From a legal perspective, this is a common game of cat and mouse law enforcement regularly uses to circumvent the 4th amendment prohibition on unreasonable search and seizures without a warrant.
In other words if law enforcement illegally obtains evidence, that evidence can be suppressed and all evidence as a result (fruit of the poisonous tree doctrine). But the 4th amendment only applies to the government, so a non government actor can otherwise illegally obtain evidence (break in to your home and steal said evidence and turn it over to law enforcement) and you would not be able to suppress the evidence because the government didn’t violate your 4th amendment rights, another private citizen did.
In this case you get entities arguing geek squad is the government/acting on behalf the government, presumably because they took some small payments, on the other hand you have the governments arguement that geek squad is not acting on behalf of the government and in fact the criminals signed a contract allowing geek squad to search and seize evidence of a crime from the computers.
It’s a well settled area of law, but it’s controversial.
> so a non government actor can otherwise illegally obtain evidence
A critical point is the police can't directly or indirectly _solicit_ this behavior. That would be a criminal act in and of itself, but it would maintain your 4th amendment rights.
Yes, you could bring an invasion of privacy suit against them. I'm not aware of anyone having done so since usually informant doesn't have the resources to justify that sort of lawsuit.
And in the case of Best Buy, they're not acting illegally in the situations described in the article.
Worse than that, if they get lazy and misreport your mileage a few times your car can get flagged as having miles rolled back. Which will destroy its resale value.
I've got caught by this, took some explaining to straighten out. I always have my on board computer set to display distance in kilometres, but I live in UK - and once, a technician logged my mileage using the value in kilometres, but for the next service they switched to miles - and I got some questions from Mercedes how come my mileage went down between visits to the garage.
For curiosity's sake, if you're interested you can see how often mileage is reported incorrectly by looking at the MOT data set published by VOSA: https://data.gov.uk/dataset/anonymised_mot_test.
but if they did just make the assumption that any odometer reading that was off by 0.62 must have been a km->mi error, couldn't someone attempting to rollback an odometer just always make sure it was rolled back to 0.62 x the number of units driven?
The issue is obviously that the two readings were not taken at the same time, and the technician does not have a field for the unit - just for the value. So let's say he typed in 20,000(in kilometres, so about ~12k miles), then I drove another 5000km, so the next reading taken was 15,000(in miles). So all they could see on their system was my odometer going down by 5000 "units" - it's impossible to work out from this that the mileage was taken in different units each time.
Right - that was my point to the parent who said "it's scary they [Mercedes] didn't figure that out" (that there was a unit change, and thus proceeded down the road of "must have been a rollback"). I was trying to get across that simply making the assumption that mileage going down implies a kilometers-to-miles conversion in reading is ripe for abuse, and so Mercedes would have to assume a rollback first and investigate.
Point taken, but they first could have investigated a unit mixup before assuming fraud. Or they could always track mileage with explicit units, not assuming a default.
Sounds like another excellent reason to change your own oil. Many lube places end up putting inferior filters on vehicles anyways, and if you do it yourself, you can know that good oil and a good filter went on the car.
They will probably know your milage anyways. Oftentimes the state requires all registered vehicles to be inspected or emissions tested regularly. I recall that my odometer reading was noted on the inspection forms. I also had to note the odometer reading when I registered the car in the first place, though that one was on the honor system. I have no reason to believe the state doesn't share that information with insurance companies.
> drivers are also asked to check a box if they wish to have their name and address "withheld from the list the department sells."
> About 2.5 million Wisconsin drivers didn't check the box to withhold their information. By not doing so, those drivers allow the DOT to sell their information on a monthly basis.
> [...]
> In 2010, the DOT made $22,250 selling driver record files.
Wisconsin sells the personal information of 2.5M drivers for a mere $22k. If that emissions information is not reported to insurance companies, I'll eat my hat.
How would it be illegal? If someone came into my business and I noticed something about them, unless it's something specifically protected by law like health information, I'm more or less free to tell others about what I saw. Or even show the public the CCTV footage of what I saw, for example: http://www.independent.co.uk/news/world/americas/espn-report...
