COMPUTER CRIME OUTLINE

SUBSTANTIVE COMPUTER CRIMES

I. Intro A. Categories of Substantive Computer Crime Law 1. computer misuse crimes = intentional interference w/proper functioning of computers (hackers, viruses) 2. traditional crimes = traditional criminal offenses facilitated by computers (gambling, pornography) B. Computer Crime v. Traditional 1. computer crime usually threatens economic interests more than physical 2. computer crime much more likely to cross state boundaries; most traditional crime is dealt with by the states

II. COMPUTER MISUSE CRIMES A. 2 ways they can occur 1. user exceeds his own privileges a. “insider”: has some privileges/rights 2. user denies privileges to others b. may be an “outsider”: no access rights B. Most Common Statutes 1. unauthorized access statutes 2. computer fraud statutes 3. computer damage statutes C. Why Punish? 1. utilitarian: deterrence of harmful conduct, incapacitation, rehabilitation (looks forward) 2. retribution: just deserts; restore moral order (looks back) D. The Hacker Ethic: an open and free approach to using and exploring computers; any computer user has the right to tinker with and improve any computer; rules governing access should NOT be followed 1. misuse can improve security E. How or When to Punish 1. Property-based view: the computer is not yours, so if you break in you should be punished; if you want access, you need permission 2. Harm-based view: the mere fact of breaking in does not create harm; need to have some financial losses a. financial losses usually relate to security measures taken after the fact to prevent future hacking

F. PROPERTY-BASED APPROACH 1. traditional property crimes: trespass, burglary, theft a. not a good fit for computer crimes b. criminal trespass & burglary = NEVER used to prosecute computer crime c. THEFT has been used to prosecute computer misuse: idea is that by upsetting intended privileges, defendant took property belonging to another i. difficulties: (1) defining a property interest; (2) identifying when the property has been taken 2. US v. Seidlitz (4th Cir 1978): a person who develops a computer software program at a company and then leaves and gets back into the system and takes the software for his own use can be convicted under the federal wire fraud statute because the software is property: the company invested substantial sums to create and modify the software and enjoyed competitive advantage because of it; the former employee could have set up a competitor business and then there would have been economic loss even though here there really was none. a. when is information property: when it has monetary value b. Carpenter v. US (1987): confidential information scheduled to appear in a newspaper IS property when used to buy and sell stocks; intangible nature does not make it not property c. courts have found that computer usage, data, and a password can all be considered property 3. State v. McGraw (Ind 1985): employee did NOT commit theft by using his work computer for his own business by storing records on it; his use cost the city (employer) nothing and did not interfere with its use by others; the harm is de minimis and civil, like a mechanic using employer’s tools to fix his own car; at most may be a conversion but is not theft. a. dissent: time and use are of value when using a computer system, and employee denied the city both time and use b. key is LOSS: employer in Seidlitz could have suffered economic loss (even though they could still use the program) but employer in McGraw did not lose anything of value, even though in BOTH cases the defendants gained a benefit c. intent: did not have intent to deprive employer of anything, and in fact didn’t (Seidlitz may have had intent to compete d. conversion: unlike theft, does not require intent to deprive of use; but US v. Collins (DC Cir 1995) found that employee did NOT convert property by using work computer for his own purposes b/c conversion requires serious interference with ownership rights; whereas in US v. Girard (2d Cir 1979) a DEA agent DID convert property when he downloaded files of undercover agents and planned to sell them to drug dealers; diff is the intent and the possible loss G. UNAUTHORIZED ACCESS STATUTES 1. enacted by federal gov’t and all fifty states: common building block is unauthorized access to a computer

2. 18 USC § 1030: The Computer Fraud & Abuse Act (CFAA) a. seven crimes: 1030(a) 1. (a)(1): accessing or exceeding access to obtain classified info to injure US or foreign power; never been used 2. (a)(2): accessing w/o authorization OR exceeding authorized access and obtaining information: most commonly used; information must be (A) financial record; (B) info from US gov’t; (C) info from protected computer or involving interstate or foreign communication: these are low hurdles and most hackers will violate this section; mens rea required is intent; felony IF over 5K in loss, can be misdemeanor even with no loss (“just looking”) 3. (a)(3): accessing gov’t computers w/o authorization; rarely used; no info needs to be taken (simple trespass); offender must be completely outside the gov’t with no authority to access or must be interdepartmental; always a misdemeanor 4. (a)(4): federal computer fraud statute: combines (a)(2) with wire fraud statute ; felony 5. (a)(5): federal computer damage statute; key is calculating the loss 6. (a)(6): prohibits password trafficking; based on federal credit card fraud statute 7. (a)(7): prohibits extortion & threats to cause damage to computers b. attempts c. statutory maximum punishments for (a) & (b) e. definitions: under (2), basically any computer w/internet access is a “protected computer” for (a)(2)(C) g. civil remedy; where most cases arise
Felony Provisions of § 1030 (felony triggers) 1. 1030(a)(2): obtaining information (in specific culpable situations, found in 1030(c)(2)(B)) 2. 1030(a)(4): fraud 3. 1030(a)(5): damage

H. Meaning of Access 1. statutes were drafted with passwords in mind but that is not always the case today 2. unauthorized access best understood as computer trespass crime 3. analogies 1. virtual: draw analogies btw using a computer and entering real property, i.e., entering a public website is like visiting an open store 2. physical: focuses on how computers operate and whether communications have physically entered the computer

4. State v. Allen (Kan 1996): a person who connects to a company’s computers by phone but does not get past the password screen or even try to do so and does not cause any damage does NOT violate the state unauthorized access statute because he did not “access” the computer; if access means “approach” then just being around a computer would violate the statute; “access” must mean “freedom or ability to obtain or make use of” and he did not make use of the computer; so no damages even though company spent $ to upgrade security. a. note that federal statute does NOT define access b. access: did make physical contact w/computer but didn’t do anything, it may be small or insignificant access so the court says it’s no access at all c. this is a virtual approach: there is no access unless you get past the password d. under a physical approach: there would be access b/c a communication was sent e. OK supports physical not virtual approach b/c of the many sites w/o passwords: wants definition of access to be broad so can focus on authorization, not access f. State v. Riley (Wash 1993): convicted for dialing numbers to discover access codes to get free calls, even though he never actually got free calls (could have caused actual damage/loss) g. AOL v. Nat’l Health Care (ND Iowa 2000): a user accesses a computer when he sends email to the computer, so sending spam is unauthorized access (physical not virtual approach) h. port scans: common surveillance tool ; held that they do NOT constitute “access” I. Meaning of Authorization

|Approach |Definition |Access w/o Authorization |Exceeds Authorization |Legal Access |
|Code |Program itself limits |Morris |Morris | |
| |access; passwords | | | |
|Contract |User promises; terms of | |Explorica | |
| |service or terms of use; | | | |
| |weaker than code | | | |
|Social Norms |Widely shared attitudes | | | |
| |or behaviors; implicit | | | |
| |contractual restrictions | | | |

J. CODE-BASED APPROACHES 1. US v. Morris (2d Cir 1991): student who sends out a worm onto the internet causing various systems to crash DID act without authorization because he only had authorization to use computers at certain universities, but the worm was designed to spread to computers that he had no account with and no authority to use; had it stayed at his school it may have been exceeding access but here it was clearly unauthorized; the worm was designed to guess passwords which is why it broke the code restrictions; although (a)(5) is “aimed at outsiders” it is not limited to them but also punishes those who have access to some computers but then access others that they are not authorized to. a. key is that authorized access to one “federal interest computer” does not mean access to all federal interest computers b. M’s argument that he was only exceeding authorization makes sense today b/c we know that if you can access the internet, you access the whole thing (drawing a line btw “insiders” and “outsiders” no longer makes much sense) c. intended function test: a user has authorization to use computers for their intended functions but NOT to exploit weaknesses to perform unintended functions (based on social norms) d. guessing passwords IS access w/o authorization: not how network was intended to be used e. access w/o authorization must generally be intentional
BREACHING A CODE-BASED RESTRICTION IS UNAUTHORIZED ACCESS OR EXCEEDING AUTHORIZATION

K. CONTRACT APPROACHES 1. EF Cultural Travel v. Explorica (1st Cir 2001): an employee from one company who uses information from that company to create a scraper program that collects data from the old company for use of his new company to get competitive advantage exceeds authorized access because of the broad confidentiality agreement he entered into with the first company; although the website the scraper was used on was public, without the proprietary information used the scraper could never have been designed and the scraper exceeds ordinary use of the public website. a. code-based restrictions are classic criminal cases; contract-based cases are more civil cases like this one: the civil remedy provision gives competitors incentive to litigate b. Commonwealth v. McFadden (Pa 2004): police officer using police computer system to make a false threat instead of official business DOES exceed authorized access c. State v. Olson (Wash 1987): police officer printing out driver’s licenses of female college students does NOT exceed authorized access because workplace policies prohibit use of information but do NOT limit access d. State v. Schwartz (Or 2001): installing gate programs that allow users to obtain remote access to a network DOES exceed authorized access when it is specifically against company policy e. AOL v. LCGM (ED Va 1998): using AOL account to send spam specifically violates AOL’s terms of service, so it IS unauthorized policy question: should companies be able to enforce their own created contracts through the criminal law?? 2. US v. Phillips (5th Cir 2007): a student who signs a university policy stating that he will not perform port scans and then proceeds to scan anyway and goes into a university system that’s supposed to be a training resource for faculty and staff and uses a “brute force attack” to enter SSNs and get personal information about students, faculty & staff and continues scanning despite warnings to stop, has intentionally accessed computers w/o authorization; under Morris, his use of the computer was not for its intended functions; it is a felony because the university spent well over 5K in assessing damage and notifying victims even though student did NOT use or sell information a. randomly enters numbers to get SSNs = password guessing: this is why he violated the law (so may really be a code-based restriction) b. terms of agreement said he couldn’t do port scans, etc. but that’s not what he was charged with; was charged w/access w/o authorization: he actually violated the norm that you are only supposed to enter your own SSN

