File000116

Module III - Searching and Seizing
Computers

EC-Council
Copyright © by EC-Council
All Rights Reserved. Reproduction is Strictly Prohibited
News: Newton Man Held in
Canada on Pornography Charges
Source: http://www.eagletribune.com/
Published: October 18, 2008 12:00 am
NEWTON, N.H. — A local resident is behind bars in Canada for allegedly bringing child pornography into that country.
John Bird, of 4 Brimstone Circle, allegedly flew into Ottawa International Airport on Monday with a large number of
pornographic images in his possession, Newton police Sgt. Mike Jewett said. Some of that was child pornography, he said.
The Canada Border Services Agency charged Bird, 61, with smuggling prohibited material into Canada, The Ottawa Sun
reported Thursday. Ottawa police charged him with possession and importation of child pornography.
The arrest was made after officers looked at Bird's computer memory stick, according to The Ottawa Sun. Jewett said Bird
had three memory sticks in his possession at the time of his arrest.
Newton police were contacted by law enforcement officials in Canada yesterday, and were asked to conduct a search of Bird's
home, Jewett said. He received a search warrant from the court and went to the Brimstone Circle residence just before 5
p.m. yesterday.
He was accompanied by officers from U.S. Immigration and Customs Enforcement and a computer forensics specialist from
the Portsmouth Police Department. The Rockingham County Attorney's Office also assisted, Jewett said.
Paula Grenier, an Immigration Customs Enforcement spokeswoman, said her agency was just assisting and that it was
Newton's case.
Jewett said last night police seized six computers from Bird's home, five of them laptops. They also took a small amount of
marijuana and some miscellaneous computer parts, he said.

EC-Council
Module Objective
• Searching and Seizing Computers without a Warrant
• The Fourth Amendment’s “Reasonable Expectation of Privacy”
• Consent
• Private Sector Workplace Searches
• Searching and Seizing Computers with a Warrant
• Basic Strategies for Executing Computer Searches
• The Privacy Protection Act
• Drafting the Warrant and Affidavit
• Post-Seizure Issues
• The Electronic Communications Privacy Act
• Voluntary Disclosure
• Electronic Surveillance in Communications Networks
• Content vs. Addressing Information
• Evidence
• Authentication
This module will familiarize you with:

EC-Council
Module Flow
Drafting the Warrant
and Affidavit
Voluntary Disclosure
The Electronic
Communications
Privacy Act
Evidence
Content vs. Addressing
Information
Electronic Surveillance
in Communications
Networks
Post-Seizure Issues
Authentication
Fourth Amendment’s
“Reasonable Expectation
of Privacy”
Searching and Seizing
Computers without
a Warrant
The Privacy Protection
Act
Consent
Basic Strategies for
Executing Computer
Searches
Private Sector
Workplace Searches
Searching and Seizing
Computers with
a Warrant

EC-Council
Searching and Seizing Computers
without a Warrant

EC-Council
without a Warrant
The Fourth Amendment of USA PATRIOT Act of 2001 limits the ability of
government agents to search for evidence without a warrant
If the government’s conduct does not violate a person’s “Reasonable
Expectation of Privacy,” then formally it does not constitute a Fourth
Amendment “search” and no warrant is required

EC-Council
§ A: Fourth Amendment’s “Reasonable
Expectation of Privacy” in Cases Involving
Computers: General Principles
A search is constitutional if it does not violate a person’s
“reasonable” or “legitimate” expectation of privacy
Katz v. United States, 389 U.S. 347, 362 (1967) (Harlan, J.,
concurring). This inquiry embraces two discrete questions:
• First, whether the individual’s conduct reflects “an actual
(subjective) expectation of privacy,”
• Second, whether the individual’s subjective expectation of privacy
is “one that society is prepared to recognize as ‘reasonable.’”

