Why IP Addresses Alone Don't Identify Criminals

8-26-2011 Global:

This spring, agents from Immigration and Customs Enforcement (ICE) executed a search warrant at the home of Nolan King and seized six computer hard drives in connection with a criminal investigation. The warrant was issued on the basis of an Internet Protocol (IP) address that traced back to an account connected to Mr. King's home, where he was operating a Tor exit relay.

An exit relay is the last computer that Tor traffic goes through before it reaches its destination. Because Tor traffic exits through these computers, their IP addresses may be misinterpreted as the source of the traffic, even though the exit node operator is neither the true origin of that traffic nor able to identify the user who is. While law enforcement officers have seized exit relays in other countries, we weren't aware of any seizures in the United States until ICE showed up at Mr. King's home.

After the computers were seized, EFF spoke with ICE and explained that Mr. King was running a Tor exit relay in his home. We pointed out that ICE could confirm on the Tor Project's web site that a computer associated with the IP address listed in the warrant was highly likely to have been running an exit relay at the date and time listed in the warrant. ICE later returned the hard drives, warning Mr. King that "this could happen again." After EFF sent a letter, however, ICE confirmed that it hadn't retained any data from the computer and that Mr. King is no longer a person of interest in the investigation.

While we think it's important to let the public know about this unfortunate event, it doesn't change our belief that running a Tor exit relay is legal. And it's worth highlighting the fact that these unnecessary incidents are avoidable, and law enforcement agents and relay operators alike can take measures to avoid them in the future.

First, an IP address doesn't automatically identify a criminal suspect. It's just a unique address for a device connected to the Internet, much like a street address identifies a building. In most cases, an IP address will identify a router that one or more computers use to connect to the Internet. Sometimes a router's IP address might correspond fairly well to a specific user—for example, a person who lives alone and has a password-protected wireless network. And tracking the IP addresses associated with a person over time can create a detailed portrait of her movements and activities in private spaces, as we've pointed out in a case in which the government is seeking IP addresses of several Twitter users in connection with the criminal investigation of Wikileaks.

But in many situations, an IP address isn't personally identifying at all. When it traces back to a router that connects to many computers at a library, cafe, university, or to an open wireless network, VPN or Tor exit relay used by any number of people, an IP address alone doesn't identify the sender of a specific message. And because of pervasive problems like botnets and malware, suspect IP addresses increasingly turn out to be mere stepping stones for the person actually "using" the computer—a person who is nowhere nearby.

This means an IP address is nothing more than a piece of information, a clue. An IP address alone is not probable cause that a person has committed a crime. Furthermore, search warrants executed solely on the basis of IP addresses have a significant likelihood of wasting officers' time and resources rather than producing helpful leads.

In the case of Tor, the police can avoid mistakenly pursuing exit relay operators by checking the IP addresses that emerge in their investigations against publicly available lists of exit relays published on the Tor Project's web site. The ExoneraTor is another tool that allows anyone to quickly and easily see whether a Tor exit relay was likely to have been running at a particular IP address during a given date and time. The Tor Project can also help law enforcement agencies set up their own systems to query IP addresses easily. These simple checks will help officers concentrate their investigative resources on tracking down those actually committing crimes and ensure that they don't execute search warrants at innocent people's homes.

If you run an exit relay, consider operating it in a Tor-friendly commercial facility instead of your home to make it less likely that law enforcement agents will show up at your door. Also follow the Tor Project's advice for running an exit relay, which includes setting up a reverse DNS name for your IP address that makes it clear your computer is running an exit relay. ..Source.. by Marcia Hofmann

Read More of Article...

Article Summary only...

Canada- No warrant needed to trace Internet use

This is likened to following someone in the public, however, in the U.S. a warrant is needed to get the IP Address from a Internet Service Provider unless the person has already waived that right. However, even though there is no privacy right in movement throughout the Internet, there is a privacy right in the sites visited and what occurrs on that site.

2-14-2009 Canada:

TORONTO, Feb 13, 2009 (UPI via COMTEX) -- A judge in Canada has ruled that Internet users have no expectation of privacy and police can use track people through Internet protocols without warrants.

The ruling by Ontario Superior Court Judge Lynne Leitch is binding on lower courts, and gives law enforcement a new tool to use in investigating such matters as child pornography, the National Post reported Friday.

Ruling in a child pornography possession case, Leitch found that the Canadian Charter does not provide a "reasonable expectation of privacy" regarding subscriber information retained by Internet service providers.