This sort of thing might be regulated under the FCRA, but other than that, companies are pretty free to talk about you to others. Just like how you're free to talk about them to others.
I'm not sure your odometer readings qualify as protected information. More importantly, on many cars, it's in public view.
So, what's the difference from the oil shop selling this data or from the insurance agent driving to your house and just looking through your side window?
Well, for one thing you have the ability to protect your car at home, and, for instance, keep it secured in a garage where no one else can access it without your permission.
Absolutely correct. In this instance, you have given consent for the staff of the service centre to power on your vehicle and even drive it around to get it inn to the service area. They will also take several measurements of your vehicle such as tyre tread depth, brake pad wear, fluid levels, date of registration, and the mileage to ensure that the correct serviceable parts are replaced for the age and service life of the vehicle. You explicitly consent to them collecting and storing this information as part of the works carried out on your vehicle, in keeping with their policies for how they use this data. This policy states that they may (will) sell this data to insurers. These are the terms of business, and if you don't agree to them you are welcome to take your vehicle elsewhere. The others will also have the same policy, so you'd better be able to source your own diagnostic equipment, or be willing to drive cars made at the latest in the 90's.
Whose fault is it that you don't have time to read? If you are being asked to sign a document that you feel you have not had reasonable time to read, you should not be signing that document.
That's reasonable until you realize that most people are very busy and don't have enough time to read every contract they sign. Not to mention the amount of peer pressure they might be under from the staff ("just sign it, it's just standard stuff"). Plus almost all of those contracts are on a "take it or leave it" basis, so if they do not agree, they just wasted their day and have to reschedule with another shop, who might also have the same clause in their contracts.
It doesn't need to be in the ToS. In the US your information has no legal protection, with a handful of exceptions like medical information. You should assume any information you give to any company is being shared, sold, and utilized to the fullest extent to monetize you.
Something many do not consider especially in today's era of social media and AI capable of scraping any tidbit of information you reveal about yourself. As an example, this [1] is an extremely primitive tool that generates a profile of Reddit users based on nothing but what they've publicly submitted. The profiles the companies people 'trust' with their information today are going to be orders of magnitude more detailed, and accurate.
How would registering dealers or mechanics change the incentives? Insurance companies already created relationships with the oil change places, how would the name on the building change the outcome?
> The image found on Rettenmaier’s hard drive was in an unallocated space, which typically requires forensic software to find
So say someone, known or unknown, emails you a bunch of unlawful zeros and ones, you open it or it displays automagically. Or you accidentally type a web address wrong and go to unlawful pictures dot com.
Anyway, you delete the file(s) and / or clear your browser cache. Your file system deletes the entry in the allocation table (or however it works) but the drive still has the relevant magnetic / electrical charges to recover the file using a data recovery tool.
Are you still in possession of the unlawful zeros and ones if you've deleted the files in the only manner you are aware of - assuming the average person doesn't understand the underlying technology???
IANAL but I have read a ton of case law on similar subjects involving possession.
In the case of Rettenmaier, the possession laws work almost identical to drug possession laws.
When the contraband is not in actual possession(physically on the persons body, in pocket, etc...) then they must use the rules of constructive possession.
(At least in FL, and many other states are similar)
For constructive possession, they must prove:
1. The person had knowledge of the presence of the contraband
2. The person had the ability to exercise dominion and control over the contraband.
There used to be a 3rd rule "Knowledge of the illicit/illegal nature of the contraband" -- but IIRC that one got thrown out a few years ago making most possession crimes strict-liability.
For files in unallocated space, without any other evidence, neither of the rules could be satisfied and a good lawyer would get it dismissed before it ever went to trial. Now, if in an interview, the subject 'confesses,' then they may have 'evidence' of either rule, and the case can go to a jury for the facts to be decided.
