ingraham.html

CFP'91 - Ingraham

Coming of Age in Cyberspace; or, perspectives of a provincial prosecutor on the protection of privacy, freedom, and property in the increasingly settled electronic frontier

Donald G. Ingraham

Assistant District Attorney and leader of the High Tech Crime Team
Office of the District Attorney of Alameda County
Oakland, California

The purpose of this paper is to add some shading to the enticing image that exudes a fascinating if wholly fictitious mirage: the illusion is that there exists, somewhere over the modem, an on-line Oz known as Cyberspace, that all things must be allowed there or it will be lost forever, and that any restraint of those who inhabit it is inherently oppressive, illegitimate, and improper. Cyberspace seems to have become for some computer users not just an ideal, but an alternate reality not unlike the realms of Dungeons and Dragons: a great place to visit but a dangerous place by which to be obsessed.

The reality is that Cyberspace, to the extent that the term applies to the free use of the growing electronic network of systems and storage, is not a frontier in any accepted sense of the term "frontier". The Oxford recognizes as a U.S. definition: "..that portion of a country which forms the border of its settled or inhabited regions: as (before the settlement of the Pacific coast), the western frontier of the United States." It is interesting, at least to this prosecutor, that the earliest use of the term comes from Caxton: "To kepe the frounters of the realme fro perylle of enemyes".

Assuming that words are used with precision and for the purpose of communicating valid concepts, it follows that the idea sought to be conveyed by reference to an "electronic frontier hypothesis", it is immediately clear that there are two aspects which have been denied their due: first, that there is "perylle of enemyes", the existence of which comes with the territory; second, that critical to the meaning of the term is that the area regarded as a frontier is unsettled.

Starting with the second aspect, that the alleged frontier be unsettled, this is blatantly untrue as applied to "the Net". (It is also true that no LAN is an island.) There is no activity in ether: the allegedly illicit traffic that has resulted in seizures of property and prosecutions has all taken place along phone lines and has required access to systems belonging to identifiable individuals. We are not discussing space at all, but structure. And that structure was not stumbled upon and held by squatters, but represents the serious and often strenuous efforts of those who "settled" what could be considered, to probably poach a phrase, the "cyberian opportunity".

As a historical note, prompted by the Century Dictionary's reference to the Pacific Coast, at least a tinge of shame should accompany the reflection that our ancestor's treatment of California as "unsettled frontier" led to the near extermination of the most populous indigenous American race and the destruction of their culture. Extending the reflective mood, one might also consider that the impact of industry and population on the less sapient members of our environment over the past few years has not been wholly benign either. Our society no longer accepts "unsettled" as once it did: Prince William Sound was not ignored for want of high-rises.

If the term "Electronic Frontier" means anything, it must mean not that it is unsettled in the sense of occupied, but unsettled in the sense whether the legal and social rules that apply to it have all been resolved. It is also unsettled in the sense of completed, but as it is uncontroverted that our technical abilities to move in and manipulate "Cyberia" are unlikely ever to be finally exhausted, so technical creativity can hardly be the frontier of our concern.

The law moves by analogy: as Oliver Wendell Holmes Jr. noted in The Common Law, the life of the law is not logic, but experience. As "the Net", which by way of compromise goes by the alias of Cyberia herein, is in many ways serving our communication needs today as did the canals and rivers when the Bill of Rights was young, it may be appropriate to regard them as legally similar enough to validate the need to regulate the traffic, to control its pollution, and protect the property rights of the riparian users. Whether that analogy holds, our commerce in the Cyberia has had experience with pirates and predators. We were before the advent of the personal computer, and we are now. This is not the crime of the future. We are confronted with the problem of legal and social rules right here and now. We are face to face with the "perylle of enemyes" that Caxton reported.

There is no doubt that one continuing enemy is arbitrary government: it is the peril that produced this nation, and has received the unrelenting attention of our Courts, legislatures, and press, as well as unofficial later organizations of which the American Civil Liberties Union is perhaps the best known. The Electronic Frontier Foundation and the Computer Professionals for Social Responsibility are in good company, but it should be remembered that concern over government is nothing new in these parts.