L. NORMS APPROACHES 1. EF Cultural Travel v. Zefer (1st Cir 2003): though Zefer did NOT sign a contract, its use of a scraper for Explorica can be enjoined but Zefer did not exceed authorized access because there was no specific regulation barring use of scrapers (no notice); there is NOT a “reasonable expectations test; Zefer is precluded from acting in concert with Explorica, which violated a contract. a. rejects a norms-based approach in the context of access to a public website; rejects because norms can vary b. Sherman v. Salton Maxim Housewares (ED Mich 2000): employee misconduct does NOT amount to unauthorized access; there must be a clearer and more explicit restriction c. Shurgard Storage Centers v. Safeguard Self Storage (WD Wash 2000): uses agency principles to find that employees do not have authorization as soon as they are with a new employer d. Register.com v. Verio (SDNY 2000): use of search robot is unauthorized access because the plaintiff objects to its use! M. Policy Qs 1. Exceeding Authorization v. W/O Authorization: 3 approaches 1. access w/o authorization = breaking code-based restrictions (outsiders but not insiders); exceeding authorized access = code, contract or norms based (both outsiders and insiders) 2. there is no difference 3. Citrin: paper thin difference based on agency and subjective intent (Posner) 2. intended function v. reasonable expectations a. intended function = the means of gaining access is what violates social norms (accepted) b. reasonable expectations = general use as violating social norms (not accepted) 3. Which approach? a. OK thinks only code-based breaches should be criminal; rest can be dealt with civilly; Explorica too broad b/c anyone can make their own restrictions and criminalize the conduct of others

N. COMPUTER FRAUD STATUTES 1. in general: hybrid btw unauthorized access statutes & fraud statutes a. 1030 (a)(4): all are felonies; must have intent to defraud and then access w/o authorization or exceed authorized access

2. US v. Czubinski (1st Cir 1997): IRS employee viewing tax returns of people he knows DOES exceed authorized access to his work computer but is NOT computer fraud; codifies Seidlitz; he did not DO anything with the information other than look at it and thus did not obtain anything of value; accessing the information did NOT deprive the IRS of it nor was there any intent to deprive: although he would not have to actually deprive, must show that there was an intent to follow through on fraud scheme; the “thing obtained” cannot be the access itself. a. violated (a)(2) but NOT (a)(4) (misdemeanor, not felony b. fraud must be a broader scheme that harms the victim in an appreciable way

O. COMPUTER DAMAGE STATUTES 1. 1030 (a)(5): focus on harm to computer owner and impose liability for particular amount of harm; focuses on (1) exceeding privileges and (2) denying privileges to others a. three offenses from (a)(5)(a): (1) denying privileges to others (viruses, denial of service attacks) (felony provision); (2) unauthorized access w/damage (felony: reckless intent); (3) unauthorized access w/damage (misdemeanor: strict liability: so punishes even accidental damage) b. damages from (a)(5)(b): 5 kinds; most common is monetary loss of at least 5K: add up losses from any “course of conduct” over a 5-year period c. 2 big Qs: (1) how to calculate damages; (2) what mens rea is required for the result elements 2. US v. Middleton (9th Cir 2000) (damages): an employee who leaves his employer but hacks back into the employer’s system using someone else’s email and deletes databases has damaged the computer system in excess of 5K, calculated by multiplying number of hours that each employee spent fixing damage by the employee’s hourly rate, plus the cost of hiring a consultant and purchasing new software. a. broad definition of loss in (e)(11): includes any reasonable cost and a list of examples that may or may not be inclusive (OK thinks it is inclusive) (codified after this case) b. damage = rate x hours; must be for reasonable damages, not excessive upgrades (looks at reasonableness of the victim’s response, this is unusual in criminal law c. defendant’s perspective, it’s unfair to be punished for 80K worth of damage if you didn’t actually get 80K or benefit from it; but this is the only real way to measure seriousness of damages 3. US v. Sablan (9th Cir 1996) (mens rea): the computer fraud statute only requires intent as to access, NOT intent to damage or to cause any specific amount of damage; the fact that the former employee intended to access the old files is enough, even though she did not intend to damage them, she did and the fact of intentional access is enough Access w/o authorization that leads to impairment is itself culpable So amount of loss is STRICT LIABILITY a. Congress codified in 1030(a)(5): must knowingly access, authorize and impair but $ of loss is strict liability b. can lead to harsh sentencing results: get more time even though didn’t intend to cause much damage

III. TRADITIONAL CRIMES A. In General: regular crimes that can use computers 1. Four Basic Types 1. economic crimes: theft & copyright 2. crimes against persons: threats & harassment 3. vice crimes: gambling & obscenity 4. child exploitation

B. ECONOMIC CRIMES 1. 4 basic types 1. general property crimes 2. specific information-based crimes: economic espionage 3. statutes that govern authentication devices 4. intellectual property laws C. Property Crimes 1. People v. Johnson (NY 1990) (possession of stolen property): a telephone credit card number qualifies as property even if defendant only possesses the numbers and not the actual credit card itself; what matters is that (1) the numbers/card had an actual owner (not just guessing numbers but an actual account), not the defendant and (2) actual charges accrued (he’s using the numbers, not just knowing them) 2. US v. Farraj (SDNY 2001) (transmission of stolen property): emailing a trial plan across state lines (selling it to opposing firm) IS transmitting stolen property; the trial plan, though in intangible form, is valuable property and although defendants were entitled to use it, they went beyond their authorized use so it became stolen (broad theory)

D. Economic Espionage 1. Economic Espionage Act (EEA) enacted to punish and deter theft of trade secrets (18 USC § 1831-39) a. trade secrets = information whose value derives from not being known b. stealing trade secrets = authorizing in some way (downloading, etc.) with intent to economically benefit someone other than owner of trade secret (requires intended harm) 2. US v. Genovese (SDNY 2005): attempting to sell Microsoft source code violates the EEA; clear that he knew that even if the source code had become accidentally available that it was still protected because (1) owner took reasonable steps to keep it secret and (2) economic value derived from not being generally known; his own website advertisements showed that he knew the code was not generally known; he knew it was proprietary and that others had stolen it a. violated EEA because: (1) is a trade secret; (2) intended to sell it; (3) has economic value; (4) intended economic value to himself (if he were giving it away, might not fall under statute); (5) knowing injury to owner (6) knowingly without authorization b. can argue that this should be handled civilly

E. Identity Theft 1. information misuse statutes 1. 18 USC 1028: identity theft: prohibits fake IDs 2. 18 USC 1029: access device fraud: prohibits possessing or using codes of others 2. both punish misuse of identification information even if no access rights are fraudulently obtained 3. US v. Cabrera (1st Cir 2000): using a computer, scanner, etc. to scan official documents, strip them of identifying material, and use them as templates to create fake documents, is a violation of § 1028; although a computer system is available to the public and has other uses, here it was “specially designed” for production of fake IDs and so basing conviction on possession of computer, printer & scanner is OK; statute is based on the defendant’s use of the items, not the general uses of the items a. computer becomes contraband by virtue of its use in the crime

F. Criminal Copyright 1. In General: to create economic incentives for authors to create new works a. overwhelmingly civil law, not criminal b. when is copyright criminal: must be done willfully and either (1) for commercial advantage or private financial gain or (2) by reproduction or distribution on a large scale (total retail value over 1K) c. when is it a felony: (1) ten copies during 180 days worth more than $2,500 4 ESSENTIAL ELEMENTS OF FELONY COPYRIGHT 1. copyright exists 2. infringed by reproduction or distribution 3. defendant acted willfully 4. at least TEN copies or more with TOTAL VALUE OF $2,500 or more within a 180 DAY PERIOD

d. primary legal issues: willfulness, fair use, intent to profit

2. US v. Moran (D Neb 1991) (willfulness): although ordinarily “ignorance of the law is no defense”, where the statute specifically provides that the conduct must be willful, the defendant cannot be convicted where he “insured” the videos that he rented by copying each once and renting the copy (with FBI warnings affixed), because he did not believe he was violating the law; the test is subjective, not objective: he truly did not believe he was violating the law based on the totality of the circumstances Key holding: there is a dramatic line between civil and criminal copyright, and that line is WILLFULNESS a. very hard for gov’t to prosecute because they must show subjective willfulness; that’s why it’s mostly civil

3. US v. Shabazz (11th Cir 1984) (intent to profit): it is not necessary that a defendant make a profit, only that he engaged in business “to hopefully or possibly make a profit” so a defendant can be convicted when he purchases sophisticated equipment and hires employees and copies several tapes, even though he has not really profited yet. a. the intent to profit is like the willfulness requirement because it will find the most culpable people who engage in the most copyright (people who don’t do it for profit don’t copy very much) 4. US v. LaMacchia (D. Mass 1994): MIT student sets up software-sharing board but does not intend to profit (it’s free) so it’s not copyright; prosecutors try to prosecute under wire fraud statute but court says they can’t because it’s a copyright case, not fraud, and not actionable under copyright a. in response, Congress passes NET Act in 1997: allows individuals to get criminal punishment for copyright even w/o commercial motive if it is willful G. CRIMES AGAINST PERSONS 1. Two Major Types 1. threats & harassment 2. invasion of privacy H. Threats & Harassment 1. Competing policy concerns: (1) social harms v. (2) freedom of speech; thus, gov’t can only punish true threats 2. statutes 1. 18 USC 875: most important; broadly prohibits interstate threats to harm a person 2. 47 USC 223: prohibits both threats and harassment over communications devices 3. 18 USC 2261A: federal stalking statute; addresses “cyberstalking” 3. US v. Alkhabaz (6th Cir 1997) (meaning of true threat): email messages between two men describing torture, rape and murder of a girl with same name as one of the men’s classmates are NOT true threats against the woman; under § 875 gov’t must show (1) transmission in interstate commerce; (2) of a communication containing a threat; (3) to injury or kidnap person of another; here the second element is NOT met because the threat did NOT go to the threatened person, did not have a purpose (not trying to achieve anything through intimidation), and did not have objective mens rea or actus reus: a reasonable person would not perceive the email stories as serious expressions of intent to harm in order to achieve a goal. a. dissent: reasonable person would take it as a serious intent to harm and there is no need for a goal (motive irrelevant) 4. US v. Carmichael (MD Al 2004): a drug case defendant’s website with “Wanted” posters of witnesses or agents that gives their pictures and info and asks users to contact defendant’s attorney is NOT a true threat; the language itself does not make out a threat and the context does not make out a threat; despite the history of intimidation of witnesses in drug cases, the incitement doctrine is implicated and the words are not likely to cause imminent danger; the fact of being posted on the internet does NOT transform it into a true threat; 1st amendment protections same for internet. a. contrast with: Planned Parenthood v. ACLA (9th Cir 2002), where anti-abortion website with Wanted posters for abortion doctors was found to be a true threat in the context of the wake of murders of abortion doctors, noted on the website I. VICE CRIMES 1. In General: involve consensual transactions a. used to occur face to face; internet changes that and makes it more difficult to enforce b. so, legal prohibitions are broad but prosecutions are rare J. Internet Gambling 1. In General: 18 USC § 1084 a. illegal in all fifty states but still very prevalent b. very regulated industry in physical world, but can’t really be regulated online c. 2 lines of thought: (1) can’t be stopped, so regulate; (2) can’t be regulated, so prohibit d. how to regulate: financial service providers can help by blocking gambling transactions using their cards; actions can be brought against financial services providers who knowingly allow gambling; but, can be difficult for providers to block 2. US v. Cohen (2d Cir 2001): US citizen who runs bookmaking operation from Antigua that allows US citizens and others to bet on sports violates 18 USC § 1084; safe harbor provision does not apply because even though betting is legal in Antigua, it is NOT legal in New York and the operation in Antigua accepted bets from New York. 3. US v. Corrar (ND Ga 2007): a defendant who provides account numbers that make a bettor’s wagers possible can be prosecuted under the Wire Act even though he is more of a “middle man” than Cohen and is not “running the show” and did not provide the usual information provided by bookies (odds on bets); the general argument that people are unsure of whether internet gambling is illegal, because it is so widespread and there are so few prosecutions, does not excuse his violation of the Act; no absolution of conduct through “rule of lenity”; even if it were legal under state law, still violates federal Wire Act 4. Unlawful Internet Gambling Enforcement Act (UIGEA) passed in 2006 and regulates banks and credit card companies by prohibiting them from processing illegal bets

