rule “applies only where it ‘result[s] in appreciable deterrence.’” Herring, 555 U.S. at 141 (quoting Leon, 468 U.S. at 909) (emphasis added). Thus, even though Rule 41(b) did not authorize the magistrate judge to issue the NIT warrant, future law enforcement officers may apply for and obtain such a warrant pursuant to Rule 41(b)(6), which went into effect in December 2016 to authorize NIT-like warrants. Accordingly, a similar Rule 41(b) violation is unlikely to recur and suppression here will have no deterrent effect.

In other words, because it's now impossible for the FBI to engage in this violation of Rule 41, there's nothing to be gained by suppressing the evidence. In essence, the court is saying that if the DOJ can get laws changed quickly enough to codify earlier statutory violations, defendants challenging evidence based on legal violations that occurred before the law was changed are shit out of luck. Compare and contrast this to civil rights lawsuits where the courts have awarded good faith to law enforcement for apparent rights violations because they occurred before such acts were declared unconstitutional by precedential opinions. It's "heads I win, tails you lose" in federal courts, thanks to the good faith exception.

More cases will reach the appellate level but it hardly seems likely any of those will result in suppressed evidence for Playpen defendants. These findings will be reached despite most appellate judges declaring the underlying warrants void from the moment they were issued. Defendants asking for suppression are going to run into judges willing to forgive the FBI both before and after the fact, which means there's very little justice left in the justice system's tanks.

Filed Under: 4th amendment, doj, fbi, good faith exception, nit, playpen, rule 41, third circuit, warrant

Third Circuit Appeals Court Establishes First Amendment Right To Record Police

from the another-circuit-embraces-the-inevitable dept

Early last year, a federal court judge decided filming police officers was not protected by the First Amendment. How the court arrived at this conclusion was by narrowly defining the First Amendment as only protecting "expressive" speech. Simply documenting activity was somehow not covered by the First Amendment, according to the government's theory (the city of Philadelphia, in this case).

According to the district court, expression is key. It was the wrong conclusion to reach, but it helped some Philadelphia police officers escape being held accountable for retaliatory arrests of citizen photographers. Even worse, it created a chilling effect for citizen photographers in the court's jurisdiction, giving them a publish or die be arrested mandate.

At that time, it seemed unlikely the Third Circuit Appeals Court would overturn its own precedential rulings. The Appeals Court had never gone so far as to establish a First Amendment right to record public officials. In fact, precedent had mostly sided with law enforcement officers who had been sued for shutting down recordings. An affirmation on appeal would have resulted in a circuit split that could only be resolved if and when the Supreme Court chose to take up a case directly related to this issue.

Fortunately, the Third Circuit Court has reversed the lower court's finding, at least in terms of the First Amendment. This adds to the list of circuits already viewing recordings of cops as protected speech. The issue appears to be (slowly) resolving itself without the Supreme Court's assistance.

The ruling [PDF] is a fantastic read, at least as far as its handling of the First Amendment goes. The opening makes it clear the lower court screwed this up badly. [h/t Brad Heath]

This case involves retaliation. Richard Fields and Amanda Geraci attempted to record Philadelphia police officers carrying out official duties in public and were retaliated against even though the Philadelphia Police Department’s official policies recognized that “[p]rivate individuals have a First Amendment right to observe and record police officers engaged in the public discharge of their duties.” No party contested the existence of the First Amendment right. Yet the District Court concluded that neither Plaintiff had engaged in First Amendment activity because the conduct—the act of recording—was not sufficiently expressive. However, this case is not about whether Plaintiffs expressed themselves through conduct. It is whether they have a First Amendment right of access to information about how our public servants operate in public.

Every Circuit Court of Appeals to address this issue (First, Fifth, Seventh, Ninth, and Eleventh) has held that there is a First Amendment right to record police activity in public. See Turner v. Lieutenant Driver, 848 F.3d 678 (5th Cir. 2017); Gericke v. Begin, 753 F.3d 1 (1st Cir. 2014); Am. Civil Liberties Union of Ill. v. Alvarez, 679 F.3d 583 (7th Cir. 2012); Glik v. Cunniffe, 655 F.3d 78 (1st Cir. 2011); Smith v. City of Cumming, 212 F.3d 1332 (11th Cir. 2000); Fordyce v. City of Seattle, 55 F.3d 436 (9th Cir. 1995). Today we join this growing consensus. Simply put, the First Amendment protects the act of photographing, filming, or otherwise recording police officers conducting their official duties in public.

