Congress Starts to Get Serious About Online Privacy(nytimes.com)
nytimes.com
Congress Starts to Get Serious About Online Privacy
http://www.nytimes.com/2016/02/07/opinion/congress-starts-to-get-serious-about-online-privacy.html
5 comments
> Remember, whenever a warrant is required to get data, that means the defendant cannot get stored data through ANY legal process.
At a minimum, the defense can subpoena the person to whom the data belongs, who is obligated to provide it. The warrant requirement might prevent them from bypassing the data owner and going to the entity storing the data; if this is the case (I'm not sure it is) and if it is a serious issue in practice, it could be addressed -- nothing in the Constitution limits warrant applications to prosecutors, even if that is the usual practice. So, incorporate in statutes creating warrant requirements shall-issue provisions requiring, on a showing of probable cause that material evidence exists, courts to issue warrants on behalf of the defense (either leaving the defense to execute the warrant, or giving the defense the option of executing the warrant themselves or having bailiffs/marshals execute it on behalf of the court) -- the authority to adopt such a rule applicable to federal courts is obvious, to apply it to state authorities one would invoke the enforcement clause of the 14th Amendment.
At a minimum, the defense can subpoena the person to whom the data belongs, who is obligated to provide it. The warrant requirement might prevent them from bypassing the data owner and going to the entity storing the data; if this is the case (I'm not sure it is) and if it is a serious issue in practice, it could be addressed -- nothing in the Constitution limits warrant applications to prosecutors, even if that is the usual practice. So, incorporate in statutes creating warrant requirements shall-issue provisions requiring, on a showing of probable cause that material evidence exists, courts to issue warrants on behalf of the defense (either leaving the defense to execute the warrant, or giving the defense the option of executing the warrant themselves or having bailiffs/marshals execute it on behalf of the court) -- the authority to adopt such a rule applicable to federal courts is obvious, to apply it to state authorities one would invoke the enforcement clause of the 14th Amendment.
About subpoenaing the person who the data belongs to, I agree. However, realistically speaking, this is not an effective way to get the data. In my experience, someone who is about to be exposed and subjected to criminal liability would simply delete the video or remove their access to it.
Note that under 18 U.S. Code § 2704, a related problem is that only governmental entities can require preservation of data.
I have not seen any legal authority for the defense getting a search warrant. If you can find any authority or precedent for that, I would love to see it. It's an awesome idea.
Note that under 18 U.S. Code § 2704, a related problem is that only governmental entities can require preservation of data.
I have not seen any legal authority for the defense getting a search warrant. If you can find any authority or precedent for that, I would love to see it. It's an awesome idea.
> I have not seen any legal authority for the defense getting a search warrant.
I wouldn't expect so, since I proposed creating statutory authority for them as a solution to the problem you described that would seem to be well within the parameters of the Constitution, so that we don't have to sacrifice protection against warrantless searches and seizures by government in order to preserve the rights of defendants to secure evidence for their defense.
I'm quite aware that defense-initiated warrants are not an existing thing.
I wouldn't expect so, since I proposed creating statutory authority for them as a solution to the problem you described that would seem to be well within the parameters of the Constitution, so that we don't have to sacrifice protection against warrantless searches and seizures by government in order to preserve the rights of defendants to secure evidence for their defense.
I'm quite aware that defense-initiated warrants are not an existing thing.
> someone who is about to be exposed and subjected to criminal liability would simply delete the video or remove their access to it.
Doesn't that count as obstruction of justice?
Doesn't that count as obstruction of justice?
Proving that crime would be a great challenge and the defense has little leverage to bring that charge about.
(IANAL) Probably not if they do it before a warrant is issued.
What is the reasoning behind attourneys being unable to direct the police in particular directions? The same failure mode you demonstrate here should be present in many cases that don't involve electronics. It seems to me like the combination of "police are only required to investigate inculpatory evidence" and "some evidence is only accessible to police" is a fundamental failure of the investigative system and legislation and provides a crippling bias toward convictions. Should I be campaigning about a more general problem that you've clued me into here, or is there something I'm missing about a useful purpose this property serves or a workaround that you haven't mentioned?
