Ride The Lightning

The Digital Trail to the Craigslist Killer

Thanks to pal Tina Ayiotis for forwarding this story.

We all watched the hunt for the Criaigslist killer in 2009, but only recently have all the digital bread crumbs followed by the detectives in the case become known. There is a splendid, gritty and compelling report of the hunt for the killer in The Boston Phoenix.

I was so rivited that my neglected tea grew cold as I read. Julissa Brisman, 25, was a massuse and probably more judging by her Craigslist ad. She died a violent death in a hotel room after meeting a client, now known to be Philip Markoff, a young man with no police record.

Surveillance cameras, disposable cell phones, cell towers, IP addresses, Craigslist accounts, Facebook data - it was a complicated scenario. There seemed to be a break when a Craigslist masseuse in a nearby hotel was tied up and robbed - her visitor looked on the surveillance film like the same man at both hotels. The presence of a gun and the use of white flexcuff seemed to support that theory. The flexcuff and duct tape used to cover the victim's mouth gave up fingerprints, but there was no match in the database.

The most important evidence was an e-mail address provided by a friend of Julissa's through which he had made contact regarding the Craiglist ad. Microsoft provided the IP address used to set up the account information only to learn that the account had been set up minutes before it was used to answer the victim's ad and then never used again. The IP address belonged to Comcast, which, with some prodding, accelerated its response to a subpoena and linked the address to Phillip Markoff in Quincy.

As a follow-up, The Boston Phoenix also has an articleon what Facebook sent law enforcement and the subpoena in the case.

It is beyond the scope of a single blog post to go through all the details of this story, but it is well worth reading from beginning to end to understand the use of digital forensics in criminal investigations.

Just don't make tea.

E-mail: snelson@senseient.com         Phone: 703-359-0700

www.senseient.com

http://twitter.com/sharonnelsonesq

Apple Holds Master Decryption Key for the iCloud

We've been lecturing to audiences for some time that we were pretty sure that Apple holds a master decryption key for the iCloud. We based our statements on the iCloud's Terms and Conditions, in which you consent to let Apple hand over your data to law enforcement. It wouldn't be much use if it were encrypted so we figured they had a decrypt key.

Now we know for sure. Ars Technica recently reported that our suspicion was true. As we keep preaching, stop and read those Terms and Conditions. In this case, they say that Apple can "access, use, preserve and/or disclose your Account information and Content to law enforcement authorities" whenever required or permitted by law.

You may want to rethink storing your data in the iCloud - or in many other clouds as well, since most of them have similiar language. From a security standpoint, "the cloud" is not a friendly place.

E-mail: snelson@senseient.com         Phone: 703-359-0700

www.senseient.com

http://twitter.com/sharonnelsonesq

Medicaid Hacked: Over 181,000 Records Breached

ZDNet has reported that the Utah Department of Technology Services (DTS) notified the Utah Department of Health (UDOH) last week that the server that stores Medicaid claims was hacked. 181,604 Medicaid and Children’s Health Insurance Plan (CHIP) recipients had their personal information breached and 25,096 of those had their Social Security Numbers compromised.

The breach is believed to have originated in Eastern Europe and took place on March 30th, 2012.

Someone's job is probably at stake since the hack was possible because of a configuration error at the authentication level of a new server commissioned to store the data. Once DTS became aware of the hack, it shut down the server - it says it has now reviewed every server in Utah to ensure that proper security measures are in place.

We continue to shut the barn door after the horse has bolted.

Hat tip to Dan Fuller.

E-mail: snelson@senseient.com         Phone: 703-359-0700

www.senseient.com

http://twitter.com/sharonnelsonesq

ABA TECHSHOW: Expo Hall Highlights

Honestly, I wish I could write about all the vendors - they were warm and welcoming. But my own duties as a speaker and author kept me from canvassing the hall as thoroughly as I might have wished. Here are just some of the highlights.

The Law Practice Management booth was full of hot new books, including Locked Down, our most recent book. If you didn't get a chance to peruse the booth, here are the top sellers for this year.

• iPad Apps in One Hour for Lawyers by Tom Mighell
• LinkedIn in One Hour for Lawyers by Dennis Kennedy and Allison C. Shields
• Microsoft OneNote in One Hour for Lawyers by Ben Schorr
• Locked Down: Information Security for Lawyers by Sharon Nelson, David Ries, and John Simek
• Limited Scope Legal Representation: Unbundling and the Self-Help Client by Stephanie L. Kimbro

Our friends at Digital WarRoom announced a significant upgrade, improving their low cost and very popular e-discovery software. You can read more about the upgrade here.

Worldox was featuring its new Worldox GX3 with dramatic gains in speed and optimized backend and data performance. There is also a new, easy-to-use interface. Worldox has long been our recommendation for document management in all but the largest firms.

The nice ladies at Ruby Receptionists (virtual receptionists) were full of smiles. They offer a 14-day trial and prices start as low at $219.00 a month - we've heard nothing but good things about this company.

This was the first year we had a chance to sit and talk with the folks from Rocket Matter, a leading provider of cloud-based practice management, including time tracking. We liked everything we heard, especially relative to their concerns about data security. And they announced in March that Rocket Matter is now integrating with the automatic time tracking tool Chrometa. We've recommended Chrometa for years, so this is very good news.

Many of our colleagues have reported good experiences with SpeakWrite, a transcription service where you can dictate your work through your telephone, dictation device or computer, with the completed documents returned to you in about three hours.

TrialPadis clearly the leader in courtroom presentation apps for the iPad and was ranked the #1 new product of 2011 by Technolawyer. All of our litigator friends sing the praises of TrialPad. We are scheduled to DO a demo with this product shortly, so look for our review, but what I saw at TECHSHOW was very impressive.

