9 ms·

The FBI is acting in bad faith. If this is found to be permitted, then search warrants are no longer necessary in many situations since the police can simply hi

The FBI is acting in bad faith. If this is found to be permitted, then search warrants are no longer necessary in many situations since the police can simply hire anyone who is not a LEO to conduct a warrantless search on their behalf. Given that the file in question was in the deleted free space, the technician didn't just stumble into it accidentally and then report it. He went looking for it to begin with. And he was searching for such files because he was paid to do so.

patcheudor 10y ago
Chain of custody should play a big factor here. Between the accused and the technician how many people had access to that system? Further, since the technician is paid when something is found, what is the motivation for the technician to not plant evidence? It's trivial to plant evidence on a hard-drive to the point that if done properly it's impossible for a forensics investigator to come in after the fact and determine the tampering. This is all before even getting into the topic of potential malware infections, running as a TOR exit node, being used for torrent hosting unbeknownst to the user, etc. There was a case many years ago and I wish I could find the reference to it in which the defense called in an expert witness who convinced the judge to have his machine inspected by a forensic analyst who found it clear of pictures of kittens. The expert witness then had the judge visit an 'innocuous' looking website which didn't have pictures of kittens visible, but loaded them in hidden iFrames. The system was then inspected again by the forensics analyst who then found pictures of kittens, the point being that when your computer is connected to the Internet it really isn't your computer anymore.
- cmurf 10y ago
  The whole repair process is fraught with liability whether the customer is the target of a criminal investigation or not. In either case, you'd probably need to image the drive as a first step, and then date stamp, hash, and then sign the date and hash. Or use something like dm-verity. Maybe the physical handling of drive removal and putting it on a docking station for imaging is video'd and that video is also verifiable (mainly you'd want a system that ensures whole frames aren't deleted..i.e. oh hey I see 5 seconds were yanked here and over here, so conceivably the drive was removed and returned to the docking station and altered prior to imaging). Also, as COW filesystems become more common (ReFS, AFS, ZFS, Btrfs) there will be a lot of stale metadata that is non-trivial to fake. Basically snapshots are constantly being taken, even if they are not preserved for very long. On an SSD ostensibly these unused blocks get trimmed and should immediately return zeros, but there might be modes were they return stale data instead if it's before erase block GC/erasure happens. Edit: And now you have this copy of the customer's drive... itself a liablity for it to exist for very long, or deleted too soon. dm-verity at least does produce a read-only encrypted image so the liability is both access to the image and the security of that image's passphrase.
  - shakna 10y ago
    Make sure you add a write blocker to that process, in fact, if you're doing anything like this, why not follow the forensic process?
    - patcheudor 10y ago
      Ultimately the Geek Squad does not follow any forensics process & that's why using them or anyone else in the computer repair space is dubious when it comes to collecting any evidence of a crime. They may be able to provide leads, but anything they uncover should not be usable in a court or alone be grounds for arrest.
      - shakna 10y ago
        I absolutely agree with that. I worked in forensics until I lost all faith and humanity, and pivoted for sanity's sake. The least flaw in the forensic process, which was always discussed in-court by lawyers who I suspect could barely use Outlook always resulted in the evidence being turfed. That due process doesn't seem to be followed here, and if a search is to be used as evidence, it better damn well follow some decent practices!
        patcheudor 10y ago
        Honestly, even with the best computer forensics in the world I still have a hard time trusting anything found mostly because I find 0-days every week that the forensics community won't know about for years. It's pretty hard if not possible to say if something got a computer because of the user or because of the Internet.
        shakna 10y ago
        To be honest, most forensic cases are slam dunks. If it's a CP case, then, generally speaking, it's 500GB+. Usually enough so that the user has repeatedly deleted old files because their hard drive was getting full. The files are rarely encrypted, and gathered over years from sources like FTP, SMTP and the like - and those logs are the main evidence. A user is unlikely to not notice that 50GB of data is appearing once a week, and unlikely to not notice that the person they are conversing with has also been given similar charges, because their email has them talking about it, and when it comes to court, you find out that they were regularly seen with the other person.
- bsder 10y ago
  > Chain of custody should play a big factor here. Yeah, I'm very surprised this didn't immediately get thrown out with a "They're FBI informants and they planted the information to get paid." However, I suspect this is all a gambit to overturn the investigation results that followed so it probably isn't that clear cut.
Someone1234 10y ago
Why has law enforcement suddenly become allergic to warrants? Warrants used to be a rather boring, but important, process that police had to fulfil to show that they had even a very flimsy case. Now it seems like law enforcement and politicians who serve their whims are outright pushing to remove the warrant requirements from as much as possible. But why now? Warrants aren't new and the landscape hasn't changed that much, why are law enforcement suddenly pushing so hard on this? Is this just a general theme on the broader problem of police oversight (or lack thereof)? This is one of the few areas of actual oversight left (judicial) so they're trying to remove that too.