Here are some California cases that discuss the issue, but I'm pretty sure federal law and the law of most states is similar:
The prosecution has no “duty to conduct the defendant’s investigation for him.” People v. Verdugo, 50 Cal. 4th 263, 288–89 (2010) (citation and internal quotations omitted); People v. Williams, 58 Cal. 4th 197, 257 (2013); People v. Zambrano, 41 Cal. 4th 1082, 1134 (2007), overruled on other grounds, People v. Doolin, 45 Cal. 4th 390, 421 n.22 (2009); People v. Salazar, 35 Cal. 4th 1031, 1048–50 (2005).
Because “the law does not ‘impose a general duty on prosecutorial officials to serve as defense investigators,’ ” People v. Moore, 50 Cal. App. 3d 989, 993 (1975) (quoting People v. Beagle, 6 Cal. 3d 441, 450–51 (1972), superseded on other grounds, Cal. Const., art. I, § 28), police are not generally required to collect particular items of evidence, People v. Montes, 58 Cal. 4th 809, 837 (2014); In re Michael L., 39 Cal. 3d 81, 86 (1985) (“police cannot be expected to gather up everything which might eventually prove useful to the defense”) (citation and internal quotations omitted); People v. Frye, 18 Cal. 4th 894, 943 (1998) (“as a general matter, due process does not require the police to collect particular items of evidence”), overruled on other grounds, People v. Doolin, 45 Cal. 4th 390, 421 n.22 (2009); People v. Callen, 194 Cal. App. 3d 558, 561 (1987) (“[The] law does not impose upon law enforcement agencies the requirement that they take the initiative, or even any affirmative action, in procuring … evidence deemed necessary to the defense of an accused.”) (citation and internal quotations omitted); People v. Bradley, 159 Cal. App. 3d 399, 407 (1984) (same).
Throw the case names and citations into Google Scholar to find the full text of the cases - which provide reasoning (unpersuasive, in my view).
The prosecution has no “duty to conduct the defendant’s investigation for him.” People v. Verdugo, 50 Cal. 4th 263, 288–89 (2010) (citation and internal quotations omitted); People v. Williams, 58 Cal. 4th 197, 257 (2013); People v. Zambrano, 41 Cal. 4th 1082, 1134 (2007), overruled on other grounds, People v. Doolin, 45 Cal. 4th 390, 421 n.22 (2009); People v. Salazar, 35 Cal. 4th 1031, 1048–50 (2005).
Because “the law does not ‘impose a general duty on prosecutorial officials to serve as defense investigators,’ ” People v. Moore, 50 Cal. App. 3d 989, 993 (1975) (quoting People v. Beagle, 6 Cal. 3d 441, 450–51 (1972), superseded on other grounds, Cal. Const., art. I, § 28), police are not generally required to collect particular items of evidence, People v. Montes, 58 Cal. 4th 809, 837 (2014); In re Michael L., 39 Cal. 3d 81, 86 (1985) (“police cannot be expected to gather up everything which might eventually prove useful to the defense”) (citation and internal quotations omitted); People v. Frye, 18 Cal. 4th 894, 943 (1998) (“as a general matter, due process does not require the police to collect particular items of evidence”), overruled on other grounds, People v. Doolin, 45 Cal. 4th 390, 421 n.22 (2009); People v. Callen, 194 Cal. App. 3d 558, 561 (1987) (“[The] law does not impose upon law enforcement agencies the requirement that they take the initiative, or even any affirmative action, in procuring … evidence deemed necessary to the defense of an accused.”) (citation and internal quotations omitted); People v. Bradley, 159 Cal. App. 3d 399, 407 (1984) (same).
Throw the case names and citations into Google Scholar to find the full text of the cases - which provide reasoning (unpersuasive, in my view).
...Yes, those don't seem to be persuasive, especially when the laws prevent the defendant from properly conducting their investigation by denying them large and important classes of information, and even more so when the police are required to investigate the prosecution's case for them. This seems like a major failure mode for the entire judicial system.
So this bill basically tips the scales in favor of prosecutors by empowering them to pick new supporting evidence while not empowering the defense to do the same.
What if your hypothetical Facebook video was < 180 days old?
What if your hypothetical Facebook video was < 180 days old?
> So this bill basically tips the scales in favor of prosecutors by empowering them to pick new supporting evidence while not empowering the defense to do the same.
