Home Invasion Search Warrant: Two Knocks is One Too Many

April 20, 2017

Screen Shot 2017-04-20 at 12.02.57 PM(United States v. Juan Olaya, D-2, Case No. 15-cr-20200, EASTERN DISTRICT OF MICHIGAN SOUTHERN DIVISION)

On December 5, 2014 a group of 6 that was attached to a spree of home invasions was finally broken after arrests were made in a home-invasion in Flower Mound, TX. The group was attributed to home invasions in New Jersey, Michigan, and Texas and charges varied from federal racketeering to weapons, kidnapping and violent assault.

In Texas, one of the group’s members left a cell phone in a vehicle that was found to be associated with the crimes. According to court documents (linked below), Texas’ officer Mark Esparza obtained a warrant to examine the Samsung phone and photo documented a number of text messages and other evidence related to the crimes. The phone did not, however, have a full forensic acquisition.  After photo documenting the evidentiary information, officer Esparza returned the warrant. Nine months after Esparza’s search, the FBI, without obtaining a new warrant, searched the cell phone again and this time they did a full forensic acquisition of the phone.

This final acquisition of the phone brought the number of searches of the phone to three: Pre-warrant search for IMEI and phone number, warranted search for the phone evidence, and Federal search through the acquired phone image. Presumably, the search through a forensically acquired phone would yield additional information, and reading between the lines I am guessing this was the case for the evidentiary Samsung phone. Certainly it would assist in authenticating the evidence.

Defendant Jaun Olaya, the owner of the phone and one of the group members charged, moved to suppress the results of all three searches.  Mr. Olaya argued that “even if the screenshots that Esparza obtained should not be suppressed, the results of the more comprehensive FBI search should be.” On 4/19/2017 the Eastern District of Michigan, Southern Division court agreed with Olaya: The FBI’s acquisition of the phone and subsequent search was found to be warrantless and a violation of Olaya’s 4th amendment.  Pages 14 through to the end of the Court’s opinion and order contain the Court’s reasoning on this point.

What would be interesting to me (and potentially to criminal defense attorneys) is whether the same logic of the court could be applied if officer Esparza HAD done a full forensic acquisition of Olaya’s phone: Under those conditions, would the government’s use of Esparza’s acquisition required a second warrant?  The fact is, there is a lot of data in a phone acquisition that has nothing to do with specific crimes so I am guessing that the argument could be made.  If any criminal attorneys know of some good cases to answer the question, feel free to post below!

 

United States v. Juan Olaya, D-2, Case No. 15-cr-20200, EASTERN DISTRICT OF MICHIGAN SOUTHERN DIVISION

 

 

 


Texas CoA Addresses Electronic Community Property and Invasion of Privacy

August 5, 2016

Reference:

Miller v. Talley Dunn Gallery LLC, 2016 Tex. App. LEXIS 2280

(Tex. App. – Dallas March 3, 2016) (mem. opinion)

(Cause No. 05-15-00444-CV)

Relevant Documents:

Memorandum Opinion:  March 3, 2016, Cause No. 05-15-00444-CV

Texas Penal Code 33

In this case, part of the original trial court’s decision determined that Talley Dunn and the Tally Dunn Gallery LLC had “established a probable right to recover on their claims under the HACA. [Harmful Access to Computers Act]”  [March 3, 2016, Cause No. 05-15-00444-CV, pg. 19]

In his appeal, Bradley B. Miller argues that, while he admits that he took screenshots of information contained on the phone, the screenshots do not qualify as “access” and that he had effective consent to do so because the cell phone was community property.  [March 3, 2016, Cause No. 05-15-00444-CV, pg. 21-22]

Texas Penal Code § 33.01(1) defines access as:

“to approach, instruct, communicate with, store data in, retrieve or intercept data from, alter data or computer software in, or otherwise make use of any resource of a computer, computer network, computer program, or computer system.”

