[00:00.000 --> 00:01.440]  ...is really focused on.
[00:01.560 --> 00:05.460]  And there are going to be three specific scenarios that I'm going to talk about in more detail.
[00:05.620 --> 00:09.860]  The first is the crime of anticipatory obstruction of justice.
[00:10.120 --> 00:13.360]  The second is the computer fraud and abuse act.
[00:13.420 --> 00:17.560]  And the third is some potential legal issues surrounding encryption.
[00:18.460 --> 00:21.480]  Now, it's not all doom and gloom.
[00:21.580 --> 00:29.980]  I am going to cover these three things, but I'm also going to, I promise, give some tips about how you can protect yourself so you can make sure the feds and the cops don't come back.
[00:30.000 --> 00:30.960]  You knock in at your door.
[00:31.200 --> 00:36.620]  The second disclaimer is when we get to... I'm going to leave some time at the end for questions.
[00:37.080 --> 00:40.440]  If you get a chance to come up and ask a question, great.
[00:40.840 --> 00:51.320]  Just please don't tell me any sensitive legal issue you're currently in or tell me, you know, real intimate details because you're going to waive the attorney-client privilege in a room filled with people.
[00:51.500 --> 00:51.700]  Okay?
[00:52.020 --> 00:55.120]  So those are my two introductory caveats.
[00:55.260 --> 00:56.340]  And with that, let's get into it.
[00:56.460 --> 01:07.240]  So when we talk about the traditional crime of obstruction of justice, that crime is a crime that's been on the books for a very long time.
[01:07.420 --> 01:16.260]  And it has traditionally had five things that the government is required to prove in order to show that a person is guilty of the crime of obstruction of justice.
[01:16.260 --> 01:21.780]  The first thing is that there has to be a pending proceeding when the documents were destroyed.
[01:21.920 --> 01:26.080]  Now, that proceeding could be a judicial proceeding, congressional.
[01:26.520 --> 01:28.000]  It could be a federal investigation.
[01:28.300 --> 01:30.420]  It doesn't really matter so much.
[01:30.420 --> 01:37.620]  But there has to be something currently going on at the time the obstruction is alleged to have taken place.
[01:37.840 --> 01:43.960]  Second, the person who does the destruction has to actually know that there is a proceeding.
[01:45.100 --> 01:50.900]  Third, and most importantly, is there has to be a nexus between the document destruction and the proceeding.
[01:51.240 --> 02:02.240]  Now, what nexus means is that the act of destruction must have a relationship in either time, causation, or logic with the judicial proceeding.
[02:02.680 --> 02:12.980]  And what this really means is that it captures an idea in the law called materiality and makes sure that whatever it is that's being destroyed is actually important.
[02:13.520 --> 02:17.520]  Not that it's just any random document that's being destroyed.
[02:17.860 --> 02:23.160]  That instead, this is something that's integral to the pursuit of whatever the feds are investigating.
[02:23.380 --> 02:31.080]  And when I say feds, I'm obviously talking about the federal criminal investigatory agencies, but I could also be talking about local law enforcement as well.
[02:31.260 --> 02:31.700]  Okay?
[02:32.280 --> 02:38.540]  The fourth thing is that there has to be a corrupt act done with the intent to interfere with the proceedings.
[02:38.700 --> 02:42.540]  So this is really two things, which is why I said there are five things that the government has to prove.
[02:42.540 --> 02:47.460]  So they have to show that you kind of did it with a guilty intention, so to speak.
[02:47.620 --> 02:51.720]  And your intention has to be to interfere with the actual proceeding.
[02:52.040 --> 03:01.280]  So, you know, if you know that those... Let's say you're being investigated for computer hacking of some sort under the CFAA, and they want some...
[03:01.280 --> 03:06.600]  You know, they know that they're... You know, the feds are after some emails you sent, and you say, Ha, ha, screw those guys.
[03:06.780 --> 03:09.260]  I'm going to delete every email I've ever sent so they don't catch it.
[03:09.780 --> 03:13.060]  Because I don't want to go to jail for this computer fraud and abuse act crime.
[03:13.280 --> 03:14.820]  I'm committed... You know, I'm charged with.
[03:15.540 --> 03:18.320]  That's the traditional sense of obstruction of justice.
[03:18.560 --> 03:18.640]  Okay?
[03:21.540 --> 03:27.080]  Now, anticipatory obstruction of justice is a newer criminal statute.
[03:27.320 --> 03:31.660]  It's been on the books, I think, since the early 2000s.
[03:31.740 --> 03:33.760]  It was part of the Sarbanes-Oxley Act.
[03:33.880 --> 03:37.680]  And the idea was that Congress wanted to make sure that...
[03:38.740 --> 03:46.280]  That important documents were not destroyed before anything had actually occurred in terms of a formal investigation.
[03:46.580 --> 03:48.360]  And so, this is the text of the statute.
[03:48.560 --> 03:52.520]  But really, the most important thing you have to take a look is here at the very end.
[03:52.680 --> 03:55.940]  Or in relation to or contemplation of any such matter.
[03:57.000 --> 04:06.280]  What... You know... If you kind of strip away all of the actual legalese text of this statute, what you're really left with is two things that the government has to prove.
[04:06.280 --> 04:09.720]  First, that the defendant knowingly altered or deleted.
[04:09.980 --> 04:12.160]  So not accidentally or not inadvertently.
[04:12.380 --> 04:15.260]  But that he knowingly altered or deleted or did something.
[04:15.800 --> 04:21.640]  And second, that he had the intent to impede an active or contemplated government investigation.
[04:22.120 --> 04:30.140]  Now... Again, when you strip away the legalese, the statute really says a couple things.
[04:30.380 --> 04:34.400]  First, there's no requirement that you destroy something important.
[04:34.400 --> 04:40.580]  So that's that idea of materiality that the traditional obstruction of justice statute was concerned with.
[04:40.720 --> 04:41.780]  That is absent.
[04:41.920 --> 04:43.720]  And when you think about it, it makes sense.
[04:43.760 --> 04:49.080]  Because it's in relation or contemplation of a pending investigation.
[04:49.460 --> 04:54.380]  So how do the feds know what's important if they haven't investigated or opened an investigation yet?
[04:54.660 --> 04:57.780]  That's why there is not that materiality requirement.
[04:58.500 --> 05:01.280]  Second, there's no requirement that you know of the investigation.
[05:01.280 --> 05:06.120]  Again, it goes back to the idea that there doesn't have to be an actual investigation.
[05:06.340 --> 05:11.780]  Because there's no requirement that you actually obstruct an investigation or that there even be an investigation.
[05:12.460 --> 05:13.080]  Okay?
[05:13.460 --> 05:28.040]  Now, what's even worse, believe it or not, is that two federal appellate circuit courts, so the second and fifth circuits, have held that a likelihood of investigation is not even required.
[05:28.040 --> 05:34.540]  So we're not even talking about a situation where you may think, well, what I'm doing is probably going to get me in trouble.
[05:35.500 --> 05:38.880]  That's not required, at least in two very large appellate circuits.
[05:39.040 --> 05:39.260]  Okay?
[05:39.680 --> 05:42.340]  So the statute is pretty broad.
[05:42.740 --> 05:44.420]  It can get you in some trouble.
[05:45.500 --> 05:49.480]  In the last presentation, there was a discussion of the case of Louis V.
[05:49.760 --> 05:50.100]  Remington.
[05:51.020 --> 05:59.620]  You know, I'm going to confess, I'm not familiar with that case, but just based on what the description of it was, this was for some people who maybe didn't attend the last talk.
[05:59.740 --> 06:08.200]  This was a situation where a gun manufacturer made a gun that was defective so that when you hit the safety, it actually discharged.
[06:08.420 --> 06:08.520]  Yeah?
[06:08.680 --> 06:08.900]  Okay?
[06:09.020 --> 06:10.680]  So that could potentially be a problem.
[06:10.820 --> 06:11.460]  I could see that.
[06:11.460 --> 06:16.980]  And received certain complaints about it from customers and took the complaints and deleted them.
[06:17.380 --> 06:17.500]  Okay?
[06:17.860 --> 06:22.260]  That type of situation is precisely captured by this statute.
[06:22.660 --> 06:32.620]  They anticipatorily deleted something before there was any active investigation open looking at the action involved.
[06:32.800 --> 06:33.000]  Okay?
[06:33.920 --> 06:38.780]  The case I want to talk to you folks about is a case you may be familiar with.
[06:38.780 --> 06:40.700]  It's the case of United States versus Colonel.
[06:41.360 --> 06:46.760]  And for those of you who aren't familiar with this case, this is the Sarah Palin email hacker case.
[06:46.860 --> 06:47.080]  Okay?
[06:47.480 --> 06:50.140]  Now, what happened in that case?
