Judge Rejects Defense That FBI Illegally Hacked Silk Road, on a Technicality
wired.com
wired.com
Wait, wait, wait. Hold the phone.
So any property which, at the time of a search, hasn't been "sufficiently demonstrated [that it belongs to you]" isn't protected, according to this judge, by the fourth amendment?
So for one example, if you sign up to gmail or Facebook using anything other than your real name, they can break it, conduct a search and then whatever they find is totally admissible in court just because they didn't know who it belonged to?
Isn't it now in the best interests of the police to avoid finding out who something belongs to since without knowing the fourth amendment doesn't exist and warrants aren't a requirement?
Here's what I don't get about this case: The FBI is obviously lying about how they got the information they have. They clearly broke into the Silk Road servers. However they could have certain got a warrant to do so had they just presented what they knew at that time about the enterprise. So why didn't they? Laziness? Incompetence? Or just because they knew they'd get away without it (per this)?
Honestly I hope they fight this case on that matter of law and it gets thrown out. We cannot have the fourth getting chucked out any time someone invokes anonymity, that's not how it was meant to work.
That's not what this means. You can't claim fourth amendment protection on someone else's property: I can't claim my rights were violated because the police searched your car. The court is saying that you have to claim it's your car first before you can claim that your rights were violated by the search. (Well, not exactly. The situation is more nuanced.)
To put it another way, the court's not saying that this was legal, or that nobody's rights were violated. The court is only denying Ulbricht's specific claim that his rights were violated, and the denial seems to be based on a procedural technicality.
Yes, this is bad.
Bad indeed.
You still have a reduced "expectation of privacy" in your mobile communications, however, in that you're using your carrier as an intermediary to those communications. Consider pen registers, for example.
I'm not a fan of the defendant here, but I am a fan of holding the authorities to the rules. You know it's their job to uphold the law.
Yes, evidence is inadmissible based on how it is obtained. However, there are rules and procedures for how you get evidence excluded from a trial. This is why you pay good money for good lawyers: they know the rules for excluding evidence. I recommend watching the 1992 moive "My Cousin Vinny".
Sure, this follows the rules, but it seems perverse to lose on a technicality that is easy to resolve with a "hey, prove you own the server. you did? ok."
So either a) Ulbright can't prove he owns the server (in which case he can't very well claim privacy rights in something that's not his property to start with), or b) he is not willing to, even though doing so might keep most of the evidence out of trial. Maybe that's because of some super-clever legal tactic they plan to unveil at appeal (although this seems very unlikely, as this is such a basic procedural issue) or maybe it's for some extrajudicial reason, like because it would reveal the identity of some partner in crime who would then seek terrible revenge. Or any other number of other possibilities.
I want to suggest that this phrase is potentially toxic. Ross's name has been horribly tarnished, not unlike aaronsw before him.
I, for one, think that the evidence suggests he's a pretty good dude. I have seen nothing that makes me believe there is any truth to the arranged murder allegations.
Also, having met and spent half a day in his mother's company, I can tell you that she is a warm, concerned soul and I got the distinct sense that she was telling the truth about this whole thing.
1) The technology and political material he published as DPR is compelling, interesting, and worth reading. This contribution is meaningful.
2) That there is nothing inherently criminal or morally reprehensible about allowing people to freely transact with one another.
...but that's not the point I was making. The point I was making was that any time the government targets somebody, we find ourselves saying, "I don't want to defend <x>, but I will say..."
But why not? Especially with aaronsw. I find it shocking that this phrase was suddenly through around so often after the indictments. We all knew what he was doing. I supported him 100% and do not believe he did anything wrong.
At the end of the day, we have to be willing to defend not only each other's speech and actions, but each other's characters if in fact they're worth defending. I think aaronsw and DPR are characters that are worth defending.
The Feds. charged both, but the thing is that the charges brought against aaronsw were largely absurd. He appeared to have broken a few misdemeanor-class laws, but was charged with wire fraud and the CFAA in ways that didn't really fit what he did at all.
The Feds. are charging Ulricht with things that he mostly was personally responsible for. He very much appeared to be engaged in narcotics trafficking conspiracy, continuing criminal enterprise, computer hacking conspiracy, and money laundering conspiracy. He set up an environment where people can freely transact with one another, but tailored that environment to narcotics trafficking, credit card fraud, selling malware, and money laundering, and chose to engage in tailoring the site specifically for those things. He was fully aware of the illegal transactions occurring through his site and not only did nothing to stop it, but enabled it and profited from it. He was also hit with a Kingpin charge that probably will stick, since he was personally involved and managed an organized crime scheme.
The Silk Road designed a site for drug trafficking and other illicit activities, recruited drug and encouraged dealers, and took a commission from the sales. Since the Feds. have the server they have a sea of evidence to show how the site wasn't running with no knowledge of what transactions were happening, but tailored itself to be effective at drug, CC, and malware trafficking.
Whatever you think morally about profiting off drug deals, malware sales, CC fraud, and money laundering, the law is really clear about it.
aaronsw was engaged in a kind of hacktivism that expanded open access to public information and contributed to the open web in many ways. Ulricht was engaged in making a profit by opening a marketplace for illegal activities and tailoring it for drug deals. There's a world of difference.