Actually, this bill just changes the existing warrant requirement to apply to a communication stored more than 180 days (the warrant requirement already exists.)
The argument is that one aspect of the existing warrant requirement is that it burdens the defense in certain circumstances (I don't think anyone would argue that the arrangement in general -- or this bill's changes -- simply favors the prosecution; without the warrant requirement, while the defense might have more access to certain evidence once a trial started, police and prosecutors would have -- and do have, now, for communications outside the time limit of the existing rule -- more ability to conduct arbitrary fishing expeditions without probable cause before a trial started.)
I would think those whose concern is primarily with the rights of the criminally accused would like the warrant requirement for police investigations but would want some provision for criminal defendants to get access to communications that might be exculpatory evidence, even if it has similar requirements (probable cause showing) to a warrant that would be sought by police/prosecutors.
Actually, this bill just changes the existing warrant requirement to apply to a communication stored more than 180 days (the warrant requirement already exists.)
The argument is that one aspect of the existing warrant requirement is that it burdens the defense in certain circumstances (I don't think anyone would argue that the arrangement in general -- or this bill's changes -- simply favors the prosecution; without the warrant requirement, while the defense might have more access to certain evidence once a trial started, police and prosecutors would have -- and do have, now, for communications outside the time limit of the existing rule -- more ability to conduct arbitrary fishing expeditions without probable cause before a trial started.)
I would think those whose concern is primarily with the rights of the criminally accused would like the warrant requirement for police investigations but would want some provision for criminal defendants to get access to communications that might be exculpatory evidence, even if it has similar requirements (probable cause showing) to a warrant that would be sought by police/prosecutors.
About tipping the scales: In my view, as someone who is a criminal defense attorney who litigates cases every day, yes. But I imagine that is not the view of a well meaning principled privacy advocate.
Before 180 days, you need a warrant. After 180 days, you need a (d) order. Can the defense can get it using a 18 U.S. Code § 2703(d) order? In my view, the answer is no. The statute specifically refers to a "governmental entity" being able to seek the order. I don't believe that includes criminal defendants.
See: https://www.law.cornell.edu/uscode/text/18/2703
"A court order for disclosure under subsection (b) or (c) may be issued by any court that is a court of competent jurisdiction and shall issue only if the governmental entity offers specific and articulable facts showing that there are reasonable grounds to believe that the contents of a wire or electronic communication, or the records or other information sought, are relevant and material to an ongoing criminal investigation."
Before 180 days, you need a warrant. After 180 days, you need a (d) order. Can the defense can get it using a 18 U.S. Code § 2703(d) order? In my view, the answer is no. The statute specifically refers to a "governmental entity" being able to seek the order. I don't believe that includes criminal defendants.
See: https://www.law.cornell.edu/uscode/text/18/2703
"A court order for disclosure under subsection (b) or (c) may be issued by any court that is a court of competent jurisdiction and shall issue only if the governmental entity offers specific and articulable facts showing that there are reasonable grounds to believe that the contents of a wire or electronic communication, or the records or other information sought, are relevant and material to an ongoing criminal investigation."
Doesn't the warrant requirement just apply to law enforcement?
Why can't a defense attorney get a subpoena for the video?
Why can't a defense attorney get a subpoena for the video?
No. That's the whole point. The defense can subpoena the video but the law would prevent the company from complying with the subpoena. The defense and DA subpoena power is the same. Thus, if the DA can't get it with a subpoena, neither can the defense.
So why not issue the subpoena directly to the account holder?
If you know the video is available on their Facebook account, then you know they have access to it.
My apologies for the remark about a lawyer clearing it up, I've deleted it from the above comment.
If you know the video is available on their Facebook account, then you know they have access to it.
My apologies for the remark about a lawyer clearing it up, I've deleted it from the above comment.
See here: https://news.ycombinator.com/item?id=11075110
In short, you can do that. But in real life, you typically won't get the data. That's why police and prosecutor bust down your door instead of mailing you a subpoena asking you to bring incriminating evidence to the police station.
In short, you can do that. But in real life, you typically won't get the data. That's why police and prosecutor bust down your door instead of mailing you a subpoena asking you to bring incriminating evidence to the police station.
Everyone in the world knows about backups except for lawyers?
