From the start of 1990 until my retirement at the end of 2007, I was a deputy district attorney in Santa Clara County. I was a lateral hire. Because of my background with developing technology companies, I was assigned to the white collar and high technology units. The practice had some unique aspects. The County is only one more local jurisdiction, with the typical range of felony prosecutions. But it is also Silicon Valley, the first and still one of the most intense technology sites in the world. During my tenure, Yahoo, Netscape, Hotmail, and Google (just to name major email service providers) came into being and located within the county borders. This led to some interesting experiences on the cutting edge of what was then the emerging issue of privacy in the electronic age, that I think are worth sharing.A little perspective. I didn't deal with major issues of policy or national security. Problems relating to electronic communications showed up in more or less 'ordinary' prosecutions - a woman being harassed by an ex-boyfriend, a couple stalked by an aggrieved suitor, a hack by a disgruntled employee, and - later on - identity theft. The point is that the holder of the account, the 'target', if you will, was not the only player on the field. There was nearly always someone else involved, a someone who cared passionately that the truth be found, and justice be done. There is always a trade-off with legal privilege, relevant material that is lost to society, and frequently a particular individual who is badly hurt by the loss. That perspective, as prosaic as it is, is frequently overlooked in these discussions.
Back in the late 90's, a complaint reached the District Attorney's office from a young woman, a beauty shop owner in Gilroy, concerning systematic telephone harassment. Evidently, someone had set up an account on a dating service, furnished her home and cell phone numbers, and described her fictional self as a sex maniac who was up for phone sex morning, noon, and night. The upshot was that her phone rang constantly at all hours of the day and night. (It is a sad commentary on the male sex that anyone believed such nonsense.) The victim strongly suspected a spurned lover, but had no direct proof.
Complaints of this type rarely come straight to the District Attorney's Office. They're usually made to the local police department, as indeed had this one. Unfortunately, at that time the Gilroy Police Department lacked any in-house computer expertise. (I am sure that has changed.) It was not that the complaint wasn't taken seriously. There had recently been a well-publicized case in Los Angeles, where an infuriated ex-boyfriend had put the victim's name and address up on a dating site, described her in the first person as being addicted to rough sex, and advised her callers to ignore her pleas for help and protests, as that was part of the fun. The victim ended up being savagely raped. The ex-boyfriend went to prison on a fairly novel theory of aiding and abetting the crime. Everyone had heard of the case, so the Gilroy victim was taken seriously. But the police department didn't know how to proceed. Thus the matter made its way to the District Attorney's Office.
The method of investigation is straightforward, even obvious. Cyberspace may be deaf, dumb, and blind, but it is not trackless. Find out the source of the dating ad, and tracing back to the origin, is a piece of cake. Internet activity comes with an ultimate, absolute, inescapable return address. This dating service (as I recall) like most required an email address. The dating service was cooperative; the notion that it was being used as a vehicle for harassment and worse was not a happy thought.
It is here that the incident becomes worth recounting. The account had been created through a Yahoo email account, a freebie, like Hotmail, Gmail, and the other Internet types. The user of such an account does not have to provide accurate personal information, and this one of course had not. The user name was something like 'Your Nightmare', and the home address 'Nightmare City'. That fact has some interesting implications.
Generally, I am about as interested in legal theory as I am in the theory of paper mache submarines. I don't really believe law exists as theory, but only in practice (a subject for a much longer essay one of these days). The basic rule of law that defines the ambit of the Fourth Amendment is a 'citizen's reasonable expectation of privacy'. As a practical matter, that rule of law really didn't matter too much to the investigation of the Gilroy case, because obtaining a search warrant on these facts is child's play. The email account connected to the phony dating site - easy. More than that, execution of the warrant does not involve breaking down a door of someone's home (a very, very big deal), but simply producing a small computer file - no major repercussions in the event of some inexplicable mistake. So in practice I could care less whether a reasonable expectation of privacy does or does not attach to such an account - and practice is generally all I care about.
This is the rule-proving exception, since I began this essay in response to a debate about electronic privacy on the civilized chat board where I hang around. So let us consider a moment whether a reasonable expectation of privacy attached to e-mail accounts. I don't think there is any argument about personal accounts an account holder maintains for him- or herself. The account holder expects them to be private. Nor is there much debate about accounts maintained by an employer or the like, particularly if the account holders are given appropriate notice that they are subject to review by the MIS staff of the employer. These clearly are not private - the account holder doesn't own them.