Agreed. Of course.
aaronsw is a personal hero of mine. I'm not trying to elevate Ross / DPR to that level.
I do think, though, that subverting controls that inhibit free consensual activity between adults is virtuous.
Furthermore, I'm not at all convinced that Ross did most of the things you mention. The indictment reads like a product of zeal and overreach, not a dispassionate document outlining a person's conduct and how it clearly violates plain language.
That he has been denied bail on this basis (especially when he hasn't been charged with the offenses that constituted the entirety of his bail hearing) is egregious and further suggests that he's being specifically targeted.
It depends entirely on what that consensual activity is. If the activity is selling stolen credit card numbers, then it's facilitating theft and doesn't seem virtuous at all, since it's harming a third party. If it's exchanging kiddie porn, again it's harming a third party. If its selling malware, then it's a free exchange with the intent of violating others privacy or otherwise harming them, which does't seem virtuous at all to me. But those were all services that Ulricht not only knowingly facilitated, but worked to specifically facilitate. While I don't agree with the US drug laws, assuming he was responsible for the Silk Road, Ulricht was choosing to facilitate many sorts of exchanges that while consensual between the parties involved in the exchange, were exchanged motivated by profiting off the harm of other parties who weren't consensually involved, but were either victims of crimes or were victimized by the use of the product of the transaction.
"The indictment reads like a product of zeal and overreach, not a dispassionate document outlining a person's conduct and how it clearly violates plain language."
I dunno, they laid out a pretty clear case of what the law was and how it was broken in my reading. He was pretty clearly violating various criminal conspiracy laws that were written to deal with just the kind of thing he was doing.
I think I was incorrect about the child pornography claim, though that was only one item in a list.
While we should also be looking at the Feds. who are certainly no angels, we shouldn't pretend that everyone the Feds. prosecute is a martyr. The problem is that the legal argument that the server was protected under the 4th was made poorly by the defense, and their arguments against the Feds. haven't been very strong. Perhaps there will be more time for the Feds. to ...clarify... their story of how they managed to get the IP, and if it's shown that they used illegal means then that evidence should be dismissed. So far the defense has looked as amateur as Ulricht's PHP programming, but we'll see. Their claim that since Ulricht wasn't actually engaging in the transactions personally, that he wasn't involved in a conspiracy made them look like they were, um, morons. There's even a chance that the Feds. can convict with the many other pieces evidence that they have that isn't hit by the Fruit of the poisonous tree (esp. in the pending case filed against Ulbricht in Maryland).
I'd like to see justice served on all fronts, with the Feds. nailed for their wrongdoings, and people like Ulbricht nailed as well.
Do you have anything substantiating your claim?
PS: nevermind, I just found out your other comment further below: https://news.ycombinator.com/item?id=8441338
And in this case, the court has never got to the question of whether the search was illegal, because the defendant's motion to suppress is not well-formed (despite the court providing the defense with an opportunity to correct that). Courts don't have much initiative in our common-law system, constitutionally speaking their function is to resolve disputes between parties, meaning the onus is on the defense to make the argument about the illegality of the search warrant and to do so in correct legal form.
- thing.BelongsTo(you)
- thing.Contents
Fortunately, no. The article explains it better than I could:
> That argument may seem like a Catch-22. If Ulbricht were to claim ownership of that server he would seem to incriminate himself. But Forrest writes that Ulbricht could have nonetheless claimed the server in a pre-trial statement that couldn’t be used against him as evidence. “Defendant could have established such a personal privacy interest by submitting a sworn statement that could not be offered against him at trial as evidence of his guilt (though it could be used to impeach him should he take the witness stand),” she writes. “Yet he has chosen not to do so.”
So he has to "pre-trial" admit to owning the "evidence" or "tool of committing the crime", or something. Thereby admitting "guilt" without it being admissible in court later on. So then, everyone knows he's guilty, because he admitted it, but they can't "prove it" because of a technicality of using that evidence.
The reason that sounds broken to me is that he has to first admit guilt in order to defend some "noble" right to privacy that'll allow him to be acquitted. If he does that, his entire life is ruined because he will forever be tainted in the media and law-enforcement as "guilty, but got away due to a technicality". They will never stop hounding him, and will actively put him under their investigation spot-light for his entire life. This applies whether he's actually guilty, or not.
> “Defendant could have established such a personal privacy interest by submitting a sworn statement that could not be offered against him at trial as evidence of his guilt (though it could be used to impeach him should he take the witness stand),”
It sounds like he could provide proof that he owned the server having the contents of the server thrown out. Then provided he didn't take the stand in his own defense the affidavit couldn't be used. Not entirely certain though.
http://lawcomic.net/guide/?p=2256
The rule most relevant to this case is found here:
http://lawcomic.net/guide/?p=2210
Essentially, you don't have standing to challenge a seizure for abandoned property and one way you can abandon property is by denying ownership.
The government can't have it both ways. Either the server is owned by Ulbrecht and they violated his rights, or the server is now owned by Ulbrecht, and thus they can't prove he is the DPR.
It's not that simple. The courts follow procedures for these things: the courts respond to claims made by various parties, and if there is no claim that the evidence is dirty, or if the claim that the evidence is dirty is not proved for whatever reason (even silly technical reasons), then the evidence is admitted.