Neither party disputes that a cell phone is a computer, and the appellate court found that in order to take the screen shots Miller necessarily HAD to access the the computing device, within the definition of the penal code.  [March 3, 2016, Cause No. 05-15-00444-CV, pg. 22]

Regarding his argument that he had effective consent to access the cell phone because it was community property, the CoA relied upon the penal code definition of ‘owner’ as:

“a person who:

(A) has title to the property, possession of the property, whether lawful or not, or a greater right to possession of the property than the actor;

(B) has the right to restrict access to the property; or

(C) is the licensee of data or computer software.”

Dunn used the cell phone on a daily basis, had the right to place a password on it (and had), and the court determined Dunn had a ‘greater right to possession of the cell phone’.[March 3, 2016, Cause No. 05-15-00444-CV, pg. 23]  Further, the CoA notes earlier in the opinion that “[N]othing in the Texas Constitution or our common law suggests that the right of privacy is limited to unmarried individuals.”  [March 3, 2016, Cause No. 05-15-00444-CV, pg. 20]

Interestingly, the court does not address the multiple licenses that are part of the software and operating system that users have to acknowledge and accept to use a modern cell phone.  I would expect that will start coming up as another layer to the definition of ‘owner’, though.

Accordingly, the CoA concludes that “the trial court did not abuse its discretion by determining appellees established a probable right to recover on their claims under the HACA.”  [March 3, 2016, Cause No. 05-15-00444-CV, pg. 23]


ABA Issues Opinion on Social Media Ethics

May 7, 2014

The most common question in cases involving Open Source Intelligence (OSI) to support an electronic investigation, is: “To what extent may an attorney ethically use social media during case investigation and discovery?”

The question is not at all surprising.  The extent to which we can develop and use information from social sites, and other types of OSI, has a really high “creep factor”.  My answer has always been:  “If a person has given up information and made it publicly available to anyone with a browser and knowledge of where to look, then what’s the question?”.

Two weeks ago, the ABA agreed… mostly.  In the ABA’s “Formal Opinion 466”, issued on 4/24/2014, the ABA states, in part:

A lawyer may review a juror’s or potential juror’s Internet presence, which may include postings by the juror or potential juror in advance of and during a trial.

In summarizing, the opinion states:

In sum, a lawyer may passively review a juror’s public presence on the Internet, but may not communicate with a juror. Requesting access to a private area on a juror’s ESM is communication within this framework.
The fact that a juror or a potential juror may become aware that the lawyer is reviewing his Internet presence when an ESM network setting notifies the juror of such review does not constitute a communication from the lawyer in violation of Rule 3.5(b).

While this opinion is specific to jurors, might it also apply to witnesses, attorneys, and other parties to a case?  I would think so.

Link to the ABA Journal’s Final Opinion PDF

Deepweb and Google Cheatsheets Updated

If you are interested in researching OSI (Open Source Intelligence), and are an attorney, you will want to request a login to Vidoc Razor’s RazorSuite.  The RazorSuite includes a connector to conduct your own OSI searches in a fraction of the time, and with more information, than manual techniques.  You can request a login here.

If you prefer to do your own manual work, I have been maintaining two “Effective Internet Search” cheat sheets since 2009. The cheat sheets cover the best sites for developing information manually, as well as how to use Google’s advanced features effectively when performing online searches of people, places, and companies.

Link to the updated DeepWeb Cheat Sheet

Link to the updated Google Search Cheat Sheet


Weekly Highlights: April 21, 2014

April 22, 2014

FRCP Rule 37(e) (Preservation) is Changing

On April 11th, the Civil Rules Advisory Committee approved a  revision to Rule 37(e) (the section covers failure to preserve Electronically Stored Information (ESI)).  The new draft reads, as follows:

“(e) FAILURE TO PRESERVE ELECTRONICALLY STORED INFORMATION. If electronically stored information that should have been preserved in the anticipation or conduct of litigation is lost because a party failed to take reasonable steps to preserve the information, and the information cannot be restored or replaced through additional discovery, the court may:

(1) Upon finding of prejudice to another party from loss of the information, order measures no greater than necessary to cure the prejudice;

(2) Only upon a finding that the party acted with the intent to deprive another party of the information’s use in the litigation,

(A) presume that the lost information was unfavorable to the party;

(B) instruct the jury that it may or must presume the information was unfavorable to the party; or

(C) dismiss the action or enter a default judgment.”