This establishes citizen photography as protected speech, no matter what the photographer's intent is. The protection here has very little to do with expression, no matter how much the defendants wish it was. Instead, it has everything to do with access.

To record what there is the right for the eye to see or the ear to hear corroborates or lays aside subjective impressions for objective facts. Hence to record is to see and hear more accurately. Recordings also facilitate discussion because of the ease in which they can be widely distributed via different forms of media. Accordingly, recording police activity in public falls squarely within the First Amendment right of access to information. As no doubt the press has this right, so does the public.

[...]

In sum, under the First Amendment’s right of access to information the public has the commensurate right to record—photograph, film, or audio record—police officers conducting official police activity in public areas.

In the Third Circuit, cops can no longer expect to shielded from lawsuits related to shutting down citizens' recording efforts.

As was noted by the court, the right likely should have been established at the time the incident took place (2014).

In 2011 the Department published a memorandum advising officers not to interfere with a private citizen’s recording of police activity because it was protected by the First Amendment. In 2012 it published an official directive reiterating that this right existed. Both the memorandum and directive were read to police officers during roll call for three straight days. And in 2014, after the events in our case and the occurrence of other similar incidents, the Department instituted a formal training program to ensure that officers ceased retaliating against bystanders who recorded their activities.

Unfortunately, the court still sides with the officers, stating that precedent from various circuits did not divorce the act of recording entirely from the concept of "expression." At the point the arrests occurred, it may have seemed reasonable to shut down citizens who attempted to record police if they couldn't clearly state an "expressive" reason for doing so. And that's apparently ok even if the officers had received repeated instructions from their supervisors about respecting the public's right to record.

The dissent disagrees with this conclusion. It wasn't just court precedent and the PD's own directives. Officers also should have been aware of the DOJ's directive along the same lines, which was handed down in 2012 to all local law enforcement agencies urging them to respect the public's "right to record."

With all of this, it is indisputable that all officers in the Philadelphia Police Department were put on actual notice that they were required to uphold the First Amendment right to make recordings of police activity. From a practical perspective, the police officers had no ground to claim ambiguity about the boundaries of the citizens’ constitutional right here.

Even absent this wealth of directives, any officer should have "reasonably" known retaliating against citizens for recording in public was the wrong way to handle this.

A reasonable police officer would have understood, first-hand, the significance of this proliferation of personal electronic devices that have integrated image capture into our daily lives, making it a routine aspect of the way in which people record and communicate events. Apart from any court ruling or official directive, the officers’ own lived experience with personal electronic devices (both from the perspective of being the one who is recording and one who is being recorded) makes it unreasonable to assume that the police officers were oblivious to the First Amendment implications of any attempt by them to curtail such recordings.

The upshot is the judicial enshrinement of the right to record police. The downside for the plaintiffs is the officers can't be sued for violating what should have been considered a clearly established right, even before the Appeals Court decision.

The way things are going, the Supreme Court may never have to address the issue. As the presiding judges note (both in the opinion and during oral arguments), the establishment of this right across the nation is inevitable. As more circuits address the issue head-on, the rulings should result in further First Amendment wins.

As a side note, the oral arguments are an amazing watch. The government's lawyer desperately wants the discussion to center on questions of immunity, but the court is far more interested in how he intends to argue speech must be tied to expressive intent to receive First Amendment protections. The fun starts about 19:45 into the recording. By the time a judge brings up the Zapruder recording ten minutes later, you almost feel sorry for the government's legal rep.

Filed Under: 1st amendment, filming police, first amendment, free expression, recording police, third circuit

Third Circuit Appeals Court Says All Writs Orders Can Be Used To Compel Passwords For Decryption

from the still-no-definitive-answer-on-the-Fifth-Amendment-though dept

The Third Circuit Court of Appeals has ruled that passwords can be compelled with All Writs Orders. Handing down a decision in the case of Francis Rawls, a former Philadelphia police officer facing child porn charges, the court finds the order lawful, but doesn't go quite as far as to determine whether compelling password production implicates the Fifth Amendment.

The Third Circuit doesn't touch the Fifth Amendment implications because Rawls failed to preserve them.

Even if we could assess the Fifth Amendment decision of the Magistrate Judge, our review would be limited to plain error. See United States v. Schwartz, 446 F.2d 571, 576 (3d Cir. 1971) (applying plain error review to unpreserved claim of violation of privilege against self-incrimination). Doe’s arguments fail under this deferential standard of review.

Orin Kerr highlights a footnote from the order [PDF], which shows even if the court had addressed the Fifth Amendment implications, it likely would have sided with government based on its interpretation of the government's "foregone conclusion" argument.