[06:50.340 --> 07:01.720]  Basically, Mr. Colonel, through a variety of guessing and Wikipedia searching, was able to hack into Sarah Palin's email in 2008.
[07:01.880 --> 07:02.160]  Okay?
[07:02.320 --> 07:06.460]  And this is a timeline of kind of the step-by-step things that happened in this case.
[07:06.460 --> 07:09.280]  And the reason I put this up there is because the timing is important.
[07:09.660 --> 07:14.340]  So, obviously, at midnight, he hacks into Sarah Palin's email through a proxy.
[07:14.580 --> 07:18.040]  At 1 a.m., he brags about the hack in 4chan.
[07:18.340 --> 07:23.500]  At some point, he deletes images that he downloaded from her email onto the computer.
[07:23.620 --> 07:30.200]  Now, what's important to remember is he did not actually get any sensitive information from the email account.
[07:30.200 --> 07:34.700]  So, it wasn't like he all of a sudden got a bunch of really important sensitive government documents.
[07:34.840 --> 07:41.680]  Basically, I think he downloaded a picture of Bristol Palin and saw some email back and forth that was nothing really remarkable.
[07:42.200 --> 07:46.940]  But he downloaded some of that information, took some screenshots, downloaded the pictures.
[07:47.240 --> 07:49.940]  At some point, though, he deleted that information.
[07:50.120 --> 07:50.400]  Okay?
[07:50.900 --> 07:55.960]  Now, we don't know the exact timing of when that happened, but it was very early on in this process.
[07:58.240 --> 08:03.100]  Later, in the chat room, basically, someone tells Colonel that he contacted the FBI.
[08:03.320 --> 08:05.440]  Whether or not this actually happened, nobody really knows.
[08:07.020 --> 08:10.500]  At 2 a.m., he posts the password on 4chan.
[08:10.880 --> 08:12.480]  Later, the thread is deleted.
[08:13.040 --> 08:16.440]  And then, a little bit after that, the Palin campaign learns of the hack.
[08:17.000 --> 08:20.900]  And then, you know, obviously, they notify the FBI in the Secret Service.
[08:21.200 --> 08:29.000]  And then, you know, a little bit later on, Colonel basically tells a friend on Facebook that he's afraid of the FBI because he thinks he did something really bad.
[08:29.200 --> 08:29.380]  Okay?
[08:31.480 --> 08:34.520]  Which, you know, probably good instinct at that point.
[08:35.280 --> 08:35.460]  Okay?
[08:37.860 --> 08:40.760]  Now, later, he takes some more steps.
[08:40.760 --> 08:47.640]  He clears his Internet Explorer cache, thinking that this will erase his tracks, which, obviously, it won't.
[08:48.220 --> 08:50.720]  And then, Gawker picks up the story.
[08:51.620 --> 08:54.540]  He then decides to reformat his hard drive.
[08:54.680 --> 08:55.860]  He uninstalls Firefox.
[08:56.140 --> 08:57.120]  He runs a defrag.
[08:57.600 --> 09:00.060]  And at that point, the next day...
[09:00.060 --> 09:01.560]  Yeah, really successful, right?
[09:01.900 --> 09:06.280]  Now, the next day, the FBI eventually calls Colonel's dad, and he's looking for Colonel.
[09:06.280 --> 09:13.180]  Now, the asterisk there is because once Colonel actually finds out that the feds are looking for him, he begins to investigate.
[09:13.800 --> 09:25.620]  And the other important thing is the FBI was able to track him down and figure out what he did, not through any of the actual stuff that he downloaded or any of the stuff that he deleted.
[09:25.620 --> 09:26.320]  Okay?
[09:26.680 --> 09:31.160]  So, if you think about the idea of obstruction of justice, they found him.
[09:31.340 --> 09:32.600]  They found him pretty quick.
[09:33.100 --> 09:34.480]  Nothing sensitive got out.
[09:34.720 --> 09:37.780]  No pending criminal investigation was in place at the time.
[09:37.980 --> 09:38.380]  Okay?
[09:39.260 --> 09:40.480]  Now, important.
[09:41.400 --> 09:43.520]  Ultimately, Colonel is indicted.
[09:43.740 --> 09:45.760]  He's indicted for identity theft.
[09:45.920 --> 09:53.120]  He's indicted for criminal fraud, the Computer Fraud and Abuse Act, wire fraud, and the anticipatory obstruction of justice.
[09:53.120 --> 09:54.060]  Okay?
[09:54.340 --> 09:58.760]  Now, when he goes to trial, he's ultimately acquitted of the wire fraud.
[09:59.080 --> 10:01.300]  He has a mistrial on the ID theft.
[10:01.440 --> 10:03.460]  Basically, the jury couldn't reach a verdict they hung.
[10:03.760 --> 10:07.000]  And he was guilty of a lesser Computer Fraud and Abuse Act charge.
[10:07.140 --> 10:08.740]  Basically, he was convicted of the misdemeanor.
[10:08.900 --> 10:13.540]  But he was convicted of the felony anticipatory obstruction of justice statute.
[10:13.540 --> 10:26.060]  So, what happened was, for the crime of downloading or hacking into Sarah Palin's email and downloading this stuff, what he got in most trouble for was the act of deleting the stuff.
[10:26.400 --> 10:26.740]  Okay?
[10:27.400 --> 10:30.620]  Even though it did not prevent the feds from finding him.
[10:30.620 --> 10:42.560]  Now, what this really kind of boils down to is that he was convicted on the basis of activity that took place before the FBI initiated or contemplated investigation.
[10:42.680 --> 10:45.940]  And before he knew he was actually being investigated.
[10:46.120 --> 10:49.880]  Now, he was worried he was being investigated.
[10:49.880 --> 10:53.900]  He was probably, and rightfully so, a little paranoid about what he'd done.
[10:53.900 --> 10:56.860]  But he didn't actually know, right?
[10:57.880 --> 11:07.240]  So, really, the crime hinged less on his actions and the way it impacted the actual investigation, and more on his state of mind when he acted.
[11:07.480 --> 11:17.020]  Now, when this case went up on appeal to the Sixth Circuit, what the government argued was that Colonel had the intent to impede because of two things.
[11:17.100 --> 11:22.480]  First, that he had actual notice based on the user who said he, you know, ratted him out to the FBI.
[11:22.480 --> 11:27.460]  And second, that he contemplated he would get in trouble because he said he was afraid of the FBI.
[11:27.640 --> 11:29.180]  So, this was what the government argued.
[11:30.140 --> 11:39.380]  And the Sixth Circuit ultimately held that he did not have actual notice, and its quote was, statements made on 4chan have no indicia of reliability.
[11:40.520 --> 11:40.960]  So...
[11:43.100 --> 11:43.540]  Okay?
[11:45.540 --> 11:46.940]  That sounds about right, yeah?
[11:47.260 --> 11:47.700]  Okay?
[11:50.120 --> 11:54.720]  But, unfortunately for Mr. Colonel, they found that he had actually contemplated federal investigation.
[11:55.020 --> 12:05.340]  And that's because there was a belief that a federal investigation directed at the defendant's conduct might begin at some point in the future, satisfies the incontemplation prong.
[12:05.600 --> 12:09.640]  The Sixth Circuit admitted that contemplation in this context is very broad.
[12:10.220 --> 12:12.560]  And they said, eh, so what?
[12:12.720 --> 12:13.880]  That's what Congress wanted.
[12:14.260 --> 12:14.700]  Okay?
[12:16.240 --> 12:19.140]  So, again, not that it was likely.
[12:19.600 --> 12:31.740]  Although, you know, factually speaking, yeah, I think it's safe to say that if you hack into the vice president candidate's email, you're likely going to get in trouble and have the feds come after you.
[12:31.920 --> 12:33.000]  But they didn't hinge...
[12:33.000 --> 12:35.980]  The legal rule to come out of it is not hinged on that.
[12:35.980 --> 12:39.260]  It's hinged on he believed he might get in trouble.
[12:39.540 --> 12:39.880]  Okay?
[12:40.480 --> 12:50.320]  So this is the first kind of situation that, you know, presents itself about this idea of destroying evidence before evidence.
[12:50.540 --> 12:55.920]  This very broad, very scary crime of anticipatory obstruction of justice.
[12:55.920 --> 12:56.420]  Okay?
[12:57.420 --> 12:59.960]  Second thing I want to talk about is the CFAA.
[13:00.140 --> 13:01.800]  This is the Computer Fraud and Abuse Act.
[13:02.000 --> 13:06.560]  It's a very long, complicated, tortured statute.
[13:06.920 --> 13:16.780]  It was initially designed to capture, you know, people who, you know, broke into sensitive computers like government computers, banking computers.
[13:17.660 --> 13:20.520]  Unfortunately, it's been broadened significantly.
[13:21.200 --> 13:27.480]  Less by Congress and more by the way courts have interpreted the terms of the CFAA.
