Electronic Data Records Law | How to Win E-Discovery

Digital Right To Be Forgotten

Privacy or Spoliation?

A movement is afoot in the European Union to grant individuals an online “right to be forgotten.”  
The general idea is that a person would have the right to force a service provider to delete  data the provider possesses about the person.  That right would promote privacy. 

Yet the right to be forgotten clashes with another emerging expectation in modern law, that is, the expectation that organizations will maintain extensive records about their activities.  Broadly speaking, law in the digital age has become increasingly suspicious of early destruction of records. See UK case, record retention trends and civil law jurisdictions.

The ability of computers to create and preserve prodigious quantities of records has fueled a sense that organizations should keep records so they can be held accountable to society.

Law expects organizations to retain records for many purposes:  consumer protection, collection of taxes, investigation of fraud, resolution of civil disputes and innumerable other purposes.  If an organization deletes records too early, law will punish the organization under doctrines like spoliation and obstruction of justice.

So . . . when an organization evaluates whether to delete a person's data for privacy purposes, it also must weigh whether the data is a record that must be preserved under some other principle of law.

[Update November 2011]  A US court ruled that putative privacy interests under European law do not justify the destruction of emails needed for litigation in the US.  In IO Group Inc., et al. v. GLBT Ltd., et al., U.S. District Court for the Northern District of California punished a website owner for intentionally destroying emails relevant to copyright litigation.  The website owner argued that U.K. Data Protection Act 1998 required destruction of the emails because they contained personally identifiable information that was no longer needed for business.  The court  dismissed the argument and held that the website owner had engaged in spoliation.  E-Commerce Law Week; Issue 683, Week Ending November 19, 2011.

--Benjamin Wright

Augmented Reality Property Protection

Augmented reality apps enable the user of a mobile device to see data and symbols laid over the image displayed in real time from the device’s camera.  

Data Over Famous Images

For example, while standing outside a famous commercial building like Caesars Palace in Las Vegas, the user could point the camera on her Android smartphone at the building. The phone could display a live video image of the building.

As that image is displayed, an augmented reality app could use
geolocation and image recognition technology to discern that the video shows an image of the famous building.

With the knowledge that CP is being displayed, the app might cause to be displayed on top of the image additional information, such as an advertisement that says, “Thinking of staying at Caesars Palace? We’ll give you a better deal down the street.” Or (hypothetically speaking) the app might display remarks from other users about Caesars Palace, like “CP is a dump!”

What legal steps might the owner of Caesars Palace take to prevent apps from displaying undesirable statements over the building’s image or to the side of the building’s image?

Trademark and Copyright

The owners of famous commercial properties sometimes claim trademark or copyright protection for the appearances of their properties. Caesars Palace might assert that the maker of the app infringes its trademark or copyright.

The mixed reality app maker, however, might counter that its app makes no more than fair and nominative use of the trademark or copyright.  


Publication of Travel Guide

The owner of a business might have a claim against the publisher of an app for defamation or commercial disparagement. The law protects a business like CP from the publication of a false statement that injures the business.

The app maker, however, might argue it is subject to the same rules and privileges as the publisher of an online travel guide that includes ads and user comments. Today a user at an online travel guide can search the words “caesars palace” and pull up reviews of Caesars Palace, as well as ads from CP’s competitors.

Yes, the publisher of an online travel guide can be liable for knowing publication of a false statement that damages a business. But free speech and other protections afford the publisher considerable leeway to publish opinions about a business.


End User License Agreement for Real Property?

Allow me to speculate. The owner of a property like Caesars Palace might try to form a contract with anyone who captures a smartphone image of the building. The contract might be like an end user license agreement (EULA).  It might say, for instance, that the image is copyrighted/trademarked and the user agrees not to use the image with a non-approved app.

Further, to add incentive and consideration to the contract, the EULA might say that the user who complies with the EULA will be afforded all of the privileges (such as CP perks and discounts) available through the use of augmented reality apps that CP has approved.

To enforce this EULA against each individual user would be difficult for CP. However, CP might try to take action against non-approved app makers. CP might assert that app makers who induce users to use non-approved apps are wrongfully:

* interfering with the contractual relationship between CP and the users; and

* committing the tort of inducing someone to violate the intellectual property of another.

CP’s owner might publish notices of the EULA as terms posted on the premises around the building. The terms might be posted as full sentences, or as references to a web address (Example: “Capturing images of the CP facilities is subject to terms published at www.caesarspalace.com/IPterms.”), or as a QR code. 


Municipal Ordinance?

A local government like the City of Las Vegas might adopt an ordinance to regulate the presentation of data over live images of territory and buildings within the city. The justification for the ordinance might be to preserve the beauty and decorum of the city scape, just as zoning laws do. That justification may not be compelling enough under the US Constitution to support restraining the rights of users and app makers to freedom of speech.

–Benjamin Wright

Mr. Wright teaches the law of data security and investigations at the SANS Institute.

Google+

Is OWADE Illegal?

Forensics Investigation as Computer Crime?