Don't forget that this is only one court. Higher courts could find the judge's ruling incorrect.
I don't understand how this isn't an illegal search irregardless though (maybe the server hosts gave the FBI permissin? I'm not aware of the specifics)
Ok, so if you rent a car for 3yrs, then they can search it without your consent because technically you don't own it?
It doesn't say on the victim's property or whatever.
That seems bassackwards.
But that pretty much exactly that FBI and other agencies are doing right now in the Internet. And this ruling puts a legal precedent footing under such behavior.
In the US, trial courts find rulings of fact, and appellate courts find rulings of law. Only the latter create precedents.
This is the critical point as the judge notes. The FBI isn't proving that he owns it yet, just submitting it as evidence. The judge can't rule based on the fact that the FBI will eventually prove that Ulbrircht. At this point it's just a server that the FBI found something on they're planning on using in the trial. Combine that with the fact that the fourth only protects your own property from search and there's nothing the judge could really do.
There's some additional oddness around if the sworn affidavit would could be used to prove he owned the server later in the trial. It sounds like he could plead the 5th and the affidavit wouldn't hurt him but I'm not sure.
> “Defendant could have established such a personal privacy interest by submitting a sworn statement that could not be offered against him at trial as evidence of his guilt (though it could be used to impeach him should he take the witness stand),”
It's very similar to the reason judges have had to reject legal challenges to the NSA spying apparatus, the defendants couldn't show that they had standing, i.e. they were affected by the law.
In short his lawyers screwed up by failing to prove he had any standing to challenge the server as evidence in the first place. Providing this proof would give an unknown amount of damage to the prosecution but the contents of the server would not have been admissible at least.
So in short his lawyers fucked up
But don't they need to do this at some point in order to get a conviction - if this server is that used to run Silk Road and they want to prove that he ran the Silk Road then it seems like a necessary step. At the point of them making this claim surely the judge has to say "if this evidence proves the defendant owned the server then you've infringed his rights under the Fourth Amendment and the evidence must be discounted"?
Yes, a server they potentially broke into and violated someone's privacy over. Why does it have to be more complicated than that?
In fact, someone at the FBI should be charged with some sort of illegal-seizure crime, or violation of privacy crime. Whatever it's called these days by the lawyer-priesthood.
Based on the third-party doctrine and United States v. Graham [1], even if you used your real name, you would not enjoy 4th amendment protection of data stored on an outside company's server (they would be protected, though).
It's fairly well established by the Court that there is no "reasonable expectation of privacy" for information disclosed voluntarily to a third party, as with your Gmail example.
Perhaps they want to set a legal precedent which would require less checks & balances.
Not sure what is worse. Democratically passing new bad laws or subverting the constitution via underhanded techniques. I guess the former is depressing and the latter shows mal-intent?
Burn down the Reichstag or get 3/4 majority to nullify the 4th?
I'd argue that it should be a constitutional offense to weaken the constitution using non-constitutional means. Attempting to rewrite the rules of the game during gameplay should get you autobanned by punkbuster.
This isn't obvious at all and the only backing we've seen for this is some butthurt speculation. Meanwhile we know for a fact that the Silk Road IP had leaked multiple times in the months before the FBI claims it leaked to them.
My reading of the Cybercrime Convention they claimed to use (see my other post) means that if they needed to get a subpoena then they would need to get one before the Convention could be applied to compel the Swedish authorities to perform the search on their behalf.
They don't appear to have got a warrant, a subpoena nor any judicial oversight before ordering the initial search and seizure - that appears to break the Convention. Perhaps that's why there's a footnote saying they may have asked the Swedes just for comity's sake, it's so hard to remember!
What I'd really want to see to prove their position is the captured packets from their initial probing of the publicly available homepage that include the IP addresses. That would show suggest they were telling the truth [eg when matched with other peoples captures that the FBI don't yet have access to]. I'm going to go ahead and assume that they don't have that data. IMO if they can't produce that data it demonstrates the personnel in court are either completely incompetent in their positions as investigators and should be fired immediately or they are flat out lying; something tells me they're largely competent.
And I'm pretty sure they would have had NO trouble getting a warrant in the USA if they had a credible lead on the SR server. And any credible hosting company would GLADLY cooperate to the fullest extent with such a warrant. Generally hosting companies do not care what you're doing on your server and won't get in the middle of disputes UNLESS:
A.) You're doing something illegal
B.) Your actions pose an untenable threat to the network or other customers
The law they claim to have used requires that the requesting country act as if the computer being searched is in their own company, all protections that would apply domestically must be applied in order to request the search lawfully.
If they needed a warrant to get the local search done (eg in Pennsylvannia) then they needed one in order to use the 2001 Convention on Cybercrime to request that Sweden perform a search (and imaging) for them.
This appears to be a hole in the FBI argument - as you say, they're claiming they didn't need a warrant or to provide protections that would normally be applied if the server were in the USA. But the Convention used - by my reading at least (see my other post for links) - contradicts that specifically demanding that the normal domestic protections and procedures be applied.
You might find it helpful to start at the very beginning of that section, which is back here: http://lawcomic.net/guide/?p=1373
EDIT: Also this - http://lawcomic.net/guide/?p=2210
As an analogy, if I keep a murder weapon hidden on my property, the police are required to get a search warrant. If I instead keep it at my friend's house, I have no 4th Amendment rights when my friend gives it to the police, especially if the crux my defense is "it wasn't my gun."