But what about these freebie HTML e-mail accounts? On the one hand, a lot of people use them as primary accounts, provide accurate personal information, and conduct their personal affairs thereby. (I am one of them - my basic email account is at Yahoo.) On the other, an account can be opened up with absolutely fictional information, e.g. 'Your Nightmare' residing in 'Nightmare City'. Surely someone who opens up an account with no personal reference of any kind does not have any expectation that such an account is private.
The distinction is important. As it happens, not unsurprisingly, every case of harassment, stalking, false identity, etc. that I worked on after 1995 was perpetrated through a phony (i.e., clearly fictional personal information) e-mail address. The Gilroy case was not exceptional in that regard. I began with it for other reasons. The Gilroy police had sat on the complaint for too long. More than 90 days had passed, and the back up data that had contained the IP information had been routinely erased. So it was not possible to make progress.
It was the response of the Yahoo representative (lawyer or paralegal, I suppose) that makes the encounter memorable. I can still recall the smugness, even gloating, with which we got the news that Yahoo no longer had the relevant information. Even though the warrant summarized the obnoxious harassment to which the victim had been subject, Yahoo felt a sense of triumph that it had successfully defended the privacy of an account holder who had identified himself only as 'Your Nightmare'. (I say Yahoo because it was by miles the most pain-in-the-ass company we worked with, as to attitude. They all insisted on warrants, which was reasonable even if we could have argued about it. But the Yahoo personnel were true believers.)
That annoyed me more than a little. There was a realio, trulio flesh and blood person who had been badly victimized by this cyber phantom. It's one thing to take a stand based on principle (although having principles doesn't mean they have to be asserted always and everywhere.) This I understand, It's quite another to align yourself emotionally with the culprit.That I do not understand. I was sorely tempted to pass along the Yahoo representatives' phone number to the beauty shop owner, so that she could contact him directly and dramatically further his education. There's no law against that. However, my charter was reacting to situations that endangered the public safety, not redressing private wrongs. That's sometimes a fine distinction, but one I took very seriously. So I bit my lip and reported to the Gilroy Police that we had come to a dead end.
(That did not entirely conclude the matter, however. The detective in charge of the investigation dropped by the residence of the ex-boyfriend suspect and told him of the outcome. He also told him that the Department had advanced considerably up the learning curve as a result of the investigation and would react with a lot more efficiency if the harassment continued. The ex denied any involvement. Nonetheless, the phone calls stopped, abruptly, and were not resumed. So I'll count that as a success.)
The essential anonymity of the Internet creates all sorts of possibilities for anonymous, rather cowardly revenge. I was involved with three cases, years apart, that were amazingly similar in a number of essential respects. The first occurred in the mid 90's and involved an MIS employee who'd been discharged from Trimble Navigation due to repeated acts of sexual harassment of an attractive co-worker. He was fired. She took a leave of absence to quiet her nerves. She was back in about three months.
A few days later, shortly before the books were to be closed for the quarter, someone entered the accounting system by means of a phone modem in the sector in which the victim employee worked, made a microscopic change to one of those ultra-long Unix commands - as I recall, changing a capital 'S' to a lower case 's' - and the Trimble accounting systems all over the world crashed. The company estimated the cost of reconstructing its financial statements as about a quarter of a million dollars.
This case occurred in the early to mid 90's and was a surprisingly easy investigation. I remain continually amazed at how persons who commit criminal offenses underestimate not so much the intelligence of the victim/detective, but the amount of information available about the crime itself. They seem to forget that ordinary people are capable of putting two and two together. In this case, the modem at Trimble had logged the time of the phone contact in which the code alteration occurred, but not the phone number from which it originated. So far, so bad, as far as deducing WhoDunIt. But what the culprit had overlooked was the subtlety of the change in the program code. He was one of only a half-dozen persons affiliated with Trimble who knew enough to wreak that kind of havoc, and he was the only one not still employed by it - fired, in fact, under circumstances that could easily lead to an act of revenge.