Police asked Bell Canada in 2007 for subscriber information on an IP address used by someone who had allegedly accessed child pornography. Bell provided the requested information without inquiring whether police had a search warrant.

The defense argued that police should have been required to obtain a search warrant before seeking such information.

Privacy rights advocates cautioned the ruling could have consequences for law-abiding Internet users, the Post said.

"There is no confidentiality left on the Internet if this ruling stands," James Stribopoulos, a law professor at York University's Osgoode Hall Law School, said. ..News Source.. by UPI.com

Read More of Article...

Article Summary only...

NM- Bill gives officers contact info of sex offenders

It never ceases to amaze me how ignorant lawmakers and law enforcement is, their heads are in the sand, they have no idea how the Internet works and are totally oblivious of the costs of today's throwaway cell phones, and have ignored land lines. Every Internet service provider has ways to eliminate spam, and any e-mail coming in can be tagged spam, e-mail addresses are a dime a dozen and can be throwaway as well, IP addresses can be dynamic and most of the major service providers use that anyway. Lawmakers and law enforcement folks seem to get a mental block when they get elected or hired, I guess it could be that reasoning is deadened by the perceived power of their position. This article displays all of these elements.

1-31-2009 New Mexico:

Keeping track of convicted sex offenders could get easier for law enforcement with the passage of a new bill.

Undersheriff Sal Bargaiola said having sex offenders' phone numbers, cell phone numbers and e-mail addresses would help big time--and they might just get the information.

The Bernalillo County Sheriff's Department and Republican State Representative Bill Rehm teamed up to introduce legislation that they hope will give detectives another tool to be able to track down and communicate with sex offenders when they move into Bernalillo County.

"We know that sex offenders go to MySpace, we know they go to Facebook, this way we'll be able to see their e-mail addresses,' Rep. Rehm said.

"What I think this bill will do is, you can switch addresses three and four times a year, you're not going to switch cell phone numbers, and you're not going to switch e-mail addresses," he said.

Under the proposed bill, the phone numbers of sex offenders would not be posted on the state's online registry. That information would be given only to law enforcement.

The sheriff's department said sex offenders who obey their registration requirements might actually prefer a checkup over the phone. Instead of a visit from armed deputies.

"I think it's better for the courts, it's better for them and it's better for us that we have more information not less," Rep. Rehm said.

Several sex offenders have called Rep. Rehm opposing the bill. But so far this session, it has received full support from lawmakers. ..News Source.. by KOB.com

Read More of Article...

Article Summary only...

Dealing With I.S.P. Snooping

9-10-2008 National:

Even though Congress has growled loudly enough to get Internet service providers to back off their plans to sell information about their customers’ Web surfing to advertising companies, one prominent legal expert argues that the law governing the issue should still be made tougher.

The issue was examined in a new paper, “The Rise and Fall of Invasive ISP Surveillance”, by Paul Ohm, a former Justice Department official who now is a professor of law at the University of Colorado.

Mr. Ohm argues that the prospect of Internet service providers using new technology to monitor what their customers do online is a grave threat to privacy.

Because ISPs pose such a high risk of terrible harm to so many people, and because of the unmistakable signs that things are getting worse, they must be regulated.

For now, Internet providers in the United States have put on hold plans to sell customer surfing information to ad companies. Several congressional committees held hearings on the topic, providing a forum for a number of senators and House members to indicate their displeasure at the concept.

Indeed, NebuAd, the company that was behind most of the advertising systems set to be used by Internet providers in the United States, has in effect put that business on hold. Robert Dykes, its chief executive, quit to become chief financial officer of VeriFone.

(Phorm, which is working with big Internet providers in the United Kingdom, says it is plowing ahead with a test with 10,000 customers of BT. But its plans have been subject to delays and questions about an earlier trial with BT that was not disclosed to customers.)

Mr. Ohm argues that the regulatory issues are still relevant because the Internet providers still have a strong incentive to seek money from advertisers to supplement their monthly fees.

The Electronic Communication Privacy Act, a 1986 law originally meant to keep telephone companies from listening to the calls of their customers, probably applies to some of these Internet monitoring schemes, Mr. Ohm writes. If a court determined that the browsing history of an Internet user represents the “contents of communication,” it could be construed as wiretapping, he wrote. Wiretapping, under the law, is a felony and also is a cause for civil action.

Even if a list of sites visited isn’t called content, he argues the companies still fall under another part of the act that bans the collection of “pen register” information, the list of phone numbers called by a given line, and other data used for the routing of communications. Using that data, other than for a few specified purposes, is only a misdemeanor, however, and cannot be the basis of a civil lawsuit.