[deleted]
Prosecutors must disclose exculpatory evidence, including the video you're describing
> Prosecutors must disclose exculpatory evidence, including the video you're describing
Not quite. Prosecutors must disclose exculpatory evidence that is in the possession of the prosecution team. In terms of the example I gave, facebook would not be considered part of the prosecution team. Thus, the prosecution does not possess the video. Thus, the Brady obligation to disclose exculpatory evidence does not apply.
As a general matter, the “prosecution team” includes persons or agencies (1) “acting on the government’s behalf in the case,” People v. Zambrano, 41 Cal. 4th 1082, 1132 (2007), overruled on other grounds, People v. Doolin, 45 Cal. 4th 390, 421 n.22 (2009); Kyles v. Whitley, 514 U.S. 419, 437 (1995); and (2) “assisting the government’s case,” In re Brown, 17 Cal. 4th 873, 881 (1998).
Not quite. Prosecutors must disclose exculpatory evidence that is in the possession of the prosecution team. In terms of the example I gave, facebook would not be considered part of the prosecution team. Thus, the prosecution does not possess the video. Thus, the Brady obligation to disclose exculpatory evidence does not apply.
As a general matter, the “prosecution team” includes persons or agencies (1) “acting on the government’s behalf in the case,” People v. Zambrano, 41 Cal. 4th 1082, 1132 (2007), overruled on other grounds, People v. Doolin, 45 Cal. 4th 390, 421 n.22 (2009); Kyles v. Whitley, 514 U.S. 419, 437 (1995); and (2) “assisting the government’s case,” In re Brown, 17 Cal. 4th 873, 881 (1998).
Should we then provide the defense access to the prosecution's evidence (and vice-versa)?
> Should we then provide the defense access to the prosecution's evidence (and vice-versa)?
The issue goes beyond that, to providing the defense comparable ability to collect evidence to the prosecution. Giving the defense access to prosecution evidence doesn't help if the prosecution deliberately does not collect evidence that it believes would be exculpatory and the defense doesn't have comparable means to compel access to potential evidence.
The issue goes beyond that, to providing the defense comparable ability to collect evidence to the prosecution. Giving the defense access to prosecution evidence doesn't help if the prosecution deliberately does not collect evidence that it believes would be exculpatory and the defense doesn't have comparable means to compel access to potential evidence.
In California:
The DA must follow this rule: http://codes.findlaw.com/ca/penal-code/pen-sect-1054-1.html.
The DA also has obligations under Brady v. Maryland: https://scholar.google.com/scholar_case?case=955043312626967...
The defense must follow this rule: http://codes.findlaw.com/ca/penal-code/pen-sect-1054-3.html
The DA must follow this rule: http://codes.findlaw.com/ca/penal-code/pen-sect-1054-1.html.
The DA also has obligations under Brady v. Maryland: https://scholar.google.com/scholar_case?case=955043312626967...
The defense must follow this rule: http://codes.findlaw.com/ca/penal-code/pen-sect-1054-3.html
That is always the case already, I believe. Prosecutors are not allowed to present evidence not made available to the defense.
Parent comment points out that requiring a warrant makes it nigh-impossible to present the data as the defense. Law is a complex beast.
So give defendants more rights and more legal protection as well.
This is the devil's advocate argument that I've heard:
Police are today facing an unprecedented situation: tech-savvy criminals are able to lock up evidence such that it can never be obtained even with a warrant. I mean sure you can compel the criminal to unlock the device, but it might be logical for the criminal to refuse if the consequences of being in contempt of court are less than the consequences of revealing what would be found if they unlocked their stuff.
By that logic, some police argue that mandating back-doors or limiting crypto represents an attempt to reclaim lost ground and return to historical baseline rather than a new encroachment. Cops, they argue, have always been able to search or wiretap with a court order.
While I am very much against backdoors and such (for multiple reasons), I also do recognize that we are in historically uncharted waters here and that these waters do need to be navigated. I am not completely unsympathetic to the arguments above.
I'm just not naive enough to believe that we don't need police protection. There are very, very bad people in the world, like organized criminals that steal peoples' pension funds and con elderly people out of their life's savings, murderers and terrorists, people who traffick in child abuse porn, etc. For the state not to seek to stop those kinds of activities would be for them to derelict on their half of the social contract that allows them to be paid (through taxes). In a sense when people like the FBI director clamor for more surveillance rights, from their point of view they are doing their job. Also keep in mind that folks like that are biased-- from their perspective they see nothing but terrible crimes that they feel powerless to prevent. Cops see nothing but the worst in humanity; nobody calls the police when everything's great.
