Ride The Lightning

FACEBOOK HITS HOME IN GRUNDY, VIRGINIA

So here, as promised, is my report from Grundy, Virginia and the Appalachian School of Law. Our student tour guide described Grundy as 9 miles long and ½ mile wide. Looks to be about right.

Last night when we arrived, we took a local’s recommendation and went to the local Chinese restaurant where the buffet table included such Chinese favorites as "taco salad" and "chicken kesadias" (Honestly, I couldn't make that up).

Having contracted a bit of a cold, I went to the Grundy Rite Aid, where a translation problem promptly developed. Trying to purchase some medicine, the clerk asked me for my “databird.” Being a geek, it is unsurprising that that’s what I heard. It took four polite “could you please repeat that” inquiries before it finally dawned on me that she was asking, in the native contracted cadence, for my date of birth. I’d like to own a databird though – sounds like a magical and charming creature.

Tonight’s presentation was to the law students about marketing yourself online – but one of our chief points (which we are constantly hammering home to the young) is that the photos and inappropriate text you post online today, often on social networking sites, may become electronic evidence tomorrow, preventing you from getting a job or a security clearance or even souring a promising relationship. Our religious fervor in this regard, along with some real life examples of young folks who have gotten themselves in a world of trouble online, clearly had an impact.

One young man came up afterwards and asked whether we thought his application to be a JAG officer might be impacted by what he had posted online, which he clearly didn’t want a prospective employer to see. When we gravely nodded and explained that the federal government is often routinely doing online checks, he quickly shook our hands and hurried off: “Thank you sir – thank you ma’am – I’ve got to get going. Got some work to do on my Facebook page.”

Good luck son. And go forth a wiser young man.

E-mail: snelson@senseient.com             Phone: 703-359-0700

DO IDENTICAL FILES EVER HAVE DIFFERENT HASH VALUES? AH . . . NO

Before I get to the title question above, I have to tell you that we are in W.V., where (could I make this up?) the front page of The Dominion Post has a headline reading “Charge dropped against man accused of farting.” For those of you wondering how such a charge could come about . . . we had heard the previous day that a presumably inebriated man had lifted his leg in the police station, and well, the headline says it all – and then he fanned his emission toward the police officer attempting to administer a breathalyzer test. As a result, he was charged with battery. Silly, but we can understand that the officer was unhappy.

Normally, the paper slipped under our hotel door doesn’t cause us to howl, but that was pretty darn good. We also had the opportunity, thanks to our gracious hosts at the WVU Law School, to watch the Mountaineers lay waste to the Marshall football team. Not being a football fan myself, I watched the 3 day hoopla surrounding the game with amazement – the Roman Circus had nothing on this.

And back to the real subject – electronic evidence – which was the focus of the WVU Law School’s conference. Apparently, one of our faculty colleagues at the conference had warned the audience that two identical files could produce two different MD5 hashes if located on different hard drives, scanned from different computers. John and I suspect that this misinformation came from an error in a widely recently viewed webinar. We gently corrected the audience the following day, and it seemed worthwhile to ensure that any readers of this blog have not suffered a similar misapprehension. Two identical files, no matter what media they are located on or what computer they are scanned from, will always produce identical MD5 hashes. Precisely because this is true, its authenticity is maintained as it is transferred to different media.

OK, it’s not a sexy point. But it is imperative to understand. Onward to Grundy, VA and the Appalachian School of Law. No doubt about our accommodations – the only game in town is the Comfort Inn and we understand that the major decision point is which fast food or pizza joint to eat in. There goes the diet.

E-mail: snelson@senseient.com    Phone: 703-359-0700

UPDATE TO THE HACK OF PALIN’S E-MAIL

A federal grand heard evidence against David Kernell, the son of Democratic Tennessee State Rep. Mike Kernell, in the hacking of Governor Sarah Palin's e-mail. It failed to return an indictment, but there is an ongoing FBI investigation and subsequent grand juries may of course elect to return an indictment. On Sunday morning, the FBI served a search warrant on Kernell's apartment near the University of Tennessee, where he is a student. Kernell's roommates have been subpoenaed to testify before the grand jury, according to television station KBIR.