[13:27.980 --> 13:36.400]  So whereas it used to kind of, you know, whereas like there's easy cases like a DDoS attack could potentially get you into CFAA trouble for, I think, obvious reasons.
[13:36.600 --> 13:42.540]  It's now being used to, you know, prosecute people for sending, you know, too many emails.
[13:43.220 --> 13:53.940]  There's a case where there was a labor dispute and the union decided to bombard management with a whole bunch of emails and that was found to be a CFAA violation.
[13:54.420 --> 14:03.340]  It's been expanded to cover terms of use violations, although that's something, you know, EFF has fought very hard against and we've had some successes in that.
[14:03.520 --> 14:04.960]  And we could talk about that at some other point.
[14:05.140 --> 14:09.540]  So it's really been stretched to cover a wide variety of things.
[14:09.680 --> 14:24.100]  And specifically what I want to focus on is on Section 1038-5, which, as you can see, covers a couple different things, but really the key term is intentionally causes damage without authorization.
[14:24.520 --> 14:25.060]  Okay?
[14:25.140 --> 14:31.560]  And you see the term without authorization appear throughout this section of the CFAA.
[14:32.720 --> 14:40.660]  Now, the words intentionally causes damage without authorization to a protected computer has had a very broad definition as well.
[14:40.660 --> 14:45.300]  And I'll start by saying protected computer really just means a computer that's connected to the Internet.
[14:45.600 --> 14:45.920]  Okay?
[14:46.700 --> 14:49.620]  Now, the case I want to focus on...
[14:49.620 --> 14:57.980]  And I'm going to apologize because, you know, I've talked about this case before and for whatever reason, I just cannot say Deloitte correctly.
[14:58.200 --> 14:58.480]  Okay?
[14:58.680 --> 15:00.760]  So if I butcher it or I screw it up...
[15:00.760 --> 15:01.500]  Deloitte, okay.
[15:01.660 --> 15:02.900]  I knew you guys would correct me.
[15:03.000 --> 15:03.260]  Thank you.
[15:03.960 --> 15:05.520]  But that was my warning ahead of time.
[15:05.620 --> 15:05.820]  All right.
[15:05.820 --> 15:10.960]  So in this case, involved an employment dispute.
[15:11.160 --> 15:14.380]  Basically, Carlson was an executive for Deloitte.
[15:14.600 --> 15:15.000]  Okay?
[15:15.120 --> 15:15.200]  Good.
[15:15.740 --> 15:25.140]  And had basically signed an agreement where he agreed that, you know, he would only use basically his work computer for work purposes.
[15:25.400 --> 15:28.280]  He decided to eventually start his own competing company.
[15:28.820 --> 15:33.280]  And so he, you know, returned the computer minus the hard drive.
[15:33.280 --> 15:35.140]  The original hard drive that was put on.
[15:35.280 --> 15:38.340]  So when they asked, hey, where is the hard drive this computer came with?
[15:38.380 --> 15:40.060]  He said, oh, I destroyed that one.
[15:40.420 --> 15:42.300]  But I copied all your data.
[15:42.460 --> 15:45.700]  And I put it on this new hard drive that I am giving you back.
[15:45.900 --> 15:47.280]  Well, they didn't like that.
[15:47.420 --> 15:48.360]  And so they sued him.
[15:48.820 --> 15:50.380]  And they sued him charging CFAA.
[15:51.380 --> 15:59.500]  And they sued him, again, under the theory that he intentionally caused damage without authorization to a protected computer.
[15:59.500 --> 16:00.160]  Okay?
[16:00.460 --> 16:10.200]  Now, what was important was there was a bit of a dispute over whether he had truly given back all the information or not.
[16:10.360 --> 16:20.300]  But at least at the point in time where the court was deciding whether this was a legal claim that could proceed, there was, you know, the court was less concerned with that.
[16:20.380 --> 16:29.040]  And basically said it was enough that he destroyed the hard drive when he was not authorized to do so because his employment agreement said he had to return the computer as it was.
[16:30.600 --> 16:38.480]  And they said that destroying data in a way that was adverse to the company's interests, specifically because he was leaving Deloitte...
[16:38.480 --> 16:38.980]  All right, good.
[16:39.040 --> 16:39.580]  I said that correct?
[16:40.060 --> 16:40.940]  Oh, I did not.
[16:41.620 --> 16:41.980]  Okay.
[16:42.360 --> 16:42.760]  No E...
[16:42.760 --> 16:43.380]  Ah, there we go.
[16:43.980 --> 16:44.340]  Okay.
[16:44.620 --> 16:44.980]  There we go.
[16:45.280 --> 16:48.140]  Because he had destroyed it in a way that was adverse to that company.
[16:48.300 --> 16:53.940]  In other words, because he left, he was leaving to go to another company, that that was enough to trigger the CFAA.
[16:54.340 --> 17:02.680]  So again, this is another example of how, you know, okay, sure, maybe a little bit obvious, you can't destroy your, you know, employer's devices.
[17:02.940 --> 17:08.560]  But again, there was no actual concrete proof that he had taken stuff he wasn't supposed to take.
[17:08.660 --> 17:13.240]  There was allegations or suspicions, but nothing actually ever concretely proven.
[17:13.580 --> 17:13.940]  Okay?
[17:15.020 --> 17:17.220]  The third thing I want to talk about is encryption.
[17:17.540 --> 17:18.180]  All right?
[17:19.220 --> 17:22.260]  And, you know, encryption is good security practice.
[17:22.720 --> 17:25.000]  It's a great way to keep people out of your computer.
[17:25.040 --> 17:31.580]  But it's also a way, unfortunately, at least under the law, to attract attention to yourself in not so good ways.
[17:35.220 --> 17:37.080]  Now, the obstruction enhancement.
[17:37.250 --> 17:38.910]  You see down there it says USSG.
[17:39.060 --> 17:42.380]  Let me give a little bit of background about what I'm talking about so this makes sense.
[17:42.580 --> 17:46.450]  Basically, the USSG refers to the United States Sentencing Guidelines.
[17:46.450 --> 17:58.930]  Whenever a person is charged with committing a federal criminal, a federal crime, so CFAA, wire fraud, whatever it may be, when they are convicted, they have to be sentenced.
[17:59.140 --> 18:08.790]  And when they are sentenced, the way federal law dictates the sentence the person receives, is that every criminal statute has a maximum sentence.
[18:09.530 --> 18:16.540]  So, for example, in the CFAA context, the maximum sentence for some violations of the CFAA is up to five years in prison.
[18:16.790 --> 18:19.640]  Some violations of the CFAA could get you up to 20 years in prison.
[18:19.910 --> 18:20.010]  Okay?
[18:20.750 --> 18:24.990]  But how is a judge supposed to decide what type of sentence to give someone?
[18:25.080 --> 18:26.970]  Does the judge give 20 years to everybody?
[18:27.170 --> 18:27.600]  Well, no.
[18:28.100 --> 18:28.320]  Okay?
[18:28.900 --> 18:37.880]  He or she has to decide where in the spectrum between no jail time and five years, where in that spectrum is he or she going to impose sentence on the defendant?
[18:37.880 --> 18:42.770]  And in order to make that decision, the judge is required to look at the United States Sentencing Guidelines.
[18:42.930 --> 18:51.060]  And what the guidelines are, they're a large book that is put together by the United States Sentencing Commission, which is a group that's appointed by Congress.
[18:51.430 --> 18:58.970]  And they basically decide how serious... how much of a sentence a particular defendant is supposed to get.
[18:59.060 --> 19:01.670]  And the way they make that determination is it hinges on two things.
[19:02.170 --> 19:04.620]  First, it hinges on the defendant's criminal record.
[19:04.620 --> 19:08.970]  So, if the defendant has previously been convicted of crimes, he'll have a higher sentence.
[19:09.840 --> 19:14.380]  And the second factor is it looks at the severity of the crime.
[19:14.530 --> 19:18.230]  And what it does is it creates a scale from 1 to 43.
[19:18.950 --> 19:20.380]  43 is the most serious crime.
[19:20.510 --> 19:21.970]  You murder someone, you're at a 43.
[19:22.250 --> 19:22.540]  Okay?
[19:23.300 --> 19:30.510]  Simple possession of marijuana, you've got two joints in your pocket, that's, you know, going to be on the much lower side of the spectrum, maybe a 3 or a 4.
[19:30.510 --> 19:36.170]  Well, there's... for CFAA-type crimes, it gets a little bit complicated, and I won't go into it.
[19:36.270 --> 19:42.770]  But suffice it to say, there's a number, and I think it starts at about 10, and it can go up depending on the circumstances.
[19:43.510 --> 19:53.510]  Anyway, in addition to calculating how serious that individual crime is based on the statute you're convicted of, the guidelines also have certain things called enhancements.