[1] http://www.scribd.com/doc/238796613/Silk-Road-Prosecution-4t... (page 12)
[2] http://www.scribd.com/doc/238844570/FBI-Explanation-of-Silk-... (page 3)
A month later, the FBI gave sworn testimony[2] indicating that they found the server because Ulbricht had failed to configure it properly and it was leaking out its actual IP outside of Tor channels. There hasn't been any proof shown that the FBI hacked his server. A number of people have claimed in the past that they came across the actual IP for Silk Road's server as a result of misconfiguration[3][4], so frankly it doesn't surprise me at all that the FBI also found a leak.
[1] https://www.scribd.com/doc/235692879/Silk-Road-4th-Amendment... (starting on page 40 of the PDF - the page number in the document itself is 28, entitled "The Searches and Seizures In This Case Failed to Satisfy the Fourth Amendment")
[2] same link as my grandparent comment (https://www.scribd.com/doc/238844570/FBI-Explanation-of-Silk...)
[3] http://www.reddit.com/r/SilkRoad/comments/1b1lvy/warning_the...
[4] http://www.reddit.com/r/SilkRoad/comments/1dmznd/should_we_b...
I was with you up until I actually read the posts, which I suspect you did not.
Paraphrase: 'we said we requested the search using MLAT but then we realised we don't have that agreement with Sweden, so it was probably 2001 CoE Convention on Cybercrime {2} or if it wasn't that then it was comity; we don't really want to say' - presumably they made this up after the fact. I'd be asking for records of the communications.
At Art 15(1) [which is specifically mentioned in the articles on search and seizure] it says:
>"Each Party shall ensure that the establishment, implementation and application of the powers and procedures provided for in this Section are subject to conditions and safeguards provided for under its domestic law, which shall provide for the adequate protection of human rights and liberties, including rights arising pursuant to obligations it has undertaken under the 1950 Council of Europe Convention for the Protection of Human Rights and Fundamental Freedoms, the 1966 United Nations International Covenant on Civil and Political Rights, and other applicable international human rights instruments, and which shall incorporate the principle of proportionality." //
That "each party" means that the state requesting the search and that being requested to do the search, in this case Sweden and USA, have to ensure that they abide by the "safeguards provided for under its domestic law". That means that contrary to what the FBI are claiming if they used this 2001 CoE Convention on Cybercrime to request the search then USA restrictions must be applied to the request, eg the Fourth Amendment.
This {3} recent Cybercrime Convention document reiterates that domestic laws must be applied in certain circumstances (see eg Section 3.2). It specifically relates to Art 32 (unilateral searches of publicly available data) but the language used is such as to reiterate the general principle running through the Convention of the requirement to apply all relevant domestic laws.
This 2001 Convention being used relies on other international laws, I wouldn't be surprised if the cited UN convention also means that a court must be involved in the issue of the request. The Art 15(2) ibid appears to say that an independent or judicial review of the request is required.
tl;dr if the footnote on p3 is correct and {2} was used then, just as for the Pennsylvannia server the USA authorities needed to satisfy USA domestic law before requesting the Swedish authorities search and imaged the server there. If they would have needed a court issued warrant if that server were in USA then they still needed one to make the request under the Cybercrime Convention.
{1} https://www.scribd.com/doc/238796613/Silk-Road-Prosecution-4...
{2} http://conventions.coe.int/Treaty/en/Treaties/html/185.htm
{3} http://www.coe.int/t/dghl/cooperation/economiccrime/Source/C...
I am not a lawyer; this is not legal advice.
http://krebsonsecurity.com/2014/10/silk-road-lawyers-poke-ho...
https://twitter.com/matthew_d_green/status/51784845258024550...
> So this reads as 'allow PHP files to be read from any IP', 'anything else is limited to 62.75.246.20'.
I don't get why Krebs hasn't updated his article. There's enough misinformation about this case floating around already.
If the servers aren't his, how can he say his privacy was violated? Therefore, the violation is contingent on establishing it was his, which he hadn't done.
That's the least effective rebuttal I've heard in a while.
Obviously the government is going to do whatever it can to prosecute the guy, rules be damned.
39 U.S.C. § 4057 specifically requires a warrant for certain classes of mail and parcels, and therefore any evidence obtained in a warrantless search would be inadmissible.
Of course, it doesn't mean that such evidence would be especially compelling to a judge or jury in those circumstances, but that's a separate matter.
If I gave you a box and asked you to give it to someone else, you have the legal right to open it up and do whatever you want to it. The most I could do is sue you, civilly, for breaking a defined contract if one was in place, but for the most part I'd be limited to calling you names.
Contract law in USA is that weak? They have authority? As in the law authorises anyone to access anything just by virtue of being contracted to move it, not even ownership? Contractual obligation can't override that authorisation .. are you sure?
That would mean, for example, that your taxi-driver has the right to go through your bags by virtue of you asking them to put them in their car. Or that Starbucks have a _right_ to access your laptop if you left it in the store for any length of time. Or if you park in a private parking lot the owner could break in, hot wire and drive your car around.