- jstanley 10y ago
  The landscape has changed hugely since 50 years ago. Individuals now have a lot more power than ever before thanks to the proliferation of technology, and individuals who want to subvert the aims of the state have a greater chance of doing so than ever. The state is beginning to recognise this and is taking steps to try to claw back some power.
  - btilly 10y ago
    The state is beginning to recognise this and is taking steps to try to claw back some power. My perception is opposite. Over the last 20 years we have gone from a fairly free country to what feels like a police state with the most effective surveillance in history. Are you actually familiar with, for example, the extent of Snowden's revelations? What an erosion of liberty the Patriot act is? Or how unusual it used to be to see armed security guards in random office buildings?
    - jstanley 10y ago
      Yes. These measures are being taken because individuals are getting more powerful. In the long run, I don't think the state is going to succeed, but it will be an arms race for a while.
      - btilly 10y ago
JoeAltmaier 10y ago
He was paid to ... by the customer, right? So that's the crux of it - can he be the paid agent of the customer and the FBI?
- Floegipoky 10y ago
  No, he was not paid by the customer, he was paid by Best Buy. The customer paid Best Buy, but the tech would still get the same paycheck if that customer had chosen a different repair shop. The repair tech is not incentivized in any way to show loyalty towards the customer unless their manager enforces it somehow. But as the article discusses, the manager, Meade, has accepted money from the FBI (and then lied about it, of course in a way that does not expose him legally).
true_religion 10y ago
That made me think.... what if instead of finding a search warrant, the FBI shows up at your door and tells your roommate "we want to search this place, here's 50 dollars". What if the police go a step further and start offering money to criminals to allow searches. Soon, you'll see people choosing to get busted in order to get an FBI payday, while the FBI can tout their high closed case rate.
- randcraw 10y ago
  Likewise, if a cable installer or plumber paid by the police enters your home, could they legally search it? Obviously not. But there's still confusion in the courts about the difference between physical and virtual property and the peoples' rights to escape search (using radar through walls or taps on data feeds). This malign overreach of prosecutors relies on that. But I think this practice clearly crosses the line since the property is physically in the hands of an untrusted party. It'd be trivial for Joe Schmo at Best Buy to plant evidence. Because that possibility is so plausible, this chain of evidence has been compromised. Any appeals court would toss this practice as unlawful, IMHO.
  - funkymike 10y ago
    It goes even farther than Joe Schmo at Best Buy not being trusted. They are being paid to find "evidence." That direct conflict of interest should invalidate anything they find.
  - gozur88 10y ago
    The chain of evidence thing really only applies if the government intends to present that evidence in court. Whether or not this constitutes an unlawful search is a separate question.
- gozur88 10y ago
  >That made me think.... what if instead of finding a search warrant, the FBI shows up at your door and tells your roommate "we want to search this place, here's 50 dollars". That's actually legal. The catch is they can only search the areas of the home the roommate "controls", meaning anything they find in a shared space like the bathroom or kitchen is legal, but your roommate can't consent to a search of your bedroom if that's understood to be your space. I think it gets dicey if you left the bedroom door open and they can see evidence of a crime from the hallway. If your wife or live-in girlfriend consents to a search the entire place is fair game, though if your wife is willing to sell you out for fifty bucks you have more than one set of problems.
Ajedi32 10y ago
> Given that the file in question was in the deleted free space, the technician didn't just stumble into it accidentally and then report it That's not necessarily true: > Prosecutors said that the Geek Squad technician who searched the unallocated space was merely trying to recover all the data Rettenmaier had asked to be restored. So in this case it sounds like the reason Best Buy had the hard drive in the first place was to recover other (possibly deleted) files on the disk. In such a scenario it seems totally plausible that they might stumble across other, more incriminating deleted files as part of the recovery process.
zodiac 10y ago
> the police can simply hire anyone who is not a LEO to conduct a warrantless search on their behalf. It's clearly illegal for private individual A to search the computer of private individual B without B's consent though
- dragonwriter 10y ago
  > It's clearly illegal for private individual A to search the computer of private individual B without B's consent though So what? If such illegally gained evidence is not excluded (and private illegality doesn't trigger the exclusionary rule), and the public prosecuting authority (who benefits from the illegality, as it serves the case they want to prosecute) declines to prosecute the illegality, it's at worst, for the perpetrator, a matter of civil tort liability.
dllthomas 10y ago
> If this is found to be permitted, then search warrants are no longer necessary in many situations since the police can simply hire anyone who is not a LEO to conduct a warrantless search on their behalf. There is a distinction to be made that a warrant often authorizes behavior that would otherwise be unlawful in the first place - which this doesn't really seem to be. That's not to say that I think this is okay.