EC-Council
§ A.1: Reasonable Expectation of Privacy
in Computers as Storage Devices
To determine whether an individual has a reasonable expectation of privacy in information stored in a computer, the
Fourth Amendment helps to treat the computer like a closed container such as a briefcase or file cabinet
The most basic Fourth Amendment question in computer cases is that whether an individual enjoys a reasonable
expectation of privacy in electronic information stored within computers/other electronic storage devices under the
individual’s control
When confronted with this issue, courts have analogized electronic storage devices to closed containers, and have reasoned
that accessing the information stored within an electronic storage device is akin to opening a closed container

EC-Council
§ A.3: Reasonable Expectation of
Privacy and Third-Party Possession
Individuals who retain a reasonable expectation of privacy in stored
electronic information under their control may lose Fourth Amendment
protections when they relinquish that control to the third parties

EC-Council
§ A.4: Private Searches
The Fourth Amendment does not apply to searches conducted by private parties
who are not acting as agents of the government
In United States v. Jacobsen, 466 U.S. 109 (1984), the Supreme Court presented
the framework that should guide agents seeking to uncover evidence as a result of
a private search
Even if courts follow the more restrictive approach, the information gleaned from
the private search will often be useful in providing the probable cause needed to
obtain a warrant for a further search
The fact that the person conducting a search is not a government employee does
not always mean that the search is “private” for Fourth Amendment purposes

EC-Council
§ A.5 Use of Technology to
Obtain Information
The government’s use of innovative technology to obtain
information about a target can implicate the Fourth
Amendment
Use by the government of innovative technology not in
general public use to obtain information stored on or
transmitted through computers or networks may implicate
this rule and thus may require a warrant

EC-Council
§ B: Exceptions to the Warrant Requirement
in Cases Involving Computers
• Consent
• Exigent Circumstances
• Search Incident to a Lawful Arrest
• Inventory Searches
• Border Searches
• International Issues
The following is a list of certain exceptions
that do not require a search warrant:

EC-Council
§ B.1: Consent
• First, when does a search exceed the scope of the consent?
• Second, who is the proper party to consent to a search? Do
roommates, friends, and parents have the authority to
consent to a search of another person’s computer files?
In computer crime cases, two consent
issues arise:

EC-Council
§ B.1.a: Scope of Consent
“The scope of a consent to search is generally defined by its expressed object, and is limited
by the breadth of the consent given.” United States v. Pena, 143 F.3d 1363, 1368 (10th Cir.
1998) (internal quotation omitted)
The standard for measuring the scope of consent under the Fourth Amendment is
objective reasonableness: “What would the typical reasonable person have understood by
the exchange between the [agent] and the [person granting consent]?”
The permitted scope of consent searches depends on the facts of each case

EC-Council
§ B.1.b: Third-Party Consent
• Any user of the computer equipment of common use, when presently
under his/her authority, may permit a search
General Rules
• The courts generally hold that either spouse may consent to search all
of the couple’s property
Spouses and
Domestic Partners
• Parents can consent to searches of their children’s rooms when the
children are under 18 years old. If the children are 18 or older, the
parents may or may not be able to consent, depending on the facts
Parents
• System administrators typically serve as agents of “provider's] of
electronic communication service” under the Electronic
Communications Privacy Act (“ECPA”), 18 U.S.C. §§ 2701-2712
System
Administrators

EC-Council
§ B.1.c: Implied Consent
Individuals often enter into agreements with the government in
which they waive some of their Fourth Amendment rights
Users of computer systems may waive their rights to privacy as a
condition of using the systems
According to the doctrine of the implied consent, consent to a search
may be inferred from an individual’s conduct

EC-Council
§ B.2: Exigent Circumstances
• The degree of urgency involved
• The amount of time necessary to obtain a Search and Seizure
Manual 19 warrant
• Whether the evidence is about to be removed or destroyed
• The possibility of danger at the site
• The information indicating that the possessors of the contraband
are aware that the police are on their trail
• The ready destructibility of the contraband
In determining whether exigent circumstances exist,
agents should consider:
Exigent circumstances often arise in computer cases because electronic
data is perishable

EC-Council
§ B.3: Plain View
Evidence of a crime may be seized without a warrant under the plain
view exception to the warrant requirement
The plain view doctrine does not authorize agents to open and view
the contents of a computer file that they are not otherwise
authorized to open and review