OWADE (Offline Windows Analysis and Data Extraction) is an open source forensics tool for extracting “hidden” data from the hard drive of a Windows PC.  According to New Scientist, OWADE enables an investigator to “bypass” the encryption Windows uses to store data on the hard drive so the investigator can discover web browsing history, including user IDs and passwords.  New Scientist, “New forensics tool can expose all your online activity,” Sept. 7, 2011.

I wonder whether OWADE violates the Windows EULA or other legal restrictions  Microsoft asserts with respect to Windows.   
 For example, paragraph 8 of the End User License Agreement for Windows 7 Professional says the user may not “work around any technical limitations in the [Windows] software.”

What is the implication of an investigator violating the Windows EULA when he gathers data?  Is the investigator committing a computer crime?  Is he accessing a computer without authority and causing harm (paraphrase for violating the Computer Fraud and Abuse Act)?  

Is he infringing privacy law?  

Is he opening himself to a lawsuit from any person who is harmed?  

Is he rendering the data he collects inadmissible as evidence in court?

What do you think?

[Update: I wonder whether use of OWADE would violate the Digital Millennium Copyright Act (DMCA). 17 USC Sec. 1201 (a)(1) (A): “No person shall circumvent a technological measure that effectively controls access to a work protected under this title.” The argument might be this: 1. The Windows user used Windows to make records of his “work” (i.e. codes showing his browsing activity and history). 2. He used the encryption in Windows to control access to his “work.” 3. OWADE circumvents the encryption.  

DMCA is complex. I note that DMCA contains many exceptions, including certain exceptions for law enforcement.]

–Benjamin Wright

Mr. Wright teaches the law of data security and investigations at the SANS Institute.

Cloud Computing Police Raid

Seizure of Servers; Co-mingled Data

What happens when police seize servers belonging to a cloud computing service provider?

Spring 2009, a federal district court granted the FBI a search warrant to seize control of computer servers and related equipment in facilities run by Core IP Networks.  Apparently Core leased its facilities to the owners of servers, including a cloud computing service provider named Liquid Motors. Liquid Motors was not accused of wrongdoing, but the FBI had information suggesting that a criminal enterprise (including apparently Core) had used LM’s servers or some of the data stored in them.

LM helps large, national auto dealers manage their inventory and Internet marketing.  The seizure shut LM down, and debilitated the operations of its innocent customers.  The data of all LM users and customers were co-mingled in a cloud-computing style.

Request Relief from Court

LM promptly requested that the court cause the FBI to release the servers.  It claimed that it and its innocent customers were suffering great economic hard. 

The court denied the request. The court was satisfied that the FBI had adequate justification to hold the servers.

Court Appearance Gives FBI Sense of Urgency

However, the court hearing put FBI under the spotlight.  FBI did not want to appear unreasonable in court.  Recognizing the economic impact of its action, the FBI said it was working urgently (over a weekend) to copy data from the hard drives of the servers, with a view to returning the servers to LM as quickly as possible. Liquid Motors, Inc. v. Lynd, No. 3:09-cv-0611-N (N.D. Tex. April 3, 2009).

As cloud computing becomes more common, I suspect courts will come to expect police like FBI to refine their methods so that targeted data can be secured without damaging all the innocent people whose data and services are coincidently housed with it. Refined methods might include, for example, allowing servers to continue functioning normally while target records are copied.

Backup Data

The customers of cloud services face more than just the risk that police will confiscate a provider's servers. The provider may go into bankruptcy or suffer sabotage at the hands of a disgruntled employee. To address these risks, customers might spread or duplicate their data and services across multiple service providers, located in multiple jurisdictions. 

–Benjamin Wright, Legal Issues Instructor at the SANS Institute

Update:  The risk that police raids will damage innocent cloud customers needs to be seen in context.  Similar risk applies in many sectors of the economy.  It is not uncommon that the seizure of assets by police affects innocent bystanders.  For example, FBI confiscated $392,000 of cash belonging to an innocent New York check-cashing company when it seized assets from an armored car company under investigation.  John Emshwiller and Gary Fields, "Federal Asset Seizures Rise, Netting Innocent with Guilty," Wall Street Journal, August 22, 2011.

New Ideas: Post banner to promote confidentiality at data center.

Related:  Opinion regarding Megaupload Takedown and

Theories of Relief for Legitimate Megaupload Users

Botched Cyber Investigations | Evidence Preservation

I am looking for cases and stories about digital evidence that had been collected but could not be used or authenticated (or at least became open to question) on account of problems like these:

1.  Investigator could not vouch for the evidence due to the investigator's death, retirement, refusal to cooperate or termination of employment.

2.  Investigator committed some kind of error related to his/her securing of the evidence with a digital hash, key or signature.  Example: investigator used a private crypto key to "sign" a digital evidence file, but the private key was compromised either before or after its use and therefore the trustworthiness of the evidence diminished.

Have you seen any cases like this?  Are any such cases documented?

The reason I am interested is that I've been experimenting with webcam "signed affidavits" by investigators.  http://legal-beagle.typepad.com/wrights_legal_beagle/2011/04/credible.html

Many thanks

--Ben

Benjamin Wright
Attorney
SANS Institute Instructor: Law of Data Security & Investigations
https://profiles.google.com/benwright214/about