patcheudor 10y ago

Chain of custody should play a big factor here. Between the accused and the technician how many people had access to that system? Further, since the technician is paid when something is found, what is the motivation for the technician to not plant evidence? It's trivial to plant evidence on a hard-drive to the point that if done properly it's impossible for a forensics investigator to come in after the fact and determine the tampering. This is all before even getting into the topic of potential malware infections, running as a TOR exit node, being used for torrent hosting unbeknownst to the user, etc. There was a case many years ago and I wish I could find the reference to it in which the defense called in an expert witness who convinced the judge to have his machine inspected by a forensic analyst who found it clear of pictures of kittens. The expert witness then had the judge visit an 'innocuous' looking website which didn't have pictures of kittens visible, but loaded them in hidden iFrames. The system was then inspected again by the forensics analyst who then found pictures of kittens, the point being that when your computer is connected to the Internet it really isn't your computer anymore.

cmurf 10y ago
The whole repair process is fraught with liability whether the customer is the target of a criminal investigation or not. In either case, you'd probably need to image the drive as a first step, and then date stamp, hash, and then sign the date and hash. Or use something like dm-verity. Maybe the physical handling of drive removal and putting it on a docking station for imaging is video'd and that video is also verifiable (mainly you'd want a system that ensures whole frames aren't deleted..i.e. oh hey I see 5 seconds were yanked here and over here, so conceivably the drive was removed and returned to the docking station and altered prior to imaging). Also, as COW filesystems become more common (ReFS, AFS, ZFS, Btrfs) there will be a lot of stale metadata that is non-trivial to fake. Basically snapshots are constantly being taken, even if they are not preserved for very long. On an SSD ostensibly these unused blocks get trimmed and should immediately return zeros, but there might be modes were they return stale data instead if it's before erase block GC/erasure happens. Edit: And now you have this copy of the customer's drive... itself a liablity for it to exist for very long, or deleted too soon. dm-verity at least does produce a read-only encrypted image so the liability is both access to the image and the security of that image's passphrase.
- shakna 10y ago
  Make sure you add a write blocker to that process, in fact, if you're doing anything like this, why not follow the forensic process?
  - patcheudor 10y ago
    Ultimately the Geek Squad does not follow any forensics process & that's why using them or anyone else in the computer repair space is dubious when it comes to collecting any evidence of a crime. They may be able to provide leads, but anything they uncover should not be usable in a court or alone be grounds for arrest.
    - shakna 10y ago
      I absolutely agree with that. I worked in forensics until I lost all faith and humanity, and pivoted for sanity's sake. The least flaw in the forensic process, which was always discussed in-court by lawyers who I suspect could barely use Outlook always resulted in the evidence being turfed. That due process doesn't seem to be followed here, and if a search is to be used as evidence, it better damn well follow some decent practices!
      - patcheudor 10y ago
        Honestly, even with the best computer forensics in the world I still have a hard time trusting anything found mostly because I find 0-days every week that the forensics community won't know about for years. It's pretty hard if not possible to say if something got a computer because of the user or because of the Internet.
        shakna 10y ago
        To be honest, most forensic cases are slam dunks. If it's a CP case, then, generally speaking, it's 500GB+. Usually enough so that the user has repeatedly deleted old files because their hard drive was getting full. The files are rarely encrypted, and gathered over years from sources like FTP, SMTP and the like - and those logs are the main evidence. A user is unlikely to not notice that 50GB of data is appearing once a week, and unlikely to not notice that the person they are conversing with has also been given similar charges, because their email has them talking about it, and when it comes to court, you find out that they were regularly seen with the other person.
bsder 10y ago
> Chain of custody should play a big factor here. Yeah, I'm very surprised this didn't immediately get thrown out with a "They're FBI informants and they planted the information to get paid." However, I suspect this is all a gambit to overturn the investigation results that followed so it probably isn't that clear cut.

