USA 2004

### Overview In this presentation, Jennifer Granick, a lawyer and teacher at Stanford Law School specializing in computer security, privacy, and surveillance, explores the legal ramifications Security Professionals face during intrusion investigations. When incident responders investigate hacked websites or anomalous server files, common technical response tools and techniques—such as monitoring network traffic, inspecting stored communications, active countermeasures, or social engineering—can conflict with statutory and constitutional constraints. The talk provides guidance on identifying legal hazards and recognizing when to consult legal counsel.

### Key Topics - **Constitutional Search and Seizure (Fourth Amendment):** The Fourth Amendment restricts only the government and those acting at the behest of government agents against unreasonable searches and seizures. Security professionals acting purely in the private sector without law enforcement direction are not bound by it. Exceptions to warrant requirements include exigent circumstances (preventing evidence destruction) and consent. Reasonable expectations of privacy often diminish for systems connected to public networks or owned by third parties. - **Social Engineering and Fraud:** Lying during an investigation carries legal ambiguity. While Kevin Mitnick was charged with wire fraud for impersonating employees to obtain credentials (United States v. Mitnick), law enforcement sting operations involving deception—such as the FBI creating the fake company 'Invita' to lure Russian suspects to Seattle (United States v. Gorshkov)—have been upheld. Granick notes entrapment strictly requires government inducement of an otherwise non-predisposed individual. - **Electronic Communications Privacy Act (ECPA):** Regulates real-time interception of electronic communications (sniffing/wiretapping). Content interception is strictly prohibited without a warrant or statutory exception, such as consent, the computer trespasser exception (introduced under the Patriot Act for actors with no contractual authorization), or the service provider exception. Service providers have latitude to monitor to protect their own rights and property, but monitoring third-party communications or remote systems poses major liabilities. - **Traffic Data vs. Stored Communications:** Intercepting real-time traffic metadata (to/from addressing) requires pen register/trap and trace orders for law enforcement, though providers retain operational exceptions. Stored communications receive lower privacy protections than data in transit. In United States v. Councilman, an email service provider copying incoming messages before delivery was found not to have violated wiretap transit laws. Additionally, Theofel v. Farey-Jones established that obtaining stored emails using a patently unlawful subpoena constitutes unauthorized access. - **Computer Fraud and Abuse Act (CFAA / 18 U.S.C. § 1030):** Prohibits unauthorized access or exceeding authorized access. Granick highlights the risk of overly broad judicial interpretations where spam, web spiders, shopping bots, tracking cookies, and even port scanning (e.g., Moulton v. VC3) have been classified as unauthorized access, often relying solely on the statutory loss/damage element to prevent criminal liability.

### Technical Details - **Wiretap Warrants:** Distinct from standard Fourth Amendment warrants; restricted to serious predicate offenses (which include CFAA § 1030 post-Patriot Act), requiring internal DOJ procedures, minimization, and strict time bounds. - **Forensic Chain of Custody:** Does not demand continuous government custody or cryptographic checksums (like MD5) by strict legal necessity; credible testimonial evidence showing an unbroken trail and lack of tampering generally satisfies court admissibility thresholds. - **Remote Countermeasures & Hacking Back:** Remotely accessing third-party or attacker infrastructure to disable attacks or retrieve data falls directly under CFAA prohibitions and lacks clear private-investigator exceptions.

### Takeaways Private investigators and sysadmins enjoy broad leeway under service provider exceptions to monitor and safeguard their own networks, but lack legal authority to pivot into external systems. Because courts continually struggle with technological definitions and contract-based authorizations, technical teams must establish sound investigative procedures, preserve clear chains of custody, and involve legal counsel before deploying intrusive techniques or monitoring tools across external environments.