EC-Council
§ B.4: Search Incident to a
Lawful Arrest
Pursuant to a lawful arrest, agents may conduct a “full search” of the arrested
person, and a more limited search of his surrounding area, without a warrant
While a search of physical items found on the arrestee’s person may always
be reasonable, more invasive searches in different circumstances may violate
the Fourth Amendment

EC-Council
§ B.5: Inventory Searches
• First, the search must serve a legitimate, non-
investigatory purpose that outweighs the
intrusion on the individual’s Fourth Amendment
rights
• Second, the search must follow standardized
procedures
The two conditions are:
“Inventory searches” are reasonable and therefore
fall under an exception to the warrant requirement
when two conditions are met

EC-Council
§ B.6: Border Searches
According to the Supreme Court of the United States, “routine searches” at
the border or its functional equivalent does not require a warrant, probable
cause, or even reasonable suspicion that the search may uncover contraband
or evidence
Searches that are especially intrusive, however, require at least reasonable
suspicion
These rules apply to people and property both entering and exiting the
United States

EC-Council
§ B.7: International Issues
Electronic evidence necessary to prevent, investigate, or prosecute a crime may be located outside the
borders of the United States, as criminals can use the Internet to commit or facilitate crimes remotely
When United States authorities investigating a crime believe electronic evidence is stored by an Internet
service provider or on a computer located abroad (in “Country A”), U.S. law enforcement usually must
seek assistance from the law enforcement authorities in Country A
The Council of Europe Cybercrime Convention, completed in 2001, obligates all signatories to have the
ability to affect cross-border preservation requests, and the availability of this critical form of assistance
therefore is expected to increase greatly in the near future

EC-Council
§ C: Special Case: Workplace
Searches
• Often-subtle factual distinctions such as whether
the workplace is a public sector or private sector
• Whether employment policies exist that authorize
a search, and whether the search is work-related
Warrantless workplace searches
depend on:
In many cases, however, workplace searches will
implicate federal privacy statutes in addition to the
Fourth Amendment

EC-Council
§ C.1: Private Sector Workplace
Searches
Warrantless workplace searches occur often in computer cases and raise
unusually complicated legal issues
The rules for conducting warrantless searches and seizures in private-sector
workplaces generally mirror the rules for conducting warrantless searches in
homes and other personal residences
Private-sector employees will usually retain a reasonable expectation of privacy
in their office space
Although most non-government workplaces support a reasonable expectation
of privacy, agents can defeat this expectation by obtaining the consent of a
party

EC-Council
§ C.2: Public-Sector Workplace
Searches
Reasonable expectation of privacy in public workplaces
• The search must be work-related
• The search must be justified at its inception and
permissible in its scope
“Reasonable” workplace searches
under O’Connor v. Ortega:
Consent in public-sector workplaces

EC-Council
with a Warrant

EC-Council
with a Warrant
Despite the common legal framework, computer searches differ from other
searches because computer technologies frequently force agents to execute
computer searches in nontraditional ways
Searches for computer files tend to be more complicated

EC-Council
A: Successful Search with a
Warrant
Stem 1:
• Assemble a team consisting of the case agent, the prosecutor, and a technical
expert as far in advance of the search as possible
Step 2:
• Learn as much as possible about the computer system that will be searched before
devising a search strategy or drafting the warrant
Searching and seizing computers with a warrant is as much an art as a science.
In general, however, agents and prosecutors have found that they can maximize
the likelihood of a successful search and seizure by four steps:

EC-Council
A: Successful Search with a
Warrant (cont’d)
Step 3:
• Formulate a strategy for conducting the search (including a
backup plan) based on the known information about the targeted
computer system
Step 4:
• Draft the warrant, taking special care to describe the object of the
search and the property to be seized accurately and particularly,
and explain the possible search strategies (as well as the practical
and legal issues that help to shape it) in the supporting affidavit

EC-Council
A.1: Basic Strategies for
Executing Computer Searches
Plan the search
Computer searches may be executed in a variety of ways
For the most part, there are four possibilities:
• Search the computer and print out a hard copy of particular files at
that time
• Search the computer and make an electronic copy of the particular
files at that time
• Create a duplicate electronic copy of the entire storage device on-site,
and then later recreate a working copy of the storage device off-site
for review; and
• Seize the equipment, remove it from the premises, and review its
contents off-site

