Deleting your browser history could land you in prison
kernelmag.dailydot.com
kernelmag.dailydot.com
> prosecutors argued that he made a conscious choice to destroy materials he knew could be used in a future investigation.
See, that's the point here. If he had happened to have (say) VHS tapes or even handwritten notes of those sessions, and he had thrown them out after the bombing, he could have been slapped with the same charges. The primary difference here is that emptying your browser history leaves a telltale sign, while chucking out some physical object does not.
Also, this article is conveniently omitting the fact that he also pled guilty to three counts of essentially lying to the FBI: http://www.thedailybeast.com/articles/2015/03/26/the-fbi-is-...
Remember kids, don't talk to police. Ever. https://www.youtube.com/watch?v=6wXkI4t7nuc
That said, I think using the "mens rea" argument associated with implicit guilt is how dangerous precedents are born.
I'm specifically concerned with this excerpt from from Sarbanes-Oxley act which is being misappropriated by prosecutors:
>Whoever knowingly alters, destroys, mutilates, conceals, covers up, falsifies, or makes a false entry in any record, document, or tangible object with the intent to impede, obstruct, or influence the investigation or proper administration of any matter within the jurisdiction of any department or agency of the United States or any case filed under title 11, or in relation to or contemplation of any such matter or case, shall be fined under this title, imprisoned not more than 20 years, or both.
Deleting videos and attempting to reformat a computer after the Boston marathon are done knowingly. Clearing one's cache/browser history is in many situations an automatic action, and it's troubling to find it lumped in with pre-meditated action.
I see justification for 3 counts of obstruction, not 4. The 4th looks like an attempt to set the modus operandi of the courts in dealing with our web/online history, and I don't think anything which draws attention to that is necessarily a bad thing...
Article says "he doctored his browser history" which sounds less automatic.
Or the writer could have been trying to introduce verbal variety and as a consequence ineptly misrepresented what happened. The link[1] immediately after "doctored his browser history" only mentions "deleting files/data" and "reformatting":
[1] https://www.bostonglobe.com/metro/2014/05/30/timeline-allege...
SOURCE: http://www.justice.gov/sites/default/files/usao-ma/legacy/20...
It states (item 40), paraphrased, that he deleted his internet cache and also browsing history selectively, which was used to reason that he was attempting to hide his philosophical similarities with the brothers.
I take issue with item 43:
----
By deleting his Internet cache and other files, MATANOV obstructed the FBI’s determination of his Internet activity during the night of April 18 and the day of April 19, 2013, and the extent to which he shared the suspected bombers’ philosophical justification for violence, among other topics of interest. MATANOV’s deletions have thus obstructed the FBI’s investigation of the bombings and the suspected bombers, and have caused the FBI to expend considerable additional resources during its investigation of the bombings and the suspected bombers.
----
This man is clearly guilty, and the other evidence is damning. That said I cannot ever see validity in the argument that clearing history of access to publicly-accessible records online definitively indicates obstruction, or "malicious intent." Localized browsing history should be considered more ephemeral than user-stored files, because otherwise where is the line drawn? Could you be charged in 2018 for not leaving your computer in a cold enough climate for encryption keys to be recoverable from RAM? Possibly, because without those you'd cause the FBI to "expend considerable additional resources during its investigation."
I say this because the application of that reasoning doesn't discriminate between individuals actually trying to defraud (e.g., this gentleman) and those who are privacy conscious. It has chilling and unintended consequences, and those shouldn't be ignored when the case can absolutely be made without this assertion.
But it does. If you're legitimately purging your browser history because you're privacy conscious, you're almost certainly going to have it performed in some sort of automated fashion. Maybe you have the browser purge those things on shutdown. Or you have an extension that nukes things older than 24h. Or, worst case, hopefully you have some way of demonstrating that you do this on the regular, by hand (but that still might not cover you, truth be told).
Doing it one-off is a completely different matter, legally speaking.
See my reply elsewhere in this subthread for an analogous situation involving company financial records. [1] Nutshell: if you don't want to be prosecuted for obstruction of justice or destroying evidence, you have a standing, documented, and meticulously followed document retention policy, under which you're shredding things on the regular.
There is unambiguous, and well-settled precedent (and probably also statute, but I'm too lazy to look it up) to this effect. There is no new legal ground being broken here whatsoever.
They were looking to create a case for philosophical sympathies and they found evidence of that in both his statements and direct actions. That would be enough to charge him, and yet they've chosen to specifically juxtapose his internet browsing history (and deletion thereof) with "[causing] the FBI to expend considerable additional resources during its investigation." As you said they either recovered the files directly, or else subpoenaed the ISP, and neither could be said to take "considerable effort."
