Module 3 - When Incidents Turn Criminal Flashcards
Upon the completion of this module students will be able to: Analyze running processes on a computer Apply legal considerations to an incident response scenario
Legal Situations That May Occur During Review of Data in IR
- violations of corporate policies / user agreements
- evidence of illegal activities
4th Amendment
Right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures… (from government, not LE)
Lawful Search (3 types)
- court order
- consent
- other legal exception exists
Katz v. US
Unreasonable Searches:
search is constitutional if it does not violate a person’s “reasonable” or “legitimate” expectation of privacy.
Container
Courts have differing opinions as to whether or not a computer’s hard drive is one container or a collection of containers. Impacts what may be searched.
Negation of Expectation of Privacy in Orgs (exceptions)
- user policies
- consent agreements
- banner/click-through agreements
US v. Ziegler
Expectation of Privacy:
- private sector employers generally have broad authority to consent to searches in the workplace and this authority extends to workplace networks.
US. V. Matlock
US V. Smith
Third Party Consent:
co-users of a computer will generally have the ability to consent to a search of its files.
Trulock V. Freeh
Third Party Consent:
When an individual protects files with passwords and has not shared the passwords with others, who also use the computer, the Fourth Circuit has held that the authority of those other users to consent to search of the computer will not extend to the password-protected files.
People v. Ramey
Exigent circumstances exception to 4th amendment:
An emergency situation requiring swift action to prevent imminent danger to life or serious damage to property, or to forestall the imminent escape of a suspect, or destruction of evidence. There is no ready litmus test for determining whether such circumstances exist, and in each case the extraordinary situation must be measured by the facts known by officials.
United States v. Ross
Expectation of Privacy:
Because individuals generally retain a reasonable expectation of privacy in the contents of closed containers, they also generally retain a reasonable expectation of privacy in data held within electronic storage devices.
Abandoned / Orphaned Property
If computer equipment is abandoned or thrown out (in a location where the refuse container is out for pickup or disposal – a place where anyone can get to it), the expectation to privacy does not exist.
US v. Jacobsen (1984)
Contraband:
The U.S. Supreme Court has held that there is no privacy interest in contraband.
Third Parties:
The Fourth Amendment “is wholly inapplicable to a search or seizure, even an unreasonable one, effected by a private individual not acting as an agent of the Government or with the participation or knowledge of any governmental official.” (Not criminally responsible for improper search)
US v. Caymen (2005)
US v. Lyons (1993)
Contraband:
Individuals do not generally enjoy a reasonable expectation of privacy in the contents of computers they have stolen or obtained by fraud.
4th Amendment Rights and Individuals
Question of civil liability
US v. Young (2003)
A third party may disclose the item or information to the government provided the third party has common authority over the item or information.
Third Party significant factors (with regard to government)
timing (order of events)
relationship to authorities
Sniffing network traffic
Question of whether there is an expectation of privacy for communication.
Berger v. New York (1967)
Communication (sniffing):
Government acquisition of an intangible electronic signal in the course of transmission may also implicate the Fourth Amendment.
Title III
Omnibus Crime Control and Safe Streets Act of 1968
Government can’t install sniffers everywhere.
Private Companies and sniffers
Corporations typically have a “monitoring” clause in user agreements.
Network traffic should be done with permission and for a reason.
Determining Reasonable Expectation of Privacy in Computers as Storage Devices
To determine whether an individual has a reasonable expectation of privacy in information stored in a computer, it is helpful to treat the computer like a closed container such as a briefcase or filling cabinet. The Fourth Amendment generally prohibits law enforcement from accessing and viewing information stored in a computer if it would be prohibited from opening a closed container and examining its contents in the same situation.
Relinquishing Control
Individuals lose Fourth Amendment protection in their computer files if they relinquish control of the files.
Exigent Circumstances (3 scenarios)
- prevent imminent danger to life or serious damage to property
- forestall the imminent escape of a suspect
- destruction of evidence