There are other perils on this "frontier", as there have always been. Cain was raised not far from the Eden that had been. Even before Caxton it was the function of law to identify and define these perils, the function of law enforcement to investigate and control their practice, and the function of the Courts to determine the truth of accusations and impose punishments.

In 1980 the Computer/Law Journal published an article by this writer that began:

"The first myth about computer crime is that it exists; the second is that it does not matter...the criminal use of computer technology has increased the vulnerability of the community, and to the extent that the definition of crimes and the enactment of prohibitions is directed to the protection of the community, computer technology is a legitimate area of penal concern."(1)

From a more creditable source, the Legislature of the State of California declared:

"It is the intent of the Legislature in enacting this section to expand the degree of protection afforded to individuals, businesses, and governmental agencies from tampering, interference, damage and unauthorized access to lawfully created computer data and computer systems. The Legislature finds and declares that the proliferation of computer technology has resulted in a concomitant proliferation of computer crime and other forms of unauthorized access to computers, computer systems, and computer data.

The Legislature further finds and declares that protection of the integrity of all types and forms of lawfully created computers, computer systems, and computer data is vital to the protection of the privacy of individuals as well as to the well-being of financial institutions, business concerns, governmental agencies, and others within this state that lawfully utilize those computers, computer systems, and computer data." (2)

There is an often expressed concern that the state is "criminalizing the use of computers:" it is doing no such thing. Every form of criminality found in Cyberia was preying on people long before Pascal got off pablum. In historic sequence, what has really happened is that crime has become computerized. The theories of the law and of the prosecution still turn on concepts of theft, extortion, trespass, and harassment that were known to Moses and to Hammurabi. Only the means have changed.

But the technology into which crime has moved has created new challenges for law enforcement, and the measures that have been taken in addressing those technical problems have prompted serious concern from a wide range of computer users. The fact is that a crime against a legitimate computer user is likely to have been perpetrated by means of a computer. The evidence of that crime is likely to be found in the victim's computer and particularly in the criminal's computer or in a system to which she or he had access.

Every crime has a victim, or it would not be a crime. There was a brief fad for discussion of so-called "victimless crimes", but it faded with the flowers of Haight- Ashbury, and in the present cocaine winter it is as likely of resurrection as the Nehru jacket. So far as the National Center for Computer Crime Data has ascertained, only Georgia among the fifty-one jurisdictions in the United States has a law requiring the reporting of a computer-related crime. The NCCCD further reports that that section, Georgia Criminal Code section 26-9954a, has had no reported use; this writer once proposed a similar requirement to the California legislature, limited to cases involving an invasion of personal privacy or a loss of over $50,000. It never saw print.

To open an investigation into a computer-related crime there must be a report by the victim. The police are no more able to monitor or detect such crimes without the request of a witness or victim than they could monitor instances of rape, or other violations of personal rights.

An investigation generally turns on two sources of evidence: from the victim, or from the suspect. The Fourth Amendment protects the suspect from unreasonable search and seizure by requiring that the prosecution be prepared to prove that the suspect's rights were respected. Admirers of Horace Rumpole are familiar with the presumption of innocence, which is the golden thread that runs through the English Common Law; devotees of James Madison, particularly those resident in this County, should be equally familiar with a concept that could be called the azure snag, which runs throughout the fabric of our criminal law, and is derived from our experience with Rumpole's forbears- the assumption of insolence. This assumption of insolence -that a government functionary is likely to have overstepped her or his authority- is the logical and operational result of the exclusionary rule, and applies to the judicial determination whether a certain item of evidence is to be admitted into evidence for the consideration of the trier of fact. It is not a question of relevance or competence: it is a challenge to the propriety of its acquisition.

If there is not a Search Warrant, the burden of showing that the officer acted properly and did not exceed his or her authority is on the prosecution; if there is a Search Warrant, the defense is still free to show that it was either obtained falsely or executed excessively. Those determinations must be made before the question of guilt or innocence is even addressed, the defense is entitled to counsel and to confrontation as well as to introduce evidence, and the Court's decisions are subject to appellate review.