The suspect lived over in Scotts Valley. I don't know whether we obtained a warrant or not here. It would have been a no-brainer, given the limited number of suspects and the motive. Phone toll records are not within the ambit of a 'reasonable expectation of privacy', since the phone company (i.e., a non-privileged third party) is fully aware of what they are. So it is possible the records were obtained by a simple letter request. In any case, one way or another, we obtained the suspect's tolls - and, lo! right there in the midst of them was a phone call to the Trimble line that had been accessed, at exactly the moment when the code alteration occurred. Case closed - the suspect became a defendant.
Since trial was both hopeless and embarrassing (this guy certainly did not want details of his sexual obsession, which was an element of proof since it was directly relevant to motive, aired before 12 strangers in open court) - the case ended with a plea. Trimble went on record as NOT wanting the defendant to go to prison, which might otherwise have been a real possibility given the amount of the damage. He ended up doing several months in the county jail and paying substantial restitution.
One thing about the case has always perplexed me. The defendant was a newlywed at the time he committed the offense. His wife was pregnant with their first child. By the time of the sentencing, 15 or so months later,the baby was nearly one year old. With my concurrence, the court showed the guy some mercy in permitting him to surrender and begin the sentence after the holidays, so he could celebrate his daughter's very first Christmas at home. One would have thought that this was the time to let bygones be bygones, and move on with life. Instead, he was so vindictive/obsessed that he pulled this cowardly stunt to get the victim of his earlier harassment fired. Strange stuff. It is hard to believe this behavior did not become an issue in his marriage, but I'll never know. I never heard from him again.
The related case occurred a few years later and it is really - really - strange. In fact, I use it as my illustration as to how difficult and counter-intuitive a criminal case can be, when someone with a little intelligence and cunning is being deliberately evasive. So fasten your seat belt.
The perpetrator had been fired from his MIS job for sexual harassment. With some care, he plans his revenge, against the woman he harassed and the man who corroborated her account of misconduct. Here's how he does it.
Step one is to fabricate an exchange of emails between the pair to whom he wishes to do harm. In the first, the man indicates he is sharing a fascinating piece of video porn with the victim-woman, which video is in fact attached. The woman responds with enthusiasm and interest, and they banter on for a while. None of this ever happened, of course. It's the perp acting entirely on his own as playwright and director. But the video was entirely real. The way the case went, I never had to watch it. But the investigating officer told me it was a really sickening thing, involving vomit, coprophagy (look it up), the sort of stuff that makes you jerk your eyes in the opposite direction and wish you had been faster. Truly vile.
Step two is to hack into the e-mail database of the former employer and leave this exchange in e-mail archives.
Step three is to create an e-mail account on Hotmail, Gmail or some such, as to which the perpetrator is (apparently) completely unrelated.
Step four is to buy a product from his former employer, in some way that does not trace back to his own credit accounts. (I candidly forget whether there'd been a local cash purchase, or from a PayPal account, or even a credit card in a fictitious name with a small limit - in any case, something like that.)
Step five is to wait a few days, then make a complaint, via that unrelated email address created in step three, about some minor warranty defect in the product. The company will of course respond promptly with a reply email to the same address.
And then - finally! - the coup de grace - step six. The perpetrator attaches that fictitious email exchange he created in step one to the company reply. He then emails his former employer in the outraged accents of the morally upright. He made (he says) a routine complaint about a warranty defect, and by some computer malfunction or keystroke error, this lighthearted email exchange about this incredibly nauseating porn video (plus attached video) had been sent to him in response. What sort of people do you have working there? he demands to know. This is horrible. I demand action!
And on the seventh step, our perpetrator rests, confident that some sort of harsh consequence will be visited on the twin objects of his vindictive wrath - reprimand, counesling, maybe (with luck) termination. Revenge, a dish best served cold, is maybe even sweeter when prepared with a recipe this complex.
Of course it didn't work out that way. Sociopathy is an interesting thing. As clever as so many are, over and over, sociopaths over and over fail to anticipate what, for want of a better word, may be called 'normalcy'. I think our perpetrator actually thought company management would take this 'customer' complaint at face value, call in the offending parties, and read them the riot act. Nothing of the sort occurred. Management was utterly baffled by the e-mail, and summoned the two involved parties not to read the riot act, but to figure out what the hell was going on. In the course of getting to the bottom of the affair, the question naturally came up as to whether there was anyone who had a grudge against the two, and who might have had access to their email accounts. The harassment victim and the witness looked at each other, and said, as one, 'Perpetrator!' - whom we can now rename 'suspect', for that is what he had just become. The police were notified that a criminal intrusion had likely occurred into the company's computer network.