K. Obscenity 1. idea is that some materials have no redeeming social value and can corrupt and coarsen the moral fabric of society 2. Roth v. US (1957): obscenity is categorically beyond the FA; if an item is defined as obscene, FA does not apply (question then becomes how to define 3. Miller v. California (1973): obscenity is limited to works which depict or describe sexual conduct in a patently offensive way and do not have serious literary artistic, political or scientific value; test is whether (1) the average person, applying contemporary community standards, would find that the work taken as a whole appeals to the prurient interest; (2) whether the work depicts or describes sexual conduct in a patently offensive way; (3) and the work, taken as a whole, lacks serious scientific, political, artistic or literary value; states should enact their own regulatory schemes and there need not be uniform national standards a. dissent (Douglas): this is censorship b. but actually, this lowers standards for obscenity (only targets hard core pornography that was relatively rare at the time but is widely available today through the internet) c. internet greatly changes “community standards”; in Ashcroft v. ACLU, Breyer argued in concurrence that community standards should mean a national standard in context of Child Online Protection Act d. Stanley v. Georgia (1969): gov’t cannot criminalize mere private possession of obscenity (can only prohibit distribution) 4. key statutes 1. 18 USC § 1460-70: federal obscenity statutes 2. 18 USC § 1462 & 1465: prohibit using “interactive computer service” in a range of activities involving obscene materials (regulates internet obscenity) 5. US v. Thomas (6th Cir 1996): couple that sets up an interactive bulletin board that requires payment and password for access to files can be convicted of violating obscenity laws for posting pictures in California that were downloaded in Tennessee and considered obscene by Tennessee community standards: it is not unconstitutional to subject interstate distributors of obscenity to varying community standards, and persons can be prosecuted for sending materials considered obscene in the district where they are received even if they are not considered obscene in the district from which they are sent; no FA “chilling” is implicated here, as may be with an open website, because the couple controlled access to the board and knew who was accessing the material and from where. a. very few obscenity prosecutions occur, and if US cracked down, foreign porn on the internet would probably pick up the slack

L. CHILD PORNOGRAPHY 1. In General: images of persons under 18 engaged in sexually explicit conduct Six factors from US v. Dost (9th Cir 1987): (1) genitalia (2) sexually suggestive (3) unnatural pose or inappropriate attire (4) partially clothed or nude (5) suggest sexual coyness or willingness to engage in sexual activity (6) intended to invoke sexual response in viewer (all distinguish family bath photos, etc.)

a. after Miller, at least some fell outside obscenity: so now every state and the federal gov’t has a child pornography law b. prohibited to protect children from abuse and deter creation, thus “drying up the market”; also encourages people to destroy the images (protecting/healing the victims) and stops pedophiles from using them to show children that activity is “normal” (“grooming”) c. Hernandez study: only study to actually link child porn with child molestation; but very small and some skeptical of results (admitted more after program than before) d. New York v. Ferber (1982): can punish distribution; Osborne v. Ohio (1990): can punish possession; apply to images of actual children

2. Statutes: 1. 18 USC 2252: 4 offenses: (a)(1) knowingly transporting or shipping in interstate commerce; (2)(2) receiving or distributing or reproducing what has been sent in interstate commerce; (a)(3) selling or having possession to sell; (a)(4) mere possession a. jurisdictional hook for (3) & (4): possession occurring on federal property b. affirmative defense for (4): if only one or two pictures, can avoid liability by taking reasonable steps to destroy and/or reporting to law enforcement (so limited that basically not used) c. (1), (2), (3) = mandatory five-year minimum 2. 18 USC 2252A, 2256: passed in response to computer technologies; 2252(A) expands 2252 and 2256 provides the definitions and includes morphed images and virtual

3. US v. Mohrbacher (9th Cir 1999) (transporting v. receiving): downloading images of child porn from foreign bulletin board is receiving images under (a)(2), NOT transporting or shipping under (a)(1); although by clicking on the items he caused them to be sent to him, downloading an image is more like requesting someone to deliver it to you, so you are only receiving, not transporting; those who provide the images on the website and configure the website to send them out to others are the ones who are doing the transporting a. but note punishment is same for shippers & receivers Key holding: if you send or even make available an image, it’s an (a)(1) crime; if you receive, it’s an (a)(2) crime

4. US v. Kuchinski (possession): possession = knowledge and control, so when you knowingly download images, you possess them, but images stored in cache (browser stores just b/c you visited website) are not under possession unless the defendant is aware that this is how the cache works a. true even if person doesn’t want them in cache (bad policy) b. Romm (9th Cir 2006): evidence that defendant exercised control over images before deleting them/leaving them in cache, by enlarging, etc., is enough to show knowing possession M. VIRTUAL CHILD PORNOGRAPHY 1. Ashcroft v. Free Speech Coalition (2002): the CPPA, which extends federal prohibition against child pornography to images that appear to depict minors but were produced w/o using any real children is NOT directed at obscenity under Miller nor child porn under Ferber is overbroad and unconstitutional as an infringement on free speech; the speech records no crime and creates no victims; where speech is neither obscene nor the product of sexual abuse, it does NOT fall outside the protection of the 1st amendment. a. if technology advances to where it is impossible to enforce actual child porn laws (b/c virtual and real are so similar), then the gov’t may have a compelling interest in banning virtual b. Bach (8th Cir 2005): where real boy’s head is put on virtual image, there IS a violation because there is a victim c. X-Citement Video (1994): mens rea of 2252 requires that defendant knew images were of a minor; combine with Ashcroft and defendant must know that image is of an actual child 2. US v. Marchand (D NJ 2004)(knowledge): the gov’t must prove that (1) the image depicts a real child and (2) the defendant knew the image depicted real minors; defendant’s knowledge can be proven by direct or circumstantial evidence of actual knowledge or of willful blindness; here, the details of the images, the staple in one of them, the file name with age of child, the number of images and websites, the use of same child over and over again and the comparison of the images w/virtual images (difference in detail) show that gov’t met the heavy burden of showing that defendant either knew or was willfully blind to the fact that the defendant knew they were real children a. proving child is real is usually not hard for gov’t; proving defendant’s knowledge is harder

N. TRAVELER CASES & ONLINE ENTRAPMENT 1. Mann Act: focused on crossing state lines for the purpose of engaging in illegal sexual activities a. 18 USC 2422: prohibits using any facility or means of interstate commerce to entice a minor to engage in sexual activity b. 18 USC 2423: prohibits traveling in interstate commerce with the purpose of engaging in sexual activity with a minor or luring a minor to travel in interstate commerce to engage in sexual activity 2. cases are easy to prove and difficult to challenge; often result from undercover operations so biggest issue is the defense of entrapment a. entrapment = inducement + predisposition; inducement = pressure beyond the mere opportunity to commit the offense b. to prove cases, gov’t must show: must prove (1) traveling; (2) intent (usually show intent by bringing a gift, condoms, etc.) 3. US v. Poehlman (9th Cir 2000): under the principle of entrapment, gov’t agents cannot induce commission of a crime in order to prosecute, but, the fact that the government merely affords opportunity does not defeat prosecution; a person who sought out cross-dressers and repeatedly reiterated interest in woman’s children but was eventually persuaded by her to come engage in sex with her children WAS entrapped because there is no evidence that he had a predisposition to having sex with children; he repeatedly showed interest in the adult woman and only agreed to the children because she made it a condition of being with her. a. impossibility defense (because children don’t actually exist) is always rejected; see Thousand (Mich 2002) b. burden of proof: factual rather than legal and goes to the jury; on appeal, question becomes whether a rational jury could have agreed with the inference the jury made, construing all evidence in favor of the government SUBSTANTIVE CRIMES RECAP: child porn becomes by far the highest priority: bothers the public the most and is easy to investigate; because of anti-virus software, there aren’t a lot of virus cases anymore