There was a case in FL(a quick search didn't find it again) of a person driving a box truck full of marijuana that had a padlock on the doors to the cargo compartment. They were pulled over and the officers could smell the marijuana from outside the truck. They were convicted but the case was overturned on appeal because there was no evidence that the driver knew what marijuana smelled like (no knowledge of its presence) and no evidence that the driver had a key to the locked cargo compartment (no ability to exercise dominion or control)
Thanks for all the info! The case you described also sounded familiar to me so I set out trying to find it. No luck though; the closest I could come was California v. Acevedo[^1] and its related cases like United States v. Chadwick.
There were two similar cases, one in which the box truck had a pass-through into the cabin, and based on this, the conviction was upheld because it was deemed that the pass-through from the passenger compartment of the vehicle into the cargo compartment allowed the defendants knowledge and control.
In the other case, there was no pass through and the conviction was overturned.
I will dig through some more files tomorrow. They were both State of Florida cases.
Another interesting(older) case was one in which a defendant was seen leaving an unoccupied house, was 'stopped and frisked' and a Tylenol(or some other legal OTC drug) bottle containing some sort of illegal drug(MDMA or something like that) was found in his actual possession(on his body). The defendant told the police that he had taken the bottle from the house and was unaware it contained illegal drugs. The conviction was overturned because while he knew of the presence of the pills in the bottle and could clearly exercise dominion and control as it was in his actual possession, there was no evidence to indicate he had knowledge of the illicit nature of the substance.
Amazing case. I dont think however it will stand the test of time today.
A driver that supposedly doesnt know how marihuana smells (how do you prove he does or does not) drives across the state moving tons of contraband so long as he does not posses a key to the truck's locker.
I guess in court you ‘prove’ that a person has no knowledge of the smell of marijuana by all of:
a) they make a statement under oath to the effect that they have no knowledge
b) they and their immediate family / propuesta they live with have no relevant convictions or charges that would contradict the above, and no known links to anyone who clearly does (no electronic communications collect as evidence)
c) they are otherwise a just, upright, and moral citizen
The burden of proof is on the prosecution. The defendant has a right to remain silent(5th amendment) and that silence cannot be used against him/her.
If there is no evidence* that the person knows what marijuana smells like, then their knowledge of what it smells like cannot be proved, so there is no issue of fact for a jury to consider, and the case should be dismissed.
* - 'evidence' is a very low bar to meet. It can be something as benign as a conversation about herbal remedies. Once there is some sort of 'evidence' -- it can go to trial and is up to the jury (the trier of fact) to determine if indeed that conversation about herbal remedies proves the defendant knows what marijuana smells like.
One thing I found interesting is that nearly every type of charge has a set of jury instructions that tell the jury exactly what they must decide. They are quite enlightening. FL Jury instructions for most drug offenses:
That less than three image requirement seems really strict. If my browser were to simply pre-fetch a child porn site, I would probably have more than 3 illegal images on my computer.
I'm against real pedophiles and child abuse as much as anyone, but it feels to me like possession of otherwise illegal digital or virtual information should really be decriminalised, simply due to its immensely malleable and interpretable nature. It reminds me of things like "illegal primes" and such. Moreover, people can already perform, in the virtual world of games, acts that would be highly illegal in the real world --- and yet this still remains legal.
Laws can persevere in the face of technology which pretty much rendered them obsolete. But they remain artefacts of a different time. Let me present you Japan requiring vanilla porn which depicts pubic hair on and around reproductive areas of people to be fuzzed: https://en.wikipedia.org/wiki/Pornography_in_Japan#Censorshi...
They seem to date from back in the Meiji restoration period. But this is Japan which is also known for the Soaplands, so go figure.
You can also commit crimes in novels or roleplaying games that are illegal. That's different from supporting a market that causes child abuse.
Possessing digital/virtual information that required abuse endorses abuse. Entropy is our friend here; only an extremely rare set of bits results from child abuse. You won't just find it.
Even fiction or photoshop is illegal. Your argument is much more applicable here, but seeing how society treats even inactive pedophiles as criminals rather than sick, I don't think it'll be very popular.