You’ll note that the existing Rule 37e language is nowhere to be found:

Absent exceptional circumstances, a court may not impose sanctions under these rules on a party for failing to provide electronically stored information lost as a result of the routine, good-faith operation of an electronic information system.”

You can read the proposed changes on the US Courts site, here.

 Popular Legal Websites Affected by the Heartbleed Flaw

Robert Ambrogi’s blog, “LawSites” had a post listing sites, popular with attorneys, that were affected by Heartbleed.  You can view that site here.  If you don’t know what “Heartbleed” is, you will need to.  You can view the Inforensics Blog post, to catch up.

Box.com, and Dropbox.com were, according to Ambrogi’s research, affected by the flaw.  If you use these sites, it is a good time to review and change passwords.  Also, read the Inforensics Blog post on Password Re-use.

 

Changing Metadata Leads to Sanctions

You may have missed the following case.  Remember: It doesn’t take an expert to alter data, and attempt obfuscation, just some software from your local Best-Buy:

T & E Inc. v. Faulkner, 2014 WL 550596 (N.D. Tex. Feb. 12, 2014)

In this case, sanctions were sought for alleged manipulation of metadata, in an attempt to hide the existence of a computer that had not been produced.  A successful motion to compel the defendant to produce computers gave a specific timeline for production.  A forensic expert found evidence that, during the time given to produce, the opposing party created a new user profile on a computer, copied data to it, and used a commercial software to alter times on files in order to make the system appear as though it had been in use, in an effort to hide the “real” computer that had been in use.  Spoliation sanctions were awarded in the form of an adverse inference, and $27,000 dollars.

 


Open Source Intelligence (OSI) and Your Case

April 2, 2014

Open Source Intelligence (OSI or OSINT) is intelligence collected from sources that are available publicly.  Much of the information fed to the internet by users, collected by advertisers, or otherwise left behind during a person’s interaction with electronic systems (or with retailers and advertisers that store such information electronically and the resell it) can be identified through “deep-“, or “dark-“ web research.  OSI is important enough of a research methodology that many law enforcement agencies, especially Federal, have dedicated resources to OSINT analysis and gathering. 

In civil litigation OSI is an invaluable resource for:

  • Research of retained and opposing experts
  • Information regarding opposing attorneys
  • Witness and litigant information
  • Uncovering other emails, social site accounts, properties, activities, and repositories of information not disclosed

Consider a recent case that I was involved with: The opposing party had disclosed certain online accounts that contained relevant information regarding their corporate history, communications via web mail, and travel.  An OSI search revealed two alternate web mail addresses, as well as a connection with a competing firm, travel information (previously undisclosed), and some “known associates” that had information relevant to the case.  Metadata analysis of documents and photos contained on the newly discovered sites yielded even more information.  None of this information was contained on the hard drive submitted for inspection.

OSI, on the web, is broken down into two main categories: Direct indexed information, and Dark web (or Deep web) information.

Direct indexed information is the category most familiar to practically anyone that uses the web.  It is information that has been picked up and indexed by a search engine and, with the correct search techniques, can be narrowed down to particular people, places and things.  Indexed information typically ends up on the web through three different paths:

Deliberate – Deliberate information is information that is on the web because of the direct interaction of an entity with a web resource.  This could be information that is publicly available because of social sites, website registration, or signing on to public newsgroups and forums. 

Accidental (Through fault of the information Owner) – Often times information is deliberately provided, but the provider of the information didn’t realize that the information would be publicly searchable.  Facebook is a perfect example of where, by not understanding ALL the privacy implications of use, users (or their friends) often provide way more details, photos, or location information than is intended, desirable, or realized.

Accidental (Through fault of the information Custodian) – Very large data breaches are far too common these days.  The reality is that they have been very common for years and years, but focus has only recently been turned towards the size, and frequency of breaches.  Aside from breaches, however, “information leakage” is not at all uncommon.  Information leakage is where a website or internet resource unintentionally will provide more information than the user, or the owner, realize. There are teams of people, advertisers, and intelligence gathering entities that  look for information leak and harvest the results.