EC-Council
§ A.1.a: When Hardware is Itself
Contraband, Evidence, or an Instrumentality
or Fruit of Crime
When the hardware itself may be seized according to Rule 41, agents will
usually conduct the search by seizing the computer and searching it off-site
The agents should explain clearly in the supporting affidavit that they plan to
search the computer for evidence and/or contraband after the computer has
been seized and removed from the site of the search
Ex: A case where a system administrator of a computer network stores stolen
proprietary information somewhere in the network

EC-Council
§ A.1.b: When Hardware is Merely a
Storage Device for Evidence of Crime
The strategy for conducting a computer search is significantly
different if the computer hardware is merely a storage device for
evidence of a crime
In such cases, Rule 41(b):
• Authorizes agents to obtain a warrant to seize the electronic evidence
• Does not directly authorize the agents to seize the hardware that happens
to contain that evidence
As a practical matter, circumstances will often require
investigators to seize equipment and search its contents off-site

EC-Council
§ A.2: The Privacy Protection Act
• Before the Supreme Court decided Warden v. Hayden, 387 U.S. 294, 309 (1967), law enforcement
officers could not obtain search warrants to search for and seize “mere evidence” of crime. Warrants
were permitted only to seize contraband, instrumentalities, or fruits of crime
• This ruling set the stage for a collision between law enforcement and the press
• By freeing the Fourth Amendment from Boyd's restrictive regime, Hayden created the possibility that
law enforcement could use search warrants to target the press for evidence of crime it had collected in
the course of investigating and reporting news stories
Brief History:
When agents have reason to believe that a search may result in a seizure of materials relating to First
Amendment activities such as publishing or posting materials on the World Wide Web, they must
consider the effect of the Privacy Protection Act (“PPA”), 42 U.S.C. § 2000aa

EC-Council
§ A.2.a: The Terms of the
Privacy Protection Act
• (a) the materials are “work product materials”, 42 U.S.C. § 2000aa-7(b)(1)
• (b) the materials include “mental impressions, conclusions, or theories”, 42
U.S.C. § 2000aa-7(b)(3)
• (c) the materials are possessed for the purpose of communicating the
material to the public by a person, some form of “public communication,”
42 U.S.C. §§ 2000aa-7(b)(3), 2000aa(a)
Subject to certain exceptions, the PPA makes it
unlawful for a government officer “to search for or
seize” materials when:
Although the language of the PPA is broad, the statute contains several
exceptions

EC-Council
§ A.2.b: Application of the PPA to
Computer Searches and Seizures
• First, the use of personal computers for publishing and
the World Wide Web has dramatically expanded the
scope of who is “involved in First Amendment activities.”
• The second reason is that the language of the statute does
not explicitly rule out liability following incidental
seizures of PPA-protected materials, and such seizures
may result when agents search for and seize computer-
stored contraband or evidence of crime that is
commingled with PPA-protected materials
PPA issues frequently arise in
computer cases for two reasons:

EC-Council
§ A.2.b: Application of the PPA to
Computer Searches and Seizures (cont’d)
The Sixth Circuit has explicitly ruled that the incidental seizure of PPA-
protected material commingled on a suspect’s computer with evidence of a
crime does not give rise to PPA liability
The Sixth Circuit’s decision in Guest does not address the commingling issue
when the owner of the seized computer is not a suspect

EC-Council
§ A.3: Civil Liability Under the Electronic
Communications Privacy Act (ECPA)
When a search may result in the incidental seizure of network accounts
belonging to innocent third parties, agents should take every step to protect the
integrity of the third party accounts to avoid the potential ECPA’s liability
ECPA expressly authorizes government access to stored communications
pursuant to a warrant issued under the Federal Rules of Criminal Procedure
Safeguarding the accounts of innocent persons absent specific reasons to believe
that evidence may be stored in the persons' accounts should satisfy the concerns
expressed in Steve Jackson Games