"[...] but it feels to me like possession of otherwise illegal digital or virtual information should really be decriminalised, simply due to its immensely malleable and interpretable nature."
I'm not really sure what you mean here. What makes something being "digital" or "virtual" special? Isn't the content/message more important than the way it is stored and transmitted?
I mean, concretely, you really think if someone has an illegal picture on their computer, and you can prove they were aware of it, that should be treated differently than them having that same picture only printed?
If someone sends an email to hire an assassin, is the fact that it was a digital message so relevant?
The data merely being present on your hard drive isn't enough for law enforcement to make a strong case. They'd also need to prove how it got there, and why.
So in the case where, as suggested in another comment, where a computer tech, or anyone with access to you device, plants the material in order to collect the bounty, while probably annoying and stressful, should auto-resolve during the investigation / discovery.
I've wanted to run forensics tools on my computer for a while, just to see what type of information I leave behind. Will that old resume I deleted 5-years ago show up on my HD? Will my personal backup SMS files that I copied to a Veracrypt volume and deleted with BleachBit still be retrievable? Not sure how to be able to access the "real-deal" forensic tools.
And if you have children, they will be taken from you until the issue is resolved, which can take months or years.
And googling your name always brings up articles about the charges on the first page. Exonerations rarely get the same attention or media coverage as accusations, if they even get any.
There was a case I read which said roughly that, yes, if you clear your cache, and are not technically savvy enough to know the files could be recovered, then as far as you knew, the files were actually gone, and you no longer "possess" them legally.
Of course, proving that you are an idiot is always a great start to a trial, but it's worked in the past.
Well if you are technically savvy... maybe you'd go a step further too and then you do think they're gone, its a whole other question... or the same one.
The case got dismissed because of that, which is really unfortunate because they found child pornography on 5 of his other devices when they searched his home.
I’ve read sentencing remarks on other cases where, although the initial evidence would have been struck for whatever reason, the weight of evidence found upon subsequent searches during the investigation resulted in the case still going to trial and a guilty verdict being handed down.
Some of those cases have gone to appeal and been reversed by higher courts.
Such is the nature of an adversarial court system predicated upon the rule of law.
We, as a society, have, and continue to, make these trade offs.
Having been ground through the court system for drug trafficking, and been lucky enough to have the evidence struck at pre-trial conference due to a very similar case where the defendant was found guilty but the decision later reversed on appeal due to illegal police search...
I, personally, reserve my judgement on all cases that make it to trial, and prefer to read about them as a curiosity.
Edited to add: I strongly support the idea that law enforcement shouldn’t be searching people’s homes illegally, and that anything found as a result of such a search should be in admissible.
We need strong privacy protections, and if that means some crime goes under reported... well, so be it.
> Anyway, you delete the file(s) and / or clear your browser cache
If you are in possession of evidence of a crime you are supposed to report it to the police. If you delete it you are destroying evidence of criminal activity.
For an alternative scenario: suppose you find a dead body in your living room. Should you A) call be police B) hack it up in your bath tub and dump it in the river.
Even if you do B you probably won't get convicted of murder, but you are probably going to be under investigation for a lot longer than A.
What legitimate purpose would a Best Buy employee have scanning unallocated storage specifically looking for images? It sounds like they were deliberately running FBI provided porn detection software. That is way beyond the scope of what Best Buy's employees should be permitted to do.
About a decade ago, I worked at a beige box store. Someone brought in just his hard drive, and asked me to recover all his files, as his thesis was on it. So, I ran our recovery software (can't recall what it was) and found the drive was completely blank. No system files, no data, no temp files, absolutely nothing. The customer didn't seem upset or irritated at all, and thanked me, paid his bill and left.
At the time, that puzzled me a bit, but now it occurs to me that he may just have been making sure his data was destroyed.
Most drive filesystems essentially have two parts: A hierarchical index and a bulk storage area. The index stores a small amount of file metadata (such as the file name, child index nodes, etc) as well as references to chunks of data in the bulk storage area which actually contains the file data.