When I reached Mr. Ohm on the phone Friday, he said he was surprised that Internet providers had proceeded as far as they have with plans for these advertising systems.

“If I were a lawyer for an I.S.P., you have to err on the side of avoiding this sort of massive liability,” he said.

Nontheless, Mr. Ohm argues that the law is overly complex and ambiguous, and should be clarified. His article proposes simplifying the overall structure:

The new unified law should regulate all monitoring — without distinguishing between whether the monitoring is of content or not — provided it is monitoring of data “of or pertaining to a user, customer, or subscriber.”

He wants to make clear that Internet providers would be allowed to monitor customers to protect themselves, such as to track down a hacker. But that exception would need to be related to a specific incident. Routine and automated monitoring of customers, beyond the minimum needed to operate a network, would be banned.

Finally Mr. Ohm wants to make it much harder for customers to waive their protections by consenting to some boilerplate agreement. Internet users would need to authorize the monitoring of their surfing each time they use the Internet, under the standard he proposes.

Mr. Ohm said he is much more concerned with Internet service providers than with other Web companies, such as Google. Web sites, he said, have the ability to describe what they are doing with customer data on every page, although they may object to doing so. Consumers don’t really interact explicitly with their Internet providers once they set up a connection. Moreover, Internet providers have an unusually broad view of what customers read, buy, watch and listen to.

“Google doesn’t know what I do when I’m on MSN,” he said. “But your I.S.P. does. There is no hiding from your I.S.P.” ..Source.. by Saul Hansell

Read More of Article...

Article Summary only...

Find Evidence on Your Opponent's Web Site

7-15-2008 National:

One of the best places on the Internet to find information about a company -- such as a litigation adversary -- is the company's own Web site. But while a visitor researches a company, the company may be researching the visitor, revealing more than the researcher would like. In addition, the company may at any time change or remove information on its Web site that may be most valuable to the researcher. This article discusses the information that Web site owners can learn about visitors to their site, and shows ways to see older versions of Web pages that may have been changed or removed.

Web sites routinely collect certain information from visitors to maintain statistics and to enhance the visitor's experience on the Web site. Much of this information may be sent from the visitor's computer to the Web site without the visitor's knowledge, and may reveal more than the visitor expects. A Web site owner can learn many things about visitors through "cookies" and environment variables such as the IP address.

A "cookie" is a small piece of information written on a visitor's computer by a Web site. A cookie might contain the visitor's Web site user name and password, display preferences or even name and address. When a Web site offers to "remember" a visitor, it is offering to write cookies. Cookies stay on the visitor's computer after the visitor has left the Web site, closed the Web browser, disconnected from the Internet and even turned off the computer. If a visitor provides his name and e-mail address to a Web site, that information might be stored in a cookie, and would be available to the Web site on the next visit, which could be months later.

Cookies have received a great deal of attention in the media because privacy advocates are concerned about the way advertisers use cookies. However, cookies are probably not a significant concern for those performing covert research on an opposing party's Web site. As a general rule, cookies contain only information that the visitor has provided to the Web site or information that the Web site could have obtained without cookies.

If a visitor is concerned about information that might be stored in cookies, cookies can be erased. In the Internet Explorer Web browser, for example, the visitor can pick Tools menu, Internet Options, General, Delete Cookies. This can be done at any time -- before, during or after the visit to a Web site -- and will immediately delete all cookies. Unfortunately, this will also delete desirable cookies, such as Westlaw or Lexis logins. For those who wish to preserve desirable cookies while deleting undesirable cookies, there is privacy software that provides enhanced cookie management.

A greater concern for those performing covert research is environment variables, particularly the Internet Protocol address. The IP address is a unique identifying set of numbers used to direct communications through a network or the Internet. A Web site always has access to every visitor's IP address: Without that information, the Web site and visitor would not be able to communicate. However, the IP address may reveal more than the visitor realizes.

Most larger businesses, including large law firms, have "static" IP addresses, permanent IP addresses that specifically identify the company. For example, the static IP address 67.200.59.2 can easily be identified as the Young Conaway law firm. Most smaller businesses and residential connections to the Internet use "dynamic" IP addresses, temporary addresses that are assigned when the person connects to the Internet and may be different every time. The dynamic IP address 141.158.235.41 can be identified as a customer of the Verizon Internet service in the Philadelphia area, but cannot be connected to a specific individual or company.