[19:53.860 --> 20:01.010]  Basically, ways that you get extra points on this 1 through 43 scale based on the way you committed your crime.
[20:01.210 --> 20:04.490]  One of those enhancements is the obstruction of justice enhancement.
[20:05.270 --> 20:05.750]  Okay?
[20:06.040 --> 20:15.380]  That says that if the defendant willfully obstructed or impeded, you know, et cetera, et cetera, et cetera, he gets or she gets a two-level increase in his crime or her crime.
[20:15.380 --> 20:15.930]  Okay?
[20:16.210 --> 20:34.430]  Now, the good news is that this specific enhancement, the one that's up on the screen, does not apply to the crime of anticipatory obstruction of justice unless the obstruction occurs in relation to a prosecution of the anticipatory obstruction of justice charge.
[20:34.510 --> 20:36.340]  What that means is you can't get it twice.
[20:37.040 --> 20:37.490]  Okay?
[20:37.490 --> 20:45.690]  So, if you're charged with anticipatory obstruction of justice, you can't also get the enhancement for anticipatorily obstructing justice.
[20:45.970 --> 20:46.450]  Okay?
[20:49.700 --> 20:53.800]  Now, unfortunately, encryption has been considered obstruction.
[20:54.140 --> 21:12.490]  And in the case that's cited here, the court found the obstruction of justice enhancement was appropriate for a defendant who changed encryption keys, used sophisticated... and this is the court's words, used sophisticated computer file swapping techniques requiring special instructions to reassemble files,
[21:12.580 --> 21:16.490]  and used special software programs that could lock down a computer or wipe it clean.
[21:16.640 --> 21:23.990]  Now, what's important for our purposes is that it didn't matter if this was done before the actual crime occurred.
[21:23.990 --> 21:24.750]  Okay?
[21:25.120 --> 21:30.100]  The guidelines cover obstructive conduct that occurs before the start of the investigation.
[21:30.690 --> 21:31.320]  Okay?
[21:32.190 --> 21:40.340]  So, this is one example of how you could potentially get in trouble or get an enhanced sentence under criminal law for using encryption.
[21:41.950 --> 21:43.620]  Encryption as a special skill.
[21:43.770 --> 21:54.000]  Basically, there's another section of the guidelines that said, if the defendant uses a special skill in a manner that significantly facilitated the commission or concealment of the offense, you get a two-level enhancement.
[21:54.280 --> 22:06.980]  Now, when the guidelines define special skill, they say, quote, a skill not possessed by members of the general public and usually requiring substantial education, training, or licensing, end quote.
[22:07.140 --> 22:15.320]  The examples it gives are pilots, lawyers, doctors, accountants, chemists, and for whatever reason, demolition experts.
[22:15.600 --> 22:15.720]  Okay?
[22:18.320 --> 22:18.950]  All right?
[22:19.260 --> 22:22.720]  So, this is what the guidelines use to define a special skill.
[22:22.880 --> 22:23.410]  Well, guess what?
[22:23.520 --> 22:25.880]  All of you encryptors out there, you are special people.
[22:26.120 --> 22:29.000]  Because encryption has been found to be a special skill.
[22:29.190 --> 22:31.580]  You're effectively the equivalent of a doctor or a lawyer.
[22:31.780 --> 22:34.190]  And I guess demolitions expert makes a little bit of sense.
[22:35.800 --> 22:43.950]  Again, in both of these cases, the use of encryption was considered a way to facilitate the commission of the crime.
[22:43.950 --> 22:47.220]  And again, like the obstruction enhancement, the timing doesn't matter.
[22:47.430 --> 22:47.620]  Okay?
[22:47.980 --> 22:49.170]  And think about that for a second.
[22:49.450 --> 22:52.740]  We're equating encryption with being a doctor.
[22:53.040 --> 22:56.710]  Well, who goes to medical school to commit a crime in the future?
[22:57.220 --> 22:59.760]  Not a lot of... maybe somebody does, right?
[22:59.930 --> 23:00.780]  Well, I'm a lawyer.
[23:00.950 --> 23:06.580]  I didn't go to law school to, you know, eventually use my legal skills to facilitate the commission of my crime.
[23:06.580 --> 23:07.120]  Okay?
[23:07.430 --> 23:12.430]  But, you know, when you think of encryption, people who take, you know, perhaps you take, you know...
[23:12.430 --> 23:15.910]  I'm sure a lot of people in this audience regularly encrypt everything that they do.
[23:16.060 --> 23:21.520]  Well, the court doesn't distinguish between, you know, why or how or when you're encrypting.
[23:21.520 --> 23:27.670]  And I think this goes really to the... a problem in the legal field.
[23:27.860 --> 23:37.460]  And that courts are only very slowly beginning to catch up with the fact that encryption is not just a way for criminals to get away with hiding what they're doing.
[23:37.670 --> 23:45.820]  Because that's the kind of implicit suggestion that the court has... that courts have entertained for a while.
[23:47.310 --> 23:52.910]  I... I mentioned that as a segue to talk very briefly about encryption in the Fifth Amendment.
[23:53.340 --> 23:58.360]  And that... this is a whole separate talk that could be done for an hour.
[23:58.520 --> 24:06.430]  But I want to flag this issue briefly because this is another way in which you can find yourself in a little bit of trouble for encrypting.
[24:06.540 --> 24:08.980]  Now, the scenario usually goes like this.
[24:09.450 --> 24:13.060]  Cops get a search warrant, they get your computer, it's encrypted.
[24:13.640 --> 24:14.080]  Okay?
[24:14.500 --> 24:16.000]  They can't break the encryption.
[24:16.220 --> 24:17.480]  They ask you for the password.
[24:17.480 --> 24:21.320]  If you're smart and you have a lawyer, he's going to say, I'm not giving you anything.
[24:21.980 --> 24:22.950]  So now what?
[24:24.520 --> 24:33.710]  Well, there have been a few, not many, but a few cases where the government has basically gone to the court and gone to the judge and say, Hey, judge, we got a problem.
[24:33.960 --> 24:37.500]  We got a search warrant, which means we're legally allowed to be in a computer.
[24:37.500 --> 24:41.210]  And we want to search that computer, which you've already said we can do.
[24:41.380 --> 24:44.170]  But we can't because it's encrypted and we can't break it.
[24:44.260 --> 24:48.340]  So we need you to order the person to decrypt his computer or her computer.
[24:49.020 --> 24:57.000]  Now, the Fifth Amendment to the Constitution generally protects us from being forced to testify against ourselves.
[24:57.840 --> 25:05.670]  And the key is it has to be both, there has to be both compulsion, that means that you have to be forced to do something, and there has to be testimony.
[25:05.980 --> 25:11.210]  And there have been a few cases that talked about whether decrypting is testimony.
[25:11.670 --> 25:12.020]  Okay?
[25:12.570 --> 25:12.930]  Maybe...
[25:12.930 --> 25:16.760]  I think probably people have heard of the case of Ramona Frekozu.
[25:16.910 --> 25:20.720]  This was a person that EFF helped out with an amicus brief.
[25:20.930 --> 25:27.690]  It was a case where she was under indictment for wire fraud and mortgage fraud.
[25:28.110 --> 25:29.710]  And the cops got a search warrant.
[25:29.800 --> 25:30.600]  They searched the house.
[25:30.720 --> 25:31.710]  They found a bunch of computers.
[25:31.950 --> 25:34.210]  They hit the, you know, this kind of roadblock.
[25:35.100 --> 25:35.930]  The computer was encrypted.
[25:35.980 --> 25:36.910]  They couldn't get into it.
[25:37.190 --> 25:41.190]  And so they went to the court and said, we want you to force Ms. Frekozu to decrypt her computer.
[25:41.430 --> 25:44.520]  Well, she said, no, I have a Fifth Amendment right not to do that.
[25:45.200 --> 25:46.080]  We agree.
[25:46.190 --> 25:47.480]  And we filed the amicus brief.
[25:47.620 --> 25:49.520]  Said, yeah, judge, you can't force her to do this.
[25:49.620 --> 25:51.340]  And so then the court had to decide the issue.
[25:51.430 --> 25:56.820]  And the court, unfortunately, decided that, well, no, she has to decrypt.
[25:56.910 --> 25:59.880]  And its holding was very factually based.
[26:00.120 --> 26:03.430]  Basically, prior to...
[26:03.430 --> 26:08.670]  Well, right after the search happened, Ms. Frekozu went on the telephone.
[26:08.720 --> 26:12.880]  And talked to her ex-husband and co-defendant, who happened to be incarcerated.
[26:13.340 --> 26:15.560]  And thus had his phones recorded, as everyone...
[26:15.560 --> 26:17.000]  As anyone who's ever been in a jail would know.
[26:17.280 --> 26:24.140]  And on the phone call, she had it, you know, implicitly suggested that the computer was hers.