Reportedly, Kernell goes by the handle "rubico." Someone posting from the e-mail address rubicon10@yahoo.com claimed that he had broken into Palin's e-mail account. The poster explained that he broke into the account by answering some security questions that allowed him to change the password. Part of what the writer said, with all errors intact (though my red pen is twitchy), is below.

"It took seriously 45 mins on wikipedia and google to find the info. Birthday? 15 seconds on wikipedia, zip code? well she had always been from wasilla, and it only has 2 zip codes (thanks online postal service!)"

The hacker said online research also revealed the answer to the hardest question, "Where did you meet your spouse?" The answer was "Wasilla High."

A posting on 4chan.org, a website frequented by hackers, indentified some of the specifics of the hack as mentioned above. The Ctunnel proxy service was used in an attempt to mask the source IP address of the posting. The operator of the proxy service has handed over the IP cache records to the FBI, which allegedly led back to Kernell.

If David Kernell is indeed guilty, he is a poster child for stupid (and criminal) online conduct – and the consequences for his future may be grim. As is often said, if you’re going to do the crime, be prepared to do the time.

E-mail: snelson@senseient.com     Phone: 703-359-0700

RULE 502 BECOMES LAW

On Friday, September 19, 2008, the President signed into law S. 2450, adding new Evidence Rule 502 to the Federal Rules of Evidence. For further information about the implications to the electronic evidence world of this rule regarding the inadvertent loss of the attorney client privilege, see the previous blog post on this subject.

E-mail: snelson@senseient.com  Phone: 703-359-0700

FOUNDATIONS OF DIGITAL EVIDENCE BY GEORGE L. PAUL

I want to thank my friend and colleague George Paul for waking dormant brain cells that I thought Captain Jack had killed off long ago. George is a true scholar, and reading his new book, Foundations of Digital Evidence (ABA 2008), was a true cerebral workout.

Once you arm yourself with a couple of strong shots of expresso, sit down and enjoy George’s take on the authentication and admissibility of digital evidence. First, savor the foreward by Judge John M. Facciola, one of the judicial rock stars of electronic evidence. He calls Paul a revolutionary and I agree. Bookish Yalie though he is, he challenges the present system of admitting ESI with scant (or no) true authentication. As Facciola states, George makes us aware “of the reality that digital information, far from being inherently reliable, can be manipulated, corrupted and misused.” Facciola frets, rightfully, that George’s excellent analysis may not prevail because of “inertia,” the fact that federal courts try relatively few cases, the reality that we do not have a true trial bar skilled in the rules of evidence and the slowness of the rule-making process.

Other than the mental calisthenics that George put me through, I enjoyed this book as a bluntly new and scientific approach to authentication. In reality, I see electronic evidence admitted all the time without a peep from the other side, even where it seems that authentication might well be challenged. George provides a great gift in his book – whether you want to make sure you have authenticated something properly or whether you want to challenge the authentication of ESI, there is something in this book for you.

You may well read this book and reach for your Advil, because the truth is that it can be daunting to authenticate electronic evidence, especially when we have so little knowledge of the systems that produce ESI, how they work, how they may be subverted, how they may innocuously be changed, or simply be misinterpreted. Who is the true author of ESI? How does the hearsay doctrine play out in the digital world? The questions are endless.

Following George’s work, there are case studies written by expert contributors supporting George’s theses. In sum, the book is admittedly nonlinear, often philosophical, but oh, how much you can learn as a litigator if you keep your highlighter handy. Embedded in this book are true practical gems that you can put to use in your practice.

George, you always make me feel like the dime novel writer of yore. But I guess there’s a place for us both. Well done!