The Web site Broadband Reports has a useful tool to show what can be learned from a person's IP address. When a person visits www.dslreports.com/whois, the page displays the visitor's current IP address. That IP address can then be entered in the WhoIs box to learn what is readily known about that IP address. Another site, www.IP-adress.com, displays the IP address of the current visitor with a map showing the locality associated with the IP address.

Web sites routinely store IP addresses for statistical purposes, but Web site owners do not ordinarily analyze the IP address of every visitor to a Web site, so there is little concern in casually browsing public areas of an opponent's Web site. However, Web site owners are likely to check the IP address when there is suspicious behavior. For example, they might check the IP address of a person who tries to view a confidential, blocked or hidden page. They might check the source of an e-mail requesting information about the company or its products. Users should be aware that the e-mail sender's identity cannot be concealed by using Web e-mail services, such as a Hotmail, Gmail or Yahoo Mail -- these services embed the sender's IP address in the e-mail. The only way to effectively conceal the sender's identity is to send the e-mail from some other location, such as a home computer, a public library or an Internet cafe.

Web site owners may also track the IP addresses of messages posted on the Web site's message boards or chats conducted through online chat services, and are likely to check the address if the post or chat is suspicious in nature. For example, if a visitor posts a message on a customer support message board asking if any other customers have had a particular problem with the company's product, the site owner might be inclined to check the poster's IP address.

Environment variables can also reveal the last page that the visitor saw before coming to the current page, the page where the visitor clicked a link to come to the current page. Like IP addresses, this is not the sort of thing that a Web site owner normally checks in the absence of suspicious activity. However, if a page on one site links to a page on another site that is supposed to be confidential or hidden, the host of the latter site might look into the former site and into the visitors who clicked that link.

Other information found in environment variables is generally less of a concern for covert research. For example, environment variables reveal the visitor's browser (Internet Explorer, Firefox, Opera, etc.), which is not especially confidential. Hypothetically, environment variables could reveal a visitor's network login, but as a practical matter that information is rarely revealed.

THE WAYBACK MACHINE

Browsing a party's Web site will only show the information that the Web site owner currently wants visitors to see. Sometimes, the most valuable information about an opposing party is the information that has been changed or removed. Fortunately, there are ways to see older versions of Web pages. Pages that were changed recently can be viewed through Google's cache feature. Pages that were changed months or years ago may be available through the Internet Archive, also known as the Wayback Machine. Viewing these older versions of Web pages avoids the privacy risks discussed above: The copied pages are not on the company's Web site, so the company has no record of the researcher's activities.

When Google indexes Web pages, it stores a copy, referred to as a "cached" page. Google provides a link labeled "Cached" that allows researchers to view this copy. This cached version may be a day, a week or a month old, depending on how recently Google indexed the page.

Google's cache is most useful when the page found in a search doesn't fit the search performed. The mismatch occurs because the page has changed since it was indexed. The cached version will show the page as it appeared when it was indexed, with the search terms highlighted. The cache can also be useful when seeking information that is known to have been recently removed. If a researcher recently saw useful information on a Web site but that information is no longer there, a Google search for the missing information could turn up a cached version of the page that would contain the desired information. Google discusses its cache feature in detail in the Google Guide at Cached Pages.

If older versions of Web pages are desired, they may be found in the Internet Archive, better known as the Wayback Machine, a reference to the "Peabody's Improbable History" segment on the classic "Rocky and Bullwinkle" cartoons. The Wayback Machine crawls the Internet and makes copies of Web pages, storing them as they existed at some time in the past. It currently stores more than 85 billion Web pages, comprising two petabytes of information, archived since 1996.

The Wayback Machine does not allow visitors to search the archive's content; it simply retrieves older versions of a page with a known Web address. The page may not look precisely the way it did at that time: Images, formatting or code may be missing from the page. However, the text of the page is as it was on the day it was archived. Links on the page will function, and will take the visitor to archived versions of the linked page, allowing visitors to browse through an older version of the site. This is very useful if the precise address of the desired old page is unknown. Users should be aware, however, that the linked page may not be from precisely the same date as the linking page. It is important to watch the URL (Web address), which indicates the date in a year-month-day format. For example, the Wayback Machine contains a version of the Young Conaway home page archived on Aug. 11, 2007, with this URL: http://web.archive.org/web/20070811170145/http://ycst.com/. The page links to an article about the firm's support for the South Asian Bar Association that was archived on June 29, 2007, with this URL: http://web.archive.org/web/20070629214521/ycst.com/newsart.htm?a=179.