[26:24.460 --> 26:26.190]  And that she had encrypted it.
[26:26.320 --> 26:39.140]  And what that meant for the judge was, well, because of that fact, the act of decryption is not testimony because the government already knows that it's her computer and that it's her... that she, you know, is the one who is able to decrypt it.
[26:39.710 --> 26:47.260]  Now, in the Frekozu case, the government made an argument that, look, the only people who use encryption are people who are trying to hide what they're doing.
[26:47.260 --> 26:51.820]  And the judge did not really address that issue, but it lingered.
[26:54.570 --> 27:00.080]  Later... a little... a short while afterwards, another case came out of the 11th Circuit Court of Appeals.
[27:00.450 --> 27:03.960]  It was a case called... in regards to the grand jury subpoena.
[27:04.820 --> 27:08.500]  I'll refer to the client... the opinion refers to the client as John Doe.
[27:08.500 --> 27:10.950]  So, in that case, very similar situation.
[27:11.850 --> 27:16.740]  Doe had a bunch of computers seized from a hotel room, subject to a search warrant.
[27:16.930 --> 27:18.520]  They, again, hit encryption.
[27:18.640 --> 27:19.600]  This time it was TrueCrypt.
[27:19.820 --> 27:21.600]  And there were a number of hidden volumes.
[27:21.860 --> 27:31.620]  The forensic examiner the feds had was not very good and was not able to tell, you know, what was on the computer, what was not on the computer.
[27:31.710 --> 27:34.380]  He didn't know if the hidden volumes had anything on them.
[27:34.960 --> 27:42.410]  But what the 11th Circuit found in that case was that Doe did have a Fifth Amendment right not to decrypt.
[27:42.500 --> 27:45.220]  And so it held that he shouldn't be forced to decrypt.
[27:45.300 --> 27:56.950]  Now, importantly, the 11th Circuit said, quote, we are not persuaded by the suggestion that simply because the devices were encrypted necessarily means that Doe was trying to hide something.
[27:57.140 --> 28:05.080]  Just as a vault is capable of storing mountains of incriminating documents, that alone does not mean that it contains incriminating documents or anything at all.
[28:05.240 --> 28:05.460]  End quote.
[28:05.600 --> 28:15.980]  So this is good language in the fight to come about debunking this government argument that they've tried to make, which is decryption equals criminal.
[28:16.540 --> 28:16.860]  Okay?
[28:17.220 --> 28:27.950]  And we've... to have a published 11th Circuit opinion, really the first appellate court to decide this issue, to come out and say something this strong is a very good sign for you all who encrypt.
[28:28.430 --> 28:28.780]  Okay?
[28:30.630 --> 28:32.240]  So, I'm getting almost at the end.
[28:32.360 --> 28:35.320]  We're going to talk about ways to protect ourselves and then we can get to some questions.
[28:36.070 --> 28:36.780]  Protect yourself.
[28:37.210 --> 28:37.560]  Disclaimer.
[28:37.720 --> 28:44.120]  This is my chance, again, to remind you that even though I'm a lawyer and I'm talking about the law, I am not giving you legal advice.
[28:44.810 --> 28:46.710]  And these are just suggestions.
[28:47.070 --> 28:48.910]  They're not guaranteed to work.
[28:49.390 --> 28:54.040]  If they don't work, don't come and call me and say, Hanni Fakhoury, the EFF, said that this would work.
[28:54.170 --> 28:55.600]  And that's not a defense.
[28:56.340 --> 29:01.930]  So, please, you know, take that with a grain of salt and, you know, these are just some suggestions.
[29:02.140 --> 29:04.100]  So, my first suggestion is you should go tomorrow morning.
[29:04.140 --> 29:05.210]  This is a shameless plug.
[29:05.320 --> 29:05.560]  Okay?
[29:06.140 --> 29:07.860]  Go tomorrow morning at 11 a.m.
[29:07.930 --> 29:10.710]  in Room Dentist to hear Marsha Hoffman, Senior EFF Staff Attorney.
[29:10.710 --> 29:12.980]  She'll be talking about protecting your data from the cops.
[29:13.020 --> 29:19.210]  So, you're going to get some great tips about how you can keep your data free and hopefully avoid some of these problems.
[29:19.210 --> 29:23.600]  But, let's say you sleep in or you're a slacker and you don't go to the talk.
[29:23.740 --> 29:24.260]  What can you do?
[29:24.500 --> 29:24.710]  Okay?
[29:25.520 --> 29:29.060]  Well, the first thing is a retention policy.
[29:29.210 --> 29:31.520]  Now, retention policies.
[29:31.540 --> 29:35.170]  Again, you know, this is easy for a company to do.
[29:35.300 --> 29:35.450]  Right?
[29:36.800 --> 29:39.410]  And it has to be in place before something happens.
[29:39.410 --> 29:42.720]  It has to be coherent, consistently applied, and routinely followed.
[29:42.720 --> 29:43.280]  Okay?
[29:43.800 --> 29:45.620]  What good is a retention policy?
[29:45.800 --> 30:04.320]  Well, what a retention policy is going to do is it's going to negate or at least counter any argument that the reason you destroyed something was because you're intending to obstruct justice or you're anticipating that you're going to be obstructing some future proceeding that could potentially happen.
[30:04.320 --> 30:09.240]  Because if you say, look, the company deletes everything after three months, period.
[30:09.500 --> 30:16.360]  I didn't delete it because I thought I was going to be in trouble, but because that's what we always do, you've got a good argument.
[30:16.520 --> 30:20.210]  Again, this is not an absolute defense, but this is just a suggestion.
[30:20.410 --> 30:23.820]  Now, you're probably thinking, okay, Hanni, that's great.
[30:24.040 --> 30:25.450]  You know, I work for a company.
[30:25.620 --> 30:26.540]  They have retention policy.
[30:26.540 --> 30:27.080]  That's fine.
[30:27.100 --> 30:28.980]  But what about if it's just me?
[30:29.710 --> 30:31.220]  What am I supposed to do?
[30:31.220 --> 30:34.450]  Am I supposed to have a retention policy at home for my home computer?
[30:34.960 --> 30:35.410]  Okay.
[30:35.740 --> 30:37.710]  Well, the answer is, yeah, sure.
[30:37.710 --> 30:38.100]  Why not?
[30:38.210 --> 30:39.080]  I guess that would work.
[30:39.190 --> 30:40.380]  You could definitely do that.
[30:41.210 --> 30:42.100]  Harder to prove.
[30:42.380 --> 30:43.210]  Harder to exercise.
[30:43.460 --> 30:44.720]  But that's a possibility.
[30:45.080 --> 30:50.710]  But I think you should think seriously about not creating the data in the first place.
[30:50.800 --> 30:58.840]  So whether that means you turn off logs, you create, you know, you use encryption in a way where you maybe, you know, I don't know.
[31:00.420 --> 31:01.950]  Well, I'll say it this way.
[31:02.020 --> 31:05.690]  You have to think about ways where you don't create a paper trail in the first place.
[31:05.720 --> 31:08.930]  Because if you don't create a paper trail, you're not destroying anything because nothing exists.
[31:09.140 --> 31:11.950]  And if you're not destroying anything, you can't get in trouble for destroying it.
[31:14.450 --> 31:17.600]  Back to the retention policy for a second.
[31:17.950 --> 31:21.740]  That really, again, it's easy when you're thinking about what to keep.
[31:21.740 --> 31:24.430]  It's harder when you're thinking again about deletion and encryption.
[31:24.690 --> 31:27.170]  So whatever you do, you have to be very careful.
[31:27.210 --> 31:36.410]  Because I think as these cases have all shown, especially the kernel case, it's enough if you think you're getting in trouble.
[31:36.560 --> 31:43.620]  Or you think that this document or this email or whatever it may be is something that someone may be interested in the future.
[31:43.620 --> 31:49.450]  So you have to be very, very careful to make sure that you don't find yourself in trouble.
[31:49.720 --> 31:49.910]  Okay?
[31:50.170 --> 31:52.190]  With that, I'm going to open it up for questions.
[31:52.320 --> 31:54.060]  Again, the same disclaimer.
[31:54.500 --> 31:57.500]  Please do not tell me your specific legal situation.
[31:57.520 --> 32:00.100]  Do not give me sensitive personal information.
[32:00.760 --> 32:03.020]  You're going to waive the attorney-client privilege if we do that.
[32:03.040 --> 32:05.020]  But I am happy to answer any questions.
[32:05.020 --> 32:09.190]  And then again, my email, if you want to talk privately, that's me on Twitter.
[32:10.080 --> 32:16.240]  And if any of these issues come up, please feel free to come by and talk to us at the EFF booth or seek out our help.
[32:16.410 --> 32:17.600]  So with that, let's open up for questions.