EC-Council
§ A.4: Considering the Need for Multiple
Warrants in Network Searches
Agents should obtain multiple warrants if they have reason to believe that a network
search will retrieve data stored in multiple locations
A territorial limit on searches of computer data poses problems for law enforcement
When agents can learn prior to the search that some or all of the data described by the
warrant is stored in a different location than where the agents will execute the search, the
best course of action depends upon where the remotely stored data is located
When agents do not and even cannot know that data searched from one district is actually
located outside the district, evidence seized remotely from another district ordinarily
should not lead to suppression of the evidence obtained

EC-Council
§ A.5: No-Knock Warrants
As a general matter, agents must announce their presence and authority prior to execute a search
warrant (“knock and announce”)
Agents may need to conduct no-knock searches in computer crime cases because technically adept
suspects may “hot wire” their computers in an effort to destroy the evidence
• The agents should request that the magistrate judge issued a no-knock warrant
• Question: Whether the agents had “a reasonable suspicion that knocking and announcing their
presence, under the particular circumstances, would be dangerous or futile, or that it would inhibit the
effective investigation of the crime
Therefore:

EC-Council
§ A.6: Sneak-and-Peek Warrants
Warrants that excuse agents from having to notify the person whose premises
are searched at the time of the search
Furthermore, under section 3103a, law enforcement authorities must provide
delayed notice within a “reasonable period” following a warrant’s execution,
but the court can further delay notification for good cause
Congress intended that if investigators intended to make surreptitious copies
of information stored on a suspect’s computer, they would obtain
authorization from the court in advance
Prosecutors should exercise discretion and obtain the approval of a
supervisory official within their office before seeking delayed-notice warrants
or orders

EC-Council
§ A.7: Privileged Documents
Agents must exercise special care when planning a computer search that may result in the seizure of the
legally privileged documents such as medical records or attorney-client communications
• Search shall not violate the Attorney General's regulations relating to obtaining
confidential information from the disinterested third parties
The Attorney General's regulations relating to searches of
disinterested lawyers, physicians, and clergymen
• Agents should devise a strategy for reviewing the seized computer files following
the search so that no breach of a privilege occurs
Strategies for reviewing privileged computer files:

EC-Council
§ B: Drafting the Warrant and
Affidavit
• The first document is the affidavit
• The second document is the proposed warrant itself
Law enforcement officers must draft two documents to obtain a
search warrant from a magistrate judge
• Warrant (and/or its attachments) must accurately and particularly describe the
property to be seized
• Second, the affidavit must establish probable cause
• Third, the affidavit should include an explanation of the search strategy
Generally three steps are involved in drafting the warrant and
affidavit:

EC-Council
§ B.1: Accurately and Particularly Describe the
Property to be Seized in the Warrant and/or
Attachments to the Warrant
Agents must take special care when describing the computer files or
hardware to be seized
Warrants to Seize Hardware Warrants to Seize Information
If computer hardware is contraband,
evidence, fruits, or instrumentalities
of crime, the warrant should describe
the hardware itself
If the probable cause relates only to
information, however, the warrant should
describe the information, rather than the
physical storage devices which happen to
contain it

EC-Council
§ B.1.a: Defending Computer Search Warrants
Against Challenges Based on the Description of
the “Things to be Seized”
• When the warrant authorizes the seizure of hardware but the affidavit
only establishes probable cause to seize information
• When agents seize computer data and computer hardware but the
warrant does not expressly authorize their seizure
• General defenses to challenges of the computer search warrants based on
the description of the “things to be seized”
Challenges to the scope of warrants arise
particularly:
Search warrants may be subject to challenge when the description of the
“things to be seized” does not comply fully with the practices suggested on the
previous slides

EC-Council
§ B.2: Establish Probable Cause in
the Affidavit
• Involving the possession and transmission of child
pornography images
• When supporting evidence in an affidavit is derived heavily
from records of a particular Internet account or Internet
Protocol (“IP”) address
Probable cause challenges to computer
search warrants arise particularly in
cases:
The probable cause requirement does not require agents to be
clairvoyant in their knowledge of the precise forms of evidence
or contraband that will exist in the location to be searched