Someone1234 10y ago

Why has law enforcement suddenly become allergic to warrants? Warrants used to be a rather boring, but important, process that police had to fulfil to show that they had even a very flimsy case. Now it seems like law enforcement and politicians who serve their whims are outright pushing to remove the warrant requirements from as much as possible. But why now? Warrants aren't new and the landscape hasn't changed that much, why are law enforcement suddenly pushing so hard on this? Is this just a general theme on the broader problem of police oversight (or lack thereof)? This is one of the few areas of actual oversight left (judicial) so they're trying to remove that too.

jstanley 10y ago
The landscape has changed hugely since 50 years ago. Individuals now have a lot more power than ever before thanks to the proliferation of technology, and individuals who want to subvert the aims of the state have a greater chance of doing so than ever. The state is beginning to recognise this and is taking steps to try to claw back some power.
- btilly 10y ago
  The state is beginning to recognise this and is taking steps to try to claw back some power. My perception is opposite. Over the last 20 years we have gone from a fairly free country to what feels like a police state with the most effective surveillance in history. Are you actually familiar with, for example, the extent of Snowden's revelations? What an erosion of liberty the Patriot act is? Or how unusual it used to be to see armed security guards in random office buildings?
  - jstanley 10y ago
    Yes. These measures are being taken because individuals are getting more powerful. In the long run, I don't think the state is going to succeed, but it will be an arms race for a while.
    - btilly 10y ago

JoeAltmaier 10y ago

He was paid to ... by the customer, right? So that's the crux of it - can he be the paid agent of the customer and the FBI?

Floegipoky 10y ago
No, he was not paid by the customer, he was paid by Best Buy. The customer paid Best Buy, but the tech would still get the same paycheck if that customer had chosen a different repair shop. The repair tech is not incentivized in any way to show loyalty towards the customer unless their manager enforces it somehow. But as the article discusses, the manager, Meade, has accepted money from the FBI (and then lied about it, of course in a way that does not expose him legally).

true_religion 10y ago

That made me think.... what if instead of finding a search warrant, the FBI shows up at your door and tells your roommate "we want to search this place, here's 50 dollars". What if the police go a step further and start offering money to criminals to allow searches. Soon, you'll see people choosing to get busted in order to get an FBI payday, while the FBI can tout their high closed case rate.

randcraw 10y ago
Likewise, if a cable installer or plumber paid by the police enters your home, could they legally search it? Obviously not. But there's still confusion in the courts about the difference between physical and virtual property and the peoples' rights to escape search (using radar through walls or taps on data feeds). This malign overreach of prosecutors relies on that. But I think this practice clearly crosses the line since the property is physically in the hands of an untrusted party. It'd be trivial for Joe Schmo at Best Buy to plant evidence. Because that possibility is so plausible, this chain of evidence has been compromised. Any appeals court would toss this practice as unlawful, IMHO.
- funkymike 10y ago
  It goes even farther than Joe Schmo at Best Buy not being trusted. They are being paid to find "evidence." That direct conflict of interest should invalidate anything they find.
- gozur88 10y ago
  The chain of evidence thing really only applies if the government intends to present that evidence in court. Whether or not this constitutes an unlawful search is a separate question.
gozur88 10y ago
>That made me think.... what if instead of finding a search warrant, the FBI shows up at your door and tells your roommate "we want to search this place, here's 50 dollars". That's actually legal. The catch is they can only search the areas of the home the roommate "controls", meaning anything they find in a shared space like the bathroom or kitchen is legal, but your roommate can't consent to a search of your bedroom if that's understood to be your space. I think it gets dicey if you left the bedroom door open and they can see evidence of a crime from the hallway. If your wife or live-in girlfriend consents to a search the entire place is fair game, though if your wife is willing to sell you out for fifty bucks you have more than one set of problems.

Ajedi32 10y ago

> Given that the file in question was in the deleted free space, the technician didn't just stumble into it accidentally and then report it That's not necessarily true: > Prosecutors said that the Geek Squad technician who searched the unallocated space was merely trying to recover all the data Rettenmaier had asked to be restored. So in this case it sounds like the reason Best Buy had the hard drive in the first place was to recover other (possibly deleted) files on the disk. In such a scenario it seems totally plausible that they might stumble across other, more incriminating deleted files as part of the recovery process.

zodiac 10y ago

> the police can simply hire anyone who is not a LEO to conduct a warrantless search on their behalf. It's clearly illegal for private individual A to search the computer of private individual B without B's consent though

dragonwriter 10y ago
> It's clearly illegal for private individual A to search the computer of private individual B without B's consent though So what? If such illegally gained evidence is not excluded (and private illegality doesn't trigger the exclusionary rule), and the public prosecuting authority (who benefits from the illegality, as it serves the case they want to prosecute) declines to prosecute the illegality, it's at worst, for the perpetrator, a matter of civil tort liability.

dllthomas 10y ago

> If this is found to be permitted, then search warrants are no longer necessary in many situations since the police can simply hire anyone who is not a LEO to conduct a warrantless search on their behalf. There is a distinction to be made that a warrant often authorizes behavior that would otherwise be unlawful in the first place - which this doesn't really seem to be. That's not to say that I think this is okay.