I think the only feasible answer is for police to themselves get far more tech-savvy and learn how to -- when legally appropriate -- target criminals using the same tactics that black hat hackers use. I actually see things like the big Tor pedophile hack as examples of how police should be responding to the increasing technical difficulty of police work. The fact is that no crypto is perfect and there are many tactics that can side-step crypto: social engineering, malware, phishing, etc. It might also be possible with a court order to "black bag" someone's stuff and physically compromise the device and steal the keys, etc. With proper legal authorization I think this is sometimes appropriate, such as if you have clear cause to believe someone to be a member of organized crime, etc.
Of course such things have to be subject to some legal oversight. We need police to protect us from criminals, but we also need laws and regulations to prevent police from becoming criminals or becoming so overzealous that they trample all over peoples' rights. Looking elsewhere in the world we can see that this is a very real danger. There are many countries where official crime and corruption is normal.
Police are today facing an unprecedented situation: tech-savvy criminals are able to lock up evidence such that it can never be obtained even with a warrant. I mean sure you can compel the criminal to unlock the device, but it might be logical for the criminal to refuse if the consequences of being in contempt of court are less than the consequences of revealing what would be found if they unlocked their stuff.
By that logic, some police argue that mandating back-doors or limiting crypto represents an attempt to reclaim lost ground and return to historical baseline rather than a new encroachment. Cops, they argue, have always been able to search or wiretap with a court order.
While I am very much against backdoors and such (for multiple reasons), I also do recognize that we are in historically uncharted waters here and that these waters do need to be navigated. I am not completely unsympathetic to the arguments above.
I'm just not naive enough to believe that we don't need police protection. There are very, very bad people in the world, like organized criminals that steal peoples' pension funds and con elderly people out of their life's savings, murderers and terrorists, people who traffick in child abuse porn, etc. For the state not to seek to stop those kinds of activities would be for them to derelict on their half of the social contract that allows them to be paid (through taxes). In a sense when people like the FBI director clamor for more surveillance rights, from their point of view they are doing their job. Also keep in mind that folks like that are biased-- from their perspective they see nothing but terrible crimes that they feel powerless to prevent. Cops see nothing but the worst in humanity; nobody calls the police when everything's great.
I think the only feasible answer is for police to themselves get far more tech-savvy and learn how to -- when legally appropriate -- target criminals using the same tactics that black hat hackers use. I actually see things like the big Tor pedophile hack as examples of how police should be responding to the increasing technical difficulty of police work. The fact is that no crypto is perfect and there are many tactics that can side-step crypto: social engineering, malware, phishing, etc. It might also be possible with a court order to "black bag" someone's stuff and physically compromise the device and steal the keys, etc. With proper legal authorization I think this is sometimes appropriate, such as if you have clear cause to believe someone to be a member of organized crime, etc.
Of course such things have to be subject to some legal oversight. We need police to protect us from criminals, but we also need laws and regulations to prevent police from becoming criminals or becoming so overzealous that they trample all over peoples' rights. Looking elsewhere in the world we can see that this is a very real danger. There are many countries where official crime and corruption is normal.
I still don't get what's so different between encrypting your phone and eating a piece of paper after you read it.
We have become addicted to information. We need all of it or we find some weasley way to say nothing happened. Crimes were solvable before wire taps. We ignore broad human intelligence for narrow computer intelligence.
We have become addicted to information. We need all of it or we find some weasley way to say nothing happened. Crimes were solvable before wire taps. We ignore broad human intelligence for narrow computer intelligence.
In the UK we "dealt" with this by making refusal to turn over crypto keys and passwords an imprisonable offence in its own right.
Do you not consider this to be compelling a defendant to testify against themselves? (At least assuming the password only exists in their memory and not written down somewhere.) And more importantly, how do you deal with the case where a person legitimately lost or corrupted their key/password or has an automated system to destroy the key if some unrelated event occurs like power failure, an incorrect password attempt, a Bluetooth disconnect, or a wipe if the device is in an unfamiliar location. Is having a system like that a criminal offense itself?