The Fourth Amendment requires that the magistrate from whom the Search Warrant is obtained be neutral and detached from the case, and that the warrant describe with particularity the places to be searched, and the persons or things to be seized. The sufficiency of the particularity is an issue for judicial review: the rule is that the law enforcement agency seeking the warrant must provide all the information available. The Courts have interpreted the rule require that the applicant for the warrant include not only the details which justify the warrant, but also every fact that the magistrate should have in weighing the credibility of the information and in narrowing the scope of the search.

Any search requires an intrusion into privacy. That is why Madison and his colleagues, many with personal experience of the Hessian tactics of the occupation and the abuses of the writs of assistance, although necessarily accepting the need for searches as a means of investigating crime, crafted the Fourth Amendment. Searches have always intruded into privacy, and always will. Indeed, in legal theories on the concepts of 'plain view' and 'open fields', the critical question is whether there was a reasonable expectation of privacy that society (i.e. the Courts) respect.

One of the troublesome facets of crime by computer is that the evidence, though legally seizable once the Forth is met, is not readily recognizable. A gun is a gun, and a bloodstain a bloodstain: there are preliminary field tests for controlled substances, but subsequent laboratory analyses are necessary for such evidence to be admitted in Court. Evidence in the form of data on a disk or other media presents other problems. These are not problems that have been ignored: the California legislature was once offered a proposal for a Constitutional amendment which would require that a Search Warrant for electronically stored data particularly describe its address. When it was pointed out that that the term "address" has a particular meaning in the context of computers, and that only the computer would or could know the address in that sense, and that even a requirement that the file name be specified was impossible to implement, the proposal was dropped. There seems to be no compelling reason to grant privileged status to criminals who are distinguishable from other criminals only in having access to a computer. In fact, privilege -literally, private law- is not a status of which Courts are fond. The Watergate and Iran-Contra experiences were not without value.

A particularly curious defense theory has been that data as such was not really property in any legal sense, but in electronic garb was divested of legal protection; by making it vulnerable, the owner made it free for the finagling (or "phinagling"). A curious notion, given the costs of obtaining information and the realties of economics, but one which was nurtured in academe, and persists to this day as part of the "hacker ethic" , according to Steven Levy in HACKERS: Heroes of the Computer Revolution where it is stated as "Access to computers- and anything which might teach you something about the way the world works- should be unlimited and total. Always yield to the Hands-On Imperative! All Information should be free." This concept, dressed in a suit, was urged in the Ward case in opposition to a prosecution and a civil suit over the theft of a proprietary program, a trade secret, where it failed to convince the judge and was flatly rejected by a Santa Clara County (the heart of Silicon Valley) jury. It resurfaced in a phase of the Sundevil prosecutions, the recent Neidorf case, where it was again rejected, this time by Federal Judge Nicholas Bua: "The accessibility of information in a readable form from a particular storage place also makes the information tangible, transferable, salable.."(3) who concluded that such information was capable of being stolen and transported in interstate commerce. The medium, contrary to McLuhan, is not the content. Not in the law, which had no trouble in distinguishing legal interests from corporeal objects at least since Coke, and does not seem to have any trouble now. Those who believe that the law has catching up to do are right in some areas, but have forgotten perhaps the metaphysical origins of that calling. Issues of intellectual property protection are the living tissue of a great deal of litigation in the area of computer-related crime, but are beyond the scope of this conference and this paper.

Nevertheless, the possibility that police, even having obtained authority from a Court, may be sniffing through one's files is not a comfortable reflection. There is little satisfaction in the knowledge that Charles Manson got the same treatment. One would like some time to tidy up, remove material in which the police would not be interested. And, as could be anticipated, exactly that was once proposed to the California legislature. The idea was that even with a neutral magistrate and all, getting a Search Warrant was still a one-handed game, and in the interests of the adversary system and all-around fairness, the subject should have the opportunity to oppose the issuance of the warrant before it is executed, rather than have to attack it after it is served and the evidence obtained. When it was pointed out that the subject might very well abuse the advance notice to move the evidence, the only response that was developed proposed to deter such abuse by making any such activity a separate crime. The problems of proving such a crime proved too great, and the proposal was dropped.