EC-Council
§ B.3: In the Affidavit Supporting the Warrant, Include an
Explanation of the Search Strategy as Well as the Practical & Legal
Considerations That Will Govern the Execution of the Search
The affidavit should inform the court of the practical limitations of conducting an on-
site search, and should articulate the plan to remove the entire computer from the site if
it becomes necessary
The affidavit should also explain what techniques the agents expect to use to search the
computer for the specific files that represent evidence of crime and may be intermingled
with entirely innocuous documents
The reasons for articulating the search strategy in the affidavit are both practical and
legal

EC-Council
§ C: Post-Seizure Issues
Several legal issues may arise during the post-seizure period that
implicate the government's right to retain and search the computers in
their custody:
• Searching computers in Law Enforcement Custody
• The permissible time period for examining seized computers
• Rule 41(e) motions for return of property
In many cases, computer equipment that has been seized will be sent to
a laboratory for forensic examination

EC-Council
§ C.1: Searching Computers Already
in Law Enforcement Custody
In general, agents should obtain a second warrant to search
a computer seized pursuant to a valid warrant if the
property targeted by the proposed search is different from
that underlying the first warrant
The Supreme Court’s recent Fourth Amendment cases
generally have declined to examine an agent’s subjective
intent, and instead have focused on whether the
circumstances, viewed objectively, justified the agent’s
conduct

EC-Council
§ C.2: The Permissible Time Period
For Examining Seized Computers
Neither Rule 41 nor the Fourth Amendment creates any specific time limits
on the government's forensic examination of the seized computers
However, some magistrate judges have begun imposing such limitations
Prosecutors should also be prepared to explain to magistrate judges why a
forensic search for files stored in a seized computer need not occur within 10
days of obtaining the warrant

EC-Council
§ C.3: Rule 41(e) Motions for
Return of Property
Rule 41(e) states that
• A person aggrieved by an unlawful search and seizure or by the deprivation of
property may move the district court for the district in which the property was
seized for the return of the property on the ground that such person is entitled
to lawful possession of the property. The court shall receive evidence on any
issue of fact necessary to the decision of the motion. If the motion is granted,
the property shall be returned to the movant, although reasonable conditions
may be imposed to protect access and use of the property in subsequent
proceedings. If a motion for return of property is made or comes on for
hearing in the district of trial after an indictment or information is filed, it
shall be treated also as a motion to suppress under Rule 12

EC-Council
The Electronic Communications
Privacy Act

EC-Council
The Electronic Communications
Privacy Act
The stored communication portion of the Electronic Communications Privacy Act
(“ECPA”), 18 U.S.C. §§ 2701-2712, creates statutory privacy rights for customers and
subscribers of computer network service providers
Whenever agents or prosecutors seek stored email, account records, or subscriber
information from a network service provider, they must comply with ECPA
To protect the array of privacy interests identified by its drafters, ECPA offers varying
degrees of legal protection depending on the perceived importance of the privacy
interest involved

EC-Council
§ A. Providers of Electronic Communication
Service vs. Remote Computing Service
ECPA divides providers covered by the statute into “provider[s] of electronic
communication service” and “provider[s] of remote computing service.”
Whether an entity is a provider of “electronic communication service,” a provider
of “remote computing service,” or neither depends on the nature of the particular
communication sought
An “electronic communication service” (“ECS”) is “any service which provides to
users thereof the ability to send or receive wire or electronic communications.” 18
U.S.C. § 2510(15)
The term “remote computing service” (“RCS”) is defined by 18 U.S.C. § 2711(2) as
“provision to the public of computer storage or processing services by means of an
electronic communications system.”

EC-Council
§ B. Classifying Types of Information
Held by Service Providers
• Basic subscriber information listed in 18 U.S.C. §
2703(c)(2)
• Records or other information pertaining to a customer
or subscriber in 18 U.S.C. § 2703(c)(1)
• Contents in U.S.C. § 2510(8)
ECPA breaks the information down
into three categories:

EC-Council
§ C. Compelled Disclosure Under
ECPA
18 U.S.C. § 2703 articulates the steps that the government must take
to compel providers to disclose the contents of stored wire or
electronic communications
Five mechanisms that a “government entity” can use to compel a
provider to disclose certain kinds of information:
• Subpoena
• Subpoena with prior notice to the subscriber or customer
• § 2703(d) court order
• § 2703(d) court order with prior notice to the subscriber or customer
• Search warrant

