Feeds

How to find stolen laptops

The legal eye

The Essential Guide to IT Transformation

Building a subpoena

There are various levels or proof required to obtain different demands for information. A subpoena generally requires very little level of proof that the information demanded is relevant to whatever you are looking for, or may lead to the discovery of relevant information. Most people think that subpoenas are issued by a court or a judge – that you apply for a subpoena to a court, show them that the information is relevant, and then get an order. Not true – well, at least not for the most part.

In reality, law enforcement (either the cops or the prosecutor) has a desk drawer filled with subpoenas. They just whip 'em out, type in the name and the information needed, and email or fax 'em to the ISP. No big deal - takes a couple of seconds and the court is not even notified.

Now technically (at least in the US federal system) all of this is illegal. You see, to issue a subpoena there has to be an investigation authorised by a grand jury: a group of citizens authorised by the court to investigate crimes. The grand jury engages in this charade of authorising the prosecutor to investigate and issue subpoenas on their behalf - but they usually don't know what is being investigated or how. Moreover, even this bare charade is not followed in most investigations. A prosecutor unknown to the grand jury may be investigating crimes unknown to the grand jury and issuing subpoenas on their behalf without even the pretext of delegated authority. But who can argue with success?

On the civil side, things are even more difficult. As a general rule, in order for you and I to compel some third party (like an ISP) to produce information, we have to also get either a subpoena or a court order. Ah, there's the rub. To get the subpoena or court order, we have to have a lawsuit pending. To have a lawsuit pending, we have to have a "case or controversy" involving some violation or law or tort, which is capable of being heard in the court in which we have filed suit, which also has jurisdiction over the matter and the people involved. OK. End of law school class.

The legal discovery process, particularly for civil discovery, is slow, unwieldy and ungainly. Imagine having to file separate individual lawsuits for each piece of SPAM you receive, each phishing attempt, each domain name hijacking, each pump-and-dump stock scam, each defamatory blog posting, each - well, you get the idea. What is worse is that you don't even know who you are suing. Just some "John Doe" who did the bad act. How do you show jurisdiction of John Doe? How do you get service of process to John Doe?

Other than what is called "pre-filing discovery," the lawsuit has to be "pending" before you can get discovery. The lawsuit isn't "pending" until you have served the person you are suing - John Doe. I mean, it isn't fair to sue somebody without telling them they are being sued. Laws written in the 18th century allow you to give notice by publication, the printing in the newspapers for three consecutive weeks. Hardly a model for internet discovery.

Discovery and blanket orders in other situations

Where else have we heard about the problem of quickly obtaining relevant information using antiquated tools and techniques? Oh yeah, getting wiretap or other orders for discovery related to national security, foreign intelligence and foreign terrorism under the Foreign Intelligence Surveillance Act (FISA.) The Bush administration has long argued that it was lawfully entitled to bypass the super-secret court set up under this law and demand records under what they later dubbed the "Terrorist Surveillance Network" because the FISA law was slow and cumbersome.

You see, FISA, like the pesky Constitution of the United States, requires that you get a court order based on "probable cause," specifying the place to be searched and the thing to be seized - or in the case of a wiretapped conversation, who you are tapping and what conversations you are looking for. We have always read this to mean that you need a separate warrant for each search, although you could theoretically apply for a single warrant for, for example, a series of telephone numbers used by a particular person, or to search a number of apartments for particular things.

On the eve of hearings about the Terrorist Surveillance Network to be held by the new Democratic majority in the US Senate, the administration after arguing that there was no alternative to bypassing the FISA Court, suddenly found religion and in a letter from the Attorney General notified the Senators that "a [single] Judge of the Foreign Intelligence Surveillance Court issued orders authorising the government to target for collection international communications into or out of the United States where there is probable cause to believe that one of the communicants is a member of al Qaeda or an associated terrorist organisation." That's all we know, and we don't know any more, as the Attorney General was mum about any further details.

What it looks like is a blanket order. The Court (well, the judge) may have said: "Look, if you can meet certain thresholds of showing membership in some associated terrorist organizations, here's a general order mandating people to provide you the information you want." Perhaps the order requires the government to report back to the FISA court, perhaps not.

Now I am not going into a discussion of whether this constitutes an improper delegation of judicial power to the executive branch (well, yeah) or violates the particularity requirements of the Fourth Amendment (that too). However, this may provide a model for civil discovery.

Build a business case: developing custom apps

More from The Register

next story
14 antivirus apps found to have security problems
Vendors just don't care, says researcher, after finding basic boo-boos in security software
'Things' on the Internet-of-things have 25 vulnerabilities apiece
Leaking sprinklers, overheated thermostats and picked locks all online
iWallet: No BONKING PLEASE, we're Apple
BLE-ding iPhones, not NFC bonkers, will drive trend - marketeers
Only '3% of web servers in top corps' fully fixed after Heartbleed snafu
Just slapping a patched OpenSSL on a machine ain't going to cut it, we're told
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Israel's Iron Dome missile tech stolen by Chinese hackers
Corporate raiders Comment Crew fingered for attacks
Tor attack nodes RIPPED MASKS off users for 6 MONTHS
Traffic confirmation attack bared users' privates - but to whom?
Roll out the welcome mat to hackers and crackers
Security chap pens guide to bug bounty programs that won't fail like Yahoo!'s
Researcher sat on critical IE bugs for THREE YEARS
VUPEN waited for Pwn2Own cash while IE's sandbox leaked
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.
The Essential Guide to IT Transformation
ServiceNow discusses three IT transformations that can help CIO's automate IT services to transform IT and the enterprise.
Maximize storage efficiency across the enterprise
The HP StoreOnce backup solution offers highly flexible, centrally managed, and highly efficient data protection for any enterprise.