It is important to note that we are not concluding that the Government’s knowledge of the content of the devices is necessarily the correct focus of the “foregone conclusion” inquiry in the context of a compelled decryption order. Instead, a very sound argument can be made that the foregone conclusion doctrine properly focuses on whether the Government already knows the testimony that is implicit in the act of production. In this case, the fact known to the government that is implicit in the act of providing the password for the devices is “I, John Doe, know the password for these devices.” Based upon the testimony presented at the contempt proceeding, that fact is a foregone conclusion.

However, because our review is limited to plain error, and no plain error was committed by the District Court in finding that the Government established that the contents of the encrypted hard drives are known to it, we need not decide here that the inquiry can be limited to the question of whether Doe’s knowledge of the password itself is sufficient to support application of the foregone conclusion doctrine.

This interpretation limits what the government has to assert to avail itself of this argument -- one that's sure to become more common as default encryption comes to more devices and communications services. As applied here, the government only has to show the defendant knows the password. It doesn't have to make assertions about what it believes will be found once the device/account is unlocked. (That being said, the DHS performed a forensic scan of the one device it could access -- the MacBook Pro -- and found data and photos suggesting the locked external drives contained more child pornography.)

The court also addresses the All Writs Act being used to compel password production in service to a search warrant that still can't be fully executed.

Doe asserts that New York Telephone should not apply because the All Writs Act order in that case compelled a third party to assist in the execution of that warrant, and not the target of the government investigation. The Supreme Court explained, however, that the Act extends to anyone “in a position to frustrate the implementation of a court order or the proper administration of justice” as long as there are “appropriate circumstances” for doing so. Id. at 174. Here, as in New York Telephone: (1) Doe is not “far removed from the underlying controversy;” (2) “compliance with [the Decryption Order] require[s] minimal effort;” and (3) “without [Doe’s] assistance there is no conceivable way in which the [search warrant] authorized by the District Court could [be] successfully accomplished.” Id. at 174-175. Accordingly, the Magistrate Judge did not plainly err in issuing the Decryption Order.

This shows just how malleable the New York Telephone decision is. This 1977 Supreme Court decision paved the way for widespread pen register use. Since that point, it has been used by the DOJ to argue for the lawfulness of encryption-defeating All Writs Orders (as in the San Bernardino iPhone case), as well as by criminal defendants arguing these same orders are unlawful.

In Apple's case, the government argued the company was not "far removed" from the controversy, despite it being only the manufacturer of the phone. Apple's distance as a manufacturer provided its own argument against the DOJ's application of this Supreme Court decision.

In this case, the key words are "third party": Rawls is arguing this isn't nearly the same thing as forcing a phone company to comply with pen register orders. This is a "first party" situation where compliance may mean producing evidence against yourself for use in a criminal trial. The government likes the New York Telephone decision for its Fourth Amendment leeway. The defendant here is arguing this isn't even a Fourth Amendment issue.

As the court points out, it can't really assess the Fifth Amendment argument -- not when it hasn't been preserved for appeal. But even so, the court says law enforcement already has enough evidence to proceed with prosecution. If so, the only reason the government's pressing the issue -- which has resulted in Rawls being jailed indefinitely for contempt of court -- is that it wants a precedential ruling clearly establishing the lawfulness of compelling the production of passwords. The court doesn't quite reach that point, but the ruling here seems to suggest it will be easier (in this circuit at least) to throw people in jail for refusing to hand over passwords, since all the government is really being forced to establish is that it knows the defendant can unlock the targeted devices/accounts.

Filed Under: 5th amendment, all writs act, compelled, francis rawls, passwords, third circuit

Pennsylvania Court Shrugs Off Microsoft Decision; Says Google Must Turn Over Emails Stored At Overseas Data Centers

from the redefining-'seizure' dept

Just south of the Second Circuit Court of Appeal's district, a Pennsylvania (3rd Circuit) federal judge has come to (nearly) the opposite conclusion on law enforcement's access to emails stored overseas. This case deals with two FBI SCA (Stored Communications Act) warrants seeking emails that Google says aren't stored in the United States. Google, however, also says the sought emails could be at any of its data storage sites -- which would include those in the US. It all depends on when it's asked to retrieve the communications.

And there's where this decision parts ways with the Second Circuit, which found that emails stored in an Irish data center weren't subject to US-issued warrants. The court explains [PDF] Google's process for handling user data, which is built for efficiency, rather than what's central to the FBI's demands: efficiency of retrieval in response to law enforcement requests.