The Wayback Machine can be used to find older versions of guidelines, policies or procedures of an organization that have since been changed. It may contain claims that the company made about its products, services or business prospects that it may now deny. It may show when a company possessed particular information. It may hold older versions of manuals or documentation that are no longer available.

USE AS EVIDENCE IN LITIGATION

The Wayback Machine has been used several times as evidence in trade secret and copyright infringement cases. See Syncsort Inc. v. Innovative Routines International Inc., No. 04-3623, 2008 U.S. Dist. Lexis 35364 (D.N.J. April 30, 2008) (to prove that information was not a trade secret because it was publicly available on the Internet at one time); Allen v. The Ghoulish Gallery, No. 06cv371, 2007 U.S. Dist. Lexis 86224 (S.D. Calif. Nov. 20, 2007) (to prove validity of copyright claim); Telewizja Polska USA Inc. v. Echostar Satellite Corp., No. 02 C 3293, 2004 U.S. Dist. Lexis 20845 (N.D. Ill. Oct. 14, 2004) (to demonstrate inaccurate claims made in opposing party's past advertising).

However, use of the Wayback Machine as evidence has been questioned as hearsay under Fed. R. Evid. 801 and as lacking authentication under Fed. R. Evid. 901. See, e.g., Novak v. Tucows Inc., No. 06-CV-1909, 2007 U.S. Dist. Lexis 21269 (E.D.N.Y. March 26, 2007); Chamilia LLC v. Pandora Jewelry LLC, No. 04-CV-6017, 2007 U.S. Dist. Lexis 71246 (S.D.N.Y. Sept. 24, 2007); and St. Luke's Cataract & Laser Inst. P.A. v. Sanderson, No. 8:06-CV-223, 2006 U.S. Dist. Lexis 28873 (M.D. Fla. May 12, 2006), though one court has permitted its use over such objections. See Telewizja Polska USA, 2004 U.S. Dist. Lexis 20845, at *6 (finding an affidavit to be sufficient authentication, and the information not hearsay as an admission by a party-opponent). Nevertheless, the Wayback Machine remains a valuable research tool, even if its contents cannot be used for evidence.

Researching an opposing party's Web site, both past and present content, can be a valuable source of information. But researchers must remember that if they are looking at their opponent's current Web site, rather than an older copy, the Web site owner may be aware of who they are and what they are doing. ..News Source.. by Tracey R. Rich is the library and information services administrator for Young Conaway Stargatt & Taylor in Wilmington, Del., and is the co-author of Bisel's Pennsylvania Damages.

Read More of Article...

Article Summary only...

YouTube to Disclose Who Watches What, When

7-3-2008 National:

Dismissing privacy concerns, a federal judge overseeing a $1 billion copyright-infringement lawsuit against YouTube has ordered the popular online video-sharing service to disclose who watches which video clips and when.

U.S. District Judge Louis L. Stanton authorized full access to the YouTube logs after Viacom Inc. and other copyright holders argued that they needed the data to show whether their copyright-protected videos are more heavily watched than amateur clips.

The data would not be publicly released but disclosed only to the plaintiffs, and it would include less specific identifiers than a user's real name or e-mail address.

-A IP address is more specific than a e-mail address, who are they kidding.

Lawyers for Google Inc., which owns YouTube, said producing 12 terabytes of data -- equivalent to the text of roughly 12 million books -- would be expensive, time-consuming and a threat to users' privacy.

The database includes information on when each video gets played, which can be used to determine how often a clip is viewed. Attached to each entry is each viewer's unique login ID and the Internet Protocol, or IP, address for that viewer's computer.

Stanton ruled this week that the plaintiffs had a legitimate need for the information and that the privacy concerns are speculative.

Stanton rejected a request from the plaintiffs for Google to disclose the source code -- the technical secret sauce -- powering its market-leading search engine, saying there's no evidence Google manipulated its search algorithms to treat copyright-infringing videos differently.

The court has yet to rule on Google's requests to question comedians Jon Stewart and Stephen Colbert of Viacom's Comedy Central.

Viacom is seeking at least $1 billion in damages from Google, saying YouTube has built a business by using the Internet to "willfully infringe" copyrights on Viacom shows, which include Comedy Central's "The Daily Show with Jon Stewart" and Nickelodeon's "SpongeBob SquarePants" cartoon.

The lawsuit was combined with a similar case filed by a British soccer league and other parties.

Together, the plaintiffs are trying to prove that YouTube has known of copyright infringement and can do more to stop it, a finding that could dissolve the immunity protections that service providers have when they merely host content submitted by their users.