Dark (or Deep) Web information sounds very “techie” and mysterious, but in reality simply describes the large portions of the web that contain information that is not indexed by search engines.  Typically these are databases of information that are accessible from a website, registration information, attendance and membership databases and information of that nature.

The challenge with OSI is to compile information both from direct indexed resources and dark web resources, and then correlate and narrow the information so that it accurate to the particular entity that is being researched.  A thorough manual search can be performed using the “cheat sheets” provided with this book.  The challenge is that aggregation, correlation and verification can take many hours.  There are tools available to an attorney that speed up the process.  LexisNexis offers access to a static database through the Accurint tool (http://www.Accurint.com), and Westlaw (http://www.Westlaw.com) also provides static database information as well.  There are any number of smaller sites that offer various degrees of information through static databases. 

Static information can quickly become inaccurate or stale, and there are tools that fill the niche for automated research.  Vidoc Razor maintains such a tool (If you are an attorney, you can request a login at: http://www.vidocrazor.com/RSInfo.php) that actively mines “live” social information, media and publications, photos, as well as location and known relations and associate information.  The information is then aggregated, correlated, and a baseline validity check performed.  The information is available for filtering and refining from a single point, and custom reports can be generated.

Whether using manual techniques, static databases, or automated approaches, the nature of OSI is important to keep firmly in mind:  it is fluid.  The information “lives” and changes as people live and change.  It is also contradictory; some OSI is incredibly volatile and can “evaporate” without warning, while other OSI is incredibly persistent, and will stay available through harvesting techniques even when the information owner is actively trying to remove it.  Any information derived from any of the harvesting techniques discussed must be verified before action is taken on it.


Weekly Highlights: December 6, 2013

December 5, 2013

Hacker Server Storing Two Million Pilfered Passwords

(From: Ars Technica)  Researchers have unearthed a server storing more than two million pilfered login credentials for all kinds of user accounts, including those on Facebook, Yahoo, Google, Twitter, and a handful of other websites.  While some have initially stated that the password compromises were primarily against the Netherlands, further research showed that the reason for the Netherlands showing so prominently was because the information was filtered through “Command and Control” bots.

Article is HERE.

Lawyer Can’t Grill ISP Over Online Defamation

(From: Courthouse News)  A California-based lawyer alleged defamation and copyright infringement with respect to the use of his photo without permission.  The lawyer filed suit against the ISP, and the Judge, while refusing to dismiss on the basis of safe harbor, granted the ISP’s motion based on the lawyer’s failure to show copyright ownership.

Article is HERE.

A Spurned Techie’s Revenge: Locking Down His Ex’s Digital Life

(From: Ars Technica)  Revenge porn is just the tip of the iceberg when it comes to cyber-domestic abuse.

Article is HERE.

Encryption Made Easy: A Primer for Mac Users

(From: Law Technology Today) This article describes the steps to encrypt documents, folders, hard drives, external drives, and backup devices using Mac OS X Mountain Lion.  Most capabilities described in this article can be found on other versions of OSX, as well.


Weekly Highlights: September 17, 2012

September 17, 2012

Things You Might Have Missed Last Week

(Highlights in legal, forensics, and electronic discovery news for the past week)

Interesting Electronic Evidence Cases

Inhalation Plastics, Inc. v. Medex Cardio-Pulmonary, Inc., No. 2:07-CV-116, 2012 WL 3731483 (S.D. Ohio Aug. 28, 2012)

The defendant inadvertently produced almost 350 pages of email. Even though, after in camera review, the court found that many of the produced materials were “within the ambit of attorney-client privilege”, the court found that privilege had been waived.

Weekly Highlighted Article

From E-Discovery Beat:

Experts Consider E-Discovery Implications of New ABA Ethics Rules Amendments

From BowTieLaw.com:

Forensically Examining a Lawyer’s Computer

Electronic Evidence News

Twitter Gives Occupy Protester’s Tweets to U.S. Judge

Court Issues 20-Year Product Injunction in Trade Secret Theft/eDiscovery Sanctions Case

Samsung Flexes Litigation Muscles at Apple Ahead of iPhone 5 Launch-Again