[32:18.640 --> 32:19.080]  Hi.
[32:19.220 --> 32:33.950]  I was wondering if you had maybe like a cron job that would run every day and delete everything in a certain directory that was over 90 days, if that would hold weight as a personal, you know, personal document retention policy in the courts.
[32:34.720 --> 32:47.690]  I think if you can demonstrate that, again, going back to these policy, the principles, that it's, let's see what slides up there, that it's coherent, consistently applied, and routinely followed, I think that's, that's, that is a way.
[32:47.800 --> 32:49.460]  Again, I can't guarantee that that's a way.
[32:49.580 --> 32:52.380]  But yes, I think that's something that you could seriously think about.
[32:52.520 --> 32:57.220]  Now, it goes back to the idea of kind of what's foreseeable.
[32:57.360 --> 33:01.860]  Like, let's say you have that to delete all the child porn files you consistently download every day.
[33:01.860 --> 33:05.560]  Okay, well, that's not really going to save you, because you should know, you shouldn't have that stuff.
[33:05.720 --> 33:16.460]  But if it's just about your routine stuff that you have, emails you have going through, personal emails, or websites you visit, your, whatever it may be, yes, I think that's a, it's a good way to counteract that.
[33:21.110 --> 33:28.660]  In the Colonel case, if he had gone online and instead said, I didn't find anything good, I just got rid of it, do you think he would have gotten away?
[33:29.780 --> 33:31.320]  Oh man, I have no idea.
[33:33.660 --> 33:34.460]  Probably not.
[33:34.860 --> 33:39.050]  I mean, I think under the government's theory, the crime was that...
[33:40.980 --> 33:49.900]  One of the things the court hinged a lot of its decision on is that, look, you hacked into the vice president's candidate's email.
[33:49.900 --> 33:55.300]  Like, you should know that this is going, that this is going to attract the attention of the FBI.
[33:55.800 --> 34:10.340]  Now, they got around the lack of actual knowledge by pointing to the fact of his comments that he expressly said what everyone is kind of implicitly thinking, which is, shit, I could get in trouble for this.
[34:10.340 --> 34:15.140]  And so, yeah, that was concrete proof of his mind state.
[34:15.310 --> 34:19.180]  But I think even if he had said, I deleted everything, I'm not really worried.
[34:19.180 --> 34:23.950]  I think they would have still argued, look, anybody would know that this was problematic, so.
[34:27.460 --> 34:37.640]  In the Colonel case, you mentioned that he got in the most trouble for the obstruction, the anticipatory obstruction of justice.
[34:38.460 --> 34:49.180]  But do you think, had he not obstructed justice, he would have gotten in more trouble because he was found guilty of greater crimes than he was?
[34:49.420 --> 35:00.940]  Well, actually, in a, again, with, since I can't, you know, as best as I can guess, I would think there's a good argument that he wouldn't have gotten as much, in as much trouble.
[35:00.940 --> 35:07.440]  Because if you think about it, he was acquitted of, and I always get him confused, let me pull it up specifically.
[35:08.960 --> 35:13.460]  He was acquitted of wire fraud, that's the most serious crime he was charged with.
[35:13.620 --> 35:13.700]  Right.
[35:13.700 --> 35:15.240]  It had the, the most serious maximum punishment.
[35:15.420 --> 35:16.920]  So, he was acquitted of the wire fraud.
[35:17.100 --> 35:21.300]  He had a hung jury on the, uh, ID theft.
[35:21.520 --> 35:27.480]  Okay, that meant that the government couldn't convince 12 people to unanimously agree that he had committed identity theft.
[35:27.480 --> 35:32.540]  Um, and I don't, I mean, I don't know what the split was, you know, an 11-1 split is different than a 7-5 split.
[35:32.680 --> 35:38.860]  But, let's say for the sake of argument that all things being equal, they couldn't, you know, they, they had a mistrial on ID theft.
[35:39.220 --> 35:49.360]  And he was guilty of the misdemeanor CFAA, which basically just criminalizes, you know, basically the intrusion of the, of entering into the email without necessarily causing a whole ton of damage.
[35:49.840 --> 35:54.720]  If you really think about it, if they'd taken away the anticipatory obstruction of justice charge, he'd have been guilty of a misdemeanor.
[35:54.720 --> 35:57.660]  Instead, he got convicted of the felony and then did 12 months in jail.
[35:57.900 --> 36:02.540]  But do you think he would have been found guilty of the wire fraud if that evidence had existed?
[36:03.440 --> 36:04.840]  Uh, I don't think so.
[36:04.880 --> 36:15.180]  Because they were still able to get into evidence all of the stuff that he said he did, all the stuff he got because they had a paper trail of him talking about it.
[36:15.620 --> 36:19.840]  Um, but yeah, so I don't think he, I don't think the actual evidence itself was really that significant.
[36:19.840 --> 36:22.160]  And that kind of goes back to the original point.
[36:22.360 --> 36:37.320]  In traditional obstruction of justice, this requirement of a nexus is what helps ensure that whatever it is that is being destroyed is actually important to the truth seeking function, if you will, of a criminal investigation.
[36:37.320 --> 36:43.620]  Well, here, these documents, a picture of Bristol Palin is not going to help the government prove that he committed wire fraud.
[36:43.720 --> 36:47.860]  The fraud is in that he attempted to enter into the computer pretending to be Sarah Palin.
[36:47.940 --> 36:52.220]  So I don't think that the evidence that he deleted was all that important in the case in the long run.
[36:52.500 --> 36:53.120]  Okay, thank you.
[36:53.200 --> 36:53.720]  Great talk.
[36:54.000 --> 36:54.240]  Thank you.
[36:56.400 --> 36:58.460]  Uh, I guess I have a two-part question.
[36:58.560 --> 36:58.660]  Sure.
[36:58.660 --> 37:07.200]  The first is, do you think that very soon we're going to see a conflict between the John Doe case that you just cited and the Colonel case?
[37:07.360 --> 37:12.420]  Because it seems like that interpretation of encryption is in direct conflict with the anticipatory obstruction of justice.
[37:12.660 --> 37:22.160]  And the second is, has plausible deniability in the case of hidden volumes, hidden encrypted volumes specifically, been tested in any real way in the courts?
[37:22.680 --> 37:31.160]  So, starting with your second question, I don't know of any cases that have dealt with it, you know, explicitly.
[37:31.460 --> 37:32.420]  So I don't know.
[37:32.620 --> 37:35.920]  I'm sure that there are going to be other situations where that comes up.
[37:35.960 --> 37:38.860]  But I can't think of any off the top of my head that are current.
[37:39.600 --> 37:47.760]  And in respect to your first question, I think the underlying concepts kind of conflict.
[37:47.760 --> 37:52.900]  But, but it's important to remember that the John Doe case dealt with the Fifth Amendment to the U.S.
[37:53.040 --> 37:53.440]  Constitution.
[37:53.440 --> 37:55.480]  And the Colonel case dealt with a statute.
[37:55.720 --> 38:00.280]  And so, to a certain extent, the law that they were both interpreting is different.
[38:00.620 --> 38:10.420]  So, you know, the law is one of those quirky things where what makes sense in one, what makes sense for one legal theory doesn't necessarily hold true in another legal theory.
[38:10.420 --> 38:22.700]  But I think the implicit understanding, this idea that, look, just because you take steps to protect yourself doesn't mean you're a criminal, is a good one.
[38:22.840 --> 38:36.160]  That the Doe case realized, and hopefully other courts, even looking at maybe a situation like Colonel's case in the future, can look and say, look, we treat computer security as a necessity today.
[38:36.160 --> 38:42.460]  You know, yesterday, Yahoo had all of its emails, passwords stolen, right, 400,000 passwords or whatever.
[38:42.820 --> 38:46.080]  Every day we're hearing about security threats.
[38:46.220 --> 38:58.860]  And the fact that people take steps that years ago may be considered unique or only for very technical, sophisticated people, is really no longer the case.
[38:58.860 --> 39:11.860]  And that technology has advanced in a way where even casual computer users or, you know, less technically savvy people than maybe the people here today are starting to take advantage of these tools designed to protect their security and safety.
[39:12.100 --> 39:15.020]  Okay, so we may see it under the umbrella of the Fifth Amendment sometime soon.
[39:15.100 --> 39:15.800]  Maybe, definitely.
[39:16.020 --> 39:16.260]  Thank you.
[39:16.400 --> 39:16.560]  Sure.
[39:19.560 --> 39:21.700]  You probably just answered my question.
[39:22.000 --> 39:22.160]  Okay.
[39:22.360 --> 39:34.720]  But is something like using a Tor browser or encrypting, basic encrypting your modem, grounds enough in any experience you had for investigation or any type of criminal action?
[39:34.960 --> 39:39.940]  Just that alone, without any data backing up, the fact that you, I mean, it's pretty much, you know, I guess.