Though Google said giving the plaintiffs access to YouTube viewer data would threaten users' privacy, Stanton referred to Google's own blog entry in which the company argued that the IP address alone cannot identify a specific individual.

-This is misstating what Google describes, which first says, IP addresses are specific, but may be broader if more than one person uses a computer. Further, several individuals may also use the same e-mail address.

In a statement, Google said it was "disappointed the court granted Viacom's overreaching demand for viewing history. We are asking Viacom to respect users' privacy and allow us to anonymize the logs before producing them under the court's order."

Google did not say whether it would appeal the ruling or seek to narrow it.

Stanton's ruling made only passing reference to a 1988 federal law barring the disclosure of specific video materials that subscribers request or obtain.

Kurt Opsahl, a senior staff attorney with the Electronic Frontier Foundation, said Stanton should have considered that law along with constitutional free-speech rights, including a right to read or view materials anonymously.

He said a user's ID can sometimes include identifying information such as a first initial and last name.

Viacom said it isn't seeking any user's identity. The company said any data provided "will be used exclusively for the purpose of proving our case against YouTube and Google (and) will be handled subject to a court protective order and in a highly confidential manner."

This is not the first time Google has fought the disclosure of user information it had been stockpiling. While gathering evidence for a case involving online pornography, the U.S. Justice Department subpoenaed Google and other search engines for lists of search requests made by their users.

After Google resisted, a federal judge ruled that Google was obliged to turn over only a sample of Web addresses in its search index, not the actual search terms requested. ..News Source.. by Anick Jesdanun

Read More of Article...

Article Summary only...

Judge Orders YouTube to Give All User Histories to Viacom

7-3-2008 National:

Google will have to turn over every record of every video watched by YouTube users, including users' names and IP addresses, to Viacom, which is suing Google for allowing clips of its copyright videos to appear on YouTube, a judge ruled Wednesday.

Viacom wants the data to prove that infringing material is more popular than user-created videos, which could be used to increase Google's liability if it is found guilty of contributory infringement.

Viacom filed suit against Google in March 2007, seeking more than $1 billion in damages for allowing users to upload clips of Viacom's copyright material. Google argues that the law provides a safe harbor for online services so long as they comply with copyright takedown requests.

Although Google argued that turning over the data would invade its users' privacy, the judge's ruling (.pdf) described that argument as "speculative" and ordered Google to turn over the logs on a set of four tera-byte hard drives.

The judge also turned Google's own defense of its data retention policies -- that IP addresses of computers aren't personally revealing in and of themselves, against it to justify the log dump.

The Electronic Frontier Foundation has already reacted, calling the order a violation of the Video Privacy Protection act that "threatens to expose deeply private information."

The order also requires Google to turn over copies of all videos that it has taken down for any reason.

Viacom also requested YouTube's source code, the code for identifying repeat copyright infringement uploads, copies of all videos marked private, and Google's advertising database schema.

Those requests were denied in whole, except that Google will have to turn over data about how often each private video has been watched and by how many persons. ..News Source.. by Wired News

Read More of Article...

Article Summary only...

NJ- Supreme Court rules Internet user has right to privacy

4-22-2008 New Jersey:

The state Supreme Court ruled today that under the New Jersey Constitution an Internet user has the right to privacy in the subscriber information maintained by the individual's Internet service provider.

Ruling in the case of Shirley Reid, a Cape May County woman who was charged with hacking into her employer's computer system after police obtained her identity from Comcast by using a municipal court subpoena, the high court unanimously held law enforcement had the right to investigate her but should have, instead, used a grand jury subpoena.

The court upheld a state appeals court ruling that overturned the conviction for second-degree computer theft.

Reid was investigated after her employer, Jersey Diesel of Lower Township, was notified by a business supplier in August 2004 that someone had accessed and changed both the company's multi-digit numbers that make up an IP address and its password and created a non-existent shipping address. When the owner, Timothy Wilson, asked Comcast for the IP address of the person who made the changes so he could identify the individual, the Internet provider declined to so without a subpoena.

Wilson suspected Reid, an employee who had been on disability leave, could have made the changes. Reid had returned to work on the day the computer changes were made, argued with Wilson and left.

The Lower Township police obtained a municipal court subpoena and served it on Comcast. Comcast then identified Reid, her address and telephone number, type of service provided, email address, IP numbers, account number and method of payment. In February 2005, a Cape May grand jury returned an indictment charging Reid with computer theft. In state Superior Court in Cape May Courthouse, Reid successfully moved to have the evidence suppressed. The court identified several flaws in the subpoena process.