Or are you saying that only certain possessions are treated as if you didn't own them and only certain companies contracts are treated as null?
tl;dr http://en.wikipedia.org/wiki/Trespass_to_chattels, but yes it's a tort.
But most likely, the contract with UPS/FedEx/etc would afford broad abilities to inspect and search packages for "safety and quality control" reasons, or whatever else.
To take his example, if I carelessly left my laptop in a Starbucks, I have not given anyone the right to use, transport or otherwise inspect my laptop. I can assume some right to privacy over the contents of it. But if I gave my laptop to a company that specializes in transporting laptops between Starbucks locations on behalf of patrons, one can pretty much assume (given today's contract binding society) that they have some clause in the contract between us that says that they are not responsible maintaining the content of the laptop, and can at their discretion open it up and inspect the contents to be sure that they are not the facilitator in transporting illegal or "bad" data (malware source code, child porn or terrorist manifestos, etc). They don't have the explicit right to open it just because, but in giving it to them I've given them the right to do so.
Which makes it even stranger, because I don't know how the judge would reconcile that theory with the third-party doctrine, which (in my layman's understanding) seems to be about what you said; namely that since some person(s) shared all the information in the image with the ISP, it wouldn't be subject to anyone's Fourth Amendment protection. Or is there some line between a hosted email account and a VPS; where the email has been "shared" with the host, but the VPS's contents can't sufficiently be shown to have been "shared" and thus are still protected? [1]
[1] https://www.quora.com/Fourth-Amendment/Does-the-third-party-...
Note that the rule doesn't require suppression of just any evidence obtained illegally -- only evidence obtained in violation of the defendant's constitutional rights (and, in particular, his right to privacy). Relatedly, note that the suppression rule is not actually written into the Fourth Amendment. It is a judicial creation to deter particularly egregious violations of the Fourth Amendment. http://en.wikipedia.org/wiki/Exclusionary_rule#Limitations_o...
You're right, if they ask that third party to see it. But if they don't ask, they hack in, then they're breaking the USC that protects against unauthorised access to computer systems [18 USC 1030?].
The third party usually will have a legal requirement not to divulge your info without a warrant (except perhaps under conditions threatening national security). I'm not sure on this for USA, most countries have laws protecting personal information; your contract binds the company to not disclose information but a warrant supersedes that ... but presumably there's not a general regulation forcing companies to disclose information to authorities who merely request it as opposed to getting a warrant. That would be most undemocratic.
Thus under rule of law, despite the Fourth not applying, the FBI would still need to get a warrant before either hacking in or making the company disclose the information, no?
Like, they can open your mailbox as the postal service own it, but if it's locked then they'd need to get the key/authorisation from the owner (or they'd break the law, breaking and entering or bypassing security or somesuch). If the owner says "no" then they'd need a warrant (legally speaking) to force the owner to open the box and take your post out. If they just break in and take the post it's not a Fourth Amendment violation against you, AFAICT, but it's still unlawful.
IMO the evidence should still be used but the fact of the evidence being obtained means that if submitted by the state it's also evidence that a person working for the state committed a crime. Rule of law means that person should be tried as should any co-conspirators. But this last para is just my idea of democratic responsibility and not how things are.
We can think about it this way. The United States (well, certain bureaus) do not believe that the Bill of Rights contains unalienable rights because:
1.) Foreigners ("aliens") are not 'given' what is presumably 'unalienable' to them (e.g. GitMo)
2.) Snowden Docs (in particular the US) shows how intelligence agencies will spy on one anothers' citizens on their behalf to skirt domestic law. A serious commitment to unreasonable searches and seizures would entail protecting citizens rights from foreign actors, not encouraging it. And it would also refrain from doing it to others.
3.) Fair trials are suspended where convenient, even before executions (e.g. Americans overseas, Bin Laden).
By tautological definition there are no 'extreme' circumstances under which natupal rights are no longer granted; for natural rights are not given, cannot be taken away, suspended or invalidated by geolocation.
While we recognize in a moral and philosophical sense today that we should treat all people of the globe identically, that isn't the group of people the Fourth Amendment protects. In a general sense, people in other countries are not subject to American law (despite being part of the same humanity and, we can agree, deserving of being treated with respect). If people and objects in other countries were subject to American law, there is a deep sense in which there would only be one country (The United States) with charming colonies labelled things like "Iceland" on maps.
No disagreement there. But that doesn't mean that the document grants the right. It merely recognizes the rights.
We hold these truths to be self-evident, that all men are created equal, that they are endowed by their Creator with certain unalienable Rights...
These rights are not granted by the United States. The United States cannot grant or take away natural rights. That's what they are and how they were intended to work.
But the FBI, and US DoJ, operate under some interpretation of the verbiage in the US Constitution. That interpretation has come to mean less and less protection against searches and seizures over the years, as the US Supreme Court interprets what the (to me) plain and simple language of the 4th amendment says.
Also, there are limits on those rights. There's one example in the opinion; if the police somewhere else discover some incriminating information about you and voluntarily pass it along to American police, it is admissible regardless of whether the foreign investigation would have been valid under the 4th amendment if initiated by American law enforcement.