EC-Council
§ D. Voluntary Disclosure
Providers of services not available “to the public” may freely disclose both
contents and other records relating to stored communications. 18 U.S.C. §
2702
It imposes restrictions on voluntary disclosures by providers of services to the
public, but it also includes exceptions to those restrictions
It provides for the voluntary disclosure of contents and non-content customer
records by a provider to a governmental entity based on certain restrictions

EC-Council
§ E. Working with Network
Providers
• Agents may direct providers to preserve existing records pending the issuance of
compulsory legal process. Such requests have no prospective effect
Preservation of Evidence:
• Permits agents to apply for a court order directing network service providers not to
disclose the existence of compelled process whenever the government itself has no
legal duty to notify the customer or subscriber of the process
Preventing Disclosure to Subjects:
In general, investigators should communicate with network service providers before
issuing subpoenas or obtaining court orders that compel the providers to disclose
information

EC-Council
§ E. Working with Network
Providers (cont’d)
• The Cable Act, 47 U.S.C. § 551 restricts government access to
cable operator records only when the records relate to the
ordinary cable services. It does not restrict government access to
records relating to Internet access or telephone service provided
by a cable operator
Cable Act Issues:

EC-Council
Electronic Surveillance in
Communications Networks

EC-Council
Electronic Surveillance in
Communications Networks
• The first and most important is the wiretap statute, 18 U.S.C. §§ 2510-2522, first
passed as Title III of the Omnibus Crime Control and Safe Streets Act of 1968(and
generally known as “Title III”)
• The second statute is the Pen Registers and Trap and Trace Devices chapter of Title 18
(“the Pen/Trap statute”), 18 U.S.C. §§ 3121-3127, which governs pen registers and trap
and trace devices
Two federal statutes govern real-time electronic
surveillance in federal criminal investigations:

EC-Council
§ A. Content vs. Addressing
Information
In general, the Pen/Trap statute regulates the collection of addressing and other non-content
information for wire and electronic communications
Title III regulates the collection of actual content of wire and electronic communications
Prosecutors or agents who encounter issues related to distinction between addressing information and
content should contact the Computer Crime and Intellectual Property Section at (202) 514-1026 or their
local CTC

EC-Council
B. The Pen/Trap Statute, 18
U.S.C. §§ 3121-3127
The Pen/Trap statute authorizes a government attorney to apply to a court for an order authorizing
the installation of a pen register and/or trap and trace device so long as “the information likely to be
obtained is relevant to an ongoing criminal investigation.” 18 U.S.C. § 3122(b)(2)
To obtain a pen/trap order, applicants must identify themselves, identify the law enforcement
agency conducting the investigation, and then certify their belief that the information likely to be
obtained is relevant to an ongoing criminal investigation being conducted by the agency

EC-Council
C. The Wiretap Statute (“Title
III”), 18 U.S.C. §§ 2510-2522
Title III has provided the statutory framework that governs real-time electronic surveillance of the
contents of communications
When agents want to wiretap a suspect’s phone, they first must consider the implications of Title III
Questions that agents and prosecutors must ask to ensure compliance with Title III are
straightforward, at least in form:
• Is the communication to be monitored one of the protected communications defined in 18 U.S.C. § 2510?
• Will the proposed surveillance lead to an “interception” of the communications?
• If the answer to the first two questions is “yes,” does a statutory exception apply that permits the interception?
Title III broadly prohibits the “interception” of “oral communications,” “wire communications,” and
“electronic communications.”