"... The court holds that citizens have a reasonable expectation of privacy in the subscriber information they provide to Internet service providers,'' the Supreme Court held. "Accordingly, the motion to suppress by Reid was properly granted because the police used a deficient municipal subpoena. Law enforcement officials can obtain subscriber information by serving a grand jury subpoena on an Internet service provider without notice to the subscriber. The state (law enforcement) may seek to reacquire the information with a proper grand jury subpoena because records of the information existed independently of the faulty process used by police, and the conduct of the police did not affect the information.''

Reid's attorney's have sought to establish a requirement that Internet users be informed when their identities are the subject of subpoenas so they can mount a challenge in court. ..more.. by Tom Hester/The Star-Ledger

Read More of Article...

Article Summary only...

Your PC's Been Arrested—Now What?

If anyone misuses your network, guess who's liable?
1-1-2008 National:

It's a typical Monday morning, except after you saunter into the office sipping Starbucks, the door flies open behind you and a flurry of federal badges rush into reception with warrant paperwork. Turns out Elliott in sales has been downloading child pornography. Or maybe Grant in accounting has been skimming a few dollars off every customer bank transfer. Or perhaps Elaine in receivables has been running a long-standing overbilling scheme.

If this moment is the first time you've considered how to respond to a cyber law-enforcement incident, you're certainly not in the best position. But don't panic—even a surprised business manager can save the day. Follow these five steps to shield your business from a potential legal disaster.

1. ENFORCE YOUR COMPANY'S EXISTING FAIR USE, DATA RETENTION, AND PRIVACY POLICIES TO THE LETTER. Documents like these aren't just lawyer fodder. They're designed to discourage your employees from committing cybercrime in the first place. Every employee must be briefed on these policies and should have easy access to them. Deviating from your policies for any reason sends the wrong message. Stick to your guns.

2. TALK TO A LAWYER—FIRST. Peter Brill of the Brill Legal Group, a New York–based criminal defense firm with eight years of cybercrime experience, says that most corporate law firms today employ at least one attorney familiar with cybercrime. Find out who that lawyer is at the firm you deal with and make him or her your first call after encountering any kind of trouble. It's a good idea to talk to this attorney before disaster strikes, too, about screening employees (so the company can't be held negligent) and what the best steps would be in an emergency.

3. DON'T DESTROY THE EVIDENCE. If you're the one who happens on Elaine's overbilling scheme, there are two things Brill maintains are paramount: First, don't destroy anything. Odds are she's already under investigation somewhere, and if your fingerprints are discovered on a smashed hard disk or a file-deletion audit trail, you're going to jail right along with her, even if you were just trying to protect your livelihood. Second, remember that your first "crime scene" conversation shouldn't be with the cops or with Elaine. It's with your lawyer and only your lawyer.

4. HONESTY IS THE BEST POLICY. For the business owner or manager, being honest with whatever law-enforcement agency winds up handling the case is definitely the best approach. "The FBI, for example, doesn't like shutting down businesses," says Brian Chee, lab director at the Advanced Network Computing Laboratory at the University of Hawaii and also an acting university information-systems security officer. Grabbing an immediate backup snapshot of your servers, say, and then spiriting it off-site in case the FBI decides to walk out with hard disks or servers can land you in a lot of trouble. "Talk to them," says Chee, "and generally they'll work with you to take what they need while making sure your business can stay up and running."

5. PUT YOUR DISASTER-RECOVERY PLAN INTO ACTION. Yeah, the Feds kicking down your door qualifies as a disaster. While some cybercrime incidents involve simply taking one workstation away and putting one miscreant employee into handcuffs, others can make a much greater dent in your company's productivity. If the Feds walk out with several workstations and servers, for example, or declare the entire office a crime scene for x number of days, it can all but cripple an unprepared business. If this happens, fall back on your disaster-recovery plan—your business has one, right? Make sure guilt-free employees have a place to work, even if you need to organize a telecommuting phase. Acquire replacement servers and populate them with the most recent off-site backup. All standard disaster-recovery stuff. "The key is not to panic," says Chee. Sure, it's not a "standard" disaster, but keeping your response orderly is the best way to assuage employee fear, maintain customer calm, and keep the business running. ..more.. by Oliver Rist

Read More of Article...

Article Summary only...

Crime-fighting arsenal increases with new face recognition system

12-16-2007 North Carolina

Technology advances every year, and local law enforcement agencies are trying to take advantage of it to deter and solve crimes.
Last week, Jim Sidler, director of marketing for Securus Technologies, presented the biometric face recognition system to members of the Rockingham County Sheriff's Office.