SENTENCING COMPUTER CRIMES

I. FEDERAL SENTENCING GUIDELINES A. In General 1. two issues: (1) prison term/length; (2) conditions of supervised release 2. Katyal: computers make crimes easier to commit and harder for gov’t to catch; should punish use of computer because it’s like a co-conspirator; also need to offset lowered probability of successful enforcement by increasing magnitude of criminal sanction (basically, need more deterrence) a. counterarguments: (1) most people won’t know there are enhanced punishments (won’t be deterred); (2) from a retributive perspective, computer users are often less culpable (it seems less real to them) and cause less physical harm 3. trend is toward harsher sentencing for computer crimes a. federal guidelines enhance sentences for child pornography if it involves use of computer b. special skills enhancement: increases punishment (2 steps up) when special skill is used in commission of offense; applies broadly; refers to skills “not possessed by members of general public”; idea is an abuse of trust that makes one more culpable B. US v. Lee (9th Cir 2002) (special skills enhancements): defendant creates a phony site by copying files from the original, copies HTML and graphics as well as recreates directory structure and edits links; could have done it by using commercially available books and w/o knowing much about it, also made slightly more sophisticated GCI script; held that should NOT get special skills enhancement because it should NOT apply to people with computer skills unless they are particularly sophisticated 1. USSC examples of “special skills”: lawyer, doctor, pilot 2. Green: printing and photographic skills NOT special 3. Petersen: expert hacker IS special skills 4. Godman: using Adobe PageMaker is NOT special skill 5. test for special skill: (1) not possessed by general public; (2) usually requires substantial education, training or licensing 6. Young: knowledge of how to commit the crime is NOT enough; must abuse a special skill to make it easier C. APPLYING THE GUIDELINES 1. offense guideline: what crime is it (base offense level) a. 2G2.2 = child porn (18 or 22) b. 2B1.1 = computer misuse (much lower) 2. offense level: crime characteristics (adjust offense level) a. includes all relevant conduct, even if not charged, pled to or proved b. computer misuse: based on dollar amount of loss 3. upward or downward adjustments (specific to this crime: defendant, victim, and crime) a. includes special skills and downward departure for pleas (accepting responsibility) b. for child porn, number of images may be key 4. defendant’s criminal history category (based on past convictions) a. assume it’s I 5. sentencing range from table (P. 281) 6. consider non-guidelines sentence a. Booker (2005): guidelines not binding

D. Issues in Applying Guidelines 1. “heartland” concept: the idea that there is a heartland for a typical violation of a particular criminal offense, and only unusual cases fall outside the heartland (that’s when you deviate) 2. computer misuse crimes: key is dollar amount of loss a. loss = greater of actual loss or intended loss; so loss need not be reasonably foreseeable b. key is loss of victim, NOT gain to defendant (and they’re not always or even usually the same)

II. SUPERVISED RELEASE RESTRICTIONS A. In General 1. probation: in lieu of jail; supervised release: after jail 2. restrictions supervised by probation officer 3. conditions: (1) mandatory (required by federal law) (2) standard (used by judges in most cases) (3) special (specific to the crime/defendant) a. special conditions may include limits on computer use B. US v. Paul (5th Cir 2001): condition that a child sex offender not “have, possess or have access to computers or the Internet” is okay and not overbroad; it is (1) reasonably related to factors listed in 3538(d) (P. 291) and (2) no greater of a deprivation than necessary to achieve statutory goals; although computers may be indispensable in the modern world and can obviously be used for legitimate purposes, here the defendant used computers to advise others how to get access to children to abuse (harsh facts) and other courts have upheld internet and computer-use restrictions; this is reasonably related to the offense and the need to prevent recidivism and protect the public 1. Crandon (3d Cir 1999): restriction on internet access reasonably related to goal of deterring defendant from engaging in future criminal acts and protecting the public, since he used it to develop illicit relationships with minors (relied on here) 2. White (10th Cir 2001): absolute ban on computer use is per se an unacceptable condition (rejected here) 3. defendant here made no specific showing about how lack of computers would impact expressive activities and occupation; may be different if he did C. US v. Sofsky (2d Cir 2002): prohibition on using computer or internet w/o approval of probation officer is NOT an acceptable condition of supervised release for defendant guilty of receipt of child pornography; using a telephone to commit fraud would not justify prohibition on ever using phone; although it (1) IS reasonably related to purposes of sentencing, it is nonetheless (2) a greater deprivation of liberty than is reasonably necessary; 1. Balon (2d Cir 2004): because technology is the key to whether or not computer restriction is reasonable, restrictions should be reviewed at the time of supervised release, not the time of sentencing Paul v. Sofsky • Paul used internet to find children; Sofsky just downloaded (harm to public greater in case of Paul) • Sofsky is more likely outcome today

COMPUTER CRIME PROCEDURE

I. Intro A. Categories of Procedural Computer Crime Law 1. Fourth Amendment as applied to digital evidence searches 2. statutory privacy law: Wiretap Act, Pen Register Statute, SCA B. how investigations usually work: (1) trace communications back over the Internet; (2) recover and analyze computer used in offense 1. usually need direct evidence (no eyewitnesses) 2. use IP addresses: one assigned to every user connected to the internet

II. THE FOURTH AMENDMENT: Individual Computers A. Basic Framework: (1) has a search or seizure occurred; (2) is it reasonable: was it authorized by warrant or does an exception apply 1. usual remedy: suppression 2. what is a search: violating a person’s reasonable expectation of privacy (Katz); not necessarily a reasonable person; exceptions include plain view 3. what is a reasonable search: one conducted pursuant to search warrant OR exception: consent, exigent circumstances, border searches, inventory searches, private searches 4. what is a seizure: meaningful interference with an individual’s possessory interests in that property” Jacobsen 5. Container Cases a. often used as an analogy in computer cases b. opening a container = “searching” it; holding the container = “seizing” it

B. US v. Jarrett (4th Cir 2003) (requirement of gov’t action): when an anonymous hacker gives information to the gov’t that is used to initiate a search, no 4th amendment violations occurred because the gov’t did not know of, or participate in, the hacker’s search, so the hacker is not an agent of the gov’t; there is NO suppression remedy for illegal private searches unless the defendant can prove that an agency relationship exists btw hacker and gov’t; the gov’t must participate in or affirmatively encourage the search; gov’t has no obligation to discourage hacking 1. test (factors): (1) did gov’t know of and acquiesce in private search; (2) did private individual intend to assist law enforcement, or is there independent motivation 2. here, (1) the gov’t did not know of and acquiesce in the search enough to create an agency relationship, even though (2) the defendant DID intent to assist law enforcement 3. key is that the gov’t’s acquiescence and knowledge was entirely post-search 4. note that gov’t explicitly lets go 1030 crime on hacker’s part and that anonymous help for gov’t much more common in computer setting C. US v. David (D Nev 1991) (defining searches): defendant does NOT have a reasonable expectation of privacy when he opens and uses laptop in officer’s presence and officer sees the password; but he DOES have a reasonable interest of property in the contents of the laptop and thus an illegal search occurs when the officer opens the laptop and uses the password to access the information w/o defendant’s consent. 1. container analogy: a person ordinarily has a reasonable expectation of privacy in contents of opaque containers when they are in his possession 2. 4th amendment protects agents looking through your stuff, not at your stuff; government needs a warrant to look inside your computer, iPod, phone, etc., because it’s your stuff 3. Caymen (9th Cir 2005): no reasonable expectation of privacy in a laptop obtained by fraud 4. Arizona v. Hicks (1987): moving stereo equipment to expose serial numbers DOES constitute a search 5. US v. Karo (1984): putting a tracking device in a defendant’s drugs is NOT a search 6. Gorshkov (D Wa 2001): recording password while using US computer, not defendant’s own, is NOT a search 7. Illinois v. Caballes (2005): dog sniff is NOT a search; no legitimate interest in possessing contraband D. US v. Gorshkov (D Wa 2001) (defining seizures): copying data from a defendant’s computer by downloading file contents and copying them onto CD is NOT a seizure because it does not interfere with defendant’s possessory interest in the data; it remains accessible to him. 1. AZ v. Hicks (1987): recording serial numbers is NOT a seizure 2. data v. serial numbers: serial numbers are NOT property, but data files are (argument against relying on Hicks) 3. US v. Thomas (10th Cir 1980): photocopying is NOT a seizure 4. Bills v. Aseltine (6th Cir 1992): photographs NOT a seizure 5. copying process is some sort of search, but NOT seizure