E-mail: snelson@senseient.com    Phone: 703-359-0700

YOU TUBE TASER VIDEO: THE 11TH CIRCUIT SHOULD BE ASHAMED

My brother is a cop. I am part of the extended family of cops who worry constantly about what might happen to the person in uniform that they love. But there’s no free pass for being a cop – no “get out of jail” free card when you abuse the Constitution. And when an appellate court of the United States sanctions that conduct, I start to hear Nero fiddling while Rome burns.

On September 9th, in an unpublished 2-1 decision by the Atlanta-based 11th U.S. Circuit Court of Appeals, the court held that a deputy’s tasering of a handcuffed motorist was not an excessive use of force that violated the Constitution. The motorist, reportedly financially destitute and homeless, had refused to sign a speeding ticket and would not stand up. He began sobbing and told the officer to arrest him.

Though the motorist was at no time threatening, and the police officer clearly felt no sense of danger, he jolted the motorist not once, but three times with his Taser. You don’t have to be a rocket scientist or a Constitutional lawyer to watch the video of a clearly disturbed person being tasered and know that excessive force was used. The officer called for a backup, exactly what he should have done in the first place, and there was no difficulty in getting the handcuffed motorist in the car once there were two officers on the scene. So why did the officer taser this man three times just to get him to stand up? Are police officers permitted to taser someone when they become impatient?

The case spurred a strong dissent by U.S. District Judge Beverly Martin, sitting by designation, who suggested the video of the incident be posted along with the court’s opinion. "The Fourth Amendment forbids an officer from discharging repeated bursts of electricity into an already handcuffed misdemeanant—who is sitting still beside a rural road and unwilling to move—simply to goad him into standing up,” she wrote.

Well, big surprise here, the 11th Circuit didn’t decide to make the video available. But when blogger Howard Bashman of the How Appealing blog suggested that lawyers for the plaintiff post the video to YouTube, voila, the video appeared.

Watch the video (about 6 ½ minutes) for yourself. And cry for our tattered Constitution.

The court’s decision may be found at: http://www.ca11.uscourts.gov/unpub/ops/200710988.pdf

E-mail: snelson@senseient.com    Phone: 703-359-0700

GOVERNOR PALIN’S E-MAIL HACKED: CRIME AND PUNISHMENT FOR BOTH SIDES?

Hardly new, hacking into someone’s e-mail. But when it is a Vice Presidential candidate, it attracts attention. First and foremost, this action was clearly illegal and cannot be condoned. A group called “Anonymous” claimed responsibility for the hack, and the computer forensics experts from the government are no doubt busy hunting the group down.

So yes, it is a despicable way to get information and I hope the authorities do find them and hold them accountable. I’ve seen the screenshots of the leaked Yahoo! Inbox and e-mails and it appears to me very likely that the Anonymous group had enough information about Palin that they were able to trick Yahoo! into resetting the account password, giving them access to the account. One of the subject lines from her Inbox is “Your Yahoo! password was changed.”

So often in our society, the most interesting information comes to light through unsavory sources and means. No one seems to deny that Governor Palin did indeed have two personal Yahoo accounts and (shocker) it appears that she was conducting government business on these personal accounts. For the blissfully naïve, this is often done to avoid leaving an archival government record, as mandated by law. When investigations and FOIA requests come, the government dutifully produces the government records – leaving the personal e-mails untouched.

As my mom would say, two wrongs don’t make a right, but it certainly appears that Governor Palin chose selectively when she turned over e-mails in response to a June public records request. Combined with her string of misrepresentations about the bridge to nowhere (she did support it, then pulled her support when Congress pulled its support but she kept the money for other projects), her supposed visits to Iraq and Ireland (didn’t set foot in Iraq and her plane refueled in Ireland), her overstated claims about her oversight of Alaska’s provision of energy resources (first it was energy and then she changed it to oil, but her numbers (20%) were still wrong (7.5% is the correct number) and her “Troopergate” shenanigans and about-faces (she is actually asking to terminate a legislative probe she originally asked for and put it in the hands of the state personnel board, which she controls), the Governor is working overtime on looking deceptive.