Sheriff Sam Page said he is seeking ways to modernize a new jail. Though it will be two years before the building is complete, Page has started to look at new technology.

Sidler said the current system of mug shots and fingerprints have flaws. The wrong criminal can be released from large prisons when their first mugshot looks nothing like their preset physical appearance. Fingerprints have a large range of fallibility, and accurate prints cannot be taken of laborers whose prints have been rubbed off after years of heavy work.

Identity is difficult for officers in the field, too. A deputy may arrest someone, but if the person produces no documents proving who he or she is, there's no way of proving if the arrestee is a common resident or a wanted criminal.

"One of the worst feelings for a law enforcement officer is not knowing who you have in the back of the car," Sidler said. "Are they a drug dealer or serial killer?"

A biometric system takes a three-dimensional picture of a person's face and compares faces using 20,000 points of reference. "The more points of match we have, the more accurate the system is," Sidler said.

The precise facial measurements give the system 99.2 percent accuracy. Sidler said an image of a new arrestee can be compared to a database of other mug shots nationwide. If the same face has been linked to several aliases, the system displays that, too.

Images can be taken in the field, just after an arrest or when an inmate is brought to a prison. The system can also track visitors. Sidler said several people were caught carrying messages between imprisoned gang members. Some were even identified as being wanted on old charges.

"I think this system would better protect the public," Page said. "I think it's a direction we want to go in."

There are drawbacks. The system's national database is still being built, so record access would be limited. Sidler said each camera runs about $13,000. Page said Rockingham County would probably start off with two cameras to use when booking arrestees.

"We could look at grants to pay for the system," Page said. "But it all depends on the cost of the system."

Old ways of monitoring criminals are quickly being replaced with more accurate methods. More detailed methods were used first by national agencies, but now even Rockingham County boasts highly developed crime-fighting tools.

The Eden Police Department has its own collection of technology. It is the only agency in the county with a computer lab. Detective William East analyzes computers belonging to people charged with possessing child pornography or committing identity theft.

"Whether you know it or not, any time a computer is started it makes a record," East said. If a computer is confiscated for evidence, investigators cannot alter it. East uses a device that analyzes hard drives and can rebuild information that was deleted without altering anything.

"The software recreates data that's been deleted, so any photo or graph you've looked at, the computer stores," East said.

East described a case of a man facing child-porn charges. He pleaded innocent until Eden police confiscated his computer. Though the man normally used a program that completely hid the sites and pictures he accessed, it malfunctioned long enough to leave three photos on the hard drive. When the man learned police had reconstructed incriminating evidence, he changed his plea to guilty.

While the computer lab has useful software, there is one new piece of software on East's wishlist.

"It tracks IP (internet protocol) addresses," he said. "I'm hoping to get software that reads IP addresses that have been to a certain Web site and then allows me to track the number to the house. Now, we're having to call Time Warner and ask for information."

Eden is also installing mobile data terminals for police cars and hopes to soon have one for each officer. Capt. Greg Light said MDTs save time in the field.

"Officers can run tag numbers and license numbers from their car," Light said. " The system runs on a wireless system they can pick up pretty much anywhere."

The Reidsville Police Department installed surveillance cameras downtown but will soon install portable cameras that can be moved to areas residents feel have regular drug traffic.

Chief Edd Hunt said the downtown cameras have already made a big difference, and he is excited to see what surveillance elsewhere will change.

"We're very proud of what it's done so far, and we believe that's worked," Hunt said.

Police cars will soon have mobile reporting units, as well as new in-car cameras that automatically download to the department's database when an officer parks in the department's wireless Internet hotspot.

"It'll be automatic so the officers don't have to spend time putting the video on a disk and bringing it in," Hunt said.

A new barcoding system will minimize how much police handle crime-scene evidence. Each piece will be given a barcode, and inventory is done with a lower risk of altering pieces. A digital crash reporting system will cut paperwork for officers at scenes, and a template will show the 50 intersections with the most accidents.

Reidsville police expect to soon have suspect composite sketch software. Because trained composite artists are not widespread, a witness description of a suspect is drawn with the software and is immediately available to investigators and the media.

While old-fashioned crime fighting will never be better than technology, it does keep officers safer and helps solve cases faster.

"It all saves time and keeps officers out on the streets instead of them having to come in to write reports." Hunt said. ..more.. by Heather J. Smith can be reached at hsmith@reidsvillereview.com or 349-4331, ext. 16.

Read More of Article...

Article Summary only...