Unless you go out of your way to do otherwise, when you delete a file, the data isn't actually purged from the bulk data storage area. The references to the data in the index are just deleted or marked as deleted. For all intents and purposes, the file was deleted, but the data is still on the drive, in "unallocated space." Every time data is written to the drive, there's a chance that some of the "deleted" file will get overwritten, but until it is, the file data is on the drive.
If you accidentally deleted all the data off of a drive in this manner (such as with a quick format, which just wipes the index and writes a new one) you could still recover a good amount of the data. Fragmented data would be nigh impossible to automatically recover after a quick format since the data isn't contiguous and the mapping was nuked when the index was wiped, though if you had known data patterns to search for (such as a few 512 byte chunks of illicit data) then you could trivially flag a drive for deeper forensic inspection. For small or unfragmented files, you can recover them in full.
You'd hope in high profile cases (or really all cases), a hash of the entire drive could be taken upon seizure and given to a lawyer before any forensics started.
Don't know much about forensics and maybe this already happens, but is surely a good way for both sides to avoid unfounded accusations.
IIRC in law enforcement situations where a HDD has been obtained through slightly more conventional means, chain of custody is as important (as it is for all evidence) as ensuring the state is maintained. There are many forensic hardware providers that specifically sell 'read only' readers to ensure that whilst in possession of the drive, it's state is preserved (as much as practicably possible).
I guess this is another example of the sort of tension caused when we make laws intended to have law enforcement save us from ourselves.
So you work for the child porn police. You sit in your office and wait for someone to call you ... but no one does. It turns out that the people who have and trade child porn are not interested in talking to you. Everyone else tends to avoid child porn. So what do you do? The very fact that you are being paid to police child porn means that the citizens must agree that you should be able to do your job. So that means that it is OK to start rooting around in the normally private places that child porn is stored. So you do that.
Now the citizens are complaining that you are invading their privacy. Well OK then. Why did was this law made if it was not intended to be enforced? Oh, it was intended to be enforced? Whatever, this is stupid, so you continue doing your job, but in total secrecy, now that it is obvious that that is the only way you are going to to be able to do your job.
A good employee is often willing and able to compensate for the irrationality of management. This is a common problem in all forms of human endeavour.
What if the plumber is repairing, say, your toilet and finds a bunch of unlawful pictures hidden in there?
What if you call a plumber to repair your hot water system, and the plumber then uses a drain inspection camera to search all your plumbing, and everything connected to it, for unlawful pictures?
I'd argue that there's a moral one /assuming it falls in to your observation/.
There is /not/ a moral obligation to actively go looking for and judge someone as a normal individual. Rifling through another's possessions without probable cause is already wrong for actual law enforcement, let alone normal people.
I guess what I'm saying is, if in the course of normal actions I do something (like opening the web browser and the default tiles are... or the background of the desktop is) and it's obvious that this is something the individual went of the way to see / keep, that's one thing.
If it's some BS ad that probably got pulled in via automation that's another question. Once you pull in individuals politically motivated to be 'tough on crime' for re-election or future offices/career developments it's likely going to be at least a major hassle even if they're actually innocent of the intent to commit a crime.
This could still be a grey area. Obviously pornography of young children could be identified by most people 99% of the time, the 1% being bizarre situations like mistaking a collection of cherub images for child pornography. But what about when the 'child' looks like a junior or senior teenager and so it's ambiguous as to weather they're of legal age or not? Is someone morally obligated to report potential child pornography in such a situation? A false report, even an accidental one, could cost an innocent person their freedom or a lot of money to preserve their freedom.
>We have a moral and, in more than 20 states, a legal obligation to report these findings to law enforcement,”
With that specific number, I am guessing it is indeed a requirement.
I really wish we could get some clear 4th amendment boundaries for the digital age. On the surface, I am ok with this. But paying the Geek Squad techs seems to undermine the whole point of the thing.
I don't particularly find a FBI-company party in 2008 relevant to this story. Just hopeful dot-connecting.
> With that specific number, I am guessing it is indeed a requirement.