E. EXCEPTIONS TO THE WARRANT REQUIREMENT 1. Exigent Circumstances: when immediately necessary to protect public safety or preserve evidence; general balancing of interests test; see Mincey v. AZ (1978) a. sometimes used in the case of electronic pagers that can only store a small number of numbers at a time, see US v. Romero-Garcia b. David: seizing laptop to stop defendant from deleting files IS reasonable under this exception, but subsequent search is not c. can’t go further than the exigency itself: can grab the computer to make sure suspect doesn’t delete it, but can’t read it because you thought the batteries were going to die (not realistic) 2. CONSENT EXCEPTION: (1) consent of suspect; (2) consent of third party with common authority a. scope of consent = what a typical person would imagine the exchange to implicitly say about what was allowed (objective test) b. Blas (pager case): consent to “look at” pager does not include consent to activate it and retrieve numbers from it; “look at”, under social understanding, means look at outside not go through the inside c. State v. Appleby (Del 2002) (third-party consent): when a husband and wife share a hard drive and both have files on it, and then they separate and wife refuses to give husband access to hard drive and then gives hard drive to police, the police have proper consent to look through the files because the wife and husband both controlled the hard drive until separation; after separation, she only had rights to her files, but the police found incriminating evidence while looking through her files, so search is OK. i. key test is common authority; she had common authority over the part of the hard drive where the evidence was found ii. virtual approach, not physical iii. Georgia v. Randolph (2006): wife’s search to consent home is invalid when husband is home and objects; wouldn’t be if he weren’t there iv. Trulock v. Freeh (4th Cir 2001): common authority over a computer does NOT extend to common authority over password-protected files d US v. Andrus (apparent authority doctrine, based on social understandings) police reasonably rely on consent of 91 year old father to search son’s computer even though the father did NOT have actual authority because it was reasonable for police to think he did: it was in his home, he paid the bill, it was in plain view; despite the fact that it was in son’s room and father didn’t go in room if door was locked; police used program that bypasses passwords so don’t know if there was one or not i. apparent authority doctrine: cops can rely on a person’s claim of authority, even if they don’t have actual authority, if it is reasonable under the circumstances to assume that the person would ii. dissent: focuses on what Andrus would have more logically been able to do with the computer or have access to on the computer: he would NOT have been able to access those files because they were locked (looks at virtual perspective, not physical perspective) 3. Searches Incident to Arrest/Inventory Exception a. Robinson (1973): pursuant to lawful arrest, police can conduct full search of arrested person and limited search of surrounding area w/o a warrant b. Reyes (SDNY 1996): search of pager permitted pursuant to lawful arrest; other devices undecided; more invasive searches less likely to be reasonable (key is small storage capacity of pagers) c. inventory searches: inventory seized items when (1) search serves a legitimate, non-investigatory purpose (i.e., safety); and (2) search follows standardized procedures i. unlikely to support search of seized computer files d. policy: this and other exceptions are much broader in computer context than physical world; eventually SC will have to decide if computers are more like virtual homes than containers 4. BORDER SEARCHES a. US v. Ickes (4th Cir 2005): searches at the border are reasonable by virtue of the fact that they occur at the border so search of van, including confiscation of computer and disks and warrantless search of computer & disks, is reasonable even w/o warrant; no 1st amendment exception for “expressive material”; old established exception based on US’s inherent authority as a sovereign to protect its territorial integrity i. here the other items in van cause suspicion to search the computer; but broad exception so may apply regardless b. US v. Roberts (SD Tex 2000): setting up customs inspection station at airport with the sole purpose of using border search exception to catch suspect with child porn is okay (border search exception works regardless of officer motive) c. US v. Ramsey (1977): opening international letter containing heroin OK under the border exception; mode of entry not critical i. so what about email: NSA probably collects all international emails, faxes, etc. but unclear whether or not it is constitutional d. allowed: taking apart gas tank, etc.; not allowed or may need suspicion: full body cavity searches, strip searches. i. District Court recently held that full computer search is more similar to a strip search and thus needs some suspicion (on appeal now in 9th Cir.) (Arnold) 5. GOVERNMENT WORKPLACE SEARCHES 1. private workplaces: 4th amendment protection is the same as for home computers except employer almost always has common authority to provide third-party consent to a search (US v. Ziegler, 9th Cir 2007) a. employee has reasonable expectation of privacy unless works in place open to public 2. government workplaces: employers ARE the gov’t; but they do not act in a law enforcement capacity 3. O’Connor v. Ortega (1987): (test) (1) reasonable expectation of privacy: (a) did he share his space or property and (b) did legitimate workplace policies put him on notice that he did not have regular 4th Amendment rights; (2) if there is a reasonable expectation, was the search reasonable: analyze under special needs exception to warrant requirement, which permits state actors to dispense w/warrant requirement when acting in non-law-enforcement capacity a. permits gov’t employers to conduct reasonable warrantless searches even if searches violate worker’s reasonable expectation of privacy b. must be for a work-related reason and justified at inception and limited in scope c. 1(b) is powerful: gov’t can contract out employee’s privacy rights

4. Leventhal v. Knapek (2d Cir 2001)(application of test): employee uses office computer to run his own private business; office has a broad theft policy that includes use of employer equipment and time and also a policy that you can’t load unrelated software; employer gets anonymous letter implicating employee for violating both these policies; (1) there IS a reasonable expectation of privacy because (a) he had a private office w/door ; did not share or open to public and (b) employer did not put him on notice or conduct routine searches but search is valid under (2) because the search was justified because there were reasonable grounds to suspect workplace-related misconduct. a. scope of search is appropriate if reasonably related to objectives and not excessively intrusive in light of the nature of the misconduct: not excessive here because they went through open door and limited search to viewing and printing file names b. most workplace searches will be okay because (1) if there is a policy, there’s no reasonable expectation of privacy (US v. Thorn) and (2) even if there’s not a policy, search only has to be reasonable i. employers have interest in not having criminal employees, so evidence of suspected crime is basically always reasonable: US v. Simons c. US v. Lifshitz (1987): special needs doctrine also applies to searches of individuals on probation

F. WARRANTS: PROBABLE CAUSE & PARTICULARITY 1. warrant = court order signed by judge that authorizes search & seizure a. must be issued on probable cause = usually written affidavit b. must particularly describe both place to be searched and property to be seized c. computer context = two searches instead of one because (1) search the residence and seize the physical property (computer) (normally that’s all that has to be done) and then (2) search the computer for evidence through computer forensics process 2. probable cause & particularity requirements a. Illinois v. Gates (1983): probable cause = fair probability that contraband or evidence of a crime will be found in a particular place b. Maryland v. Garrison (1987): purpose of particularity is to prevent general searches c. practical, common sense, totality of the circumstances 3. remedies a. US v. Leon (1984): defects in search warrants do NOT lead to suppression IF investigators had a reasonable good faith belief that the warrant satisfied the 4th amendment b. Malley v. Briggs (1986): in a civil suit, the good faith standard is the same: victim of a search pursuant to a defective warrant can only get relief if it would be clear to a reasonable officer that his conduct was unlawful in the situation he confronted 4. US v. Adjani (9th Cir 2006): officers have warrant to search defendant’s home for evidence of extortion; they seize and search not only his computer but his girlfriend’s computer and found and used incriminating evidence from her computer; government DID have probable cause to search gf’s computer: his email address was billed to her account; she was observed using the same kind of computer he used to send incriminating emails; the warrant allowed search of all instrumentalities that might contain communications, documents, etc.; the fact that she is not named as a co-conspirator does not matter; they had a right to search computers he had access to, regardless of ownership. a. has never been held that probable cause applies only to items owned or possessed by actual suspect b. not overbroad: warrants that describe generic categories of items are not invalid if no more specific description is possible; here, limiting search to evidence of a specific crime is enough; “as well as could reasonably be suspected given the nature of the crime and the evidence then possessed” c. in computer context: limiting to specific search terms or specific programs won’t cast wide enough net (files easily renamed, etc.) d. emails NOT outside scope of warrant: it does covers “communications with” and also evidence found while officers are rightfully searching does not need to be excluded simply because it supports charges of a related crime and not the crime in the warrant e. key to particularity in the computer context is in the second step not the first: they’re almost always going to (1) physically take computers from place; question is (2) what can the search for on the computers: if extortion, can’t look at images, only documents, etc. 5. US v. Riccardi (10th Cir 2005) (particularity): warrants for computer searches must limit search to evidence of specific crimes OR specific types of material; need to limit to either particular files or particular crime a. BUT Leon can still apply if officers acted in good faith 6. Davis v. Gracey (10th Cir 1997) (particularity): “equipment pertaining to the distribution or display of pornographic material” is sufficiently particular; references specific criminal activity 7. US v. Gourde (9th Cir 2006) (probable cause): membership for a paid subscription with “Lolitagurls.com” does create probable cause to execute warrants at homes of subscribers; sole basis of warrant is paid subscription to website and court says that is acceptable: membership manifested intent and desire to obtain illegal images; took intentional steps to become a member (not an accident) and membership never ended until FBI shut down site a. (1) site had illegal images; (2) defendant wanted access to images; (3) images were retrievable from his computer b. under totality of the circumstances and common sense, someone w/a paid subscription to website hosting illegal images is likely to have downloaded those images c. dissent: can’t assume that someone who likes someone possesses it when possession is against the law; too many secrets on computers to be liberal in search warrants d. but note: signing up for an account like AOL and then sending images is probably not enough (could sign up for AOL for many reasons) 8. US v. Lamb (NDNY 1996) (staleness): child pornography collectors may keep images for a long time; need evidence that person is a collector

G. EXECUTING WARRANTS (issue is how to minimize b/c there’s so much information) 1. US v. Scarfo (D NJ 2001): when officers have sufficiently specific warrant to enter office and look on computers for evidence of gambling & bookmaking, and they cannot get into an encrypted file, so they get warrants to install keystroke monitor device in order to get password to encrypted file, they do NOT violate 4th amendment just because the keystroke device captured a lot of unrelated info that they don’t need; during many lawful searches, agents come across items they don’t need or don’t know exact nature of incriminating evidence until they find it; it’s like looking through files in a cabinet: officers can look through innocent files to find incriminating ones a. “no tenet of 4th Amendment prohibits a search merely b/c it cannot be performed w/surgical precision” b. complexity of a scheme cannot be used as a shield to avoid detection c. “needle in the haystack” problem: court seems to give gov’t a lot of leeway to look through the haystack to get the needle; particularity requirement is not that burdensome and then all they have to do is be reasonable d. how to limit searches: by date, by file type, by file size: problem is there are easy ways to get around those e. search protocols: magistrate requires gov’t to state how they’re going to search and then to stick to those steps; but not common in recent years because searches are so unpredictable (but good approach to OK, otherwise searches are too broad) f. Schandl, Hill: most lower courts have held that investigators CAN take computers offsite to search them (may indeed be less intrusive than staying at suspect’s home to search) g. server searches: usually not necessary b/c ISPs normally willing to share voluntarily; but if needed, legal under Zurcher rationale 2. US v. Gray (1999) (plain view exception): under the plain view exception, officers can seize evidence unrelated to the justification for the search IF (1) incriminating nature is immediately apparent and (2) search was otherwise lawful; in this case child pornography found while executing unrelated warrant IS admissible and NOT suppressed; while opening all subdirectories as part of routine search about unauthorized computer intrusions, found “Tiny Teen” files; not sure the first time he sees them then finds another and shows to supervisor, then they get second warrant to look for more porn; when looking for files or documents, need to look in all b/c probably won’t be labeled “crime”, so he was entitled to search all files a. problem is impossible to know agent’s intent: when did he stop looking for evidence of hacking and start looking for porn; here the court focuses on subjective intent (says officer’s testimony is credible) but traditionally the standard is an objective one: Horton v. California i. some say subjective standard is more restrictive b/c with objective officers can keep searching w/bad intent so long as it’s objectively reasonable; but subjective is hard because hard to determine true intent b. Carey: evidence suppressed in similar situation but there the officer didn’t get a second warrant; court did not suppress first image found in “plain view” but those seized thereafter w/o warrant c. hackers can easily mislabel files, so can’t really go by the .jpg suffix or labels of files; here some text files were mixed w/pictures d. 5 possible approaches: (1) no rules, everything’s admissible; (2) search protocol; (3) objective standard; (4) subjective standard; (5) no plain view evidence admissible (OK likes this one: removes incentive for broad searches and neutralizes effect of broad searches that occur; incriminating nature of most digital evidence is NOT immediately apparent)