As a simple example, imagine a drug bust in Thailand which would not be 4th amendment compliant turns up evidence that 50% of the money from the drug operation is always send to John Doe, who lives on 123 Main Street in Anytown, USA. The FBI duly arrests John Doe and he's charges with international drug trafficking. The Thai evidence is admissible notwithstanding the non-compliance of Thai investigative procedures with US law.
This isn't meant to be an analogy for this case, BTW, just an illustration of one limiting case.
The rights are really limitations on the American government, so it's not "subjecting" anyone to anything, and there's no reason limitations on the US government couldn't apply to how it treats people all over the globe. It's no imposition on the sovereignty of Iceland for the US not allow itself to hack into servers there.
Moreover, in practice, it's way more complicated than you're implying. The Supreme Court has been clear that the geographical location of a US citizen actually doesn't matter at all:
> When the Government reaches out to punish a citizen who is abroad, the shield which the Bill of Rights and other parts of the Constitution provide to protect his life and liberty should not be stripped away just because he happens to be in another land. [1]
So it's not just "people in other countries", and presumably the same thing applies to his property being in that other country.
And it's not just citizenship that matters: foreigners on US soil are protected by much of the Constitution, even undocumented immigrants [2]. So apparently neither location nor citizenship strip you of your rights. However--and this is the weird part--for some reason the combination matters: foreigners on foreign soil are not afforded the protections of the Constitution. See e.g. [3].
[1] http://www.law.cornell.edu/supremecourt/text/354/1 [2] http://usgovinfo.about.com/od/rightsandfreedoms/a/illegalrig... [3] http://en.wikipedia.org/wiki/United_States_v._Verdugo-Urquid...
An important point you made, though:
> The rights are really limitations on the American government [...] It's no imposition on the sovereignty of Iceland for the US not allow itself to hack into servers there.
This is pointing in the key direction I was trying to go. I feel we _should_ hold ourselves to a higher standard, and I suspect there is no substantial barrier legally. But judges are rarely in the business of "should", otherwise we wouldn't have rule of law. Hence my comment about him seeming to just do his job in this case.
Anyhow, you got my upvote. :)
But it's an easy mistake to make because it's a totally archaic word.
Second, you think the Framers thought they were limiting rights to US citizens. When did the Constitution first even mentioned the notion of citizenship?
EDIT: I am concerned, the further I go in this search, that the reason they seem not to speak of the rights of foreigners as inalienable may be because e.g. so many foreigners are black or Chinese, and you didn't even get a rights guarantee back then if you were American-born and black or Chinese (not that there were a lot of Chinese people there at the time -- burning down their houses and threatening to kill them if they didn't leave comes later in American history, with similar problems for Japanese people even _later_ in American history), so there was just no chance anyone would even possibly consider the hilarious joke that we'd give rights guarantees to foreigners.
Could be off-base, but the context back then was... decidedly less progressive than we'd like to imagine them now.
Now find me a lawyer who reads the Constitution this way.
Bottom line here is there was no warrant, and as far as I can tell, no attempt to gain any sort of permission to access property-- and in a foreign country no less. I thought the FBI's purview was limited to domestic soil.
Anyone here a security expert with experience with TOR? The FBI's claim that they just typed random values into a login to accidentally reveal the server's IP address seems far fetched.
That's hardly related to TOR, but most probably a misconfiguration of the web-server or application which leaked the IP.
According to http://motherboard.vice.com/read/how-did-the-fbi-find-the-si... "He also says that the logs provided in the new evidence don't match up with the pages described in Tarbell's declaration." So it's most likely a case of parallel construction
In or about early June 2013, another member of CY-2 and I closely examined the traffic data being sent from the Silk Road website when we entered responses to the prompts contained in the Silk Road login interface. This did not involve accessing any administrative area or “back door” of the site. We simply were interacting with the website’s user login interface, which was fully accessible to the public, by typing in miscellaneous entries into the username, password, and CAPTCHA fields contained in the interface. When we did so, the website sent back data to the computer we were using – specifically, the Silk Road homepage, when we used valid login credentials for undercover accounts we had on the site, or an error message, when we used any username, password, or CAPTCHA entry that was invalid.
Upon examining the individual packets of data being sent back from the website, we noticed that the headers of some of the packets reflected a certain IP address not associated with any known Tor node as the source of the packets. This IP address (the “Subject IP Address”) was the only non-Tor source IP address reflected in the traffic we examined. The Subject IP Address caught our attention because, if a hidden service is properly configured to work on Tor, the source IP address of traffic sent from the hidden service should appear as the IP address of a Tor node, as opposed to the true IP address of the hidden service, which Tor is designed to conceal. When I typed the Subject IP Address into an ordinary (non-Tor) web browser, a part of the Silk Road login screen (the CAPTCHA prompt) appeared. Based on my training and experience, this indicated that the Subject IP Address was the IP address of the SR Server, and that it was “leaking” from the SR Server because the computer code underlying the login interface was not properly configured at the time to work on Tor.
[1] http://www.scribd.com/doc/238844570/FBI-Explanation-of-Silk-... (pages 3-4)
The server was public, the Feds don't need a warrant to investigate public facing web content any more than they'd need a warrant to look at a storefront. They fuzzed some content to get the thing to leak an IP (according to their account). Given the incompetence of the Silk Road admin, that's honestly not a real stretch. There were SQL injection bugs in the search on the site, and he left PHPMyAdmin running on the server. It was amateur hour. With that IP they contacted the ISP in Iceland who gave up the data since the server was violating it's TOS, and the Iceland authorities got legally involved (with no legal issues in that search).
