The brave new world of overzealous law enforcement data warehouse searches just continues to wreak havoc on "cloud" services and content. It's akin to digging up the neighborhood to search somebody's house. What can the Feds/providers do differently to prevent this from happening so often?
It seems ridiculous that this is affecting so many customers - pinboard, Curbed, one Instapaper eval/test server, bunch of individuals - when there was one FBI warrant.
Most likely, DigitalOne doesn't have support staff sleeping in hammocks at the colo. If you were an admin, logged in remotely (from switzerland, say, where DigitalOne is headquartered), and you saw a few racks of equipment go offline, would you:
1. suspect that someone had walked away with 3 racks, or
2. guess that some network hardware had gone bad?
When there's an FBI goon breathing down your neck telling you to keep your mouth shut, and you're pressured by customers to say something, your options aren't real attractive.
These are blade servers so you can fit a whole bunch of them into one chassis. Still trying to figure out why they told us initially it was router trouble, and what exactly the sequence of events was.
> What can the Feds/providers do differently to prevent this from happening so often?
In the United States we might start considering computer equipment as private spaces, not unlike our residents and vehicles. With so much of our lives increasingly digital in nature, it's not that screwy of an idea that law enforcement should require a search warrant for computer equipment and storage media.
> In the United States we might start considering computer
> equipment as private spaces, not unlike our residents and
> vehicles. With so much of our lives increasingly digital
> in nature, it's not that screwy of an idea that law
> enforcement should require a search warrant for computer
> equipment and storage media.
That's not at all the issue. The 4th amendment has been extended to digital media:
I'd be willing to bet my house that the law enforcement had a search warrant to take the data in question.
The problem is that the government's strategy -- grab the hardware -- doesn't work well when the hard drive is a virtual disk that sits on a server with a ton of other virtual disks.
Ultimately though, I think this isn't a question that can be solved by technical means. The solution is going to come when law enforcement can come up with a way of "confiscating" the virtual disks that doesn't open the door for claims of tampering & evidence planting.
I should have made myself more clear; I was aware that digital media is covered by the 4th, but failed to indicate this or discuss the following:
> The problem is that the government's strategy -- grab the hardware -- doesn't work well when the hard drive is a virtual disk that sits on a server with a ton of other virtual disks.
A fine point. I assert that the government should, then, have to receive a search warrant for each individual's data on the specific piece of hardware. Consider the search of an apartment complex: getting a warrant for one residence of the building does not grant search rights for every other residence. My contention is that physical disks with many virtual disks should be treated as multiple tenant property, as indeed it is.
Law enforcement does not require a search warrant, in your hypothetical, for 2A precicesly because the search of 4B leaves the residence of 2A unmolested. I do not believe the metaphor falls apart, at all: because the virtual 'tenant' vhd0 of physical hard-drive hd0 cannot be undisturbed by the search and seizure of the data in virtual 'tenant' vhd1--and might reasonably be considered to have the data subjected search and by definition seizure--law enforcement _should_ require a warrant for vhd0 and vhd1.
Going back to your hypothetical, if the resident of 3A were stuffing materials of interest into the crawlspace between their ceiling the the floor of 4B and said crawlspace could only be accessed through the floor of 4B, the interested authorities would need either the express permission of the residents of 4B for entry into their residence or a warrant for search. _That_, I assert, is a similar situation akin to the topic under discussion.
In the case of Pinboard, at least, they had their own machine(s), i.e dedicated servers not virtual servers or shared hosting. So at least some machines were taken the belonged entirely to people not subject to the warrant - it seems like the idea was just to take the whole rack, regardless of who else was on it.
But the government is going to claim that its "right" to get at the evidence is stronger than the property rights of the other co-resident users.
Consider: the 4th Amendment isn't in effect when you're within 100 miles (?) of the border; the chance of smuggling, etc., is greater there, so the need to detain and search people in that zone outweighs our rights. Or, consider a case in which my buddy borrows my car, and is seen driving through an unsavory neighborhood, is stopped, and found with a big sum of cash. This gives them the "right" to confiscate my car because it was involved in drug trafficking, even though no crime has been committed, and I wasn't involved in any case.
My understanding is that the CBP and immigration officers can work anywhere within 100 miles of the border ... or of any port. Which includes airports and general aviation fields capable of receiving flights from outside the USA. Which means just about anywhere.
However, that particular issue is not germane to the case in point, which appears to involve the FBI rather than immigration/border patrol.
Wow, I'd better avoid all the hosting companies that repeatedly fly my data through TSA!
Just because the government has the legitimate right to conduct warrantless searches under conditions {x,y,z} doesn't mean they have rights to conduct warrantless searches under any other condition, or under all conditions.
>What can the Feds/providers do differently to prevent this from happening so often?
The feds could do plenty, but won't. The legal system is slow to react, and the feds likely fear that just taking virtual disks would lead to evidentiary issues at trial.
Hosting providers might be able to provision in a way that the servers hosting evil.site could be taken by the feds but backups existed of the other sites, but it would be an extremely hard -- if not impossible -- task.
In the end, cloud computing doesn't change the rules of safely deploying your site to the world -- if you care about uptime & your data, your site must be running on at least two different hosts.
But the police have a well designed chain of custody system to at least reduce the possibility of tampering. Not everybody in the office can tamper with evidence behind lock and key with seals -- of course it still happens, but the goal is to reduce the possibility.
This falls apart when the evidence in question is data that can be copied, altered, etc.
And of course we can likely come up with clever cryptographic answers to this problem, but in the end, it's far easier and a more understood procedure for the police just to grab hardware and seal it up.
Keep in mind that ultimately the chain of custody must be explained to a jury, to convince them that what they're being shown actually comes from the defendant's computer, while a defense attorney does his best to sow doubt in the jury's minds.
Do you want to explain to 12 randomly selected people how virtual disks work, and the cryptographic algorithms you used to ensure that the data you're showing them is identical to the data the defendant had on their system? Could you explain it so well that a reasonably skilled defense attorney couldn't confuse them enough to produce reasonable doubt?
I don't think it does answer the question, though. The data is the evidence rather than the medium it exists on. What guarantee is made that the disk wasn't tampered with that cannot be made by a cryptographic signature...
...or is the answer that the law has no adequate treatment of abstract evidence?
Letting people that are familiar with what they're investigating to actually run the investigations would be a fairly decent start. In my experience with federal law enforcement, the support personnel and a few agents are usually quite knowledgeable and on top of things. The supervisory agents, however, are promoted into the positions based on their performance in completely unrelated types of investigations.
There may be safety in numbers. One can imagine that if the FBI showed up at an Amazon data center and was told "it's somewhere in these thousand racks" they'd rethink the "seize it all" approach.
Unless they threatened the local staff to keep quiet (or whipped out the 'National Security Theater' card). I'll bet in either case, they would get smacked down hard by Amazon's lawyers though.