I no longer recall whether the warrants that were issued were 'kneebone's-connected-to-the-hipbone' sequential stuff, or based on the uniqueness of the suspect's motive and opportunity. In either case, issuance would have been routine. The last one was a residential search warrant for the suspect's home, resulting in the seizure of the suspect's home computer. The case was fairly good before the computer had been examined, but the status changed to 'untriable' shortly thereafter - for the suspect, God bless him, had kept the files as trophies, doubtless for gloating purposes. He learned the sad truth that gloating is much like laughter. He gloats best who gloats last.
As vicious as this act of cyber slander was, the prosaic reality was that no actual harm befell anyone. So the case was another one in which extended imprisonment was not called for. The suspect (renamed now 'defendant') did a few months in the county jail. I did get one extra iota of emotional satisfaction at the sentencing hearing. It was necessary to describe this whole convoluted, somewhat amazing affair, several times before the sentencing judge understood it. (The investigating officers had had the same problem with me when they first presented the case.) The defendant was sitting to my immediate left beside counsel. With each iteration, he sank lower and lower in his chair, trying hard to blend into the cherrywood. There were a half-a-dozen inmates from the county jail waiting their turn. They ended up staring at him collectively with an unbelieving, icy contempt - and, you may believe me, there is no icier contempt than prisoner contempt.
These first two cases had one other interesting feature in common. Both defendants coincidentally happened to answer the door when the police showed up with the warrant. Both instantly turned white, walked to the bathroom, and vomited. Both, in short, were rather contemptible cowards. The second, the e-mail hoaxer, also had a criminal record. He had been convicted for telephone harassment, a very, very unusual charge. His victims in this case were evidently not the first he had tried to harm anonymously.
Which is a natural segue to the last of the three. The victim here was another woman, who had recently changed jobs. She came to work one Monday, and found that someone had used her email account to distribute to everyone in her new office, a message from her to a lesbian lover, thanking the lover for a marvelous, just concluded weekend and describing in explicit, graphic detail the various sexual acts that had been performed. Not that there's anything wrong with that, but the victim was not in fact lesbian, hadn't been anywhere that weekend, and the erotic acts were described to virtual strangers in a way that would have embarrassed any one.
This case, like the others, traced to another male, a co-employee at the former employer, who nursed some sort of grievance against the victim. In addition to the creation of a fictional dialog, this incident had one other striking similarity with the e-mail hoax case. The suspect here also had a prior conviction for phone harassment. In well over 20 years in criminal practice, these were the only two persons I encountered who had been convicted of that rarely charged offense. They had both used the Internet to perpetrate another piece of anonymous aggression of a nearly identical type. Curious.
I'd like to inform the loyal reader how the prosecution turned out, but in this case it isn't possible. The perpetrator had left the state about the same time he blanketed the email system of the victim's new company. There was no felony charge that applied. (False impersonation might at first seem applicable, but an element of that charge is an intent to defraud, i.e., theft of some kind. Clearly, there was no thieving intent here, just vicious, slanderous malice.) There are misdemeanors that apply, but no one extradites for misdemeanor prosecutions. In fact, I doubt very seriously that we would have extradited even on a minor felony. The conduct was obnoxious, but not that much harm had been done, particularly after the culprit had been identified and the victim could tell her new associates what in fact had happened. So the outcome was simply that a misdemeanor warrant went into the system, where it probably still remains, a mine floating quietly beneath the water if the defendant ever returns to California and is unlucky enough to be stopped by an unusually alert traffic cop.
So what to make of all this? I didn't begin this to draw any moral. These are just stories, anecdotes. The idea is simply to present them, and let whoever reads them draw what conclusions make sense. So . . . no moral - but I do have a comment or two.
It seems to me that what the Internet has changed is not so much notions of privacy, but the degree to which a great portion of ordinary life, once private, now is public. The change is obvious for Internet users. The bills that once were paid by cash or handwritten check are now paid electronically. The personal letter, even love letter, once sent in a sealed envelope, now travels from one server to another over innumerable routers. But even people who have never heard of a computer find their purchasing habits and life style showing up in one database after another. It's a larger fishbowl, and brighter.