There is, nevertheless, legitimate concern whether noncriminal material could be seized, as it surely could be; and whether the possibility of such seizure result in chilling and even denying the right of the person whose files are seized to fully participate in the electronic agora Cyberia affords.

The concept of untrammeled exchange of ideas is not new: the late Desiderus Erasmus counted himself a citizen of a "Republic of Letters" that stretched all over Europe, vaulting borders and dynastic clashes. Our own Republic is marking the 200th anniversary of withholding from its government the power of "..abridging the freedom of speech, or of the press...". The philosophy that communication should be untrammeled is not new; the only new aspect which concerns us today is that we can communicate immediately (or covertly plant a communication for later "delivery"), anonymously, and from any distance.

With the possibility of the abuse of electronic communications to plant Trojan horses, computer contaminants, and other invasions of another's system, the old adage of the harmlessness of words, as distinct from the breakage potential of sticks and stones, is recognizably more ignorant than ever. Some forms of speech have always been controlled: compromises of national security, libel, slander, threats. Some forms of mischievous speech have been singled out: Justice Holmes concern about crying "fire" in a crowded theatre, simplistic at best, would still apply to sneaking in instructions that would trigger the sprinklers. Communications in electronic format can and have caused loss and injury, and are clearly the proper concern of the law. The proof is that 49 States and Congress have passed specific laws identifying illegal computer activity.

That the steps necessary to criminal investigation may risk compromising protected freedoms is not a new concern that came shrink-wrapped with the first computer: it is the very stuff that American Law is made of, and the scales borne by Lady Justice are not an inappropriate symbol of the continuing effort to balance the concerns of the State with the rights of the Individual.

On the 200th anniversary of our Bill of Rights it might not be inappropriate to scroll up to the top of the document which is amended by those limitations on the power of government: the Bill of Rights and the decisions are analogous to system upgrades, but the purpose of our system remains as originally contracted:

...establish Justice, insure domestic Tranquility, provide for the common defence, promote the general Welfare, and secure the Blessings of Liberty to ourselves and our Posterity..."

The legislatures are doing their jobs; the training of law enforcement in computer- related crime investigation is steadily expanding, with new hands-on courses being developed by the SEARCH Group for local law enforcement nationwide, augmenting courses already taught by the Federal Bureau of Investigation, the Internal Revenue Service, and the Secret Service for their personnel. A major portion of all of those courses addresses the legal problems and their solutions. If there is a problem in this area, it may be not as attributable to a lack of computer literacy in law enforcement as to a lack of legal literacy in the computer milieu.

It is important to defend civil rights; it is also important to acknowledge civil responsibilities, particularly if one is in a position to exemplify ethics and serve as a role model not only to ones peers, but also to the young people who wandered in from the Marvel Universe and the fields of Gygax. Cyberia is what we have in common, the players and the bystanders and those that don't even know what game is being played. The odds of being a victim far exceed those of being a suspect. What is needed for a start may well be the acceptance by sociable professionals in the field to accept some role in developing computer responsibility. Just as the law is too important to be left to the lawyers, Cyberspace -however one defines it- is too important to be left to computer frontiersmen: it is the world we share, the only one we've got.

You ought not to practice childish ways,
since you are no longer that age.

Homer, The Odyssey, book I, line 296.

1 Computer/Law Journal, Volume 2, No. 2; reprinted in Parker, Fighting Computer Crime, Scribner, 1983.

2 California Penal Code, Section 502.

3 2 CCH Computer Cases 62,411.

Copyright, 1991, Jim Warren & Computer Professionals for Social Responsibility All rights to copy the materials contained herein are reserved, except as hereafter explicitly licensed and permitted for anyone: Anyone may receive, store and distribute copies of this ASCII-format computer textfile in purely magnetic or electronic form, including on computer networks, computer bulletin board systems, computer conferencing systems, free computer diskettes, and host and personal computers, provided and only provided that:

this file, including this notice, is not altered in any manner, and
no profit or payment of any kind is charged for its distribution, other than normal online connect-time fees or the cost of the magnetic media, and
it is not reprodunor distributed in printed or paper form, nor on CD ROM, nor in any form other than the electronic forms described above without prior written permission from the copyright holder.