III. THE FOURTH AMENDMENT: Networked Environment A. In General 1. networked environment = collecting evidence from remote networks w/o approaching suspect 2. how the internet works: (1) user has account w/server (ISP) connected to network; (2) communications sent to or from the user are routed through user’s ISP; (3) communications are sent in “packets” and each packet has an IP header that explains what it is and a “payload” that is the actual communication; (4) receiving computer reassembles the packets a. emails also have “email headers” that explain what they are B. US v. Horowitz (1986): H worked for one company and privately consulted for another; he sold the second company confidential info that they used to undercut the first; he sent the confidential information to the company’s computer terminal and it was stored there, agents seize the info saved on magnetic storage devices at the company; held that the defendant did NOT have a reasonable expectation in either (1) the tapes (items seized) or (2) the company’s facility (place searched); factors looked at are (1) defendant’s interest in and control of area searched; (2) his subjective expectation of privacy in the area as evidenced by his efforts to ensure that privacy and (3) society’s willingness to recognize his expectation as reasonable. 1. the tapes were sold to the company and once sold, they had property rights: H no longer controlled them (property rights not determinative but conceptually relevant); his own access to the tapes was controlled by the company and they could restrict him from access 2. willfully sending info to someone else makes it their property 3. so: if you post something on Web where everyone can see it, NO expectation of privacy; if you encrypt something, there may be (but OK doesn’t think so: gov’t can reassemble shredded paper) 4. 2 bases for reasonable expectation of privacy: (1) relationship to data; (2) relationship to physical storage device

C Traditional Crim Pro Cases. 1. Katz v. US (1967): reasonable expectations of privacy test: the 4th amendment protects people, not areas and does NOT turn on the presence or absence of a physical intrusion; Harlan concur: (1) person has subjective expectation of privacy; (2) the expectation is one society is prepared to recognize as reasonable 2. Rakas v. Illinois (1978): expectation of privacy must be MORE than not wanting to be discovered; must have a source outside the 4th amendment, such as real or personal property law or societal expectations a. US v. Butler (D Me 2001) (computer context): student has no reasonable expectation of privacy in college computer lab’s computer b. Us v. Gines-Perez (D PR 2002): no subjective expectation of privacy of photo posted on the web, regardless of stage of website production or protective measures taken; the internet is clearly a public medium (society recognizes the opposite: society recognizes it as public, not private) 3. Kyllo v. US (2001): warrantless use of infrared camera to disclose facts like the temperature of the room IS a violation of reasonable expectation of privacy because the technology in question is not in general public use D. ANALOGIES 1. speech analogy: models computers as if they were people, and transmission of information is like people sharing info a. under this analogy, there is not a reasonable expectation of privacy: a person who reasonably, even if mistakenly, tells secrets to another loses interest in privacy b. Hoffa v. US (1966): person assumes the risk that those who listen to him, or even eavesdrop, will share the info c. US v. Longoria (1999): recording Spanish speaker’s words and translating into English does not violate privacy; speaking in foreign language doesn’t make it more secret (good analogy for encryption) d. State v. Moller (Ohio 2002): internet chats not secret because someone thinks he is speaking to 14 yr old girl but is really speaking to gov’t agent 2. letter or package analogy: treats sending info over computers like sending it through the mail a. under this analogy, there IS a reasonable expectation of privacy in the insides of the container but not the outside b. Ex Parte Jackson (1877): people are secure in their papers sealed and closed against inspection; construed broadly to apply to packages sent through post office, through private carriers, left with clerks, left with friends, etc. c. two limits: (1) expectation of privacy is eliminated when package reaches destination: search of home that uncovers letters sent to that address does not implicate rights of senders (King); (2) delivery to a person who has rights to access the documents may eliminate sender’s reasonable expectation of privacy (Miller: bank can reveal info sent by customers to police; depositor takes risk by revealing info to the bank) 3. telephone analogy a. Olmstead v. US (1928): wiretapping does NOT constitute a search (like speech, not letters) i. Brandeis dissent: application of Constitution must change with new technology (like letters, not speech) b. Berger v. New York (1967): invalidated NY state wiretapping law on 4th amendment grounds c. Katz v. US (1967): overturned Olmstead: wiretapping IS a 4th amendment search (see above) (telephone calls like letters: there IS a reasonable expectation of privacy) 4. Smith v. Maryland (1979): the use of a pen register that is installed on at the phone company and records the numbers dialed but not the actual calls IS NOT A SEARCH; no reasonable expectation of privacy in numbers dialed and police do not need a warrant to install pen registers; site of the call (home) is immaterial a. Katz test: (1) subjective expectation of privacy: all telephone users realize that they convey numbers to phone company when they dial and that company records it (doesn’t really apply subjective test); (2) is society prepared to accept it as reasonable (objective): Court has consistently held that person has NO reasonable expectation of privacy in information he voluntarily turns over to third parties (assumes the risk) b. compare to letter analogy: expectation in contents of letters but not addresses you put on the outside (this matches that) c. but in practice people don’t use the technology this way; don’t think that every time they dial they are sharing info w/phone company d. Marshall dissent: (1) assumption of risk implies that there is choice: people do not choose to give info to phone company, it is the only way they can use the technology; (2) majority allows gov’t to define scope of 4th Amendment, not actual subjective beliefs of individuals E. US v. Forrester (9th Cir 2007) (non-content info): police used computer surveillance that allowed them to learn (1) to/from addresses of emails; (2) IP addresses of websites visited and (3) total volume of info transmitted to and from his account; held that this surveillance IS analogous to pen registers and thus is NOT a search for 4th amendment purposes whether or not it is covered by pen register statute 1. devices used: “mirror port” used w/o warrant, imaging & keystroke monitoring DID have warrant (installed at ISP) 2. two lines of reasoning: (1) email and internet users, like telephone users, rely on third parties to send and receive information; (2) IP addresses and email to/from addresses are like addressing information on letters or numbers dialed on phones: they do not reveal contents; volume of mail is just like the size of package, it’s not private 3. limits holding to these techniques that do not reveal any content information 4. criticism: IP addresses do have some content b/c you can figure out the websites visited 5. gov’t always gets warrants for Trojan horses but not mirror ports 6. application: a search query is probably protected (content information) but a URL may or may not be (probably depends on length/specificity) F. Warshak v. US (6th Cir 2007) (content info): the privacy interest that email users have in content of emails IS similar to the interest they have in the contents of phone calls under Smith; the privacy interest is NOT diminished because the ISP can access the contents (the user does not expect it will do so: societal expectation that ISP will not do so as a matter of course); the sender assumes the risk of disclosure by the recipient, but not by the ISP; when user agreement puts user on notice that emails may be monitored, there may be no reasonable expectation of privacy; but where there is no notice, the ISP’s ability to access files does NOT overcome the expectation of privacy (see cases below); thus, individuals retain a reasonable expectation of privacy in the contents of emails sent or delivered through a commercial ISP; therefore, the gov’t needs a warrant (subpoena NOT good enough) unless it can show that the user waived right of privacy through agreement w/ISP 1. US v. Simons (4th Cir 2000): gov’t employee does NOT have reasonable expectation of privacy in files on office computer because he was specifically notified by employer that they would be monitoring (key is notification) 2. US v. Heckenkamp (9th Cir 2007): college student DOES have reasonable expectation of privacy in personal computer files even though he is connected to university network 3. the fact that an ISP can access emails does not destroy privacy interest unless they actually do so in the ordinary course 4. 3 possibilities when gov’t wants emails (holding): (1) must get warrant; (2) must provide notice to account holder and thus accord him judicial review w/opportunity to be heard (subpoena); (3) gov’t must show that ISP had access to emails and regularly accessed them, then can just compel from ISP w/o notice to user a. makes sense b/c focuses on control, like Horowitz 5. applies even if account is “abandoned” 6. all information stored on servers IS protected by 4th amendment under this case; may be even more expansive than in the physical realm; but if it’s open to the public, then it’s not covered by 4th amendment (webpage content that’s open)

G. US v. D’Andrea (D Mass 2007): pornography posted on password-protected website; password is given to social services by anonymous caller and they download images and give to police, who obtain a warrant; under Katz test (1) they DID have subjective expectation of privacy b/c of the password but under (2) society does not recognize interest as reasonable because non-state actors are not subject to 4th; expectation of privacy is destroyed when third party gets access; fits into assumption of risk exception despite the password protection because they shared the password with the anonymous caller 1. key: they gave out the password; if not, may have interest 2. holding: this IS a search but the private search exception applies (OK not persuaded b/c unclear who searched); upholds Warshak b/c there IS an interest in contents of protected sites H. US v. Hambrick (4th Cir 2000): internet users have no reasonable expectation of privacy in basic subscriber info (non-content) stored with ISPs 1. non-content info = billing address, phone numbers, etc.: knowingly revealed to ISP in course of business

IV. STATUTORY PRIVACY PROTECTIONS A. In General: Congress stepped in big-time b/c of haziness of 4th A; created a statutory version of the 4th Amendment for computer networks 1. 3 statutes: (1) Wiretap Act (2) Pen Register Statute (3) SCA 2. apply in early stages of investigations to trace criminal conduct back to its source 3. History a. Communications Act of 1934: 1st Wiretap Act for phones; Nardone v. US holds that suppression remedy applies for statutory violations b. late 1960s: new Wiretap Act addresses bugging and wiretapping comprehensively; adds heightened requirements for these known as “super warrants” c. 1986: newest Wiretap Act, addresses computers for the first time d. 2001: USA PATRIOT ACT

|2 Major Distinctions: |Prospective: in the course of transmission|Retrospective (stored communications |
| |(monitoring device) (repeated) |already sent) (one-time) |
|Content (substance of message) (more |Wiretap Act |Stored Communications Act |
|protection) | | |
|non-content (info used to deliver; info |Pen Register Statute |Stored Communications Act |
|generated by the network, not the user) | | |
|(less protection) (DRAS-dialing, routing, | | |
|addressing, signaling) | | |

REMEDIES: statutory privacy laws do NOT include a statutory suppression remedy • Violations of all three can lead to criminal liability • Violations of WA and SCA can lead to civil liability • Only statutory suppression remedy is for violations of the Wiretap Act involving interception of the human voice (for wire not electronic)(so usually NOT computer crimes) • no suppression remedy means few challenges are brought to the statutes and few opinions exist