I'm guessing here, because the language is ambiguous and the relevant states & laws are not mentioned, that the legal obligation exists if you should find suspected child pornography you must report it to the relevant legal authority. I highly doubt the law states something along the lines of if you're a computer repair technician you are legally obligated to run these forensic tools to local clandestine or non-hidden photos that may be child pornography. The former I could see an argument being made that failing to report could make you criminally complicit or even an accessory to the crime. The latter, I see as possible 1st or 4th amendment violations to the US Constitution (1st amendment violation in that it's possibly compelling speech, and for the 4th, the DOJ compelling a warrant-less search. By virtue of offering the bounty in this manner, it could be argued Best Buy is effectively acting as a page contractor of the DOJ).
Obligatory, I am not a lawyer. I'm merely speculating on possible legal arguments.
Morally, I'm torn on this. On one hand, I find child pornography morally reprehensible, yet on the other hand, I want these scum bags thrown in a dark, dank prison. In the end, I think, however, that this should constitute a 4th amendment violation. If this is to stand, what's the rate to be for the government to get anything they want to know about me? $100? $.01? gratis? any IRS inquiries to disappear? I think we need to revisit the 4th amendment to give explicit protection to data held by an external party.
"Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety." - Benjamin Franklin
I totally agree. I feel the same way about Tor. On one hand people who fight oppressive regimes use it for privacy, but on the other hand people are using it to distribute disturbing content.
What if we change or broaden the transport mechanism? I'm willing to bet that you wouldn't have such conflicted feelings about https or flash drives which are also used to distribute this content.
True, but again that is a bit different. The feds could simply seize the tangible flash/hard drives. The conflict regards the law and how encryption is handled. Of course law enforcement should go after these people and take down this content. I've never heard of plain HTTPS servers used to do this, though; it's a scary world...
I believe they're showing that Best Buy has intent to work with the FBI beyond what they say, and therefore can't be trusted regarding their public statement. It isn't enough to draw any conclusions, of course, but should cast doubt that they're being honest in their public statement. The average person probably already assumes they aren't being honest, but a journalist needs a reason to have such a doubt.
There is generally an obligation to report child pornography, child sex abuse, and so on. Absolutely, and rightly so.
There is no obligation to search. But if you consented to a technically-unnecessary search and the tech has an incentive to do that search...
The only real question is whether the techs here were government actors. If the government pays them for the actions that nets them the evidence needed to convict, then I'd say the tech is a government actor indeed.
People still get "compensated" for reporting to the authorities a sighting of a [wanted] criminal, so long that it leads to the capture of said criminal. This could be a similar case. If the device was turned in for a hard drive migration, for instance, and the employees stumbled upon this nightmarish content, I see nothing wrong with them (the employees) reporting it to the authorities. As a result, the authorities could have paid them [individually] a bounty.
Violation of the 3rd amendment if trojan/rat installed. Chilling effect potentially violation of 1st amendment due to going public. Workaround violation of 4th amendment.
Get a fucking warrant. It's the law. The supreme law of the land in fact.
ps. informants are the real criminals, they just want to make it seem noble when they violate the rights of people en mass because they caught a bad guy via fruit of the poison tree
The original image found by Best Buy techs was in unallocated space which did not hold up in court as justification for a warrant. Unfortunately, the charges against him have been dropped. The accused had child pornography on 5 devices when the FBI searched his home.
In other words if law enforcement illegally obtains evidence, that evidence can be suppressed and all evidence as a result (fruit of the poisonous tree doctrine). But the 4th amendment only applies to the government, so a non government actor can otherwise illegally obtain evidence (break in to your home and steal said evidence and turn it over to law enforcement) and you would not be able to suppress the evidence because the government didn’t violate your 4th amendment rights, another private citizen did.
In this case you get entities arguing geek squad is the government/acting on behalf the government, presumably because they took some small payments, on the other hand you have the governments arguement that geek squad is not acting on behalf of the government and in fact the criminals signed a contract allowing geek squad to search and seize evidence of a crime from the computers.
It’s a well settled area of law, but it’s controversial.