[39:39.940 --> 39:54.040]  So I haven't seen, again, just because I haven't seen it doesn't mean it doesn't exist, but I haven't seen anyone be charged like criminally with a crime on the basis of the fact they've used like a Tor exit node, for example.
[39:54.220 --> 40:08.400]  But I have seen many times the cops coming to the Tor exit node operator's house and saying, we found child porn associated with this IP address and that's your IP address.
[40:08.400 --> 40:10.160]  And so what's going on?
[40:10.340 --> 40:15.780]  And, you know, I think the feds are starting to understand how Tor works better.
[40:16.180 --> 40:20.060]  And so oftentimes what I've done is I've said, hey, have you ever heard about Tor?
[40:20.200 --> 40:21.540]  And they go, oh, okay.
[40:21.720 --> 40:23.500]  And then they go turn around somewhere else.
[40:23.620 --> 40:37.160]  So, I mean, I've seen it in that context more than I've seen it in the sense that people are being, you know, held accountable, like criminally, like being held criminally accountable for stuff that's coming out at the end of the exit node.
[40:37.160 --> 40:45.660]  But in general, using the browser, if it's not for anything illegal, could draw attention to you or could be cause for investigation even if there was no illegal...
[40:45.660 --> 40:47.900]  I mean, let's say you were just researching bicycles.
[40:47.900 --> 40:50.500]  You just don't want Google to know what you're using, you know what I mean?
[40:50.560 --> 40:50.800]  Sure.
[40:51.340 --> 40:52.360]  I doubt it.
[40:53.280 --> 41:00.120]  Every individual case would be unique, but I would be less concerned with that rather than like the exit node situation.
[41:00.120 --> 41:02.260]  So, I don't know if that answers your question.
[41:02.480 --> 41:04.760]  Well, I'm not exactly... the exit node being like...
[41:04.760 --> 41:08.540]  Like you run an exit node and then the cops come because you got an IP address.
[41:08.900 --> 41:09.300]  Right.
[41:09.440 --> 41:11.500]  They found the IP address that you're running.
[41:11.960 --> 41:13.260]  It came back to ChildPoint or something.
[41:13.660 --> 41:13.780]  Right.
[41:14.360 --> 41:14.720]  All right.
[41:14.840 --> 41:15.040]  Thanks.
[41:15.100 --> 41:15.220]  Sure.
[41:15.300 --> 41:15.660]  Great talk.
[41:18.060 --> 41:18.540]  All right.
[41:18.620 --> 41:20.380]  It actually has to do with encryption as well.
[41:20.960 --> 41:37.400]  What about with, I guess it's a shade of grain away, corporations who have policies in place to, for instance, full disk encryption or drive locker where employees have to encrypt their hardware because of maybe trade secrets or company information that they don't want their competitors to get.
[41:38.120 --> 41:43.660]  Usually, like a corporation will do this to prevent a laptop if it gets lost from somebody picking it up and using it.
[41:44.120 --> 41:53.420]  I mean, what happens in the case of let's say an employee might do something, company doesn't know, company might not have the password, the person might not give it up.
[41:54.060 --> 41:55.860]  Like, what would happen in a case like that?
[41:57.200 --> 42:00.720]  Well, again, I can't pretend to...
[42:00.720 --> 42:00.960]  I mean...
[42:00.960 --> 42:03.420]  Every factual situation would be different, but it will be unique.
[42:03.580 --> 42:12.080]  But I think the kind of the first thing you started with talking about how companies are now, you know, routinely using encryption, I think goes back to the point that the Eleventh Circuit made.
[42:13.540 --> 42:18.340]  Here, this idea that just the fact of encryption doesn't mean that a person is acting criminal.
[42:18.480 --> 42:21.260]  And the more examples we have of that, the better we'll be able to impact the law.
[42:21.260 --> 42:23.720]  Now, if you enter into a situation where...
[42:23.720 --> 42:25.520]  Let's say an employee does something...
[42:25.520 --> 42:25.700]  Yeah.
[42:26.100 --> 42:27.440]  ...and the company doesn't know about it...
[42:27.440 --> 42:27.700]  Right.
[42:28.120 --> 42:30.680]  Well, there's a number of things that come into play with that.
[42:30.760 --> 42:31.680]  The first may be...
[42:31.680 --> 42:32.540]  Let's say you have like...
[42:32.540 --> 42:36.860]  If your employer agreement says you've got to cooperate with the feds, for example.
[42:37.160 --> 42:37.300]  Okay?
[42:37.340 --> 42:40.440]  I've never seen one that does that, but maybe there are some out there that does.
[42:40.660 --> 42:44.940]  Then you've got an issue there, and that's going to be an employee-employer issue.
[42:44.940 --> 42:53.960]  Now, the Fifth Amendment really only comes into play if what your testimony will be, will be incriminating.
[42:54.160 --> 42:55.660]  So, if it's like...
[42:55.660 --> 42:55.940]  Gotcha.
[42:56.540 --> 43:01.680]  If there's no chance that you're going to be incriminated by the act of decryption, you're not protected by the Fifth Amendment.
[43:01.920 --> 43:06.340]  Now, then that goes back to this idea that it's going to really depend on the situation.
[43:06.540 --> 43:16.120]  If, you know, you don't want to decrypt because you're afraid they're going to find all this bad stuff you did, then you've got arguably some Fifth Amendment protection, and the court would have to go through the analysis there.
[43:16.280 --> 43:23.460]  If it's not going to be incriminating, then, you know, there's going to be a good argument that you're not protected by the Fifth Amendment, and then it's going to be a harder sell in that case.
[43:23.840 --> 43:46.600]  But I guess the second part was like with the corporation aspect of things, where, like, I'm trying to figure out like how to explain exactly, like, if the employer gives a laptop to an employee, employee does X, Y, Z, illegal, whatever, does the company have to answer for that employee in a way because the company required encryption or put these policies in place?
[43:46.860 --> 43:47.300]  Oh, okay.
[43:47.440 --> 43:51.000]  So, like, can the employer be held liable for what the employee is doing?
[43:51.300 --> 43:52.480]  That's a good question.
[43:53.680 --> 43:56.080]  And I don't have a great answer off the top of my head for that.
[43:56.200 --> 44:10.520]  I would suspect the employer is going to try their best to say, look, you know, in the employment context there's a distinction between things you do at the behest of your company and things you just do on your own time, even if you're using the company's equipment.
[44:10.700 --> 44:12.240]  And so it's going to really depend on that.
[44:12.340 --> 44:17.880]  Now let's say you're doing illegal stuff on the behest of your company, then that's going to be, you know, then, yeah, obviously the company is going to be held liable.
[44:17.980 --> 44:27.460]  If you're doing just stuff on your own, but you're using your employer's equipment, then, you know, there's going to be a much more focus, much more of the focus is going to be on you rather than on the company.
[44:27.620 --> 44:27.900]  Okay.
[44:27.940 --> 44:28.520]  If that makes sense.
[44:28.880 --> 44:29.400]  Makes sense.
[44:29.620 --> 44:29.760]  Okay.
[44:29.920 --> 44:30.380]  Thank you.
[44:34.580 --> 44:35.600]  Thanks for your talk.
[44:36.360 --> 44:42.840]  I guess it seems like, from what you're saying, that creating a document retention policy is a pretty good idea.
[44:43.900 --> 44:55.180]  I guess what I'm wondering is, what sort of scenarios are there that could be considered anticipatory obstruction of justice for creating a document retention policy?
[44:57.440 --> 44:58.520]  It's a little meta.
[44:58.720 --> 45:00.900]  No, I get exactly what you're talking about.
[45:01.660 --> 45:08.900]  I understand an obvious one would be if you created it after an investigation started and to cover your ass.
[45:09.060 --> 45:19.200]  Let's say you haven't done anything wrong and you came to HOPE and you heard this awesome talk by this awesome speaker and you decided to go back and, you know, I think it's going to be a good idea to create a document retention policy.
[45:19.460 --> 45:20.880]  I think you're probably okay.
[45:21.360 --> 45:22.860]  Again, it's going to be...
[45:22.860 --> 45:24.300]  This is not legal advice you're giving.
[45:24.400 --> 45:25.340]  This is not legal advice.
[45:26.740 --> 45:28.340]  I think you're probably going to be okay.
[45:28.780 --> 45:31.440]  You know, it's a very factual determination.
[45:31.700 --> 45:37.080]  And so, a lot of it is going to just depend on, you know, I think you're okay...
[45:37.080 --> 45:38.780]  Being a little bit paranoid is okay.
[45:39.080 --> 45:42.340]  Like, being a little bit paranoid doesn't make you a criminal necessarily.
[45:42.720 --> 45:50.420]  You know, being a little bit paranoid and also doing something that's maybe questionable is going to be a bigger problem.