They're saying that because he viewed certain videos and pictures (publicly available) online, he must be a sympathizer. I'm saying, yes he's a sympathizer (and deserves prosecution) but his browsing history online should not be a legally valid justification. Unless you want to sweep up journalists & whistleblowers in the process... Even copyright defendants (thanks to the TPP), if the hypothetical owner of defecatingdwarves.us were to demand criminal charges be brought against a cyberlocker illegally streaming their videos, and you just happened to delete the history entry from your recent visit which the plaintiff decided to treat as "evidence."
This case isn't creating a precedent, but it's the first time I have seen federal prosecutors use this rationale and it's concerning. I personally don't think deleting your browsing history alone--even selectively--warrants a potential 20yr federal sentence.
Also, nobody under investigation has to implicate itself?
If you play postal, and one of the guys you have smoke breaks with runs amok - deleting that game from a "new philosophical viewpoint" makes you guilty?
The problem is, that law tryies to mindread here in the end. Which they can not. There is a diffrent between rhetoric and action.
That makes the action (assuming it was done with intent to destroy the evidence, and not merely an automatic, "quitting the browser purges its history" type thing) illegal.
Consider the analogous situation of two companies, both engaged in illegal activities:
Company A has a standing, published document retention policy that says that all financial records must be destroyed after 30 days.
Company B has someone sneaking in at night to shred the records of their profits from selling meth to schoolchildren.
The Feds have copies of both of their records, because they have someone on the inside copying them and turning them over.
One company's relevant employees are going to face one set of charges. The other's are going to face two. Can you guess which is which?
Taking out the trash is in many situations an automatic action, but if you do it to hide evidence, it's obstruction of justice and it's a crime.
I don't find it troubling at all just because it's a new technology. When researching something in pre-internet days, I'd often write things down. Book titles, periodical dates and pages, microfilm request forms, key quotes. That my browser does that sort of thing automatically is different, but not all that different.
If anybody doesn't like that, they can turn it off right now with one checkbox. But clearing the cache because you want to destroy evidence is no different than, as in War Games, quickly taking the trash can out to the curb.
Which is to say: deleting your browser history as part of an effort to thwart a criminal investigation could land you in prison.
Deleting your browser history if they government says that you thought it might one day be relevant in an investigation can land you in prison.
For example: You're downloading run of the mill adult-on-adult pornography and one of the links that you click redirects you to a child porn site, you weren't looking for child porn and you didn't want any but you inadvertently browsed to a site that hosts it, so you delete all of your cache because you don't want that on your computer. Well, if that site was a honeypot and when the authorities come investigating, they'll use your cleared cache as proof that you knew you were doing something illegal and prosecute you for it despite the fact that you didn't intentionally break the law.
(d) Affirmative Defense.— It shall be an affirmative defense to a charge of
violating subsection (a)(5) that the defendant—
(1) possessed less than three images of child pornography;
and
(2) promptly and in good faith, and without retaining or allowing any person,
other than a law enforcement agency, to access any image or copy thereof—
(A) took reasonable steps to destroy each such image;
or
(B) reported the matter to a law enforcement agency
and afforded that agency access to each such image.
The Internet Watch foundation is one site. There are probably others for different countries. https://www.iwf.org.uk/
The IWF has just announced a collaboration with Google, Facebook, Twitter: http://www.bbc.co.uk/news/uk-33844124
I called the local FBI office and reported the site. I never heard anything else on the matter. To be honest, I was more worried that it was a honeypot and I wanted to make sure that if they were watching, they knew that I didn't go there on purpose.
The man in this story wasn't otherwise implicated in the terrorist plot but they got him for deleting his internet cache because he was afraid of how it would look.
And nobody can say absolutely for sure whether a murderer had the mens rea to charge him with first degree.
This issue is that they now have the tools to charge you with obstructing an investigation that hadn't even begun yet, when you took the action.
We all understand how this scenario is obstruction:
1. -Investigation Begins-
2. Police:We would like to see #source_of_potential_evidence.
3. Person:Sure thing. -deletes #source_of_potential_evidence-. Oh, sorry guys, I don't have that.
This is what happened:
1. Person:Oh, this doesn't look good. I don't think I want to keep this on my computer. -deletes #source_of_potential_evidence-
2. -Investigation Begins-
3. Police:We would like to see #source_of_potential_evidence.
4. Person:Sorry guys, I don't have that.
If there is not yet an investigation, it's not yet evidence. How can you be held responsible for destroying evidence if it's not yet evidence?