B. THE WIRETAP ACT 1. structure: prohibits real-time interception of telephone calls and computer communications unless an exception applies (how most evidence is collected) OR investigators have a super warrant (gotten very rarely) 2. O’Brien v. O’Brien (FL 2005) (prospective v. retrsospective): wife uses spyware program to detect husband chatting with another woman; program records all chats, IMs, emails sent & received, and websites visited, husband files to prevent wife from disclosing; wife says they’re stored (retrospective); husband says they’re intercepted (prospective); court finds for husband and holds that because spyware intercepted the communications contemporaneously w/the transmission, they were intercepted (prospective.) a. but no suppression remedy: court does not have to suppress the evidence but because there are criminal sanctions, court says the trial court can exclude them because they were illegally obtained (don’t have to suppress, but can) b. WA begins when data is first transferred over interstate system, and ends when data reaches its destination and is no longer being transferred over an interstate system = VERY BROAD

C. EXCEPTIONS TO THE WIRETAP ACT 1. CONSENT EXCEPTION: permits a party to the communication to give prior consent a. can be either party, including an undercover agent (some states require 2-party consent) b. apply to non-gov’t AND gov’t actors 2. Griggs-Ryan v. Smith (1st Cir 1990): tenant at campground who uses his landlady’s phone and has been warned by her that she is recording all calls (for reasons unrelated to him) has impliedly consented to the surveillance and does not have cause of action against landlady when she turns his drug-related calls over to the police; he was given unqualified warning and he knowingly agreed to use the phone anyway so his consent, although not explicit, was manifest and in fact (not constructive) a. did not have to consent for that particular call; consented to monitoring of calls in general so did not have to be “aware” that she was monitoring that particular call b. computer context: consent exception can be very powerful under this case b/c notice implies consent: so reading a banner and continuing could be consent i. but deficient notice will defeat implied consent

3. PROVIDER EXCEPTION: particularly important in misuse cases, it allows electronic communications services to intercept and disclose communications while engaged in activity that is necessary to providing the service OR protecting property or rights a. recognizes that ISPs have legitimate business reasons to tap communications and gives them a limited right to do so b. basic standard is reasonableness c. both the interception AND the disclosure must be independently justified 4. US v. Auler (7th Cir 1976): telephone company attached detection device to customer’s phone b/c they believed he was using a “blue box” to fraudulently place long-distance calls and then gave info to FBI then installed more devices that actually recorded calls; held that provider exception is not unlimited and that actual recording goes over the line but that the initial device to detect the blue box and subsequent FBI monitoring were allowable under the exception a. company is limited to (1) determining if blue box is used (2) number dialed by the blue box (3) whether call was completed (4) duration of call (5) identity of caller b. in hacker cases in the computer context, may allow companies to trace back to the source 5. McClelland v. McGrath (D Ill 1998): officers investigating a kidnapping ask the phone company to intercept calls made on cloned cellular phone, so phone company is not really investigating theft but helping investigate kidnapping at police request; held that the provider exception does NOT apply and the WA was violated because the police cannot ask companies to help them just to make exception apply; company must be legitimately protecting business interests, not helping police a. must be private party acting alone, not at behest of gov’t

6. COMPUTER TRESPASSER EXCEPTION: narrowest exception specifically aimed at 1030 investigations and allows government to ask companies for help in these cases (not allowed in telephone context under McLelland) because hacker should not have protected privacy rights in unauthorized behavior a. how it works: (1) officer is already investigating and (2) reasonably believes intercepting communication will be relevant and (3) owner or operator of protected computer consents and (4) no extra communications other than those transmitted to or from trespasser (no add’l monitoring) b. enacted as part of PATRIOT Act: corrects the anomaly that a hacker’s undeserved privacy right trumps rights of victims c. pass-through computers: should construe these as NOT party to communications b/c otherwise no need for this exception (consent would cover it) d. computer trespasser is someone breaking a code-based restriction

D. THE PEN REGISTER STATUTE 1. In General: the WA for non-content information: because it’s non-content, it is weaker, has broader exceptions, and modest penalties a. the legislative response to Smith v. Maryland: didn’t want pen registers to be 4th amendment violation but wanted to regulate b. allows two types of devices i. pen registers: traces outgoing communications ii. trap & trace devices: traces incoming communications iii. for internet, becomes a pen/trap because the communications usually combine the to-from info c. practical impact: used A LOT by the gov’t but not a lot of cases b/c of the few remedies: no suppression remedy and no civil suit 2. DRAS v. content: the key question a. DRAS is clearly: non-content info used to route the communication such as packet headers, IP addresses, email headers minus subject line b. DRAS is also: basic website names (law.gwu.edu) c. questionable: more specific URLs, search queries (the more specific, the more likely it’s content) d. 2 approaches: (1) Kerr think that just because the non-content info may let you know what the content is doesn’t make it content; Solove disagrees: think that if you know from the outside of the envelope what it is (college rejection), then it’s content e. hacker commands ARE contents because otherwise there would be no need for computer trespasser exception 3. In re Application of the USA (D Fl 1994): an application for a pen register cannot be denied because of insufficient factual demonstration that it is likely to reveal relevant information; all that a pen register application requires is (1) identity of applying attorney and agency and (2) certification by the attorney that the information likely obtained is relevant to an ongoing investigation; identification and certification are the only requirements, and all the court has the power to do is to make sure those safety measures have been complied with; Congress intended only minimal safeguards and does NOT require probable cause or reasonable suspicion; all the pen register statute does is ensure that responsible persons are identified and responsible in case any misconduct occurs a. magistrate judge does NOT conduct independent inquiry into the facts b. the government does not need to explain the case and the magistrate has to sign the order c. in computer cases, the Justice Department still usually explains what is going on anyway but in the phone context there’s no explanation given 4. Exceptions to the Pen Register Statute a. provider exception: even broader (any provider interest will justify) and widely used in computer context b. consent exception: allows caller ID c. US v. Freeman (7th Cir 1975): exceptions to PRS should be construed broadly (at least as broad as WA); if monitoring is acceptable for content, it MUST be acceptable for non-content

E. STORED COMMUNICATIONS ACT 1. In General: regulates retrospective surveillance of telephone & internet communications a. regulates interactions btw gov’t investigators and sysadmins b. more limited in scope than WA or PRS: only regulates records btw legitimate customers and subscribers of two specific types of providers c. 2 functions: limits both (1) gov’t’s ability to compel providers to disclose AND (2) ISPs ability to voluntarily disclose to gov’t 2. what is regulated: only two categories and if neither applies, statute doesn’t apply, only 4th Amendment does a. electronic communication service or ECS: sending and receiving communications, such as email b. remote computing services or RCS: outsourcing computer tasks (storage & processing) 3. privacy protections (also see chart on 507)
(a)
Compelled Disclosure by Gov’t: § 2703
|Type of Communication |What Gov’t Must Do |
|ECS/content/less than 180 days old |Search warrant |
|ECS/content/greater than 180 days old |(1) warrant; (2) less process than a warrant with prior notice = |
| |either a subpoena or a d order |
|RCS/content |(1) warrant; (2) less process than a warrant with prior notice = |
| |either a subpoena or a d order |
|ECS/non content |(1) d order; (2) search warrant; (3) consent of customer or |
| |subscriber; (4) mere request if involves telemarketing fraud |
|RCS/non content |(1) d order; (2) search warrant; (3) consent of customer or |
| |subscriber; (4) mere request if involves telemarketing fraud |
|Basic subscriber information |subpoena |

(b)
Voluntary Disclosure by ISPs: § 2703: ONLY APPLY IF PROVIDE SERVICES TO THE PUBLIC • general rule: CANNOT disclose CONTENT info; can disclose NON-CONTENT to nongovernment entities, but NOT gov’t entities • exceptions that allow content disclosure: (1) in order to deliver; (2) if authorized by law; (3) if person whose rights are at state consents; (4) dangerous emergency; (5) if inadvertently discovered and relates to a crime; (6) needed to protect the provider from unauthorized use; (7) images of child pornography • nonpublic providers can disclose w/o restriction

4. In Re JetBlue (EDNY 2005): disclosing customer data does not violate SCA because JetBlue does NOT provide either ECS or RCS, so statute does not apply; just maintaining a website does not make RCS or ECS 5. opened emails: unopened emails are definitely ECS but open is unclear a. traditional understanding: Before email is opened, ISP is acting as a means of receiving communications (ECS); after it has been opened, the ISP is only a storage site (RCS) b. Theofel v. Farley-Jones (9th Cir 2004): emails are ECS regardless of whether they’ve been opened or not

6. US v. Kennedy (D Kan 2000) (compelled disclosure): government uses D order to request subscriber info even though could have just used a subpoena; D order app did NOT meet standard because it did not have “specific & articulable facts”; but NO suppression remedy anyway a. so know what you are looking for 1. basic subscriber info = subpoena 2. session logs & IP addresses = subpoena 3. other records = 2703(d) order 4. contents held by ECS = warrant if < 180 days; like RCS if > 180 days 5. contents held by RCS = subpoena w/notice or 2703(d) notice or warrant w/o notice 6. contents held by non-RCS or ECS = subpoena (by default)

7. notice requirement under § 2702 a. gov’t can get a court order allowing “delayed notice” for up to 90 days on a showing of good cause b. only applies to content from ECS or RCS and notice is to service provider, NOT to customer

8. 2703(f) Preservation Request a. allows gov’t to make request that provider keep the records already created pending further legal process b. important b/c most providers delete records in the ordinary course of business 9. Andersen Consulting v. UOP (D Ill 1998): company can disclose emails transmitted on its internal email system because the email system was not open to the public and thus does not fall under the act a. why not apply to private providers: generally they have legitimate interests in controlling use; in practice most users use their own (public) accounts for private use and use work email only for work