So it is that the government has all sorts of new and scary means to monitor the lives of ordinary citizens. But it is also the case that anti-social persons have all sorts of new and scary means to victimize ordinary citizens. How any particular individual sees this altered landscape depends on whether he sees government as a threatening force or a protective one - whether he is more afraid of public power or personal victimization. None of the crimes I recounted would have been possible in the pre-Internet age. It's not possible to spin an elaborate plot to slander someone with a contrived email unless the victim also has an email account. Clothe the preSpence of the perpetrator in too much privilege and the criminal justice system becomes one-sided (even more so than it already is). The offender violates the exact same matrix of rights in which he subsequently cloaks himself to avoid detection. Since the State has taken over all of the traditional forms of tribal and family justice, and in fact made such retributions illegal, it seems to me this is unfairly one sided. But maybe my own bias is showing here. Perhaps I am too much the prosecutor in this.
The ultimate bottom line for me is that the acquisition of knowledge, even the collation of mere fact, is itself intrinsically neutral. It can be used or misused. It can prevent epidemics or to facilitate mass racial arrests. In terms of law enforcement, and security, it's not possible to find a needle in a haystack without first assembling the haystack. I began writing this on May 5th, 2010, two days after the arrest of a suspect on a failed bombing attempt in New York. The arrest, only 53 hours after the discovery of the bomb, is the result of spectacularly good police work. However, the principal data on which the investigators relied seems to have been the output of the surveillance cameras that now are situated everywhere in public places, and the database of cell phone calls made during the relevant time period. Cities such as London and Paris now have cameras everywhere. The suspect is under arrest because in plotting his crime he could not avoid the public eye, the public ear.
Obviously this is a positive outcome. But the possibilities for abuse and misuse are equally obvious. In the realm of electronics, in the world of cyberspace, any given day is always day one, i.e., the state of technology, no matter how apparently advanced, is capable of infinite improvement. However sophisticated the surveillance cameras in 2010, they are crude compared to what will be available in 2011, and the same is true of search engines, face and voice recognition software, and all the rest. It will shortly be possible, if it is not already, to feed a photograph of a particular individual into a search engine, and trace his or her progress across a major city. The public world is going to become ever more public, not out of malice or some fiendish government scheme, but by the nature of technology itself. I wish I had more to say about this than yada, yada, yada we-have-to-be-careful, but there isn't much more to say.
I am going to close with one last anecdote. Back in the 90's, I received a referral from Massachusetts about some truly obnoxious behavior. It seems a coed in one of the innumerable universities-colleges that dot the Boston-Cambridge area had rented a room from a reliable old couple who supplemented their income by renting to students. What she did not know was that the husband, a likable grandfatherly type with a twinkle in his eye, had rigged small cameras throughout her bed- and bathrooms. She was taped in all her private moments - shower, bathroom, etc. It did not end there. The old geezer was a member of a video club, made up of similar twinkly eyed types located all over the country. The members would tape (sic - that's how long ago this was, before digital video) their female guests in all their glory, then trade and compare them. I don't know how the victim found out about this, but she was outraged, as was the investigating officer in Massachusetts. The case connected to Santa Clara County in California because either Yahoo or Hotmail email accounts were used, both of which are located there.
This was another case that went nowhere, as frustrating as that outcome was. California has peeping-tom statutes, as I suppose does Massachusetts. But the offenses were misdemeanors only. Search warrants can only be obtained for felony offenses. We could have ginned up a creative theory of 'conspiracy to commit a misdemeanor', but there were neither information nor resources to expend in going further. (There were no details about the club, only vague and hazy outlines.) So the young woman was left to her civil remedies, which I do hope she utilized. It would have been a humdinger of a small claims action. Plus, as I have noted, the pleasures of embarrassing a perpetrator in open court are not inconsiderable.
I closed on this note because this incident occurred maybe 15 years ago. There are several generations of improved video technology available to twinkly-eyed old perverts, and the whole digital universe at their disposal. There is no hope of reversing this trend, nor would it be a good idea if we could - too much social benefit. But it does mean that the issues this relentless publicism raises have to be perpetually watched and constantly reevaluated. That advice is something of a cliche, but in this case the cliche is meaningful. Over and out.
Recent Comments