This isn't about maintaining the integrity of investigations. It's about giving prosecutors the ability to get people when they otherwise couldn't.
Correction: a criminal investigation that didn't happen yet, might never happen, or might happen say 6 years from now.
And you'll be guilty regardless of whether this investigation targets you or someone you just happened to interact with. And regardless of whether the investigation results in other charges or not. And regardless of whether your potential evidence even matters in the investigation.
I don't think a government should hold such power over any person. SOX was targeted at corporations, the fact that it is used on other targets is a demonstration of how overreaching it is.
Combined with the alarmingly common practice of threatening innocent people with 20 year sentences until they plead guilty, this is a very dangerous precedent.
I'd recommend reading the Indictment. This wasn't that sort of case. This was a case where the accused knew the Tsarnaev brothers, had communicated with them electronically, and made and received several phone calls to and from them after the Boston bombing and they'd been announced as suspects.
Under those circumstances, it was highly likely the FBI would come to him seeking evidence, and if the facts alleged are true, the defendant's behavior in this case looks very sketchy indeed.
Is that decision so exceedingly unreasonable that he needs to spend 20 years in prison for it? Keeping in mind that he has no obligation to create or retain the records that he deleted in the first place.
Mind you, I don't like this guy at all, and he does look sketchy as hell, but he is not even charged with knowing about the attacks. He is guilty of simply being afraid of the government.
And the worst thing is, most people don't even know that SOX applies to them as persons.
So would having a browser/extension that automatically cleans up after itself imply guilt? Even people who don't do anything illegal, immoral, or unethical online might legitimately not want their computer constantly polluted with all the droppings from every site they visit - tracking cookies, cached ads, etc.
What about browsing from a VM that loads a pristine provisioned image every time you boot it? Seems a reasonable way to avoid both that pollution and reduce likelihood of being infected by malware or other security issues. The responsible thing for any good patriotic law-abiding citizen to do.
Either way, it would be a standard operating procedure. So anything that they didn't find would not be something that you had intentionally deleted.
This is also why many companies have a very precise document destruction procedures. I used to run a company that was involved in the document management industry. Many companies track very closely the lifecycle of every document they create, and many have programs that will purge the document literally on the day when it can be delete. If you have to keep a document for 7 years, there are systems that will purge that document at midnight on the 7th anniversary of it's creation.
This is perfectly legal as long as it's all automatic. I think under Sarbanes-Oxley you do have an obligation to preserve evidence once the investigation is open, so you would have to disable the automated system. But as long as your documents are destroyed as soon as it's legally possible, you are basically covered.
How a guy was charged with violating it seems odd.
Too bad SOX doesn't apply to government.
The problem isn't that there aren't laws that criminalize these activities, there are.
The problem is that the government will never prosecute itself, and thus the government lets the corrupt get away with it increasing corruption over time.
One example of this is that there's been no reform of voting systems despite their failure in 2001, and increasing evidence of voter fraud in every presidential election since.
This guy was not prosecuted for deleting his browser history, he was prosecuted for deleting information he knew was relevant to a criminal terrorism investigation.
So, yeah, browsing history possesses all the legal integrity of pocket litter and fast food receipts, and who's to say which information on a typical consumer-class hard drive constitutes a forgery contaminated by trojans and rootkits, versus what is actual legitimate forensic evidence, but that doesn't stop zealous prosecutors and judges from placing this sort of evidence in front of bored, apathetic juries, serving jury duty, because their name came up on the list after getting a traffic ticket.
The wicked flee when no man pursueth: but the righteous are bold as a lion.
If I were to realize a (now very much ex-)friend had just maimed and murdered a bunch of people, my first thought would not be to dispose of evidence.
Do browsers actually log when you delete history? Is there any record or log beyond traces on the filesystem?
Which is exactly why I might delete my browsing history as I occasionally do without realizing that I was disposing of "evidence".
Were it my first thought, I suspect my second thought would be "that's a terrible idea" - and my third to buy another computer, lest my daily, innocuous, use of it be cast as any form of evidence tampering.
If only we had some sort of system where two legal experts argued this in front of a neutral third party, possibly calling in technical experts as needed. If only.
You do understand that it's quite the common perception, outside the technical field, that computer evidence is nigh-infallible, nearly on the level of DNA evidence. So much that, once brought into context, it's pretty much believed as iron-clad evidence by non-technical people.