How to find stolen laptops

Building a subpoena

There are various levels or proof required to obtain different demands for information. A subpoena generally requires very little level of proof that the information demanded is relevant to whatever you are looking for, or may lead to the discovery of relevant information. Most people think that subpoenas are issued by a court or a judge – that you apply for a subpoena to a court, show them that the information is relevant, and then get an order. Not true – well, at least not for the most part.

In reality, law enforcement (either the cops or the prosecutor) has a desk drawer filled with subpoenas. They just whip 'em out, type in the name and the information needed, and email or fax 'em to the ISP. No big deal - takes a couple of seconds and the court is not even notified.

Now technically (at least in the US federal system) all of this is illegal. You see, to issue a subpoena there has to be an investigation authorised by a grand jury: a group of citizens authorised by the court to investigate crimes. The grand jury engages in this charade of authorising the prosecutor to investigate and issue subpoenas on their behalf - but they usually don't know what is being investigated or how. Moreover, even this bare charade is not followed in most investigations. A prosecutor unknown to the grand jury may be investigating crimes unknown to the grand jury and issuing subpoenas on their behalf without even the pretext of delegated authority. But who can argue with success?

On the civil side, things are even more difficult. As a general rule, in order for you and I to compel some third party (like an ISP) to produce information, we have to also get either a subpoena or a court order. Ah, there's the rub. To get the subpoena or court order, we have to have a lawsuit pending. To have a lawsuit pending, we have to have a "case or controversy" involving some violation or law or tort, which is capable of being heard in the court in which we have filed suit, which also has jurisdiction over the matter and the people involved. OK. End of law school class.

The legal discovery process, particularly for civil discovery, is slow, unwieldy and ungainly. Imagine having to file separate individual lawsuits for each piece of SPAM you receive, each phishing attempt, each domain name hijacking, each pump-and-dump stock scam, each defamatory blog posting, each - well, you get the idea. What is worse is that you don't even know who you are suing. Just some "John Doe" who did the bad act. How do you show jurisdiction of John Doe? How do you get service of process to John Doe?

Other than what is called "pre-filing discovery," the lawsuit has to be "pending" before you can get discovery. The lawsuit isn't "pending" until you have served the person you are suing - John Doe. I mean, it isn't fair to sue somebody without telling them they are being sued. Laws written in the 18th century allow you to give notice by publication, the printing in the newspapers for three consecutive weeks. Hardly a model for internet discovery.

Discovery and blanket orders in other situations

Where else have we heard about the problem of quickly obtaining relevant information using antiquated tools and techniques? Oh yeah, getting wiretap or other orders for discovery related to national security, foreign intelligence and foreign terrorism under the Foreign Intelligence Surveillance Act (FISA.) The Bush administration has long argued that it was lawfully entitled to bypass the super-secret court set up under this law and demand records under what they later dubbed the "Terrorist Surveillance Network" because the FISA law was slow and cumbersome.

You see, FISA, like the pesky Constitution of the United States, requires that you get a court order based on "probable cause," specifying the place to be searched and the thing to be seized - or in the case of a wiretapped conversation, who you are tapping and what conversations you are looking for. We have always read this to mean that you need a separate warrant for each search, although you could theoretically apply for a single warrant for, for example, a series of telephone numbers used by a particular person, or to search a number of apartments for particular things.

On the eve of hearings about the Terrorist Surveillance Network to be held by the new Democratic majority in the US Senate, the administration after arguing that there was no alternative to bypassing the FISA Court, suddenly found religion and in a letter from the Attorney General notified the Senators that "a [single] Judge of the Foreign Intelligence Surveillance Court issued orders authorising the government to target for collection international communications into or out of the United States where there is probable cause to believe that one of the communicants is a member of al Qaeda or an associated terrorist organisation." That's all we know, and we don't know any more, as the Attorney General was mum about any further details.

What it looks like is a blanket order. The Court (well, the judge) may have said: "Look, if you can meet certain thresholds of showing membership in some associated terrorist organizations, here's a general order mandating people to provide you the information you want." Perhaps the order requires the government to report back to the FISA court, perhaps not.

Now I am not going into a discussion of whether this constitutes an improper delegation of judicial power to the executive branch (well, yeah) or violates the particularity requirements of the Fourth Amendment (that too). However, this may provide a model for civil discovery.