The fuzzing of input to get the IP is iffy, but it's certainly not a cut and dry case where a warrant would be required.
The investigators did get warrants for some of the evidence they collected (esp. the evidence that tied , and I'd imagine if there was a a clear legal requirement for a warrant to investigate the web server, since they had overt probable cause it would have been trivial to get one.
Besides that the only way Ulricht can claim that the search was illegal is to admit that he owned the server, at which point that admission will certainly put him in prison, so an appeal isn't going to do him any good.
Also, the article specifically states that the defense could have "claimed" the server as part of their motion to suppress evidence in such a way that the claim could not have been used as evidence against Ulbricht.
On a separate note, there are two separate cases against Ulbricht, one in New York happening now, and the other Maryland (which is where the contract murder charges are). So he probably does need to be very cagey about any claim of ownership of the server given that this isn't the only trial he faces. As I understand it, while the claim wouldn't be admissible as evidence in the NY case, it could still be germane to the future case.
It also means the "Fruit of the poisonous tree" issue could be mitigated even if the NY case is dismissed, given there's different evidence and claims presented in the MD case, and some of that evidence is not tied to the IP leak at all.
"Defendant could have established such a personal privacy
interest by submitting a sworn statement that could not
be offered against him at trial as evidence of his guilt
(though it could be used to impeach him should he take the
witness stand)"
You had probable cause to investigate what appeared to be a cache of proceeds from the sale of contraband, despite not knowing who it belonged to. On discovering the identity documents in such close proximity to actual contraband, you had probable cause to locate and arrest that person on suspicion of drug dealing.
It's actually Ulbricht who wants to have it both ways. Asserting 4th amendment rights effectively amounts to saying 'hey, that's mine and you snoops had no right to access it.' Ulbricht refuses to admit or assert that the servers were his in any meaningful way, even though the prosecution could not put such an admission before the court as evidence. The only way the prosecutors could bring it up is if he took the stand and said 'no way, that's not my server,' in which case they'd say 'but you told the court that it is.' So as a defendant you can say that evidence is the result of an illegal search, or you can disclaim ownership of it, but not both at the same time.
I don't know whether the original warrant was deficient or not, and haven't looked it up. but bear in mind that the job of the trial court is not to establish whether it was valid (unless there is glaring evidence to the contrary), but whether it is admissible as evidence to be considered by the finder-of-fact (typically a jury). It's up to the defense counsel to raise those arguments, not for the court to preempt. In this case, the court is pointing out that it told the defense exactly what it needed to do to to make a procedurally valid 4th amendment challenge, and the defense failed to do so.
It's not the court's job to step in and assist the defendant if the the defendant's lawyer is no good, although bad lawyering is sometimes the basis for an appeal (on the grounds of ineffective assistance of counsel, in which case the appeal court could order a new trial if it agreed with the claim). In the American legal tradition (and the English one from which it derives), courts are not investigative bodies, they are determinative ones, which can only rule on matters brought up by one of the parties. This is completely different from how courts operate in jurisdictions based on Napoleonic law, in which the functions of prosecutor and judge and virtually combined. Obviously this is a highly simplistic summary, please take it with a grain of salt as I can't compress centuries of different legal traditions into a few sentences.
Can anyone explain "though it could be used to impeach him should he take the witness stand" from the article? Sounds like this pre-trial statement could effectively constrain his options during the trial, so it's not like it's perfectly safe or inconsequential for him to have said this pre-trial.
1. FBI agents noticed the captcha mechanism on Silk Road was not configured to go through Tor (revealing the server IP address)
2. They asked Icelandic police to get an image of the server.
Another part of the argument is that the TOS of the data center said that servers could be "monitored" for lawful use (probably removing expectation of privacy questions, independent of localisation, in the prosecution's mind).
I wouldn't call this "hacking", but the constitutional question remains. I think the crux of this is that information obtained from foreign agents seems to be admissible independent of how they obtained it. Not a fun state of affairs.
"A person who has been aggrieved by an illegal search and seizure only through the introduction of damaging evidence secured by a search of a third person's premises or property has not had any of his Fourth Amendment rights infringed."
Prosecutors have long found our constitutional protections to be inconvenient in their pursuit of "justice". Over the years, however, they have managed to obtain Supreme Court decisions, like this one, that pierce through these protections in every meaningful way. This particular ruling opened up the floodgates, and it seems that the FBI is actively utilizing it.
> If successful, the move would have likely made Ulbricht nearly impossible to convict on the central charges of narcotics and money-laundering conspiracy that he faces.
The judge's instructions to his clerk was probably something like: We're going to deny the defendant's motion; find me the legal precedent to do so.
>Forrest writes that Ulbricht could have nonetheless claimed the server in a pre-trial statement that couldn’t be used against him as evidence.
Legal rulings are like scientific papers - you should not rely on how the press reports them to get a full understanding of what they mean. Read the original document on which the report is based, which addresses the dichotomy you are imagining.