Google stores user data in various locations, some of which are in the United States and some of which are in countries outside the United States. Some user files may be broken into component parts, and different parts of a single file may be stored in different locations (and, accordingly, different countries) at the same time. Google operates a state-of-the-art intelligent network that, with respect to some types of data, including some of the data at issue in this case, automatically moves data from one location on Google's network to another as frequently as needed to optimize for performance, reliability, and other efficiencies.

As a result, the country or countries in which specific user data, or components of that data, is located may change. It is possible that the network will change the location of data between the time when the legal process is sought and when it is served. As such, Google contends that it does not currently have the capability, for all of its services, to determine the location of the data and produce that data to a human user at any particular point in time.

Because of the way Google handles data, it theoretically could refuse every US law enforcement request for communications. (It could do the same to foreign requests as well.) This makes Google's case distinguishable from Microsoft's legal battle. Microsoft knew exactly where the stored communications were located. Google says the communications might be anywhere -- in one place upon receipt of a warrant and in another when retrieval efforts begin. As the court sees it, the Second Circuit's ruling would basically make Google completely immune to law enforcement requests.

[I]f the court were to adopt Google’s interpretation of the Microsoft decision and apply such a rationale to the case at bar, it would be impossible for the Government to obtain the sought-after user data through existing MLAT channels.

The "fix," according the Pennsylvania court, is to have Google round up the sought communications in the US, putting them within reach of the FBI's warrants.

In contrast, under this court’s interpretation, Google will gather the requested undisclosed data on its computers in California, copy the data in California, and send the data to law enforcement agents in the United States, who will then conduct their searches in the United States.

Of course, this means compelling Google to do something with its data that it doesn't normally do, which would make it a seizure. And since the data sought is constantly in transit, the court is giving the government the power to step in and alter Google's data-handling. This would obviously be a seizure of data potentially stored (at least temporarily) in foreign countries. To get around the Fourth Amendment concerns this raises -- not to mention the expansion of the US government's power to compel the production of data from foreign servers -- the court decides no seizure actually takes place until the government takes control of the data Google has been ordered to compile.

In contrast to the decision in Microsoft, this court holds that the disclosure by Google of the electronic data relevant to the warrants at issue here constitutes neither a "seizure" nor a "search" of the targets' data in a foreign country. This court agrees with the Second Circuit's reliance upon Fourth Amendment principles, but respectfully disagrees with the Second Circuit's analysis regarding the location of the seizure and the invasion of privacy.

[...]

Electronically transferring data from a server in a foreign country to Google's data center in California does not amount to a "seizure" because there is no meaningful interference with the account holder's possessory interest in the user data. Indeed, according to the Stipulation entered into by Google and the Government, Google regularly transfers user data from one data center to another without the customer's knowledge. Such transfers do not interfere with the customer's access or possessory interest in the user data. Even if the transfer interferes with the account owner's control over his information, this interference is de minimis and temporary.

This is a really weird -- and wrong -- interpretation of the word "seizure." While it's true the FBI won't actually have taken possession of the emails until after Google has gathered them in a California datacenter to make them more Fourth Amendment-compliant (or whatever), the fact that Google has to interrupt its normal flow of data at the government's request would appear to make that initial interruption a "seizure" -- de minimis or not.

In essence, the court is saying the Fourth Amendment doesn't apply to data in transit. The government can compel the collection of overseas data and have the Fourth Amendment applied to it after it's already been gathered and stored locally. The decision makes a mess of the Fourth Amendment cart-horse configuration, but figures this is more acceptable than informing the FBI that its warrants might be useless.

The better conclusion to reach would be the one the Second Circuit reached: if the concern is that the 30-year-old SCA limits law enforcement's ability to demand data from overseas data centers run by US companies, the solution lies with the entity that created it (Congress), rather than the courts. This decision will be appealed and it's safe to assume the Third Circuit Court of Appeals will arrive at the same conclusion.

Even if Congress doesn't "fix" the SCA to make US companies with foreign data centers more responsive to law enforcement demands, cases going forward may start applying the Rule 41 changes that went into effect at the beginning of this year, which greatly expand the jurisdictional reach of US court-issued warrants. As for Google, its system isn't built with law enforcement's needs in mind, nor should it be. It does what works best for it, which is what we expect from private companies. This ruling gives law enforcement a workaround for dealing with the SCA's limits, so some forum shopping should be expected until this decision is (hopefully) overturned.

Filed Under: 4th amendment, ecpa, emails, pennsylvania, stored communications act, subpoena, third circuit, warrant
Companies: google, microsoft