[45:50.420 --> 45:52.900]  So, it's hard for me to answer your question.
[45:53.200 --> 46:03.080]  All I would say is, if you don't have one yet, I would encourage you to do one before something bad happens or you think something bad has happened.
[46:03.220 --> 46:04.820]  Because that's enough if you think it's bad.
[46:05.780 --> 46:09.360]  And that's probably the best I'm going to be able to tell you right now.
[46:09.520 --> 46:09.680]  Sorry.
[46:10.140 --> 46:12.660]  Not the best answer, but that's the best I could come up with.
[46:12.660 --> 46:12.860]  Okay.
[46:13.100 --> 46:13.440]  Sure.
[46:13.660 --> 46:13.880]  Thank you.
[46:14.120 --> 46:14.200]  Yeah.
[46:16.340 --> 46:31.760]  Stepping back from an absolute and justified paranoia for a moment, probably a lot of people saw the guideline from the Seventh Circuit that stated that disc blocks which were parts of deleted files or not normally accessible for the operating system are not discoverable.
[46:31.760 --> 46:46.960]  Can you comment on whether this guideline exists in any other circuits, under what circumstances it's likely to be honored, and how something can enter into evidence if that thing is not discoverable?
[46:48.120 --> 46:55.040]  Well, I think in terms of other circuits, I don't know the answer to that off the top of my head, but I can look back.
[46:55.040 --> 47:08.600]  In terms of how things can be discoverable, how something can be admitted into evidence that's not discoverable, I think it's important to distinguish between the criminal process and the civil process.
[47:09.240 --> 47:27.660]  And in the civil litigation process, the way, and again, the speaker before me went into a lot of detail about this, there's all the document creation, well, not creation, but the way documents are gathered and put at issue in a civil lawsuit or civil case are done by the parties.
[47:27.980 --> 47:31.500]  So subpoenas are sent and interrogatories are sent and there's discovery.
[47:31.720 --> 47:34.660]  But in a criminal case, the discovery is one-sided.
[47:34.980 --> 47:43.340]  And what happens is the government gets the information, and most often, they're not getting it with the assistance of the defendant.
[47:43.560 --> 47:51.560]  Now, we talked about the Fifth Amendment context and encryption, and that may be a very rare exception to that when they've hit an absolute roadblock.
[47:51.680 --> 48:02.900]  But for the most part, what they're doing is they're getting search warrants and subpoenas and going to ISPs and service providers and, you know, getting the information from other individuals.
[48:03.080 --> 48:08.380]  Or maybe they have a witness who will hand over all the emails, let's say, for example.
[48:08.620 --> 48:18.980]  And then, what that means is that all the discovery rules that apply in the civil case don't necessarily control in a criminal case.
[48:19.100 --> 48:24.560]  So even though something may not be discoverable for civil purposes doesn't necessarily mean it's not admissible.
[48:24.560 --> 48:25.940]  In a criminal case.
[48:26.100 --> 48:31.900]  Now, that's subject to if the evidence was obtained in violation of, like, the Fourth Amendment, for example.
[48:32.060 --> 48:40.040]  Let's say the police went to Google and said, give us all the emails you have for this user, and we are not giving you a search warrant, we're just going to do it with a subpoena.
[48:40.460 --> 48:46.700]  And we want the emails that are newer, not 180 days old, you know, like ones from the last two weeks.
[48:46.800 --> 48:49.920]  Well, that's illegally obtained evidence, and, you know, it's suppressed.
[48:50.120 --> 48:59.200]  Or, you know, if you think of it in a physical context, like if the cops just walked into your house and took your stuff without a search warrant, that would be an illegal search, and you could maybe get it struck out that way.
[48:59.540 --> 49:02.380]  But the civil discovery rules are not going to necessarily help you in a criminal case.
[49:02.620 --> 49:10.200]  So the one sentence summary would be that if a criminal allegation is made, then the protection on discovery do not apply, and we're back to paranoia.
[49:11.140 --> 49:11.540]  Yes.
[49:11.940 --> 49:12.280]  Thank you.
[49:12.580 --> 49:12.860]  Sure.
[49:18.220 --> 49:24.840]  Would it be considered an obstruction of justice if, let's say, you're running Windows, and Windows decided to crap out, and they couldn't get any of the data?
[49:25.380 --> 49:26.760]  Again, it has to be willful.
[49:26.980 --> 49:31.500]  So you have to be the one, you have to be knowingly, willingly doing something.
[49:31.660 --> 49:37.500]  If it's just like, I got a virus and wiped out my hard drive, and I didn't mean to get a virus, then okay.
[49:37.840 --> 49:45.400]  Now, caveat is, if you say, you know, the feds are coming, I think I'm going to accidentally download a virus, then, you know, that's going to be a problem.
[49:45.540 --> 49:47.940]  So it's all about what you willingly and knowingly do.
[49:47.940 --> 49:48.940]  Okay, thank you.
[49:49.020 --> 49:49.120]  Sure.
[49:50.340 --> 49:52.260]  I think this is probably going to be the last one.
[49:52.360 --> 49:52.660]  Yeah, go ahead.
[49:52.840 --> 49:54.540]  I hope this is coherent.
[49:55.360 --> 49:58.840]  So, encryption is protected by the right to not self-incriminate?
[49:59.460 --> 50:00.480]  It can be, yes.
[50:00.580 --> 50:02.320]  It can be, but not by the right to privacy.
[50:03.260 --> 50:05.400]  You're talking about by the, like, under the Fourth Amendment?
[50:05.460 --> 50:05.660]  Yes.
[50:06.460 --> 50:07.480]  That's a different issue.
[50:08.560 --> 50:17.400]  And all of the encryption cases that have kind of come out, they've all dealt with computer searches done by search warrant.
[50:18.000 --> 50:24.720]  Generally speaking, a search warrant is enough to overcome the Fourth Amendment, or in another way of saying, the Fourth Amendment requires a search warrant.
[50:24.880 --> 50:29.580]  So, let's say they, under the Fourth Amendment, they have a legal right to be in the computer.
[50:29.780 --> 50:35.580]  So, in the encryption cases where the search warrant exists, no, you're not necessarily protected by the right to privacy.
[50:35.860 --> 50:45.440]  Okay, so, could I then draw the wild conclusion that I'm better protected if, let's say, my hard drive is encrypted, or a person, not myself.
[50:46.600 --> 50:47.920]  That person is better protected...
[50:47.920 --> 50:49.420]  Some hypothetical person, not you.
[50:49.440 --> 50:49.700]  Hypothetical person.
[50:49.960 --> 50:59.560]  This person is better protected for, if they just want to have, you know, privacy, by actually having evidence of some crime on their hard drive.
[50:59.600 --> 51:06.400]  And then they can say, well, I'm protected by the Fifth Amendment, so I don't need to reveal it.
[51:06.420 --> 51:08.200]  No, I wouldn't agree with that.
[51:10.240 --> 51:15.880]  I mean, is it enticing to go out and actually, you know, violate the law so that you can't...
[51:15.880 --> 51:18.460]  Well, I would, let me say this, and I think this is a good way to conclude it.
[51:18.900 --> 51:22.320]  The more steps you take to protect your privacy, the better.
[51:22.900 --> 51:27.660]  Even if that means that the court doesn't necessarily see it the same way.
[51:27.760 --> 51:34.240]  So, what I would say is I would encrypt, if I were you, because you're going to be potentially protected under the Fifth Amendment.
[51:34.240 --> 51:39.480]  And, you know, the Fourth Amendment protection kicks in by the fact that the government needs to get a search warrant to get your stuff.
[51:39.820 --> 51:41.120]  And, you know, there are, again, exceptions.
[51:41.340 --> 51:46.240]  You can agree to let them have your stuff, which, please, nobody would consent to anything, okay?
[51:47.220 --> 51:48.280]  Again, not legal advice.
[51:50.300 --> 51:54.140]  But, you know, I would say more protection is better.
[51:54.480 --> 52:05.500]  Yes, the law is slow to keep up with the changes in technology and kind of deal with these quirky situations we're only now starting to get ourselves into, but I would say you're better off encrypting.
[52:05.640 --> 52:08.120]  Okay, so I shouldn't... a person...
[52:08.120 --> 52:08.280]  Not you.
[52:08.640 --> 52:16.780]  A hypothetical person shouldn't vaccinate him or herself by, like, running a stoplight and having a picture taken of it and storing it on that hard drive with...
[52:17.360 --> 52:18.040]  Yes, that would be a bad idea.
[52:18.500 --> 52:19.400]  That would be a bad idea.
[52:19.560 --> 52:19.740]  Okay.
[52:20.180 --> 52:21.220]  Thank you guys very much.
[52:21.320 --> 52:21.780]  I appreciate it.
[52:21.780 --> 52:22.000]  Thank you.