If it really is not your box then you don't have any privacy expectation. The 4th amendment protects '[t]he right of the people to be secure in their persons, houses, papers, and effects [...' (emphasis added). You don't have a right to security in other people's property, eg if we are both drug dealers and I keep notes about you in my notebook, you can't make a 4th amendment claim about the privacy of my papers even though they incriminate you.
Even if those papers are the fruits of an illegal search of my apartment, only I have the right to demand that evidence is suppressed. If I don't (perhaps because I cut a deal for immunity, or perhaps because I was smart and blew town before the police suspected me) then that's just too bad for you.
Is the a reason the rules are this way? It's certainly not because of what the 4th amendment actually says.
This seriously hurts my faith in the entire common law system.
IF I understand the court in Payner correctly, the problem is the lack of an objective standard for determining when the cost of government overreach outweighs the benefit of truth-seeking in criminal cases, or as the court puts it 'After all, it is the defendant, and not the constable, who stands trial.' The court ad established a standard a year or two before in another case called Rakas (involving the objections of passengers in a car to the admission of incriminating evidence found in the car that the owner of the car did not attempt to suppress). The court in that case took the simplistic but nevertheless straightforward view that only the owner of a property that is illegally searched has standing to complain about a 4th amendment violation. While acknowledging that this is a flawed standard that will sometimes result in injustices, it is nevertheless an unambiguous standard and was a core holding that case. The Payner court, while admiring the principle that the lower court was trying to uphold, agreed with the government that the standard laid down by the Supreme Court in Rakas should control despite its shortcomings, because it came from the Supreme Court.
In other words, it's sort of pointless having a hierarchical court system (as established by the Constitution) if lower courts can interpret constitutional issues without reference to the standards established by the Supreme Court. If those standards have to be abandoned,it must be the Supreme court that abandons them, or the whole system collapses. To quote Justice Jackson: 'We are not final because we are infallible, but we are infallible only because we are final.'
http://caselaw.lp.findlaw.com/scripts/getcase.pl?court=US&vo...
http://caselaw.lp.findlaw.com/cgi-bin/getcase.pl?navby=case&...
I think you've raised some very interesting questions here. While I said your earlier statement was wrong legally, I don't disagree with your comment that 'it's one of the worst rules [you've] ever heard.' Morally it's very problematic, because as Justice Marshall observed in his Payner dissent, it provides the government with a sword that allows them to deliberately infringe upon one person's 4th amendment rights in order to obtain evidence against someone else. It might well be that the decision was influenced by the perception of out-of-control crime levels in the late 1970s, and might have something to do with the exponential rise in incarceration rates that took off in 1980, which bears thinking about.
Balancing of conflicting imperatives under the 4th amendment is a real ethical minefield, as in this unrelated but interesting case from a few years which has been bothering me ever since I read it. There should be a better rule for handling cases like this, but so far I have been unable to articulate one that doesn't have any holes in it.
http://scholar.google.com/scholar_case?q=mcgacken&hl=en&as_s...
So basically, any hacked system with incriminating data is almost an automatic hit against a defendant.
This seems like bad news for due process.
EDIT: Not that it should not be prosecuted if something is found also, but WHY does the obtained evidence have to be dismissed?
Because to permit it effectively allows the end to justify the means. It would effectively permit law enforcement to ignore any and all laws they wanted to in the course of investigations in order to produce a favorable result. Why the hell would you only conduct searches within the bounds of the law if you could get the same result more expediently by just doing it however you want?
If the police are willing to break the law, then who is going to enforce the consequences for doing so?
If you're allowed to use evidence from an illegal search, there's a huge incentive to keep doing illegal searches.
If you want to curtail illegal searches, then you make such searches have a worse payoff.
In short, if illegal techniques can be used to find evidence, and that evidence can be admitted, that's a pretty powerful reason to use illegal techniques.
Barring that evidence is a way to prevent that abuse. Aggressively prosecuting the use of illegal techniques is another way, but given that we're not willing to prosecute prosecutors who railroad the innocent or government employees who torture other people, well, I'd say that's a non-starter.
When you take the stand in court you are an individual giving testimony though. The rule of law means that if you perjure yourself you should be tried.
/lives in Sweden, where all evidence is admissible, but where the prosecutors should, but don't, go after their own on transgressions.
I (and many others) view the government as a service by the people, for the people. It should adhere to the same laws and constraints that the people do in order to be kept in check and not all-powerful. One of these regulations is that citizens have powerful rights of ownership over their personal belongings and no one should be able to rifle through them without permission. Objects/data/articles/ideas can be held private for a multitude of reasons, and due process should be followed in order to gain access to these details. By removing the government's requirement to abide by this, you grant it an immense power to control and have knowledge of your life. That simply isn't necessary for the true function of government. Our original constitution and amendments attempted to protect its citizens from that fear.
There is no "they". There are individuals who influence each other, each of whom may change their position depending on the position of others. History is replete with the consequences of changes inspired by advisers to advisers of leadership.
There is no guarantee that you can influence outcomes, but it is exceedingly likely that if you believe that you cannot influence outcomes, then you will not.
General Warrants
More than 2 words - If one would give me six lines written by the hand of the most honest man, I would find something in them to have him hanged. - Cardinal Richelieu
You get into situation where you tell a prosecutor - find this guy guilty of something and throw him into jail.