JURISDICTIONAL ISSUES

I. LIMITS ON FEDERAL AUTHORITY A. In General: Congress has almost limitless power to regulate computer crimes, and it does (even though criminal law is usually state law) 1. Issues: (1) constitutional limits; (2) statutory jurisdictional hooks; (3) procedural limits B. Constitutional Limits 1. most computer crime statutes enacted under commerce clause because interstate communications networks are both channels and instrumentalities of interstate commerce (US v. Hornaday) 2. broad reading of CC gives Congress broad power over networks but harder question is individual computers 3. US v. Jeronimo-Bautista (10th Cir 2005): Congress CAN make it a federal crime to create child pornography entirely in one state (doesn’t put it on internet) because the camera used was a “material mailed, shipped and transported in interstate commerce”; Congress made a rational determination that local activities constitute an essential part of interstate market for child porn that Congress has power to regulate a. Lopez/Morrison factors: (1) is activity commercial/economic in nature; (2) is statute’s reach limited by express jurisdictional element; (3) are there Congressional findings; (4) is there a link btw prohibited conduct and effect on interstate commerce b. Raich: Congress can regulate purely local production, possession and use of marijuana: aggregation theory c. here: there ARE findings on child porn as highly organized, multimillion dollar industry; jurisdictional element: items shipped in interstate commerce d. reasonable to believe that controlling local markets will have an effect on national markets (aggregation theory) and don’t need direct evidence, only a rational basis e. key is that under Raich, they don’t even need the jurisdictional hook that the camera was sold in interstate commerce; under the aggregate effects theory, Congress can regulate any computer crime under the Constitution so the only limits are statutory

C. Statutory Limits 1. US v. Kammersell (10th Cir 1999): a person CAN be charged with a federal crime for transmitting a threat in interstate commerce when he emails from his terminal in a state to another computer in the same state BUT the computer service, AOL, automatically routes all email through its server in another state before sending to recipient; the fact that K did not intend it to go outside the state doesn’t matter; it still did a. so basically any internet message is part of interstate commerce b. the fact that only the recipient could view the message (IM) is immaterial; threat does not need to be seen by anyone outside the state c. this case + Jeronimo-Bautista gives Congress basically plenary power over computer crime d. knowledge of interstate knowledge on part of sender is NOT required 2. US v. Henriques (5th Cir 2000): pornography statute requires that government prove that at least three (now one) images traveled in interstate commerce; the fact that H accessed the internet and that his computer contained pornography is NOT enough, need to show the images traveled in interstate commerce; images could have come from a disk or another hard drive and not from the internet; how to establish: (1) witness testimony that H viewed an image on the internet; (2) web address on the image may establish; H cannot be convicted b/c three not linked a. idea is that federal jurisdiction is so vast that there need to be some requirements of proof b. now that law has been changed to one image, not hard to prove b/c there are usually many to choose from c. US v. Runyan (5th Cir 2002): circumstantial evidence linking image to internet, such as website address, can be sufficient evidence d. US v. Carroll (1st Cir 1997): telling someone else about plans to distribute on the internet may be sufficient evidence e. US v. MacEwan (3d Cir 2006): the fact that images were received on internet connection is sufficient (split in circuits, go with Henriques)

II. LIMITS ON STATE AUTHORITY A. In General: state officials face considerable substantive & procedural barriers to investigating & prosecuting computer crime 1. dormant commerce clause: states can’t do anti-competitive things; can’t regulate conduct outside of their state or regulate too much commerce relative to intrastate benefit 2. state actors have to follow both state & federal law; court orders from states are only enforceable in the state B. American Library Association v. Pataki (SDNY 1997) (constitutional limits): NY statute regulating pornography on the internet violates the dormant commerce clause because (1) unconstitutional projection of NY law on conduct that occurs wholly outside NY; (2) burdens on interstate commerce outweigh state’s legitimate interest in protecting children from indecent material (Pike balancing test); (3) internet is an area of commerce that must be marked off as a national preserve: CC ordains that only Congress can regulate this area; Act is invalid because by its terms it applies to any intrastate or interstate communication and there is no way to limit the Act to purely intrastate communication b/c of the nature of the internet; witnesses testified to the chill on communication in other states because of the NY act 1. note: : in online solicitation statute context, state statutes are okay because all states have them and soliciting children for online sex is not legitimate “commerce” so it’s okay to interrupt it C. Procedural Limits 1. In General: state actors are bound by (1) 4th amendment and federal privacy laws; (2) federal privacy laws that expressly regulate the states; (3) state statutory laws that can extend beyond federal laws; (4) limits on ability of state subpoena and search warrant authorities to demand evidence out-of-state a. also: state constitutions can go beyond 4th amendment 2. Commonwealth v. Beauford (Pa 1984): state constitutions are an independent source of supplemental rights and a state CAN give more privacy protection (although not less) than the federal Constitution; so, the Supreme Court of Pennsylvania can construe its state privacy provision more broadly and require warrants w/probable cause before allowing pen registers, contrary to federal rule of Smith v. Maryland; PA gives stronger protection to privacy interest in a telephone call; this is true even though the state statute, like the federal WA, does not require a warrant a. PA is one of eleven states that reject Smith as a matter of state constitutional law D. State v. Signore (Conn 2001) (collecting evidence between states): the SCA authorizes CT police to fax a warrant to AOL headquarters in VA to get evidence; the fact that the evidence is gathered outside officer’s jurisdiction does not mean it is suppressed 1. can allow it, but does not mean they can compel 2. one way to do it: have local officials open their own investigation (comity) 3. some states have passed laws requiring ISPs in the state to comply w/out-of-state legal process

III. INTERNATIONAL COMPUTER CRIMES A. US v. Ivanov (D Conn 2001) (US substantive law): defendant who was physically located in Russia when offenses were committed CAN be charged under US law when the victim is in CT; extortionate emails were sent from Russia, through ISP in Washington, to CT; there is subject matter jurisdiction because (1) intended and actual effects occurred in US and (2) statutes charged under were intended by Congress to apply extraterritorially 1. under (1) (effects test): he accessed computers in CT and was able to control them and obtained info from them 2. under (2): although it is ordinarily assumed that Congress acts w/in its own borders, the plain language of § 1030 says interstate or foreign commerce 3. so, § 1030 applies around the globe B. US Procedural Law 1. Statutes: only apply to US evidence collection 2. 4th amendment: DOES apply outside the US (?) C. US v. Barona (9th Cir 1995): wiretaps on calls made in foreign countries used to convict defendants on drug charges; 4th amendment does NOT apply to the acts of foreign officials unless (1) circumstances of foreign search shock the conscience or (2) US officials are so involved that the action is a joint venture; if the action is a joint venture, then (1) was foreign law complied with and (2) if not, did US agents rely in good faith on foreign agents that their law was complied with 1. applied in this case for first search: (1) this IS a joint venture; (2) foreign law WAS followed; for second search: (1) NO joint venture, hence 4th amendment does NOT apply 2. US v. Verdugo-Urquidez (1990): (1) does 4th apply: 4th amendment only applies to US citizens or significant contacts to US; (2) who did the search: if it does apply, then (a) foreign gov’t: 4th does NOT apply, search is good unless it shocks the conscience; (b) joint: 4th amendment reasonableness in the context of the foreign law: was it applied correctly and if not was there good faith; (c) US exclusively: rare, but if so 4th amendment applies, but unclear how

| |US Gov’t |Joint Investigation |Foreign Investigation |
|US Citizen |Full 4th amendment |(1) foreign law |Shocks the conscience |
| | |followed; (2) if not,| |
| | |was it relied on in | |
| | |good faith | |
|Non-US Citizen |None under Verdugo |None |None |

IV. MUTUAL LEGAL ASSISTANCE & TREATIES: general notion is reciprocity and more common in computer crime than in other crimes A. Letters Rogatory 1. one of the most often used processes to get evidence 2. = judicial procedures whereby one country requests judicial assistance from another 3. how it works when other countries request: (1) one tribunal or person initiates letter; (2) US District Court can grant or refuse order and/or impose conditions; (3) if it grants assistance, USDC appoints commissioner to supervise 4. how it works when we request: state court asks State Dept for help 5. letters rogatory are INFERIOR to MLAT: cannot be used prior to grand jury stage and result in substantial delays; also are discretionary and not mandatory 6. customary method (default) but can take a year or more B. Mutual Legal Assistance Treaties (MLATs) 1. more effective & efficient than letters rogatory 2. = criminal cooperation treaties 3. make assistance mandatory as a matter of international law 4. until now only bilateral; but can be multilateral 5. these are for evidence; there are also extradition treaties for people C. Treaties 1. 24-hour points of contact treaty: each country agrees to have computer crime prosecutor and agents available 24 hours a day 2. COE Cybercrime Convention: basically codifies US law D. US v. Vilar (SDNY 2007): court will NOT suppress a search conducted in the UK pursuant to an MLAT and two UK search warrants; 4th amendment does NOT apply to extraterritorial searches and so the fact that the search complied with British law is enough; search would only violate 4th if it “shocks the conscience” and here it clearly does not (there was a lot of process); a foreign search is reasonable so long as it meets the requirements of the law in the nation where the search is executed, so long as it does not shock the conscience; even if the search did not comport w/British law, it would be okay if the US officers relied in good faith on the representations of the British that it did (Leon)

V. NATIONAL SECURITY AND THE FOREIGN INTELLIGENCE SURVEILLANCE ACT A. Foreign Intelligence Security Act (FISA) 1. goal is to get the information and protect country 2. need to follow rules but different standards than the criminal setting 3. White concurring in Katz: we should not require warrant for executive authorized wiretapping in the national security interest 4. FISA = direct regulation of executive branch intelligence activities 5. requires executive branch to apply for and obtain court orders in order to conduct foreign surveillance: domestic surveillance follows regular criminal law 6. parts of FISA a. FISA Wiretap Act: defines contents more broadly than WA; wire communication does NOT mean human voice b. FISA Pen Register Statute: same as regular c. FISA SCA B. United States v. United States District Court (1972): AG approved wiretaps to thwart domestic terrorism w/o warrant procedure; executive action is excepted from the Wiretap Act, BUT that only means Congress “left the executive powers where they found them” and so look at Constitutional powers of the president: the executive action is subject to the 4th amendment and in this case a warrant procedure was required; prior judicial approval is required for domestic security surveillance (no opinion on foreign surveillance) 1. there is NOT inherent Article II power to wiretap in national security interest and although WA does not apply, as a policy call, better to have a warrant 2. What does it need to be: needs to be approved by a judge, but probable cause doesn’t need to be probable cause of a crime, just probable cause that the person poses a national security risk
Possibilities
1. monitoring from US of agent in US: FISA 2. monitoring from US of agent abroad: lower courts have found that there is no warrant requirement (?) 3. monitoring from abroad of agent abroad: if no voluntary contacts to US, no 4th amendment rights at all under Verdugo 4. monitoring from abroad of agent in US