For both the Anonymous group and the Governor, it might be wise to remember the old adage that “the truth will find a way.”

Hat tip to Dan Fuller for finding those screen shots!

E-mail: snelson@senseient.com      Phone: 703-359-0700

WEBCAM STRIPTEASES: THE GIFT THAT BACKFIRES

There seems to be a growing and incomprehensible (to me) phenomenon of ladies young and old filming themselves doing a striptease (or worse) as a gift to their boyfriends/husbands. So why does someone doing computer forensics know this? Because men who once said “I’ll love you forever” didn’t – and then posted their “gifts” on the Internet by way of revenge or humiliation. We see the bitter aftermath of women who are ashamed and distraught at these postings – now accessible to employers, families and friends. Once someone who knows you finds them, they tend to become viral, deepening the distress.

Ladies, please consider carefully what photos, movies, etc. you allow yourself to “star” in. All too often, these candid moments wind up as electronic evidence in a legal case where you are trying to discover who posted these erotic images online and struggling to get them off. Even if you KNOW who did it, proving it is another matter entirely. Depending on how clever the poster is, you may never be able to hold him accountable.

Give him aftershave. Much safer.

E-mail: snelson@senseient.com    Phone: 703-359-0700

YOUR MISSION, SHOULD YOU DECIDE TO ACCEPT IT . . .

Apologies for the brief hiatus. I have just returned to work after tending to the storybook wedding of one of my daughters. Though I feel as though I’ve been hit by a freight train, I’m back.

From the mailbag: A reader submitted a question about one of my recent posts concerning encrypting data on laptops. While we recommend whole disk encryption for laptops, he expressed the thought that folks would have a “warmer and fuzzier” feeling if the data was wiped after a number of incorrect passphrases were entered. This would be the modern day equivalent of the opening scene of Mission Impossible without the puff of smoke. To address this suggested improvement to the encryption process, I went to our team of computer forensics experts. Sorry, but nobody here knows of a product or implementation that provides whole disk encryption AND will automatically wipe the drive after a defined number of incorrect password guesses. This “self destruct” logic must be included as part of encryption implementation. There are many products that will perform this destruction for defined virtual encryption volumes and several flash drives (e.g. IronKey) that wipe the data contents after a number of incorrect passwords have been entered.

We still feel that you’re pretty darn safe if you encrypt with a good password without self destruction. If someone knows of a product that does whole disk encryption and self destructs, please e-mail me and I’ll pass the information along. In the meantime, we’ll keep our mobile data on our IronKey flash drives and use biometrics and whole disk encryption for our laptops.

Mr. Phelps, this post will self-destruct in five seconds. I miss those innocent days, when that opening MI scene really did seem high tech!

E-mail: snelson@senseient.com    Phone: 703-359-0700

FINALLY – RULE 502 PASSED BY HOUSE

Things don’t exactly move fast in Congress. It was a relief to those in the electronic evidence world that the House of Representative passed Rule 502 (S. 2450) on September 8th. As the House version is identical to the version approved in the Senate by unanimous consent on February 27th (again, what took so long?), it now awaits the President’s signature, expected in the next few weeks.

The bill protects against inadvertent waiver of the attorney-client privilege and work product production. It was approved by the Judicial Conference of the United States and sent to Congress in September 2007. It will take effect for all new proceedings after the date of enactment, and, insofar as is just and practicable, in all proceedings pending on that date.

With the consent of the Judicial Conference, Congress added more text to the explanatory note which accompanies the rule.

Make sure you read the rule carefully because it’s not a “home free” rule. The attorney needs to take reasonable steps to prevent inadvertent disclosure and take reasonable and timely steps to rectify any such disclosure. Failure to do so has already burned several attorneys, so a careful reading of the bill is in order!

E-mail: snelson@senseient.com    Phone: 703-359-0700