EC-Council
§ C.1: Exceptions to Title III
• Interception pursuant to a § 2518 court order
• The ‘consent’ exception, § 2511(2)(c)-(d)
• The ‘provider’ exception, § 2511(2)(a)(i)
• The ‘computer trespasser’ exception, § 2511(2)(i)
• The ‘extension telephone’ exception, § 2510(5)(a)
• The ‘inadvertently obtained criminal evidence’ exception, § 2511(3)(b)(iv);
and
• The ‘accessible to the public’ exception, § 2511(2)(g)(i)
In computer crime cases, however, seven
exceptions apply most often:
Title III contains dozens of exceptions, which may or may not apply in
hundreds of different situations

EC-Council
§ D. Remedies For Violations of
Title III and the Pen/Trap Statute
• Title III provides for statutory suppression of wrongfully intercepted oral and wire communications,
but not electronic communications
• Constitutional violations may result in suppression of the evidence wrongfully obtained
Suppression Remedies
• Agents and prosecutors are generally protected from liability under Title III for reasonable decisions
made in good faith in the course of their official duties
Defenses to Civil and Criminal Actions
Agents and prosecutors must adhere strictly to the dictates of Title III and the Pen/Trap statute when
planning electronic surveillance, as violations can result in civil penalties, criminal penalties, and
suppression of the evidence obtained

EC-Council
Evidence

EC-Council
Evidence
Although the primary concern is obtaining computer records in criminal investigations, the ultimate goal is
to obtain evidence admissible in court
Most federal courts that have evaluated the admissibility of computer records have focused on computer
records that the records fall within the business records exception, Fed. R. Evid. 803(6) as potential hearsay
Like paper records, computer records are not monolithic: the evidentiary issues raised by their 143
admission should depend on what kind of computer records a proponent seeks to have admitted

EC-Council
Evidence (cont’d)
• Computer-generated records
• Records that are merely computer-stored
• A third category of computer records exists: some computer records are both computer-generated
and computer-stored
Computer records that contain text often can be divided
into two categories:
• The government must establish the authenticity of all computer records by providing
“evidence sufficient to support a finding that the matter in question is what its
proponent claims.” Fed. R.Evid. 901(a)
• If the computer records are computer-stored records that contain human statements,
the government must show that those human statements are not inadmissible hearsay
Issues raised due to computer records:

EC-Council
§ A. Authentication
• The government must offer evidence “sufficient to support a finding that the [computer record or other
evidence] in question is what its proponent claims.” Fed. R. Evid. 901(a)
Before a party may move for admission of a computer record or any
other evidence, the proponent must show that it is authentic
• Parties may challenge the authenticity of both computer-generated and computer-stored records by
questioning whether the records were altered, manipulated, or damaged after they were created
• Parties may question the authenticity of computer-generated records by challenging the reliability of the
computer program that generated the records
• Parties may challenge the authenticity of computer-stored records by questioning the identity of their
author
Challenges to the authenticity of computer records often take on one
of three forms

EC-Council
§ B. Hearsay
• The hearsay rules exist to prevent unreliable out-of-court statements by human declarant from
improperly influencing the outcomes of trials. Because people can misinterpret or misrepresent their
experiences, the hearsay rules express a strong preference for testing human assertions in court,
where the declarant can be placed on the stand and subjected to cross-examination
Inapplicability of the Hearsay Rules to Computer-Generated
Records
• Computer-stored records that contain human statements must satisfy an exception to the hearsay
rule if they are offered for the truth of the manner asserted. Before a court will admit the records, the
court must establish that the statements contained in the record were made in circumstances that
tend to ensure their trustworthiness
Applicability of the Hearsay Rules to Computer-Stored Records
When a computer record contains the assertions of a person, whether or not processed by a computer,
and is offered to prove the truth of the matter asserted, the record can contain hearsay

EC-Council
§ C. Other Issues
The authentication requirement and the hearsay rule usually provides the most significant
hurdles that prosecutors will encounter when seeking the admission of computer records
However, some agents and prosecutors have occasionally considered two additional issues:
• The application of the best evidence rule to computer records
• Whether computer printouts are “summaries” that must comply with Fed. R. Evid. 1006

EC-Council
End Note
Searching and Seizing Computers and Obtaining Electronic Evidence
in Criminal Investigations
• Computer Crime and Intellectual Property Section Criminal Division United
States Department of Justice
• www.justice.gov/criminal/cybercrime/s&smanual2002.htm
References:

EC-Council

File000116

More Related Content

What's hot (20)

Viewers also liked (19)

Similar to File000116 (20)

More from Desmond Devendran (16)

Recently uploaded (20)

File000116