The Expo floor was busy and full of enthusiasm. As a former ABA TECHSHOW Chair, I thank all the vendors for their warmth and hospitality!

E-mail: snelson@senseient.com Phone: 703-359-0700

www.senseient.com

http://twitter.com/sharonnelsonesq

Google and Apple - How They Help Police Bypass Smartphone Lock Screens

A CNET article published yesterday further expands on a subject I've been following closely - how law enforcement is bypassing smartphone lock screens with the assistance of the manufacturers.

Training materials from the sheriff's office in Sacramento CA include a fill-in-the-blank court order mandating Apple to "assist law enforcement agents" with "bypassing the cell phone user's passcode so that the agents may search the iPhone."

Google is little tougher. You need the Gmail user name and password, but even Google does not have access to the automatically encrypted password. Therefore, the court order must require that Google "resets the password and further provides the reset password to law enforcement." This has the downside, from the point of view of law enforcement, that the user will be tipped off, once they try to access their e-mail account, that the phone has been compromised.

Clearly, Google and Apple have no choice but to comply with court orders. But the extent of the use of these orders was previously unknown. I remain hopeful that the Supreme Court will take up this issue soon.

************************

BTW, Charles Holloway of Millnet did a blog post on trolls (the real kind) referencing my post about the recent patent troll litigation targeting e-discovery companies. I had no idea that trolls are said to turn to stone when exposed to sunlight. As John would tell you, I am the Queen of Useless Knowledge, so I am happy to add to my collection of utterly useless factoids.

E-mail: snelson@senseient.com Phone: 703-359-0700

www.senseient.com

http://twitter.com/sharonnelsonesq

 

Anatomy of a Law Firm Data Breach

One of my favorite sessions at ABA TECHSHOW had this title. I might be slightly prejudiced by the fact that my husband and partner, John Simek, was teaching it with our friend and co-author Dave Ries. I would be remiss if I didn't happily say that our new book, Locked Down: Information Security for Lawyers was a bestseller at the conference - we're hoping that the recent spate of law firm data breaches is really waking lawyers up to the dangers of ignoring data security.

Besides the excellent job Dave and John did at presenting some real-life scenarios involving data breaches, I loved Dave's sense of humor (the gloomy subject does benefit from lightening efforts). In the breach scenario, one law firm was named Doolittle & Billum and the other (harking back to the days of The Three Stooges) was Dewey, Cheatem and Howe.

Dave pointed out - who knew - that there is actually a Wikipedia entry for the latter firm, complete with a photo of a building in Harvard Square with the firm name visible on a third story window.

If we must think about the gloom and doom of data breaches, it was kind of cool to acquire this completely worthless (but entertaining) scrap of information about this legendary fictional firm.

You had the audience riveted John and Dave - well done chaps! Mama Nelson owes you both dinner.

E-mail: snelson@senseient.com         Phone: 703-359-0700

www.senseient.com

http://twitter.com/sharonnelsonesq

Law Enforcement Routinely Tracks Cell Phones

As my granddaughter Samantha would say, "Uh-oh."

Many of us assumed that the tracking of cell phones was done primarily by federal law enforcement. It appears we were wrong. According to a startling report from yesterday's New York Times, local law enforcement is heavily into tracking cell phones, obtaining location information and even the contents of text messages. This activity often has little court supervision, which is deeply troubling from a privacy perspective.

It certainly bothered me to hear that cellphone carriers are actually marketing a catalog of "surveillance fees" to police departments. They might charge several hundred dollars to locate a phone - or up to $2200 for a full scale wiretap. When did this become a cottage industry for cell phone carriers?

While some police departments carefully require warrants to use phone tracking in non-emergencies, others claim broad discretion to get the records on their own, according to 5,500 pages of internal records obtained by the American Civil Liberties Union from 205 police departments nationwide.

The internal documents, which were provided to The New York Times, indicate that the practice is used far more often and with far more lax safeguards, then we previously knew. Given the Supreme Court's January ruling that placing a GPS tracking device on a drug suspect's car without a warrant violated his Fourth Amendment rights against unreasonable searches, there is certainly a lot of questioning now about whether some of the same reasoning in that case might apply to cellphone tracking. I think a LOT of its reasoning applies.

The article reported that California state prosecutors are advising local police departments on ways to get carriers to “clone” a phone and download text messages while it is turned off. I don't know about my readers, but that scares the heck out of me in a warrantless situation.

I was horrified to read the words of a Sheriff's Department in Ogden, Utah, which indicates that the department lets the carrier determine what the sheriff must provide. Really? Here's a quote: “Some companies ask that when we have time to do so, we obtain court approval for the tracking request.” When they have time to do so? I don't think so guys.

Small police departments in Arizona have determined that cell surveillance is so valuable that they have acquired their own tracking equipment to avoid the time and expense of having the phone companies carry out the operations for them. The police in the town of Gilbert spent $244,000 on such equipment. The article didn't say whether these departments always get warrants before using their own equipment, but the betting money says "no."

I hope that another landmark case on this issue makes its way to the Supreme Court soon. Many of us were astonished and delighted that a unanimous court required a warrant before law enforcement can use GPS trackers - and I am convinced that the court will once again demand warrants prior to the use of cell phone tracking.

Stayed tuned, in the next or two, for a wrap-up from ABA TECHSHOW 2012, which broke attendance records and was 2 1/2 exciting and exhausting days of learning on all kinds of legal tech topics, including e-discovery. That one will take a while to compile - and unpacking and laundry come first!

E-mail: snelson@senseient.com      Phone: 703-359-0700

www.senseient.com

http://twitter.com/sharonnelsonesq