Oh good. I am sure they will manage to fuck this up. I have about as much confidence in Congress getting tech stuff right as I do a monkey performing brain surgery.
Probably not enough to make US companies a legal place for EU personal data.
Remember the 4th Amendment doesn't apply to Europeans in Europe (but our Charter of Fundamental Rights applies to USians in USA)
Remember the 4th Amendment doesn't apply to Europeans in Europe (but our Charter of Fundamental Rights applies to USians in USA)
300 sponsors? There is something else in that bill they want, I assure you.
Read it yourself, it's like 6 pages: https://www.congress.gov/bill/114th-congress/house-bill/699/...
Plenty of time for riders to get attached.
Then we watch it all the way through.
Or an anonymous hold that never ends.
This bill was extremely close to becoming law in 2013 before Snowden. The nice thing that happened in the meantime is we got a stronger law passed in California that applied to all digital service customer information and not just messages.
We think what the Intel Community wants in this bills is a PRISM like program for UK law enforcement and GCHQ.
https://www.washingtonpost.com/world/national-security/the-b...
We think what the Intel Community wants in this bills is a PRISM like program for UK law enforcement and GCHQ.
https://www.washingtonpost.com/world/national-security/the-b...
ECPA already has "emergency" carve-outs in it, when a warrant is not required. If it's not restricted, it could easily be as abused as the NSLs are.
At the very least a judge should be able to retrospectively review the law enforcement request and all the data they got (and the company itself should have evidence of all of this as well).
At the very least a judge should be able to retrospectively review the law enforcement request and all the data they got (and the company itself should have evidence of all of this as well).
That's sort of laughable, considering the only major legislation passed since the WWW became legit has been Net Neutrality. As for Facebook's Zuckerberg said famously - privacy is dead.
> That's sort of laughable, considering the only major legislation passed since the WWW became legit has been Net Neutrality.
This is false in two ways:
(1) Net neutrality has never been passed as legislation, (2) Lots of other legislation has been passed (some later struck down as unconstitutional, other that have stuck) directed toward online life since the web became commonly used on topics other than net neutrality (including some on privacy -- both for and against) -- examples include COPA, CIPA, COPPA, DMCA, USA PATRIOT, and USA FREEDOM, among others.
This is false in two ways:
(1) Net neutrality has never been passed as legislation, (2) Lots of other legislation has been passed (some later struck down as unconstitutional, other that have stuck) directed toward online life since the web became commonly used on topics other than net neutrality (including some on privacy -- both for and against) -- examples include COPA, CIPA, COPPA, DMCA, USA PATRIOT, and USA FREEDOM, among others.
For example: I’m the victim of an unprovoked attack and beat up by four men. One of the men records the attack and uploads the video to facebook, He makes it private, but shares it with a few friends to shame me. In the attack, I try to defend myself but am only able to get in a few hits on one of the men. The man that I hit goes to the police and accuses me of battery. I’m arrested and charged by a prosecutor for battery. I plan to claim self-defense at trial. I try to collect as much evidence as I can on my behalf.
With a warrant requirement, the video that I know exist on facebook which would show that these men beat me in an unprovoked attack and would certainly lead to a not guilty verdict is now completely inaccessible to me or my attorney. Think about that for a minute. And, as you probably know from watching Making a Murderer, the police have no duty to investigate potentially exculpatory information.
I’m not saying that a warrant requirement for stored data is a bad idea. But the ups and downs need to be considered. I never see anyone present the downsides that I present here. I’ve brought it up before on HN before and got very little attention. https://news.ycombinator.com/item?id=10066879. No one will care until innocent people are convicted. I wish tech and legal people would work together on this to prevent the perverse consequences.
Here is an example of this happening: Facebook v. Superior Court: http://www.courts.ca.gov/opinions/documents/A144315.PDF (This case is currently being reviewed by the CA Supreme Court.)
Here is a law review article on point: http://scholarlycommons.law.northwestern.edu/cgi/viewcontent...
My background: California attorney for 7 years. Prosecutor for 4 1/2 years, defense attorney for 2 1/2 years. Tech savvy for a lawyer - Associates degree in Computer Science.
Edit 1: added link to law review article. Edit 2: added my background. Edit 3: added link to Facebook v. Superior Court.